Spyware / Malware / Virus Removal

[Resolved] Windows update cannot phone home

9 min read

Looking for the outcome? Ask AI

ExTruckie Topic Starter

Post #1December 31, 2008, 7:53 PM UTC

I have this minor problem. I can no longer access windows update in any form. I an not able to install the latest patches. I am always redirected to the msn.com page. I also cannot get any downloads from Microsoft.
I have done a clean install of XP but found the source of the contamination was in Firefox and I reinfected myself.

I got everything fixed but windows update.
I have included the HijackThis log file below, Next is the MalwareBytes Log file, and after that is the AVG Antivirus scan results log.
Thank you

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:30:54, on 12/31/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20815)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Lexmark 3400 Series\lxcymon.exe
C:\Program Files\Lexmark 3400 Series\ezprint.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\D4\D4.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\lxcycoms.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
G:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT1048306
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Foxit Toolbar - {73c7d5b0-7b03-444a-84c7-ce1ba03b5573} - C:\Program Files\Foxit\tbFox1.dll
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: Foxit Toolbar - {73c7d5b0-7b03-444a-84c7-ce1ba03b5573} - C:\Program Files\Foxit\tbFox1.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: Foxit Toolbar - {73c7d5b0-7b03-444a-84c7-ce1ba03b5573} - C:\Program Files\Foxit\tbFox1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [lxcymon.exe] "C:\Program Files\Lexmark 3400 Series\lxcymon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 3400 Series\ezprint.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Dimension4] C:\Program Files\D4\D4.exe
O4 - HKLM\..\Run: [LXCYCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCYtime.dll,_RunDLLEntry@16
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = E:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O13 - Gopher Prefix:
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: lxcy_device - - C:\WINDOWS\system32\lxcycoms.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 6484 bytes

Malwarebytes' Anti-Malware 1.29
Database version: 1276
Windows 5.1.2600 Service Pack 3

12/31/2008 14:22:32
mbam-log-2008-12-31 (14-22-32).txt

Scan type: Quick Scan
Objects scanned: 41445
Time elapsed: 3 minute(s), 2 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{3c471948-f874-49f5-b338-4f214a2ee0b1} (Trojan.HumourCanine) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b} (Adware.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files\Conduit\Community Alerts\Alert.dll (Trojan.HumourCanine) -> Delete on reboot.
C:\Documents and Settings\Mark\Local Settings\Temporary Internet Files\Content.IE5\4GMG4A1Q\tbedrs[1].dll (Adware.HumourCanineToolbar) -> Quarantined and deleted successfully.

AVG Log

@HL_UpdateOK
avi:1410-1225;banner:494-488;iavi:1869-1197;

@HL_TestStarted
@TestName_02

@HL_ReportFind
C:\autorun.inf
@EID_Fi_vir
Worm/AutoRun

@HL_ReportFind
C:\Documents and Settings\Mark\Local Settings\Temp\tmp1.tmp
@EID_Fi_vir
Worm/AutoRun

@HL_ReportFind
D:\autorun.inf
@EID_Fi_vir
Worm/AutoRun

@HL_ReportFind
F:\autorun.inf
@EID_Fi_vir
Worm/AutoRun

@HL_ReportFind
G:\autorun.inf
@EID_Fi_vir
Worm/AutoRun

@HL_ReportFind
G:\Switchless\Unattend CD Programs\WPI\WPI\Tools\CDSwitch\CDswitchGenerator.exe
@EID_Id_trj
Downloader.Agent.AMNQ

@HL_ReportFind
G:\WPI\WPI\Tools\CDSwitch\CDswitchGenerator.exe
@EID_Id_trj
Downloader.Agent.AMNQ

@HL_ReportFind
G:\WPI\WPI\Tools\Tools\CDSwitch\CDswitchGenerator.exe
@EID_Id_trj
Downloader.Agent.AMNQ

@HL_TestEnded
@TestName_02
8

@HL_ActionTakenFailed
C:\autorun.inf
@HL_ActCleaned

@HL_ActionTaken
C:\Documents and Settings\Mark\Local Settings\Temp\tmp1.tmp
@HL_ActVVInserted

@HL_ActionTaken
D:\autorun.inf
@HL_ActCleaned

@HL_ActionTakenFailed
F:\autorun.inf
@HL_ActCleaned

@HL_ActionTaken
G:\autorun.inf
@HL_ActCleaned

@HL_ActionTaken
G:\Switchless\Unattend CD Programs\WPI\WPI\Tools\CDSwitch\CDswitchGenerator.exe
@HL_ActCleaned

@HL_ActionTaken
G:\WPI\WPI\Tools\CDSwitch\CDswitchGenerator.exe
@HL_ActCleaned

@HL_ActionTaken
G:\WPI\WPI\Tools\Tools\CDSwitch\CDswitchGenerator.exe
@HL_ActCleaned

@HL_ActionTakenFailed
C:\autorun.inf
@HL_ActCleaned

@HL_ActionTaken
C:\autorun.inf
@HL_ActVVInserted

@HL_ActionTakenFailed
F:\autorun.inf
@HL_ActCleaned

@HL_ActionTaken
F:\autorun.inf
@HL_ActVVInserted

@HL_TestStarted
@TestName_13

@HL_TestEnded
@TestName_13
0

ExTruckie

Post #2December 31, 2008, 11:42 PM UTC

I too used combofix without direct advice. Happily things worked out, and everything is normal as I just finished running windows update. I realize things could have been different, having read other threads here, by using other peoples answers. I am saying this to discourage other for taking the steps, I did without supervision. Thank you all for your assistance and wish all a Happy New Year!!

Tomk

Post #3January 1, 2009, 2:23 AM UTC

ExTruckie, Do you want to post the ComboFix report and a new HijackThis log and let me have a look for you?

ExTruckie

Post #4January 1, 2009, 7:50 AM UTC

TomK as you requested.

ComboFix 08-12-30.02 - Mark 2008-12-31 15:30:59.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2722 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG 7.5.516 *On-access scanning enabled* (Updated)

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Mark\LOCALS~1\Temp\tmp2.tmp
c:\windows\system32\drivers\msqpdxypasbfoo.sys
c:\windows\system32\msqpdxqesdpbit.dll
D:\Autorun.inf
D:\resycled
d:\resycled\boot.com
F:\resycled
f:\resycled\boot.com
G:\Autorun.inf
G:\resycled
g:\resycled\boot.com

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_MSQPDXSERV.SYS

((((((((((((((((((((((((( Files Created from 2008-11-28 to 2008-12-31 )))))))))))))))))))))))))))))))
.

2008-12-31 13:10 . 2008-12-31 13:10 d——– c:\program files\Foxit
2008-12-31 13:10 . 2008-12-31 13:10 d——– c:\program files\Conduit
2008-12-31 03:03 . 2008-12-31 14:14 d——– c:\program files\Mozilla Thunderbird
2008-12-31 03:03 . 2008-12-31 03:03 d——– c:\documents and settings\Mark\Application Data\Thunderbird
2008-12-31 03:01 . 2008-12-31 03:01 d——– c:\program files\Malwarebytes' Anti-Malware
2008-12-31 03:01 . 2008-12-31 03:01 d——– c:\documents and settings\Mark\Application Data\Malwarebytes
2008-12-31 03:01 . 2008-12-31 03:01 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-31 03:01 . 2008-10-16 20:25 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-31 03:01 . 2008-10-16 20:25 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2008-12-31 02:58 . 2008-12-31 02:58 d–h—– c:\windows\system32\GroupPolicy
2008-12-31 02:38 . 2008-12-31 02:38 d——– c:\documents and settings\LocalService\Application Data\SACore
2008-12-31 02:32 . 2008-12-31 02:32 d–h—– c:\windows\$hf_mig$
2008-12-31 02:22 . 2008-12-31 02:31 d——– c:\program files\McAfee
2008-12-31 02:22 . 2008-12-31 02:22 d——– c:\program files\Common Files\McAfee
2008-12-31 02:21 . 2008-12-31 02:26 dr-h—– C:\$VAULT$.AVG
2008-12-31 02:16 . 2008-12-31 02:16 d——– c:\program files\EASEUS
2008-12-31 02:12 . 2007-07-17 06:27 14,208 -ra—— c:\windows\system32\drivers\battc.sys
2008-12-31 02:12 . 2008-04-14 03:06 10,240 -ra—— c:\windows\system32\drivers\compbatt.sys
2008-12-31 02:12 . 2008-04-14 03:06 10,240 –a–c— c:\windows\system32\dllcache\compbatt.sys
2008-12-31 02:07 . 2008-12-31 02:07 d——– c:\windows\system32\NtmsData
2008-12-30 22:19 . 2008-12-30 22:19 d——– c:\windows\system32\Macromed
2008-12-30 21:55 . 2003-06-25 16:05 266,360 –a—— c:\windows\system32\TweakUI.exe
2008-12-30 21:55 . 2002-06-21 15:09 160,217 –a—— c:\windows\system32\PowerToysLicense.rtf
2008-12-30 21:51 . 2008-12-31 14:24 d——– c:\program files\lx_cats
2008-12-30 21:51 . 2008-12-30 21:51 d——– c:\program files\Lexmark Toolbar
2008-12-30 21:50 . 2008-12-30 21:51 d——– c:\program files\D4
2008-12-30 21:50 . 2007-02-22 17:31 344,064 –a—— c:\windows\system32\lxcycoin.dll
2008-12-30 21:50 . 2006-03-23 03:33 40,960 –a—— c:\windows\system32\lxcyvs.dll
2008-12-30 21:33 . 2008-12-30 21:33 d——– c:\program files\Common Files\Palo Alto Software
2008-12-30 21:33 . 2008-12-30 21:35 d——– c:\program files\Common Files\AnswerWorks 5.0
2008-12-30 21:33 . 2008-12-30 21:33 d——– c:\documents and settings\Mark\Application Data\Intuit
2008-12-30 21:33 . 2007-07-26 17:13 3,518,464 –a—— c:\windows\system32\cdintf300.dll
2008-12-30 21:33 . 2007-07-26 17:13 1,843,200 –a—— c:\windows\system32\acXMLParser.dll
2008-12-30 21:32 . 2008-12-30 21:32 d——– c:\program files\Common Files\Intuit
2008-12-30 21:32 . 2008-12-30 21:35 165 –a—— c:\windows\QUICKEN.INI
2008-12-30 21:27 . 2008-12-30 21:27 d——– c:\documents and settings\All Users\Application Data\Intuit
2008-12-30 21:24 . 2008-12-31 02:27 d——– c:\documents and settings\Mark\Application Data\AVG7
2008-12-30 21:24 . 2008-12-30 21:24 d——– c:\documents and settings\LocalService\Application Data\AVG7
2008-12-30 21:24 . 2008-12-30 21:24 d——– c:\documents and settings\All Users\Application Data\Grisoft
2008-12-30 21:24 . 2008-12-31 01:41 d——– c:\documents and settings\All Users\Application Data\avg7
2008-12-30 21:24 . 2008-12-30 21:24 499,712 –a—— c:\windows\system32\msvcp71.dll
2008-12-30 21:24 . 2008-12-30 21:24 348,160 –a—— c:\windows\system32\msvcr71.dll
2008-12-30 21:17 . 2008-12-31 02:21 d——– c:\documents and settings\Mark\Application Data\SiteAdvisor
2008-12-30 21:17 . 2008-12-30 21:17 d——– c:\documents and settings\All Users\Application Data\SiteAdvisor
2008-12-30 21:17 . 2008-12-30 21:17 d——– c:\documents and settings\All Users\Application Data\McAfee
2008-12-30 21:16 . 2008-12-30 21:16 d——– c:\program files\MozBackup
2008-12-30 21:15 . 2008-12-30 21:15 d——– c:\documents and settings\Mark\Application Data\Talkback
2008-12-30 21:15 . 2008-12-30 21:15 0 –a—— c:\windows\nsreg.dat
2008-12-30 21:03 . 2008-12-30 21:03 d——– c:\documents and settings\Mark\Application Data\FaxCtr
2008-12-30 21:01 . 2007-12-05 01:41 356,352 –a—— c:\windows\system32\nvudisp.exe
2008-12-30 21:01 . 2007-12-17 13:53 159,458 –a—— c:\windows\system32\nvapps.nvb
2008-12-30 21:01 . 2007-12-05 01:41 17,737 –a—— c:\windows\system32\nvdisp.nvu

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-31 08:14 ——— d—–w c:\program files\Windows Media Connect 2
2008-12-31 06:39 ——— d—–w c:\program files\Lexmark Fax Solutions
2008-12-31 02:33 ——— d–h–w c:\program files\InstallShield Installation Information
2008-12-31 02:00 ——— d—–w c:\program files\Common Files\InstallShield
2008-12-31 01:58 ——— d—–w c:\documents and settings\All Users\Application Data\Bluetooth
2008-12-31 01:56 ——— d—–w c:\program files\APC
2008-12-31 01:53 ——— d—–w c:\program files\IVT Corporation
2008-12-31 01:49 ——— d—–w c:\program files\Lexmark 3400 Series
2008-12-31 01:49 ——— d—–w c:\program files\Abbyy FineReader 6.0 Sprint
2008-12-31 01:49 ——— d—–w c:\documents and settings\All Users\Application Data\FaxCtr
2008-12-31 01:33 ——— d—–w c:\program files\VIA
2008-12-31 01:11 ——— d—–w c:\program files\microsoft frontpage
2008-10-11 20:20 6,923,477 —-a-r c:\program files\ThunderBird.exe
2008-10-03 01:25 4,154 —-a-w C:\Runonce100108.cmd
2008-10-02 22:04 29,088,197 —-a-r c:\program files\Vista_Trasnformation_Pack.exe
2008-10-02 21:43 2,613,100 —-a-r c:\program files\PCWizard.exe
2008-10-02 21:37 896,083 —-a-r c:\program files\erunt-setup.exe
2008-10-02 20:53 8,595,439 —-a-r c:\program files\epm.exe
2008-10-02 20:47 3,121,727 —-a-r c:\program files\ccsetup212.exe
2008-09-20 14:16 170,496 —-a-w c:\windows\system32\BootMan.exe
2008-09-20 01:42 86,408 —-a-w c:\windows\system32\setupempdrv03.exe
2008-09-20 01:42 8,704 —-a-w c:\windows\system32\epmntdrv.sys
2008-09-20 01:42 3,072 —-a-w c:\windows\system32\EuGdiDrv.sys
2008-09-20 01:42 14,848 —-a-w c:\windows\system32\EuEpmGdi.dll
2008-09-19 23:10 86,016 —-a-w c:\windows\system32\ResizeNTFS.dll
2008-09-19 23:10 61,952 —-a-w c:\windows\system32\FatResizeMove.dll
2008-09-19 23:10 472,576 —-a-w c:\windows\system32\NTFSFormat.dll
2008-09-19 23:10 22,016 —-a-w c:\windows\system32\FatFormat.dll
2008-09-19 23:09 92,672 —-a-w c:\windows\system32\Partition.dll
2008-09-19 23:09 31,744 —-a-w c:\windows\system32\FatLib.dll
2008-09-19 23:09 179,200 —-a-w c:\windows\system32\DeviceManager.dll
2008-09-19 23:09 124,416 —-a-w c:\windows\system32\NTFSCopy.dll
2008-09-19 23:08 86,528 —-a-w c:\windows\system32\NTFSLib.dll
2008-09-19 23:08 68,096 —-a-w c:\windows\system32\Device.dll
2008-09-19 23:08 6,144 —-a-w c:\windows\system32\CallbackOperator.dll
2008-09-19 23:08 44,032 —-a-w c:\windows\system32\FileSystemCheck.dll
2008-09-19 23:08 25,088 —-a-w c:\windows\system32\FATFileSystemAnalyser.dll
2008-09-19 23:08 24,576 —-a-w c:\windows\system32\NTFSFileSystemAnalyser.dll
2008-09-19 23:08 21,504 —-a-w c:\windows\system32\Fixup.dll
2008-09-19 23:08 14,848 —-a-w c:\windows\system32\FileSystemAnalyser.dll
2008-09-19 23:08 10,752 —-a-w c:\windows\system32\DeviceAdapter.dll
2008-08-31 17:54 912,812 —-a-r c:\program files\MozBkup.exe
2008-08-31 17:35 1,745,837 —-a-r c:\program files\Image_Burn.exe
2008-08-31 16:48 1,992,888 —-a-r c:\program files\TSO.EXE
2008-08-31 16:44 6,000,350 —-a-r c:\program files\TeamSpeak.exe
2008-08-31 16:30 322,449 —-a-r c:\program files\TASKSWITCH.EXE
2008-08-31 16:27 337,481 —-a-r c:\program files\SlideShow.exe
2008-08-31 16:21 60,140,922 —-a-r c:\program files\SAMSUNG_PC_STUDIO.EXE
2008-08-31 16:07 309,147 —-a-r c:\program files\IMAGERESIZER.exe
2008-08-31 16:00 15,817,845 —-a-r c:\program files\IE7X86ENU.EXE
2008-08-31 15:52 651,522 —-a-r c:\program files\DMSETUP.EXE
2008-08-31 15:24 221,280 —-a-r c:\program files\SelectAll.exe
2008-08-31 15:12 814,793 —-a-r c:\program files\Desktop_Clock.exe
2008-08-31 15:05 250,723 —-a-r c:\program files\Desktop_Weather.exe
2008-08-31 14:56 975,622 —-a-r c:\program files\7z.exe
2008-08-31 14:48 1,048,916 —-a-r c:\program files\Unistaller.exe
2008-08-31 14:23 1,864,599 —-a-r c:\program files\Advisor.exe
2008-08-30 21:32 748,515 —-a-r c:\program files\WinPatrol.exe
2008-08-28 23:06 166,724,421 —-a-r c:\program files\OOffice.exe
2008-08-24 20:28 5,518,508 —-a-r c:\program files\sunbird-0.8.en-US.win32.installer.exe
2008-08-24 20:26 6,073,931 —-a-r c:\program files\Firefox.exe
2008-08-24 15:00 17,207,702 —-a-r c:\program files\gimp-2.4.5-i686-setup.exe
2008-08-24 14:40 2,754,677 —-a-r c:\program files\foxitreader23_setup.exe
2008-08-24 14:15 256,152 —-a-r c:\program files\D4.exe
2008-08-24 13:55 326,407,571 —-a-r c:\program files\apup.exe
2008-08-13 23:28 6,104,632 —-a-r c:\program files\PICASAWEB-CURRENT-SETUP.EXE
2008-12-31 19:25 67,688 —-a-w c:\program files\mozilla firefox\components\jar50.dll
2008-12-31 19:25 54,368 —-a-w c:\program files\mozilla firefox\components\jsd3250.dll
2008-12-31 19:25 34,944 —-a-w c:\program files\mozilla firefox\components\myspell.dll
2008-12-31 19:25 46,712 —-a-w c:\program files\mozilla firefox\components\spellchk.dll
2008-12-31 19:25 172,136 —-a-w c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{73c7d5b0-7b03-444a-84c7-ce1ba03b5573}"= "c:\program files\Foxit\tbFox1.dll" [2008-12-31 1784856]

[HKEY_CLASSES_ROOT\clsid\{73c7d5b0-7b03-444a-84c7-ce1ba03b5573}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{73c7d5b0-7b03-444a-84c7-ce1ba03b5573}]
2008-12-31 13:10 1784856 –a—— c:\program files\Foxit\tbFox1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{73c7d5b0-7b03-444a-84c7-ce1ba03b5573}"= "c:\program files\Foxit\tbFox1.dll" [2008-12-31 1784856]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{73C7D5B0-7B03-444A-84C7-CE1BA03B5573}"= "c:\program files\Foxit\tbFox1.dll" [2008-12-31 1784856]

[HKEY_CLASSES_ROOT\clsid\{73c7d5b0-7b03-444a-84c7-ce1ba03b5573}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-07-29 8523776]
"lxcymon.exe"="c:\program files\Lexmark 3400 Series\lxcymon.exe" [2007-06-25 291504]
"EzPrint"="c:\program files\Lexmark 3400 Series\ezprint.exe" [2007-06-25 82608]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2007-06-25 295600]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [2008-12-30 579072]
"Dimension4"="c:\program files\D4\D4.exe" [2004-02-04 200704]
"LXCYCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCYtime.dll" [2006-11-21 106496]
"SoundMan"="SOUNDMAN.EXE" [2008-07-29 c:\windows\SOUNDMAN.EXE]
"nwiz"="nwiz.exe" [2007-12-05 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2008-12-30 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2008-08-16 c:\windows\system32\advpack.dll]
"_nltide_3"="advpack.dll" [2008-08-16 c:\windows\system32\advpack.dll]

c:\documents and settings\Mark\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - e:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
APC UPS Status.lnk - c:\program files\APC\APC PowerChute Personal Edition\Display.exe [2008-12-30 221247]
BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2006-07-16 626176]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\lxcycoms.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"c:\\Program Files\\D4\\D4.exe"=

R2 lxcy_device;lxcy_device;c:\windows\system32\lxcycoms.exe -service []
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\McAfee\SiteAdvisor\McSACore.exe" [2008-12-31 206096]
S3 epmntdrv;epmntdrv;\??\c:\windows\system32\epmntdrv.sys [2008-12-31 8704]
S3 EuGdiDrv;EuGdiDrv;\??\c:\windows\system32\EuGdiDrv.sys [2008-12-31 3072]

*Newly Created Service* - PROCEXP90
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid;=CT1048306
uInternet Connection Wizard,ShellNext = hxxp://windowsupdate.microsoft.com
FF - ProfilePath - c:\documents and settings\Mark\Application Data\Mozilla\Firefox\Profiles\vxow49wb.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1048306&SearchSource;=3&q;=
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - prefs.js: browser.startup.homepage - hxxp://www.centralpafire.com
FF - component: c:\documents and settings\Mark\Application Data\Mozilla\Firefox\Profiles\vxow49wb.default\extensions\{0784CD66-62FE-4cef-ABF4-F8ED9B654ACC}\components\tab_effect_xpcom.dll
FF - component: c:\documents and settings\Mark\Application Data\Mozilla\Firefox\Profiles\vxow49wb.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayAccessService.dll
FF - component: c:\documents and settings\Mark\Application Data\Mozilla\Firefox\Profiles\vxow49wb.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayFormSubmitObserver.dll
FF - component: c:\documents and settings\Mark\Application Data\Mozilla\Firefox\Profiles\vxow49wb.default\extensions\{73c7d5b0-7b03-444a-84c7-ce1ba03b5573}\components\FFAlert.dll
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - component: c:\program files\Mozilla Firefox\extensions\[removed]\components\qfaservices.dll

ATTENTION: FIREFOX POLICES IS IN FORCE
FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-31 15:32:13
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCYCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCYtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\msqpdxserv.sys]
"imagepath"="\systemroot\system32\drivers\msqpdxypasbfoo.sys"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(940)
c:\windows\system32\cscui.dll
.
Completion time: 2008-12-31 15:32:58
ComboFix-quarantined-files.txt 2008-12-31 20:32:44

Pre-Run: 16,430,149,632 bytes free
Post-Run: 16,486,543,360 bytes free

253

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:48:26, on 1/1/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lexmark 3400 Series\lxcymon.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
E:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
G:\Program Files\OpenOffice.org 3\program\soffice.exe
G:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\lxcycoms.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\dllhost.exe
G:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/a/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Foxit Toolbar - {73c7d5b0-7b03-444a-84c7-ce1ba03b5573} - C:\Program Files\Foxit\tbFox1.dll
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: Foxit Toolbar - {73c7d5b0-7b03-444a-84c7-ce1ba03b5573} - C:\Program Files\Foxit\tbFox1.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: Foxit Toolbar - {73c7d5b0-7b03-444a-84c7-ce1ba03b5573} - C:\Program Files\Foxit\tbFox1.dll
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [lxcymon.exe] "C:\Program Files\Lexmark 3400 Series\lxcymon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 3400 Series\ezprint.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Dimension4] C:\Program Files\D4\D4.exe
O4 - HKLM\..\Run: [LXCYCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCYtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinPatrol] E:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [OM2_Monitor] "E:\Program Files\MMonitor.exe"
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = E:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: OpenOffice.org 3.0.lnk = G:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O13 - Gopher Prefix:
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1230756726015
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1230756711093
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: lxcy_device - - C:\WINDOWS\system32\lxcycoms.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

–
End of file - 7399 bytes

Thanks

Tomk

Post #5January 1, 2009, 3:11 PM UTC

ExTruckie,

You've got a worm on there that appears to have been passed around on thumb drives. If you've been sharing information on removable media with friends, they probably have it also. It's a little bit fragmented now, probably because you ran Combofix without disabling active scanning. I can't tell for sure if it's dead or still active. There is also indications that you may have or have had a DNS changer. All in all, from what I'm seeing, you ran the wrong tool.

Let's try an easy sweep first:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Then

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).

Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

ExTruckie

Post #6January 1, 2009, 3:41 PM UTC

Tomk

Thank for your reply

As you requested I reran ATF Cleaner and MalwareBytes.
Below are the results. You asked how my computer is acting. It is acting normally but with 1 caveat. If I go to speedtest.net and try to run a speed test, The page loads normally but when I try to run a test. I get a good ping but then it just stops. There is no indication it is running at all.
Also I did notice when I ran the malware scan I had a DNS Changer floating around. What I did removed most of it but not enough.

Thanks again

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:28:49, on 1/1/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\lxcycoms.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Lexmark 3400 Series\lxcymon.exe
C:\Program Files\Lexmark 3400 Series\ezprint.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\D4\D4.exe
C:\WINDOWS\system32\RUNDLL32.EXE
E:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
E:\Program Files\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\MMonitor.exe
C:\Documents and Settings\Mark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
E:\Program Files\LClock\lclock.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
G:\Program Files\OpenOffice.org 3\program\soffice.exe
G:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
G:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/a/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Foxit Toolbar - {73c7d5b0-7b03-444a-84c7-ce1ba03b5573} - C:\Program Files\Foxit\tbFox1.dll
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: Foxit Toolbar - {73c7d5b0-7b03-444a-84c7-ce1ba03b5573} - C:\Program Files\Foxit\tbFox1.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: Foxit Toolbar - {73c7d5b0-7b03-444a-84c7-ce1ba03b5573} - C:\Program Files\Foxit\tbFox1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [lxcymon.exe] "C:\Program Files\Lexmark 3400 Series\lxcymon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 3400 Series\ezprint.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Dimension4] C:\Program Files\D4\D4.exe
O4 - HKLM\..\Run: [LXCYCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCYtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinPatrol] E:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [ZoneAlarm Client] "E:\Program Files\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OM2_Monitor] "E:\Program Files\MMonitor.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Mark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [LClock] E:\Program Files\LClock\lclock.exe
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = E:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: OpenOffice.org 3.0.lnk = G:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O13 - Gopher Prefix:
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1230756726015
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1230756711093
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: lxcy_device - - C:\WINDOWS\system32\lxcycoms.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

–
End of file - 8100 bytes

Malwarebytes' Anti-Malware 1.31
Database version: 1589
Windows 5.1.2600 Service Pack 3

1/1/2009 10:23:59
mbam-log-2009-01-01 (10-23-59).txt

Scan type: Quick Scan
Objects scanned: 48988
Time elapsed: 3 minute(s), 35 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\extravideo (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Tomk

Post #7January 1, 2009, 4:00 PM UTC

ExTruckie,

Let's do a quick Rootkit check while I try to decide how to proceed.

Download Rooter.exe to your desktop

Then doubleclick it to start the tool
A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt. Post that here

ExTruckie

Post #8January 1, 2009, 4:17 PM UTC

Tom Here ya go Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3 X86-based PC ( Uniprocessor Free : AMD Athlon™ XP 2900+ ) BIOS : Phoenix - AwardBIOS v6.00PG USER : Mark ( Administrator ) BOOT : Normal boot Antivirus : AVG 7.5.516 7.5.516 (Activated) Firewall : ZoneAlarm Firewall 8.0.065.000 (Activated) A:\ (USB) B:\ (USB) C:\ (Local Disk) - NTFS - Total:24 Go (Free:12 Go) D:\ (Local Disk) - NTFS - Total:24 Go (Free:23 Go) E:\ (Local Disk) - NTFS - Total:100 Go (Free:98 Go) F:\ (Local Disk) - NTFS - Total:27 Go (Free:27 Go) G:\ (Local Disk) - NTFS - Total:27 Go (Free:14 Go) H:\ (CD or DVD) I:\ (CD or DVD) J:\ (USB) K:\ (USB) L:\ (USB) M:\ (USB) Thu 01/01/2009|11:15 ———————-\\ Search.. No infections found ! 1 - "C:\Rooter$\Rooter_1.txt" - Thu 01/01/2009|11:16 ———————-\\ Scan completed at 11:16

Tomk

Post #9January 1, 2009, 4:52 PM UTC

ExTruckie,

Disable your protection programs as we did before.

Please open HijackThis and run Do a system scan only
Check the boxes next to ONLY the entries listed below(if present):
- R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com
  O13 - Gopher Prefix:
Close all programs except for HijackThis.
Click on Fix checked
A box will pop up asking you if you wish to fix the selected items. Please choose YES.
Once it has fixed them, please exit/close HijackThis.

Next

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
```
File::

Folder::

Registry::
[-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\msqpdxserv.sys]

Driver::
```
Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Then

This tool will sometime find DNS hijackers when others miss it.

Please download SmitfraudFix

Double-click SmitfraudFix.exe
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

In your next reply please provide:

ComboFix.txt
SmitfraudFix report
New HijackThis log taken after everything else completed

ExTruckie

Post #10January 1, 2009, 4:55 PM UTC

Tom I will do the above later today. I have an engagement to attend. Thanks

Tomk

Post #11January 1, 2009, 5:06 PM UTC

ExTruckie

Post #12January 1, 2009, 11:59 PM UTC

Ok here is all the stuff you asked for

SmitFraudFix v2.388

Scan done at 18:48:55.25, Thu 01/01/2009
Run from G:\Downloads\New Folder\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\lxcycoms.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\RUNDLL32.EXE
E:\Program Files\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Mark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
E:\Program Files\LClock\lclock.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\WINDOWS\explorer.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Mozilla Firefox\firefox.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Mark

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Mark\LOCALS~1\Temp

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Mark\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Mark\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\Google\googletoolbar1.dll FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, following keys are not inevitably infected!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: VIA PCI 10/100Mb Fast Ethernet Adapter - Packet Scheduler Miniport
DNS Server Search Order: 68.87.75.194
DNS Server Search Order: 68.87.64.146
DNS Server Search Order: 68.87.72.130

HKLM\SYSTEM\CCS\Services\Tcpip\..\{34E0A626-7D6E-41D5-8EE5-8542BA7F0E46}: DhcpNameServer=[removed] [removed] [removed]
HKLM\SYSTEM\CS1\Services\Tcpip\..\{34E0A626-7D6E-41D5-8EE5-8542BA7F0E46}: DhcpNameServer=[removed] [removed] [removed]
HKLM\SYSTEM\CS2\Services\Tcpip\..\{34E0A626-7D6E-41D5-8EE5-8542BA7F0E46}: DhcpNameServer=[removed] [removed] [removed]
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed] [removed]

»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

ComboFix 08-12-31.01 - Mark 2009-01-01 18:43:05.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3071.2525 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG 7.5.516 *On-access scanning enabled* (Updated)
FW: ZoneAlarm Firewall *enabled*
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-12-01 to 2009-01-01 )))))))))))))))))))))))))))))))
.

2009-01-01 11:15 . 2009-01-01 11:16 d——– C:\Rooter$
2009-01-01 05:19 . 2009-01-01 05:19 d——– c:\windows\system32\ZoneLabs
2009-01-01 05:19 . 2008-11-13 15:18 1,221,008 –a—— c:\windows\system32\zpeng25.dll
2009-01-01 05:19 . 2009-01-01 18:17 348,371 –a—— c:\windows\system32\vsconfig.xml
2009-01-01 05:06 . 2009-01-01 05:06 d——– c:\program files\Windows Installer Clean Up
2009-01-01 05:06 . 2009-01-01 05:06 d——– c:\program files\MSECACHE
2009-01-01 03:54 . 2009-01-01 05:19 4,212 –ah—– c:\windows\system32\zllictbl.dat
2009-01-01 03:53 . 2009-01-01 18:44 d——– c:\windows\Internet Logs
2009-01-01 03:33 . 2009-01-01 03:33 d——– c:\windows\system32\IOSUBSYS
2009-01-01 03:33 . 2008-04-07 18:16 9,200 ——— c:\windows\system32\drivers\cdralw2k.sys
2009-01-01 03:33 . 2008-04-07 18:16 9,072 ——— c:\windows\system32\drivers\cdr4_xp.sys
2009-01-01 03:32 . 2009-01-01 04:34 d——– c:\documents and settings\All Users\Application Data\Google Updater
2009-01-01 01:42 . 2009-01-01 01:42 d——– c:\documents and settings\Mark\Application Data\gtk-2.0
2009-01-01 01:42 . 2009-01-01 01:42 d——– c:\documents and settings\Mark\.thumbnails
2008-12-31 19:30 . 2008-12-31 19:30 d——– c:\documents and settings\Mark\Application Data\OpenOffice.org
2008-12-31 19:18 . 2008-12-31 19:18 d——– c:\program files\SpiritPyre Extensions
2008-12-31 19:00 . 2009-01-01 01:42 d——– c:\documents and settings\Mark\.gimp-2.6
2008-12-31 19:00 . 2008-12-31 19:00 d——– c:\documents and settings\Mark\.gegl-0.0
2008-12-31 18:55 . 2008-12-31 18:55 d——– c:\documents and settings\Mark\Application Data\WinPatrol
2008-12-31 18:54 . 2008-12-31 18:54 d——– c:\program files\ZSoft
2008-12-31 18:54 . 2008-12-31 19:06 d——– c:\documents and settings\Mark\Application Data\teamspeak2
2008-12-31 18:54 . 2008-12-31 18:54 34,064 –a—— c:\windows\system32\lhacm.acm
2008-12-31 18:36 . 2009-01-01 04:39 d——– c:\windows\system32\XPSViewer
2008-12-31 18:36 . 2008-12-31 18:36 d——– c:\program files\Reference Assemblies
2008-12-31 18:36 . 2008-12-31 18:36 d——– c:\program files\MSBuild
2008-12-31 18:36 . 2008-07-06 07:06 1,676,288 ——— c:\windows\system32\xpssvcs.dll
2008-12-31 18:36 . 2008-07-06 07:06 1,676,288 —–c— c:\windows\system32\dllcache\xpssvcs.dll
2008-12-31 18:36 . 2008-07-06 05:50 597,504 —–c— c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2008-12-31 18:36 . 2008-07-06 07:06 575,488 ——— c:\windows\system32\xpsshhdr.dll
2008-12-31 18:36 . 2008-07-06 07:06 575,488 —–c— c:\windows\system32\dllcache\xpsshhdr.dll
2008-12-31 18:36 . 2008-07-06 07:06 117,760 ——— c:\windows\system32\prntvpt.dll
2008-12-31 18:36 . 2008-07-06 07:06 89,088 —–c— c:\windows\system32\dllcache\filterpipelineprintproc.dll
2008-12-31 18:26 . 2008-12-31 18:26 d——– c:\program files\Microsoft Silverlight
2008-12-31 18:25 . 2008-12-31 18:25 d——– c:\program files\Windows Desktop Search
2008-12-31 18:25 . 2008-12-31 18:25 d——– c:\documents and settings\Mark\Application Data\Windows Desktop Search
2008-12-31 18:20 . 2008-12-31 18:20 d——– c:\windows\system32\URTTemp
2008-12-31 17:45 . 2008-12-31 17:45 d——– c:\program files\MSXML 4.0
2008-12-31 17:45 . 2008-12-31 17:50 1,393 –a—— c:\windows\imsins.BAK
2008-12-31 16:57 . 2008-12-31 17:10 d——– c:\windows\system32\CatRoot_bak
2008-12-31 16:57 . 2008-07-07 15:26 253,952 —–c— c:\windows\system32\dllcache\es.dll
2008-12-31 16:57 . 2008-06-24 11:43 74,240 —–c— c:\windows\system32\dllcache\mscms.dll
2008-12-31 16:56 . 2008-10-16 15:38 6,066,176 —–c— c:\windows\system32\dllcache\ieframe.dll
2008-12-31 16:56 . 2007-04-17 04:32 2,455,488 —–c— c:\windows\system32\dllcache\ieapfltr.dat
2008-12-31 16:56 . 2007-03-08 00:10 991,232 —–c— c:\windows\system32\dllcache\ieframe.dll.mui
2008-12-31 16:56 . 2008-10-16 15:38 459,264 —–c— c:\windows\system32\dllcache\msfeeds.dll
2008-12-31 16:56 . 2008-10-16 15:38 383,488 —–c— c:\windows\system32\dllcache\ieapfltr.dll
2008-12-31 16:56 . 2008-09-08 05:41 333,824 —–c— c:\windows\system32\dllcache\srv.sys
2008-12-31 16:56 . 2008-10-23 07:36 286,720 —–c— c:\windows\system32\dllcache\gdi32.dll
2008-12-31 16:56 . 2008-10-16 15:38 267,776 —–c— c:\windows\system32\dllcache\iertutil.dll
2008-12-31 16:56 . 2008-08-14 05:04 138,496 —–c— c:\windows\system32\dllcache\afd.sys
2008-12-31 16:56 . 2008-10-16 15:38 63,488 —–c— c:\windows\system32\dllcache\icardie.dll
2008-12-31 16:56 . 2008-10-16 15:38 52,224 —–c— c:\windows\system32\dllcache\msfeedsbs.dll
2008-12-31 16:56 . 2008-10-16 08:11 13,824 —–c— c:\windows\system32\dllcache\ieudinit.exe
2008-12-31 16:53 . 2008-09-04 12:15 1,106,944 —–c— c:\windows\system32\dllcache\msxml3.dll
2008-12-31 16:53 . 2008-04-11 14:04 691,712 —–c— c:\windows\system32\dllcache\inetcomm.dll
2008-12-31 16:53 . 2008-10-24 06:21 455,296 —–c— c:\windows\system32\dllcache\mrxsmb.sys
2008-12-31 16:53 . 2008-10-15 11:34 337,408 —–c— c:\windows\system32\dllcache\netapi32.dll
2008-12-31 16:53 . 2008-10-03 05:02 247,326 —–c— c:\windows\system32\dllcache\strmdll.dll
2008-12-31 15:41 . 2009-01-01 03:33 d——– c:\program files\Google
2008-12-31 13:10 . 2008-12-31 13:10 d——– c:\program files\Foxit
2008-12-31 13:10 . 2008-12-31 13:10 d——– c:\program files\Conduit
2008-12-31 03:03 . 2009-01-01 18:31 d——– c:\program files\Mozilla Thunderbird
2008-12-31 03:03 . 2008-12-31 03:03 d——– c:\documents and settings\Mark\Application Data\Thunderbird
2008-12-31 03:01 . 2009-01-01 10:18 d——– c:\program files\Malwarebytes' Anti-Malware
2008-12-31 03:01 . 2008-12-31 03:01 d——– c:\documents and settings\Mark\Application Data\Malwarebytes
2008-12-31 03:01 . 2008-12-31 03:01 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-31 03:01 . 2008-12-03 19:52 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-31 03:01 . 2008-12-03 19:52 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2008-12-31 02:58 . 2008-12-31 02:58 d–h—– c:\windows\system32\GroupPolicy
2008-12-31 02:38 . 2008-12-31 02:38 d——– c:\documents and settings\LocalService\Application Data\SACore
2008-12-31 02:32 . 2008-12-31 17:50 d–h—– c:\windows\$hf_mig$
2008-12-31 02:22 . 2008-12-31 02:31 d——– c:\program files\McAfee
2008-12-31 02:22 . 2008-12-31 02:22 d——– c:\program files\Common Files\McAfee
2008-12-31 02:21 . 2008-12-31 02:26 dr-h—– C:\$VAULT$.AVG
2008-12-31 02:16 . 2008-12-31 02:16 d——– c:\program files\EASEUS
2008-12-31 02:12 . 2007-07-17 06:27 14,208 -ra—— c:\windows\system32\drivers\battc.sys
2008-12-31 02:12 . 2008-04-14 03:06 10,240 -ra—— c:\windows\system32\drivers\compbatt.sys
2008-12-31 02:12 . 2008-04-14 03:06 10,240 –a–c— c:\windows\system32\dllcache\compbatt.sys
2008-12-31 02:07 . 2009-01-01 03:44 d——– c:\windows\system32\NtmsData
2008-12-30 22:19 . 2008-12-31 15:50 d——– c:\windows\system32\Macromed
2008-12-30 21:55 . 2003-06-25 16:05 266,360 –a—— c:\windows\system32\TweakUI.exe
2008-12-30 21:55 . 2002-06-21 15:09 160,217 –a—— c:\windows\system32\PowerToysLicense.rtf
2008-12-30 21:51 . 2009-01-01 04:49 d——– c:\program files\lx_cats
2008-12-30 21:51 . 2008-12-30 21:51 d——– c:\program files\Lexmark Toolbar
2008-12-30 21:50 . 2008-12-30 21:51 d——– c:\program files\D4
2008-12-30 21:50 . 2007-02-22 17:31 344,064 –a—— c:\windows\system32\lxcycoin.dll
2008-12-30 21:50 . 2006-03-23 03:33 40,960 –a—— c:\windows\system32\lxcyvs.dll
2008-12-30 21:33 . 2008-12-30 21:33 d——– c:\program files\Common Files\Palo Alto Software
2008-12-30 21:33 . 2008-12-30 21:35 d——– c:\program files\Common Files\AnswerWorks 5.0
2008-12-30 21:33 . 2008-12-30 21:33 d——– c:\documents and settings\Mark\Application Data\Intuit
2008-12-30 21:33 . 2007-07-26 17:13 3,518,464 –a—— c:\windows\system32\cdintf300.dll
2008-12-30 21:33 . 2007-07-26 17:13 1,843,200 –a—— c:\windows\system32\acXMLParser.dll
2008-12-30 21:32 . 2008-12-30 21:32 d——– c:\program files\Common Files\Intuit
2008-12-30 21:32 . 2008-12-30 21:35 165 –a—— c:\windows\QUICKEN.INI
2008-12-30 21:27 . 2008-12-30 21:27 d——– c:\documents and settings\All Users\Application Data\Intuit
2008-12-30 21:24 . 2009-01-01 04:03 d——– c:\documents and settings\Mark\Application Data\AVG7
2008-12-30 21:24 . 2008-12-30 21:24 d——– c:\documents and settings\LocalService\Application Data\AVG7
2008-12-30 21:24 . 2008-12-30 21:24 d——– c:\documents and settings\All Users\Application Data\Grisoft
2008-12-30 21:24 . 2009-01-01 04:03 d——– c:\documents and settings\All Users\Application Data\avg7
2008-12-30 21:24 . 2008-12-30 21:24 499,712 –a—— c:\windows\system32\msvcp71.dll
2008-12-30 21:24 . 2008-12-30 21:24 348,160 –a—— c:\windows\system32\msvcr71.dll
2008-12-30 21:17 . 2008-12-31 02:21 d——– c:\documents and settings\Mark\Application Data\SiteAdvisor
2008-12-30 21:17 . 2008-12-30 21:17 d——– c:\documents and settings\All Users\Application Data\SiteAdvisor
2008-12-30 21:17 . 2008-12-30 21:17 d——– c:\documents and settings\All Users\Application Data\McAfee
2008-12-30 21:16 . 2008-12-30 21:16 d——– c:\program files\MozBackup
2008-12-30 21:15 . 2008-12-30 21:15 d——– c:\documents and settings\Mark\Application Data\Talkback
2008-12-30 21:15 . 2008-12-30 21:15 0 –a—— c:\windows\nsreg.dat
2008-12-30 21:03 . 2008-12-30 21:03 d——– c:\documents and settings\Mark\Application Data\FaxCtr
2008-12-30 21:01 . 2008-09-17 23:55 453,152 –a—— c:\windows\system32\nvudisp.exe
2008-12-30 21:01 . 2008-09-17 23:55 201,050 –a—— c:\windows\system32\nvapps.nvb
2008-12-30 21:01 . 2008-09-17 23:55 18,394 –a—— c:\windows\system32\nvdisp.nvu

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-31 08:14 ——— d—–w c:\program files\Windows Media Connect 2
2008-12-31 06:39 ——— d—–w c:\program files\Lexmark Fax Solutions
2008-12-31 02:33 ——— d–h–w c:\program files\InstallShield Installation Information
2008-12-31 02:00 ——— d—–w c:\program files\Common Files\InstallShield
2008-12-31 01:58 ——— d—–w c:\documents and settings\All Users\Application Data\Bluetooth
2008-12-31 01:56 ——— d—–w c:\program files\APC
2008-12-31 01:53 ——— d—–w c:\program files\IVT Corporation
2008-12-31 01:49 ——— d—–w c:\program files\Lexmark 3400 Series
2008-12-31 01:49 ——— d—–w c:\program files\Abbyy FineReader 6.0 Sprint
2008-12-31 01:49 ——— d—–w c:\documents and settings\All Users\Application Data\FaxCtr
2008-12-31 01:33 ——— d—–w c:\program files\VIA
2008-12-31 01:11 ——— d—–w c:\program files\microsoft frontpage
2008-12-04 12:18 43,520 —-a-w c:\windows\system32\drivers\fetnd5bv.sys
2008-11-17 20:04 2,306,113 —-a-w c:\windows\system32\GPhotos.scr
2008-10-23 12:36 286,720 —-a-w c:\windows\system32\gdi32.dll
2008-10-16 20:38 826,368 —-a-w c:\windows\system32\wininet.dll
2008-10-16 19:13 1,809,944 —-a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:12 561,688 —-a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 323,608 —-a-w c:\windows\system32\wucltui.dll
2008-10-16 19:12 202,776 —-a-w c:\windows\system32\wuweb.dll
2008-10-16 19:09 92,696 —-a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 —-a-w c:\windows\system32\wuauclt.exe
2008-10-16 19:09 43,544 —-a-w c:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 —-a-w c:\windows\system32\wups.dll
2008-10-16 19:07 208,744 —-a-w c:\windows\system32\muweb.dll
2008-10-16 19:06 268,648 —-a-w c:\windows\system32\mucltui.dll
2008-10-11 20:20 6,923,477 —-a-r c:\program files\ThunderBird.exe
2008-10-03 10:02 247,326 —-a-w c:\windows\system32\strmdll.dll
2008-10-03 01:25 4,154 —-a-w C:\Runonce100108.cmd
2008-10-02 22:04 29,088,197 —-a-r c:\program files\Vista_Trasnformation_Pack.exe
2008-10-02 21:43 2,613,100 —-a-r c:\program files\PCWizard.exe
2008-10-02 21:37 896,083 —-a-r c:\program files\erunt-setup.exe
2008-10-02 20:53 8,595,439 —-a-r c:\program files\epm.exe
2008-10-02 20:47 3,121,727 —-a-r c:\program files\ccsetup212.exe
2008-08-31 17:54 912,812 —-a-r c:\program files\MozBkup.exe
2008-08-31 17:35 1,745,837 —-a-r c:\program files\Image_Burn.exe
2008-08-31 16:48 1,992,888 —-a-r c:\program files\TSO.EXE
2008-08-31 16:44 6,000,350 —-a-r c:\program files\TeamSpeak.exe
2008-08-31 16:30 322,449 —-a-r c:\program files\TASKSWITCH.EXE
2008-08-31 16:27 337,481 —-a-r c:\program files\SlideShow.exe
2008-08-31 16:21 60,140,922 —-a-r c:\program files\SAMSUNG_PC_STUDIO.EXE
2008-08-31 16:07 309,147 —-a-r c:\program files\IMAGERESIZER.exe
2008-08-31 16:00 15,817,845 —-a-r c:\program files\IE7X86ENU.EXE
2008-08-31 15:52 651,522 —-a-r c:\program files\DMSETUP.EXE
2008-08-31 15:24 221,280 —-a-r c:\program files\SelectAll.exe
2008-08-31 15:12 814,793 —-a-r c:\program files\Desktop_Clock.exe
2008-08-31 15:05 250,723 —-a-r c:\program files\Desktop_Weather.exe
2008-08-31 14:56 975,622 —-a-r c:\program files\7z.exe
2008-08-31 14:48 1,048,916 —-a-r c:\program files\Unistaller.exe
2008-08-31 14:23 1,864,599 —-a-r c:\program files\Advisor.exe
2008-08-30 21:32 748,515 —-a-r c:\program files\WinPatrol.exe
2008-08-28 23:06 166,724,421 —-a-r c:\program files\OOffice.exe
2008-08-24 20:28 5,518,508 —-a-r c:\program files\sunbird-0.8.en-US.win32.installer.exe
2008-08-24 20:26 6,073,931 —-a-r c:\program files\Firefox.exe
2008-08-24 15:00 17,207,702 —-a-r c:\program files\gimp-2.4.5-i686-setup.exe
2008-08-24 14:40 2,754,677 —-a-r c:\program files\foxitreader23_setup.exe
2008-08-24 14:15 256,152 —-a-r c:\program files\D4.exe
2008-08-24 13:55 326,407,571 —-a-r c:\program files\apup.exe
2008-08-13 23:28 6,104,632 —-a-r c:\program files\PICASAWEB-CURRENT-SETUP.EXE
2008-12-31 19:25 67,688 —-a-w c:\program files\mozilla firefox\components\jar50.dll
2008-12-31 19:25 54,368 —-a-w c:\program files\mozilla firefox\components\jsd3250.dll
2008-12-31 19:25 34,944 —-a-w c:\program files\mozilla firefox\components\myspell.dll
2008-12-31 19:25 46,712 —-a-w c:\program files\mozilla firefox\components\spellchk.dll
2008-12-31 19:25 172,136 —-a-w c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((( snapshot@2008-12-31_15.32.22.32 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-12-31 23:20:56 7,680 —-a-w c:\windows\assembly\GAC\Accessibility\1.0.5000.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2008-12-31 23:20:54 12,288 —-a-w c:\windows\assembly\GAC\cscompmgd\7.0.5000.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2008-12-31 23:20:56 33,792 —-a-w c:\windows\assembly\GAC\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2009-01-01 07:05:25 8,192 —-a-w c:\windows\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2009-01-01 07:05:26 32,768 —-a-w c:\windows\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\IEHost.dll
+ 2008-12-31 23:20:56 4,608 —-a-w c:\windows\assembly\GAC\IIEHost\1.0.5000.0__b03f5f7f11d50a3a\IIEHost.dll
+ 2008-12-31 23:20:57 26,112 —-a-w c:\windows\assembly\GAC\ISymWrapper\1.0.5000.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2009-01-01 07:05:31 720,896 —-a-w c:\windows\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2008-12-31 23:20:54 28,672 —-a-w c:\windows\assembly\GAC\Microsoft.VisualBasic.Vsa\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
+ 2009-01-01 07:05:27 299,008 —-a-w c:\windows\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2008-12-31 23:20:55 6,144 —-a-w c:\windows\assembly\GAC\Microsoft.VisualC\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualC.dll
+ 2008-12-31 23:20:54 11,264 —-a-w c:\windows\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2008-12-31 23:20:54 32,768 —-a-w c:\windows\assembly\GAC\Microsoft.Vsa\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
+ 2008-12-31 23:20:54 6,656 —-a-w c:\windows\assembly\GAC\Microsoft_VsaVb\7.0.5000.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
+ 2008-12-31 23:20:57 1,564,672 —-a-w c:\windows\assembly\GAC\mscorcfg\1.0.5000.0__b03f5f7f11d50a3a\mscorcfg.dll
+ 2009-01-01 07:05:30 32,768 —-a-w c:\windows\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\RegCode.dll
+ 2008-12-31 23:20:57 77,824 —-a-w c:\windows\assembly\GAC\System.Configuration.Install\1.0.5000.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2009-01-01 07:05:29 303,104 —-a-w c:\windows\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2009-01-01 07:05:30 1,294,336 —-a-w c:\windows\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\System.Data.dll
+ 2009-01-01 07:05:26 1,703,936 —-a-w c:\windows\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Design.dll
+ 2009-01-01 07:05:31 90,112 —-a-w c:\windows\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2008-12-31 23:20:57 65,536 —-a-w c:\windows\assembly\GAC\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2009-01-01 07:05:28 466,944 —-a-w c:\windows\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2009-01-01 07:05:27 241,664 —-a-w c:\windows\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
+ 2009-01-01 07:05:27 66,560 —-a-w c:\windows\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.Thunk.dll
+ 2009-01-01 07:05:30 372,736 —-a-w c:\windows\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\System.Management.dll
+ 2009-01-01 07:05:32 241,664 —-a-w c:\windows\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2009-01-01 07:05:29 323,584 —-a-w c:\windows\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2009-01-01 07:05:27 131,072 —-a-w c:\windows\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2009-01-01 07:05:28 77,824 —-a-w c:\windows\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\System.Security.dll
+ 2009-01-01 07:05:30 126,976 —-a-w c:\windows\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2009-01-01 07:05:25 819,200 —-a-w c:\windows\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2009-01-01 07:05:27 57,344 —-a-w c:\windows\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2009-01-01 07:05:26 573,440 —-a-w c:\windows\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2009-01-01 23:23:00 1,265,664 —-a-w c:\windows\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
+ 2009-01-01 07:05:28 2,052,096 —-a-w c:\windows\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2009-01-01 07:05:29 1,339,392 —-a-w c:\windows\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\System.XML.dll
+ 2009-01-01 23:23:00 1,232,896 —-a-w c:\windows\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
+ 2009-01-01 09:38:05 69,120 —-a-w c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2009-01-01 09:38:09 72,192 —-a-w c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2008-12-31 23:36:42 163,840 —-a-w c:\windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll
+ 2009-01-01 09:38:06 4,546,560 —-a-w c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2008-12-31 23:36:45 4,210,688 —-a-w c:\windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.dll
+ 2009-01-01 09:37:58 486,400 —-a-w c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2009-01-01 09:38:12 2,933,248 —-a-w c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
+ 2009-01-01 09:38:03 258,048 —-a-w c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
+ 2009-01-01 09:38:03 113,664 —-a-w c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2008-12-31 23:36:46 368,640 —-a-w c:\windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\System.Printing.dll
+ 2009-01-01 09:38:01 261,632 —-a-w c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
+ 2009-01-01 09:37:57 5,238,784 —-a-w c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
+ 2009-01-01 09:38:05 10,752 —-a-w c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2009-01-01 09:37:58 507,904 —-a-w c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
+ 2009-01-01 09:38:05 13,312 —-a-w c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2009-01-01 09:38:09 8,192 —-a-w c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2009-01-01 09:38:09 77,824 —-a-w c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
+ 2009-01-01 09:38:07 6,656 —-a-w c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
+ 2008-12-31 23:37:27 106,496 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Conversion.v3.5.dll
+ 2009-01-01 09:38:08 348,160 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
+ 2008-12-31 23:37:28 733,184 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
+ 2009-01-01 09:38:08 36,864 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2008-12-31 23:37:28 36,864 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2008-12-31 23:37:28 802,816 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.v3.5.dll
+ 2009-01-01 09:38:08 655,360 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
+ 2008-12-31 23:37:28 94,208 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.v3.5.dll
+ 2009-01-01 09:38:07 77,824 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2009-01-01 09:38:01 749,568 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2008-12-31 23:36:42 397,312 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.dll
+ 2009-01-01 09:38:05 110,592 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2009-01-01 09:38:03 372,736 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
+ 2009-01-01 09:38:09 28,672 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
+ 2009-01-01 09:38:03 659,456 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2008-12-31 23:37:27 41,984 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\1.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.STLCLR.dll
+ 2009-01-01 09:38:07 5,632 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
+ 2009-01-01 09:38:08 12,800 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2009-01-01 09:38:04 32,768 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
+ 2009-01-01 09:38:01 7,168 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
+ 2008-12-31 23:36:49 598,016 —-a-w c:\windows\assembly\GAC_MSIL\PresentationBuildTasks\3.0.0.0__31bf3856ad364e35\PresentationBuildTasks.dll
+ 2008-12-31 23:36:45 32,768 —-a-w c:\windows\assembly\GAC_MSIL\PresentationCFFRasterizer\3.0.0.0__31bf3856ad364e35\PresentationCFFRasterizer.dll
+ 2008-12-31 23:36:49 46,104 —-a-w c:\windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe
+ 2008-12-31 23:36:50 196,608 —-a-w c:\windows\assembly\GAC_MSIL\PresentationFramework.Aero\3.0.0.0__31bf3856ad364e35\PresentationFramework.Aero.dll
+ 2008-12-31 23:36:50 139,264 —-a-w c:\windows\assembly\GAC_MSIL\PresentationFramework.Classic\3.0.0.0__31bf3856ad364e35\PresentationFramework.Classic.dll
+ 2008-12-31 23:36:51 397,312 —-a-w c:\windows\assembly\GAC_MSIL\PresentationFramework.Luna\3.0.0.0__31bf3856ad364e35\PresentationFramework.Luna.dll
+ 2008-12-31 23:36:51 163,840 —-a-w c:\windows\assembly\GAC_MSIL\PresentationFramework.Royale\3.0.0.0__31bf3856ad364e35\PresentationFramework.Royale.dll
+ 2008-12-31 23:36:51 5,283,840 —-a-w c:\windows\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\PresentationFramework.dll
+ 2008-12-31 23:36:51 864,256 —-a-w c:\windows\assembly\GAC_MSIL\PresentationUI\3.0.0.0__31bf3856ad364e35\PresentationUI.dll
+ 2008-12-31 23:36:46 528,384 —-a-w c:\windows\assembly\GAC_MSIL\ReachFramework\3.0.0.0__31bf3856ad364e35\ReachFramework.dll
+ 2008-12-31 23:37:29 5,632 —-a-w c:\windows\assembly\GAC_MSIL\Sentinel.v3.5Client\3.5.0.0__b03f5f7f11d50a3a\Sentinel.v3.5Client.dll
+ 2008-12-31 23:36:42 110,592 —-a-w c:\windows\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\SMdiagnostics.dll
+ 2009-01-01 09:38:07 110,592 —-a-w c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
+ 2008-12-31 23:37:29 45,056 —-a-w c:\windows\assembly\GAC_MSIL\System.AddIn.Contract\2.0.0.0__b03f5f7f11d50a3a\System.AddIn.Contract.dll
+ 2008-12-31 23:37:30 163,840 —-a-w c:\windows\assembly\GAC_MSIL\System.AddIn\3.5.0.0__b77a5c561934e089\System.AddIn.dll
+ 2008-12-31 23:37:34 57,344 —-a-w c:\windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll
+ 2009-01-01 09:38:10 81,920 —-a-w c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2009-01-01 09:38:12 425,984 —-a-w c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2008-12-31 23:37:30 667,648 —-a-w c:\windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.dll
+ 2008-12-31 23:37:30 53,248 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.DataSetExtensions\3.5.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll
+ 2008-12-31 23:37:31 229,376 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.Entity.Design\3.5.0.0__b77a5c561934e089\System.Data.Entity.Design.dll
+ 2008-12-31 23:37:31 2,879,488 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.Entity\3.5.0.0__b77a5c561934e089\System.Data.Entity.dll
+ 2008-12-31 23:37:27 684,032 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.Linq\3.5.0.0__b77a5c561934e089\System.Data.Linq.dll
+ 2008-12-31 23:37:26 294,912 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.Services.Client\3.5.0.0__b77a5c561934e089\System.Data.Services.Client.dll
+ 2008-12-31 23:37:26 114,688 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.Services.Design\3.5.0.0__b77a5c561934e089\System.Data.Services.Design.dll
+ 2008-12-31 23:37:26 442,368 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.Services\3.5.0.0__b77a5c561934e089\System.Data.Services.dll
+ 2009-01-01 09:38:11 745,472 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
+ 2009-01-01 09:38:12 970,752 —-a-w c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
+ 2009-01-01 09:38:00 5,062,656 —-a-w c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2008-12-31 23:37:26 286,720 —-a-w c:\windows\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\3.5.0.0__b77a5c561934e089\System.DirectoryServices.AccountManagement.dll
+ 2009-01-01 09:38:04 188,416 —-a-w c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
+ 2009-01-01 09:38:04 401,408 —-a-w c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2009-01-01 09:38:00 81,920 —-a-w c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2009-01-01 09:38:10 626,688 —-a-w c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2008-12-31 23:36:52 126,976 —-a-w c:\windows\assembly\GAC_MSIL\System.IdentityModel.Selectors\3.0.0.0__b77a5c561934e089\System.IdentityModel.Selectors.dll
+ 2008-12-31 23:36:42 430,080 —-a-w c:\windows\assembly\GAC_MSIL\System.IdentityModel\3.0.0.0__b77a5c561934e089\System.IdentityModel.dll
+ 2008-12-31 23:36:42 131,072 —-a-w c:\windows\assembly\GAC_MSIL\System.IO.Log\3.0.0.0__b03f5f7f11d50a3a\System.IO.Log.dll
+ 2008-12-31 23:37:32 143,360 —-a-w c:\windows\assembly\GAC_MSIL\System.Management.Instrumentation\3.5.0.0__b77a5c561934e089\System.Management.Instrumentation.dll
+ 2009-01-01 09:38:02 372,736 —-a-w c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2009-01-01 09:38:02 258,048 —-a-w c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2008-12-31 23:37:35 233,472 —-a-w c:\windows\assembly\GAC_MSIL\System.Net\3.5.0.0__b03f5f7f11d50a3a\System.Net.dll
+ 2009-01-01 09:38:02 303,104 —-a-w c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2009-01-01 09:38:02 131,072 —-a-w c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2008-12-31 23:36:42 966,656 —-a-w c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll
+ 2009-01-01 09:38:11 258,048 —-a-w c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
+ 2008-12-31 23:36:44 73,728 —-a-w c:\windows\assembly\GAC_MSIL\System.ServiceModel.Install\3.0.0.0__b77a5c561934e089\System.ServiceModel.Install.dll
+ 2008-12-31 23:36:45 32,768 —-a-w c:\windows\assembly\GAC_MSIL\System.ServiceModel.WasHosting\3.0.0.0__b77a5c561934e089\System.ServiceModel.WasHosting.dll
+ 2008-12-31 23:37:26 569,344 —-a-w c:\windows\assembly\GAC_MSIL\System.ServiceModel.Web\3.5.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll
+ 2008-12-31 23:36:43 5,931,008 —-a-w c:\windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll
+ 2009-01-01 09:38:13 114,688 —-a-w c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2008-12-31 23:36:49 688,128 —-a-w c:\windows\assembly\GAC_MSIL\System.Speech\3.0.0.0__31bf3856ad364e35\System.Speech.dll
+ 2008-12-31 23:37:35 77,824 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Abstractions\3.5.0.0__31bf3856ad364e35\System.Web.Abstractions.dll
+ 2008-12-31 23:37:36 32,768 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.DynamicData.Design\3.5.0.0__31bf3856ad364e35\System.Web.DynamicData.Design.dll
+ 2008-12-31 23:37:36 225,280 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.DynamicData\3.5.0.0__31bf3856ad364e35\System.Web.DynamicData.dll
+ 2008-12-31 23:37:32 131,072 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Entity.Design\3.5.0.0__b77a5c561934e089\System.Web.Entity.Design.dll
+ 2008-12-31 23:37:33 139,264 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Entity\3.5.0.0__b77a5c561934e089\System.Web.Entity.dll
+ 2008-12-31 23:37:37 335,872 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Extensions.Design\3.5.0.0__31bf3856ad364e35\System.Web.Extensions.Design.dll
+ 2008-12-31 23:37:37 1,277,952 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Extensions\3.5.0.0__31bf3856ad364e35\System.Web.Extensions.dll
+ 2009-01-01 09:37:59 835,584 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2009-01-01 09:37:59 77,824 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2008-12-31 23:37:38 61,440 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Routing\3.5.0.0__31bf3856ad364e35\System.Web.Routing.dll
+ 2009-01-01 09:37:59 839,680 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2009-01-01 09:38:00 5,025,792 —-a-w c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2008-12-31 23:37:33 12,288 —-a-w c:\windows\assembly\GAC_MSIL\System.Windows.Presentation\3.5.0.0__b77a5c561934e089\System.Windows.Presentation.dll
+ 2008-12-31 23:36:48 1,138,688 —-a-w c:\windows\assembly\GAC_MSIL\System.Workflow.Activities\3.0.0.0__31bf3856ad364e35\System.Workflow.Activities.dll
+ 2008-12-31 23:36:48 1,630,208 —-a-w c:\windows\assembly\GAC_MSIL\System.Workflow.ComponentModel\3.0.0.0__31bf3856ad364e35\System.Workflow.ComponentModel.dll
+ 2008-12-31 23:36:48 540,672 —-a-w c:\windows\assembly\GAC_MSIL\System.Workflow.Runtime\3.0.0.0__31bf3856ad364e35\System.Workflow.Runtime.dll
+ 2008-12-31 23:37:26 507,904 —-a-w c:\windows\assembly\GAC_MSIL\System.WorkflowServices\3.5.0.0__31bf3856ad364e35\System.WorkflowServices.dll
+ 2008-12-31 23:37:33 139,264 —-a-w c:\windows\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\System.Xml.Linq.dll
+ 2009-01-01 09:38:11 2,048,000 —-a-w c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
+ 2009-01-01 09:38:10 3,149,824 —-a-w c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
+ 2008-12-31 23:36:50 167,936 —-a-w c:\windows\assembly\GAC_MSIL\UIAutomationClient\3.0.0.0__31bf3856ad364e35\UIAutomationClient.dll
+ 2008-12-31 23:36:50 385,024 —-a-w c:\windows\assembly\GAC_MSIL\UIAutomationClientsideProviders\3.0.0.0__31bf3856ad364e35\UIAutomationClientsideProviders.dll
+ 2008-12-31 23:36:47 40,960 —-a-w c:\windows\assembly\GAC_MSIL\UIAutomationProvider\3.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll
+ 2008-12-31 23:36:47 98,304 —-a-w c:\windows\assembly\GAC_MSIL\UIAutomationTypes\3.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll
+ 2008-12-31 23:36:47 1,245,184 —-a-w c:\windows\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\WindowsBase.dll
+ 2008-12-31 23:36:50 94,208 —-a-w c:\windows\assembly\GAC_MSIL\WindowsFormsIntegration\3.0.0.0__31bf3856ad364e35\WindowsFormsIntegration.dll
+ 2008-12-31 23:46:16 25,600 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\c2af7cfbb47c077029a2645930b4eeac\Accessibility.ni.dll
+ 2008-12-31 23:46:18 842,240 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\c7ffd8c23e8de4018a88185b3b60631e\AspNetMMCExt.ni.dll
+ 2008-12-31 23:46:04 409,600 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\19b50dd470540911fc5cc65331a769e4\ComSvcConfig.ni.exe
+ 2008-12-31 23:46:30 220,672 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\e148983beeb0f30918b0564849a16456\CustomMarshalers.ni.dll
+ 2008-12-31 23:46:46 81,408 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\DdsFileType\ae5eedbd8bab63d1532a728e1df385d8\DdsFileType.ni.dll
+ 2008-12-31 23:46:18 14,336 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\dfsvc\a2865dcec9c5d3cc9c55f026cbad6fcc\dfsvc.ni.exe
+ 2008-12-31 23:46:47 504,320 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\ICSharpCode.SharpZi#\6ebfd8b7de7e5c268bcb673b233bd70e\ICSharpCode.SharpZipLib.ni.dll
+ 2008-12-31 23:46:36 94,208 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Interop.WIA\efca70ca873ab8817754464e26c18833\Interop.WIA.ni.dll
+ 2008-12-31 23:46:57 222,720 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\c5c4db4f9bc7a454e9cfc2548a9d45a5\Microsoft.Build.Conversion.v3.5.ni.dll
+ 2008-12-31 23:46:22 1,886,208 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\ce984d7bbd9a6d5d3cca28c4e5038020\Microsoft.Build.Engine.ni.dll
+ 2008-12-31 23:46:59 838,656 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\daf5ff5e06c80eefa80c6fcc79aec963\Microsoft.Build.Engine.ni.dll
+ 2008-12-31 23:47:00 65,024 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\36dbc4689f7c51e393504230004c9dec\Microsoft.Build.Framework.ni.dll
+ 2008-12-31 23:46:19 74,752 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\66359457e427c0d547750a79f754f9ba\Microsoft.Build.Framework.ni.dll
+ 2008-12-31 23:47:03 1,620,480 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\152cf75db013f0523933ac45177b4217\Microsoft.Build.Tasks.ni.dll
+ 2008-12-31 23:47:06 1,965,568 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\cd6eeb3d7ea1f65c28a43e665db38644\Microsoft.Build.Tasks.v3.5.ni.dll
+ 2008-12-31 23:47:08 175,104 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\28eede53267524df58362a75a668cf86\Microsoft.Build.Utilities.v3.5.ni.dll
+ 2008-12-31 23:47:07 144,384 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\43dceeb2d0601d79af40752fb20283c2\Microsoft.Build.Utilities.ni.dll
+ 2008-12-31 23:48:52 2,332,160 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\7d61e63dea85f4f77ea4c13df7651ec7\Microsoft.JScript.ni.dll
+ 2008-12-31 23:46:07 1,092,608 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\21bb6244c91b6207fbcb038884a641ef\Microsoft.Transactions.Bridge.ni.dll
+ 2008-12-31 23:46:08 386,560 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\539e297cc9bc67fbf2fbdc9dc5fcd0f1\Microsoft.Transactions.Bridge.Dtc.ni.dll
+ 2008-12-31 23:47:11 1,711,104 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\5b3d048d8c003d743ea5e72caf07773a\Microsoft.VisualBasic.ni.dll
+ 2008-12-31 23:48:53 55,296 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\28ea74096df47800fe2c78bb2b9a4f2a\Microsoft.Vsa.ni.dll
+ 2008-12-31 23:46:19 133,632 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\MSBuild\87c84ffaaad81d8d106a9aa9d68b5926\MSBuild.ni.exe
+ 2008-12-31 23:38:54 11,485,184 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9adb89fa22fd5b4ce433b5aca7fb1b07\mscorlib.ni.dll
+ 2008-12-31 23:46:34 227,328 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PaintDotNet.Base\ff5529e64d52b5e3c9a2458675dc3d49\PaintDotNet.Base.ni.dll
+ 2008-12-31 23:46:43 1,810,944 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PaintDotNet.Core\49549bfdb2cf54e1fd5c3daf641cd6e7\PaintDotNet.Core.ni.dll
+ 2008-12-31 23:46:45 695,296 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PaintDotNet.Data\4959452d8a41097ee3cf09b21f0ec696\PaintDotNet.Data.ni.dll
+ 2008-12-31 23:46:50 642,560 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PaintDotNet.Effects\a4eb4f4e12f2e29fa12f31f1ed23dcfb\PaintDotNet.Effects.ni.dll
+ 2008-12-31 23:46:37 322,048 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PaintDotNet.Resourc#\53d5ac76b453df590081a4f8241dd707\PaintDotNet.Resources.ni.dll
+ 2008-12-31 23:46:36 20,992 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PaintDotNet.StylusR#\faf277f248798b92116f90d4df10520f\PaintDotNet.StylusReader.ni.dll
+ 2008-12-31 23:46:35 600,576 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PaintDotNet.SystemL#\790115710e04bc07632a8bd7a9ce2742\PaintDotNet.SystemLayer.ni.dll
+ 2008-12-31 23:46:54 2,016,768 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PaintDotNet\fede73673eb24f0df2c656bbac762633\PaintDotNet.ni.exe
+ 2008-12-31 23:39:06 1,451,008 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\b6bfb51dec7f8cc42c21c5928470c773\PresentationBuildTasks.ni.dll
+ 2008-12-31 23:39:07 39,424 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\487c1bc20f6e73e8e79503898d17d102\PresentationCFFRasterizer.ni.dll
+ 2008-12-31 23:39:34 12,213,248 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\12dcb10b76012416357bdbb010fdaa97\PresentationCore.ni.dll
+ 2008-12-31 23:39:36 47,104 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\9469981a17c01dd154c540127e678b35\PresentationFontCache.ni.exe
+ 2008-12-31 23:40:08 258,048 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\79c2fd29b1e46c943960278051b4e1b9\PresentationFramework.Royale.ni.dll
+ 2008-12-31 23:40:04 14,320,128 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\9519494798a88867406b5755e1dbded6\PresentationFramework.ni.dll
+ 2008-12-31 23:40:05 368,128 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\9e71fd0d299c5668c96a54e4a63479fa\PresentationFramework.Aero.ni.dll
+ 2008-12-31 23:40:07 539,648 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\b4dc4bd8534d90fbb7430926ad990cd9\PresentationFramework.Luna.ni.dll
+ 2008-12-31 23:40:06 224,768 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\ef1a93d10c3a91b728745dbfcc79c2c7\PresentationFramework.Classic.ni.dll
+ 2008-12-31 23:40:11 1,656,832 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\87fb973e4ab6a21fd00e45656fa7c115\PresentationUI.ni.dll
+ 2008-12-31 23:40:15 2,125,824 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\5c59991df60164cae10fd81b88a8e5b1\ReachFramework.ni.dll
+ 2008-12-31 23:46:10 319,488 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\6781b87c8d3b55e6120b1e86bea6e040\ServiceModelReg.ni.exe
+ 2008-12-31 23:46:11 255,488 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\2e19ccefc30d7b827bab3f7d8dcc0ab9\SMDiagnostics.ni.dll
+ 2008-12-31 23:46:12 365,056 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\b9c1a29e684bc02e49226ff1e9eec253\SMSvcHost.ni.exe
+ 2008-12-31 23:47:14 82,944 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\f2b48eab657b4ef1d19dac11bdf0c913\System.AddIn.Contract.ni.dll
+ 2008-12-31 23:47:13 632,832 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn\b01721205312c6c18df033cc47b60e5c\System.AddIn.ni.dll
+ 2008-12-31 23:47:14 94,208 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\a8e047504bdad9ec14efd483574b0dd5\System.ComponentModel.DataAnnotations.ni.dll
+ 2008-12-31 23:48:47 140,800 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\22a1629a4dcdd493bbd8be40cc122e94\System.Configuration.Install.ni.dll
+ 2008-12-31 23:46:24 970,752 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb4cb21d14767292e079366a5d3d76cd\System.Configuration.ni.dll
+ 2008-12-31 23:40:20 2,294,784 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\6c69930d05c557da70144bcc0add7065\System.Core.ni.dll
+ 2008-12-31 23:47:15 135,680 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\4f4ddae492a4a4ce4a2961f3d72d9399\System.Data.DataSetExtensions.ni.dll
+ 2008-12-31 23:48:29 755,200 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\9867484f25281882e61f61066fa651a3\System.Data.Entity.Design.ni.dll
+ 2008-12-31 23:48:26 9,903,104 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\8c050147d7031f912f6ca2b15550173f\System.Data.Entity.ni.dll
+ 2008-12-31 23:40:42 2,510,848 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\fa206c73f39721cd2c55829b9853de44\System.Data.Linq.ni.dll
+ 2008-12-31 23:48:38 354,816 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\3cb9c5203e50cb6af99b163522e9357c\System.Data.Services.Design.ni.dll
+ 2008-12-31 23:48:36 939,520 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\d3aed340a6562196ca40978556fb29d1\System.Data.Services.Client.ni.dll
+ 2008-12-31 23:48:34 1,326,080 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Services\6f298259c87cc6c7318d931f52f053c5\System.Data.Services.ni.dll
+ 2008-12-31 23:46:28 2,508,800 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\0ec1b690c5ee057fa92ecff78de1457c\System.Data.SqlXml.ni.dll
+ 2008-12-31 23:40:31 6,614,016 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\0b40341027c01716cec1dd97592698e0\System.Data.ni.dll
+ 2008-12-31 23:46:33 1,800,704 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\df1efcbac5973454c608890f72eb994d\System.Deployment.ni.dll
+ 2008-12-31 23:40:58 10,681,344 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Design\204db7071fb26343b0fd3f3d140c0bf8\System.Design.ni.dll
+ 2008-12-31 23:48:43 455,680 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\44de75caba2b9711b3d9030a30767f8b\System.DirectoryServices.Protocols.ni.dll
+ 2008-12-31 23:48:40 1,116,672 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\6bcc481030a56c24d5990d199812c594\System.DirectoryServices.ni.dll
+ 2008-12-31 23:48:42 880,640 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\c205bbbb88bfa4bd5e274f43ea0013cb\System.DirectoryServices.AccountManagement.ni.dll
+ 2008-12-31 23:41:02 208,384 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\5f5d64dd0e7991aaaad2d98ee52afe42\System.Drawing.Design.ni.dll
+ 2008-12-31 23:41:01 1,587,200 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6978f2e90f13bc720d57fa6895c911e2\System.Drawing.ni.dll
+ 2008-12-31 23:48:45 627,712 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\5f9cd5bfebcb94175d440ebab3aa412f\System.EnterpriseServices.ni.dll
+ 2008-12-31 23:48:45 280,064 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\5f9cd5bfebcb94175d440ebab3aa412f\System.EnterpriseServices.Wrapper.dll
+ 2008-12-31 23:45:09 212,992 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\be8c7482f1e78a3b4984af9082d455a7\System.IdentityModel.Selectors.ni.dll
+ 2008-12-31 23:45:08 1,056,768 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\94b2ca600c860c76e387f8bd317bd4c3\System.IdentityModel.ni.dll
+ 2008-12-31 23:45:11 381,440 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.IO.Log\bcfccfa22245d2223a764611c61a7cb9\System.IO.Log.ni.dll
+ 2008-12-31 23:48:46 330,752 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\1db9deebde7c96b2874b4ffccac2f48e\System.Management.Instrumentation.ni.dll
+ 2008-12-31 23:48:48 997,888 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\894d87c08a9a5b5923e7104055a616d2\System.Management.ni.dll
+ 2008-12-31 23:48:54 620,032 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Net\eabe1915c13467e1e66e2b073bcb842f\System.Net.ni.dll
+ 2008-12-31 23:41:05 1,035,264 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Printing\db428f231a2ccaf490ae219efd2edc69\System.Printing.ni.dll
+ 2008-12-31 23:46:32 311,296 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\01dc643b54310ebc5ab7e4696df426bc\System.Runtime.Serialization.Formatters.Soap.ni.dll
+ 2008-12-31 23:45:16 2,338,304 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\bb748f8ef8c98eb5c7f79b8faee95397\System.Runtime.Serialization.ni.dll
+ 2008-12-31 23:46:30 676,352 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\0418eb6dbffe9b46aa4c989153d6a3b5\System.Security.ni.dll
+ 2008-12-31 23:49:00 1,705,984 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\a3adabee8e63dc76f65710a9c32175fc\System.ServiceModel.Web.ni.dll
+ 2008-12-31 23:46:01 17,313,792 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\d85d9535e91da842fded56869d57790a\System.ServiceModel.ni.dll
+ 2008-12-31 23:49:01 212,992 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\a9e71dda6389403be4db7b567592e3b8\System.ServiceProcess.ni.dll
+ 2008-12-31 23:41:09 1,912,832 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Speech\2e7a6c977ac9f8d46ebe2982697a0c8d\System.Speech.ni.dll
+ 2008-12-31 23:49:02 627,200 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\12903c3843fe923d1977801ffa3cf26c\System.Transactions.ni.dll
+ 2008-12-31 23:49:20 141,312 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\fbe60d84b9f1ab74e396fb1507f69615\System.Web.Abstractions.ni.dll
+ 2008-12-31 23:49:29 36,864 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\17e2a7113434da494a846a8f4e4ac5e9\System.Web.DynamicData.Design.ni.dll
+ 2008-12-31 23:49:28 542,720 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\aff5e0fa23e49ee75e458408c1f66da2\System.Web.DynamicData.ni.dll
+ 2008-12-31 23:49:32 301,056 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\ca1ce755bb49324c7d275c426188a28f\System.Web.Entity.Design.ni.dll
+ 2008-12-31 23:49:30 328,192 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\bbdc5cb2f2f92fd610de7331d748193a\System.Web.Entity.ni.dll
+ 2008-12-31 23:49:27 2,400,256 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\6a20b64ad8e2aaa2f40d67ff01fcc708\System.Web.Extensions.ni.dll
+ 2008-12-31 23:49:35 858,112 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\f288f2cb75465c0f45154079365af9e8\System.Web.Extensions.Design.ni.dll
+ 2008-12-31 23:49:39 2,209,280 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\e5995a34d44ad5af7d9f335075bded4d\System.Web.Mobile.ni.dll
+ 2008-12-31 23:49:40 202,240 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\70764208219715962d310336b5959dfa\System.Web.RegularExpressions.ni.dll
+ 2008-12-31 23:49:21 129,536 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\18e1acd6761195389db42bab83169fd2\System.Web.Routing.ni.dll
+ 2008-12-31 23:49:45 1,840,128 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\1dad08772eb89d48a8a0cfe9b0467eb0\System.Web.Services.ni.dll
+ 2008-12-31 23:49:19 11,791,360 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\50ea744ffc3cb7f09b027fd6c5c93b2b\System.Web.ni.dll
+ 2008-12-31 23:41:29 12,428,800 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9a254c455892c02355ab0ab0f0727c5b\System.Windows.Forms.ni.dll
+ 2008-12-31 23:49:46 37,888 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\b5a285233229bb4f9d9831ebf27fe9ac\System.Windows.Presentation.ni.dll
+ 2008-12-31 23:49:54 2,989,568 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\d6cc33db5d526553ffbbfd1d372a8493\System.Workflow.Activities.ni.dll
+ 2008-12-31 23:50:04 4,510,720 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\9de33f5786cd15e220f47b916c5a15e9\System.Workflow.ComponentModel.ni.dll
+ 2008-12-31 23:50:09 1,904,128 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\6d0966370023925610756f368140b947\System.Workflow.Runtime.ni.dll
+ 2008-12-31 23:50:13 1,355,264 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\43911ac4e29949c57560eee5cb7b76c2\System.WorkflowServices.ni.dll
+ 2008-12-31 23:50:14 400,896 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\8c0d96269480bdd3de8a825f0215308d\System.Xml.Linq.ni.dll
+ 2008-12-31 23:41:40 5,449,728 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\36f3953f24d4f0b767bf172331ad6f3e\System.Xml.ni.dll
+ 2008-12-31 23:39:04 7,867,392 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System\aa7926460a336408c8041330ad90929d\System.ni.dll
+ 2008-12-31 23:41:42 447,488 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\d255ab525d10d8fefe5df9ba092b2df8\UIAutomationClient.ni.dll
+ 2008-12-31 23:41:44 1,049,600 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\8698f073a59ef0db10a3258b1f1deaee\UIAutomationClientsideProviders.ni.dll
+ 2008-12-31 23:41:45 60,928 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\8f5c0e1b77c840d99a68897898317b79\UIAutomationProvider.ni.dll
+ 2008-12-31 23:41:45 187,904 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\dbb2fcd246efaf3df823410597cd1677\UIAutomationTypes.ni.dll
+ 2008-12-31 23:46:56 24,064 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\WiaProxy32\46c94d7cca0eb94fd86ba689c71fd717\WiaProxy32.ni.exe
+ 2008-12-31 23:39:12 3,311,104 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\df20e56b59b1b1a595af305ddc0777ba\WindowsBase.ni.dll
+ 2008-12-31 23:41:47 239,616 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\a18dff8832712a0f6cccaaefbcc45861\WindowsFormsIntegration.ni.dll
+ 2008-12-31 23:46:13 321,024 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\7d2a3adbdcb675f872eb2dbf21f73596\WsatConfig.ni.exe
+ 2009-01-01 23:23:37 118,784 —-a-w c:\windows\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_36cb6dc3\CustomMarshalers.dll
+ 2009-01-01 23:23:09 61,440 —-a-w c:\windows\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_bdddcc7f\CustomMarshalers.dll
+ 2009-01-01 23:23:32 3,391,488 —-a-w c:\windows\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_189a3bb4\mscorlib.dll
+ 2009-01-01 23:23:53 8,908,800 —-a-w c:\windows\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_f2d7ca36\mscorlib.dll
+ 2009-01-01 23:23:48 3,395,584 —-a-w c:\windows\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_15340ba7\System.Design.dll
+ 2009-01-01 23:23:27 1,470,464 —-a-w c:\windows\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_c1883113\System.Design.dll
+ 2009-01-01 23:23:37 192,512 —-a-w c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_0b4f98eb\System.Drawing.Design.dll
+ 2009-01-01 23:23:10 90,112 —-a-w c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_3b98cbc6\System.Drawing.Design.dll
+ 2009-01-01 23:23:28 835,584 —-a-w c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_3bad3a61\System.Drawing.dll
+ 2009-01-01 23:23:49 2,244,608 —-a-w c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_61a425ef\System.Drawing.dll
+ 2009-01-01 23:23:42 7,884,800 —-a-w c:\windows\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_4e8a4724\System.Windows.Forms.dll
+ 2009-01-01 23:23:18 3,018,752 —-a-w c:\windows\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_f0e8d362\System.Windows.Forms.dll
+ 2009-01-01 23:23:23 2,088,960 —-a-w c:\windows\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_439d186d\System.Xml.dll
+ 2009-01-01 23:23:45 5,513,216 —-a-w c:\windows\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_916a8dda\System.Xml.dll
+ 2009-01-01 23:23:08 1,966,080 —-a-w c:\windows\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_a7eef6ac\System.dll
+ 2009-01-01 23:23:36 4,788,224 —-a-w c:\windows\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_c8934821\System.dll
+ 2008-06-13 11:05:51 272,128 ——w c:\windows\Driver Cache\i386\bthport.sys
+ 2008-07-06 12:06:10 89,088 ——w c:\windows\Driver Cache\i386\filterpipelineprintproc.dll
+ 2008-10-24 11:21:09 455,296 ——w c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2008-07-06 12:06:10 765,440 ——w c:\windows\Driver Cache\i386\mxdwdrv.dll
+ 2008-07-06 12:06:10 198,656 ——w c:\windows\Driver Cache\i386\mxdwdui.dll
+ 2008-08-14 10:09:26 2,145,280 ——w c:\windows\Driver Cache\i386\ntkrnlmp.exe
+ 2008-08-14 09:33:16 2,066,048 ——w c:\windows\Driver Cache\i386\ntkrnlpa.exe
+ 2008-08-14 09:33:16 2,023,936 ——w c:\windows\Driver Cache\i386\ntkrpamp.exe
+ 2008-08-14 10:11:02 2,189,184 ——w c:\windows\Driver Cache\i386\ntoskrnl.exe
+ 2008-07-06 12:06:10 373,248 ——w c:\windows\Driver Cache\i386\unidrv.dll
+ 2008-07-06 12:06:10 744,960 ——w c:\windows\Driver Cache\i386\unidrvui.dll
+ 2008-03-13 04:52:36 761,344 ——w c:\windows\Driver Cache\i386\unires.dll
+ 2005-10-20 17:02:28 163,328 —-a-w c:\windows\ERDNT\AutoBackup\1-1-2009\ERDNT.EXE
+ 2009-01-01 06:34:57 1,466,368 —-a-w c:\windows\ERDNT\AutoBackup\1-1-2009\Users\00000001\NTUSER.DAT
+ 2009-01-01 06:34:57 8,192 —-a-w c:\windows\ERDNT\AutoBackup\1-1-2009\Users\00000002\UsrClass.dat
+ 2007-03-06 01:22:39 213,216 -c—-w c:\windows\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:47 371,424 -c—-w c:\windows\ie7updates\KB938127-v2-IE7\spuninst\updspapi.dll
+ 2007-08-13 23:54:10 765,952 -c—-w c:\windows\ie7updates\KB938127-v2-IE7\vgx.dll
+ 2008-08-17 01:28:39 124,928 -c—-w c:\windows\ie7updates\KB958215-IE7\advpack.dll
+ 2007-08-13 23:35:46 346,624 -c—-w c:\windows\ie7updates\KB958215-IE7\dxtmsft.dll
+ 2007-08-13 23:35:38 214,528 -c—-w c:\windows\ie7updates\KB958215-IE7\dxtrans.dll
+ 2007-08-13 23:54:10 131,584 -c—-w c:\windows\ie7updates\KB958215-IE7\extmgr.dll
+ 2008-08-17 01:39:04 63,488 -c—-w c:\windows\ie7updates\KB958215-IE7\icardie.dll
+ 2008-08-17 01:32:52 70,656 -c—-w c:\windows\ie7updates\KB958215-IE7\ie4uinit.exe
+ 2008-08-17 01:32:52 153,088 -c—-w c:\windows\ie7updates\KB958215-IE7\ieakeng.dll
+ 2008-08-17 01:32:53 230,400 -c—-w c:\windows\ie7updates\KB958215-IE7\ieaksie.dll
+ 2008-08-17 01:32:53 161,792 -c—-w c:\windows\ie7updates\KB958215-IE7\ieakui.dll
+ 2008-08-17 01:39:10 383,488 -c—-w c:\windows\ie7updates\KB958215-IE7\ieapfltr.dll
+ 2008-08-17 01:32:54 388,608 -c—-w c:\windows\ie7updates\KB958215-IE7\iedkcs32.dll
+ 2008-08-17 01:39:24 6,068,224 -c—-w c:\windows\ie7updates\KB958215-IE7\ieframe.dll
+ 2008-08-17 01:32:56 44,544 -c—-w c:\windows\ie7updates\KB958215-IE7\iernonce.dll
+ 2008-08-17 01:39:27 267,776 -c—-w c:\windows\ie7updates\KB958215-IE7\iertutil.dll
+ 2007-08-13 23:39:10 13,312 -c—-w c:\windows\ie7updates\KB958215-IE7\ieudinit.exe
+ 2008-08-17 01:32:58 625,664 -c—-w c:\windows\ie7updates\KB958215-IE7\iexplore.exe
+ 2007-08-13 23:54:10 27,136 -c—-w c:\windows\ie7updates\KB958215-IE7\jsproxy.dll
+ 2008-08-17 01:41:38 459,264 -c—-w c:\windows\ie7updates\KB958215-IE7\msfeeds.dll
+ 2008-08-17 01:41:38 52,224 -c—-w c:\windows\ie7updates\KB958215-IE7\msfeedsbs.dll
+ 2007-08-13 23:54:10 475,648 -c—-w c:\windows\ie7updates\KB958215-IE7\mshtmled.dll
+ 2007-08-13 23:44:26 192,000 -c—-w c:\windows\ie7updates\KB958215-IE7\msrating.dll
+ 2007-08-13 23:54:10 670,720 -c—-w c:\windows\ie7updates\KB958215-IE7\mstime.dll
+ 2008-08-17 01:34:10 102,912 -c—-w c:\windows\ie7updates\KB958215-IE7\occache.dll
+ 2007-08-13 23:36:12 44,544 -c—-w c:\windows\ie7updates\KB958215-IE7\pngfilt.dll
+ 2007-03-06 01:22:39 213,216 -c—-w c:\windows\ie7updates\KB958215-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:51 371,424 -c—-w c:\windows\ie7updates\KB958215-IE7\spuninst\updspapi.dll
+ 2008-08-17 01:34:50 105,984 -c—-w c:\windows\ie7updates\KB958215-IE7\url.dll
+ 2007-08-13 23:54:10 1,162,240 -c—-w c:\windows\ie7updates\KB958215-IE7\urlmon.dll
+ 2008-08-17 01:48:39 396,800 -c—-w c:\windows\ie7updates\KB958215-IE7\webcheck.dll
+ 2007-08-13 23:54:10 818,688 -c—-w c:\windows\ie7updates\KB958215-IE7\wininet.dll
+ 2007-08-13 23:54:12 3,578,368 -c—-w c:\windows\ie7updates\KB960714-IE7\mshtml.dll
+ 2007-03-06 01:22:39 213,216 -c—-w c:\windows\ie7updates\KB960714-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:47 371,424 -c—-w c:\windows\ie7updates\KB960714-IE7\spuninst\updspapi.dll
+ 2009-01-01 08:33:09 26,694 —-a-r c:\windows\Installer\{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}\ARPPRODUCTICON.exe
+ 2009-01-01 08:33:09 26,694 —-a-r c:\windows\Installer\{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}\googleearth.exe_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2009-01-01 08:33:09 26,694 —-a-r c:\windows\Installer\{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}\googleearth.exe1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2009-01-01 08:33:09 26,694 —-a-r c:\windows\Installer\{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}\ShortcutDX_EB071909B9884F8CBF3D6115D4ADEE5E.exe
+ 2009-01-01 08:33:09 26,694 —-a-r c:\windows\Installer\{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}\ShortcutOGL_EB071909B9884F8CBF3D6115D4ADEE5E.exe
+ 2009-01-01 08:33:09 26,694 —-a-r c:\windows\Installer\{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}\UNINST_Uninstall_G_408FFBEED62349E08B232864A94D2864.exe
+ 2009-01-01 10:09:22 77,610 —-a-r c:\windows\Installer\{43602F34-1AA3-44FB-AEB2-D08C2C73743F}\_6FEFF9B68218417F98F549.exe
+ 2009-01-01 00:25:32 32,768 —-a-r c:\windows\Installer\{716E0306-8318-4364-8B8F-0CC4E9376BAC}\icon.exe
+ 2008-12-31 22:45:29 32,768 —-a-r c:\windows\Installer\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}\icon.exe
+ 2008-07-25 16:16:58 82,944 —-a-w c:\windows\Microsoft.NET\Framework\NETFXSBS10.exe
+ 2002-05-14 14:42:38 5,120 —-a-w c:\windows\Microsoft.NET\Framework\sbs_diasymreader.dll
+ 2002-05-14 14:42:38 5,120 —-a-w c:\windows\Microsoft.NET\Framework\sbs_iehost.dll
+ 2002-05-14 14:42:38 5,120 —-a-w c:\windows\Microsoft.NET\Framework\sbs_microsoft.jscript.dll
+ 2002-05-14 14:42:38 5,632 —-a-w c:\windows\Microsoft.NET\Framework\sbs_microsoft.vsa.vb.codedomprocessor.dll
+ 2002-05-14 14:42:38 5,120 —-a-w c:\windows\Microsoft.NET\Framework\sbs_mscordbi.dll
+ 2002-07-19 16:52:48 5,120 —-a-w c:\windows\Microsoft.NET\Framework\sbs_mscorrc.dll
+ 2002-05-14 14:42:38 5,120 —-a-w c:\windows\Microsoft.NET\Framework\sbs_mscorsec.dll
+ 2002-05-14 14:42:38 5,120 —-a-w c:\windows\Microsoft.NET\Framework\sbs_system.configuration.install.dll
+ 2002-05-14 14:42:38 5,120 —-a-w c:\windows\Microsoft.NET\Framework\sbs_system.data.dll
+ 2002-05-14 14:42:38 5,120 —-a-w c:\windows\Microsoft.NET\Framework\sbs_system.enterpriseservices.dll
+ 2002-06-27 17:45:32 5,120 —-a-w c:\windows\Microsoft.NET\Framework\sbs_VsaVb7rt.dll
+ 2002-05-14 14:42:38 5,120 —-a-w c:\windows\Microsoft.NET\Framework\sbs_wminet_utils.dll
+ 2008-07-25 16:16:58 16,896 —-a-w c:\windows\Microsoft.NET\Framework\sbscmp10.dll
+ 2008-07-25 16:17:02 16,896 —-a-w c:\windows\Microsoft.NET\Framework\sbscmp20_mscorwks.dll
+ 2008-07-25 16:17:02 16,896 —-a-w c:\windows\Microsoft.NET\Framework\sbscmp20_perfcounter.dll
+ 2008-07-25 16:17:02 16,896 —-a-w c:\windows\Microsoft.NET\Framework\SharedReg12.dll
+ 2008-07-25 16:16:58 96,768 —-a-w c:\windows\Microsoft.NET\Framework\v1.0.3705\mscormmc.dll
+ 2003-02-21 07:59:44 16,896 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\1033\alinkui.dll
+ 2003-02-21 08:55:06 94,208 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\1033\cscompui.dll
+ 2003-02-21 08:02:16 131,072 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\1033\vbc7ui.dll
+ 2003-02-21 10:04:20 155,648 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\1033\Vsavb7rtUI.dll
+ 2003-02-21 12:24:08 7,680 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\Accessibility.dll
+ 2003-02-21 10:00:36 98,304 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\alink.dll
+ 2003-02-21 00:19:42 24,576 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_filter.dll
+ 2007-04-14 02:30:52 258,048 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
+ 2003-02-21 00:19:22 40,960 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_rc.dll
+ 2004-07-15 06:49:18 20,480 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe
+ 2004-07-15 06:49:26 32,768 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
+ 2007-04-14 02:30:52 32,768 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
+ 2002-07-29 16:11:50 219,136 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\c_g18030.dll
+ 2003-02-21 12:24:10 94,208 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\CasPol.exe
+ 2003-02-21 12:24:32 49,152 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\ConfigWizards.exe
+ 2007-04-14 01:57:52 81,920 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll
+ 2004-07-15 16:23:28 49,152 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\csc.exe
+ 2004-07-15 16:23:44 626,688 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\cscomp.dll
+ 2003-02-21 12:24:34 12,288 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\cscompmgd.dll
+ 2003-02-21 12:24:36 33,792 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\CustomMarshalers.dll
+ 2003-02-21 09:12:24 28,672 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\cvtres.exe
+ 2003-02-21 15:21:40 524,288 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\diasymreader.dll
+ 2003-02-21 00:16:32 798,720 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\EventLogMessages.dll
+ 2004-07-15 05:24:30 282,624 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\fusion.dll
+ 2003-10-08 19:30:14 81,920 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\gacutil.exe
+ 2003-02-21 12:24:38 7,680 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\IEExec.exe
+ 2004-07-15 19:31:00 8,192 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\IEExecRemote.dll
+ 2004-07-15 19:31:04 32,768 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\IEHost.dll
+ 2003-02-21 12:24:40 4,608 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\IIEHost.dll
+ 2004-07-15 05:35:30 196,608 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\ilasm.exe
+ 2003-02-21 12:24:42 15,872 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\InstallUtil.exe
+ 2003-02-21 00:22:24 40,960 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\InstallUtilLib.dll
+ 2003-02-21 12:24:44 26,112 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\ISymWrapper.dll
+ 2003-02-21 12:24:52 40,960 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\jsc.exe
+ 2004-07-15 19:28:58 720,896 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.dll
+ 2004-07-15 19:28:56 299,008 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.dll
+ 2003-02-21 12:24:54 28,672 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.Vsa.dll
+ 2003-02-21 12:25:02 6,144 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualC.Dll
+ 2003-02-21 12:24:58 32,768 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.Vsa.dll
+ 2003-02-21 12:25:06 11,264 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2003-02-21 12:25:02 6,656 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\Microsoft_VsaVb.dll
+ 2004-07-15 19:28:50 49,152 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\MigPol.exe
+ 2004-07-15 19:28:50 49,152 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\MigPolWin.exe
+ 2003-02-21 12:25:06 1,564,672 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorcfg.dll
+ 2004-07-15 05:32:44 86,016 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\mscordbc.dll
+ 2004-07-15 05:32:46 233,472 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\mscordbi.dll
+ 2007-04-14 01:57:58 86,016 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorie.dll
+ 2007-04-14 01:56:30 315,392 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll
+ 2007-04-14 01:58:00 102,400 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorld.dll
+ 2007-04-14 01:50:46 2,142,208 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll
+ 2003-02-20 23:43:52 131,072 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\mscormmc.dll
+ 2003-02-21 00:06:34 65,536 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorpe.dll
+ 2004-07-15 05:33:22 143,360 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorrc.dll
+ 2004-07-15 05:33:24 81,920 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsec.dll
+ 2007-04-14 01:58:02 77,824 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll
+ 2007-04-14 01:57:00 2,523,136 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll
+ 2003-02-21 00:09:24 9,216 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\mscortim.dll
+ 2007-04-14 01:57:28 2,514,944 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
+ 2003-02-21 09:42:22 348,160 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\msvcr71.dll
+ 2003-02-21 00:18:34 20,480 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\mtxoci8.dll
+ 2003-02-20 23:43:36 22,528 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\MUI\0409\mscorsecr.dll
+ 2007-01-15 21:11:26 73,728 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe
+ 2003-02-21 00:09:46 73,728 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\ngen.exe
+ 2004-07-15 05:34:50 94,208 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\PerfCounter.dll
+ 2003-02-21 12:25:24 28,672 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\RegAsm.exe
+ 2004-07-15 19:28:48 32,768 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\RegCode.dll
+ 2003-02-21 12:25:30 12,288 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\RegSvcs.exe
+ 2004-07-15 06:49:16 258,048 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\SHADOW3304\_aspnet_isapi.dll
+ 2004-07-15 05:32:22 81,920 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\SHADOW3304\_CORPerfMonExt.dll
+ 2004-07-15 05:24:30 282,624 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\SHADOW3304\_fusion.dll
+ 2004-07-15 05:25:06 315,392 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\SHADOW3304\_mscorjit.dll
+ 2004-07-15 19:29:02 2,138,112 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\SHADOW3304\_mscorlib.dll
+ 2003-02-21 00:09:18 77,824 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\SHADOW3304\_mscorsn.dll
+ 2004-07-15 05:26:52 2,510,848 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\SHADOW3304\_mscorsvr.dll
+ 2004-07-15 05:28:34 2,502,656 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\SHADOW3304\_mscorwks.dll
+ 2003-02-21 09:42:22 348,160 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\SHADOW3304\_msvcr71.dll
+ 2004-07-15 05:34:50 94,208 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\SHADOW3304\_PerfCounter.dll
+ 2003-02-21 00:09:34 253,952 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\shfusion.dll
+ 2003-02-21 00:09:34 122,880 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\shfusres.dll
+ 2004-07-15 05:35:04 319,488 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\SOS.dll
+ 2003-02-21 12:26:38 77,824 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Configuration.Install.dll
+ 2004-07-15 19:32:00 1,294,336 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Data.dll
+ 2004-07-15 19:31:14 303,104 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Data.OracleClient.dll
+ 2004-07-15 19:29:02 1,703,936 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Design.dll
+ 2004-07-15 19:28:54 90,112 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\System.DirectoryServices.dll
+ 2007-04-14 02:35:38 1,232,896 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\System.dll
+ 2003-02-21 12:26:48 65,536 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Drawing.Design.dll
+ 2004-07-15 19:28:58 466,944 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Drawing.dll
+ 2004-07-15 19:28:56 241,664 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.dll
+ 2004-07-15 05:35:12 66,560 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.Thunk.dll
+ 2004-07-15 19:31:58 372,736 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Management.dll
+ 2004-07-15 19:31:12 241,664 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Messaging.dll
+ 2004-07-15 19:28:58 323,584 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Remoting.dll
+ 2004-07-15 19:31:54 131,072 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Serialization.Formatters.Soap.dll
+ 2004-07-15 19:28:52 77,824 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Security.dll
+ 2004-07-15 19:28:54 126,976 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\System.ServiceProcess.dll
+ 2007-04-14 02:35:46 1,265,664 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Web.dll
+ 2004-07-15 19:28:58 819,200 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Web.Mobile.dll
+ 2004-07-15 19:28:52 57,344 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Web.RegularExpressions.dll
+ 2004-07-15 19:31:16 573,440 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Web.Services.dll
+ 2004-07-15 19:32:02 2,052,096 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Windows.Forms.dll
+ 2004-07-15 19:29:00 1,339,392 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\System.XML.dll
+ 2004-06-22 18:51:38 53,248 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe
+ 2004-07-15 16:23:20 737,280 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\vbc.exe
+ 2004-07-15 13:15:14 1,032,192 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\VsaVb7rt.dll
+ 2004-07-15 07:11:56 31,744 —-a-w c:\windows\Microsoft.NET\Framework\v1.1.4322\WMINet_Utils.dll
+ 2008-07-25 16:16:42 28,672 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\alinkui.dll
+ 2008-07-25 16:16:48 145,408 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\cscompui.dll
+ 2008-07-25 16:16:50 13,824 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\CvtResUI.dll
+ 2008-07-25 16:17:10 193,016 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\vbc7ui.dll
+ 2008-07-25 16:16:36 218,112 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\Vsavb7rtUI.dll
+ 2008-07-25 16:17:00 10,752 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Accessibility.dll
+ 2008-07-25 16:17:02 147,968 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\AdoNetDiag.dll
+ 2008-07-25 16:16:44 98,808 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\alink.dll
+ 2008-07-25 16:17:02 58,880 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
+ 2008-07-25 16:16:40 36,864 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
+ 2008-07-25 16:16:40 22,024 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll
+ 2008-07-25 16:16:40 17,416 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll
+ 2008-07-25 16:16:40 33,800 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll
+ 2008-07-25 16:16:38 84,480 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll
+ 2008-07-25 16:16:40 24,576 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
+ 2008-07-25 16:16:40 33,288 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
+ 2008-07-25 16:16:40 106,496 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
+ 2008-07-25 16:16:40 34,312 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
+ 2008-07-25 16:16:40 33,792 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
+ 2008-07-25 16:16:40 507,904 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll
+ 2008-07-25 16:17:00 106,496 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
+ 2008-07-25 16:17:00 89,608 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll
+ 2008-07-25 16:16:50 80,376 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
+ 2008-07-25 16:16:50 1,163,768 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\cscomp.dll
+ 2008-07-25 16:16:50 13,312 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\cscompmgd.dll
+ 2008-07-25 16:17:02 27,136 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
+ 2008-07-25 16:17:00 69,120 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\CustomMarshalers.dll
+ 2008-07-25 16:16:50 35,320 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
+ 2008-07-25 16:16:46 62,968 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\dfdll.dll
+ 2008-07-25 16:16:46 5,120 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
+ 2008-07-25 16:17:16 575,496 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
+ 2008-07-25 16:17:00 798,224 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll
+ 2008-07-25 16:16:58 18,936 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\fusion.dll
+ 2008-07-25 16:17:00 9,728 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
+ 2008-07-25 16:17:02 8,192 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\IEExecRemote.dll
+ 2008-07-25 16:17:00 77,824 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\IEHost.dll
+ 2008-07-25 16:17:00 6,656 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\IIEHost.dll
+ 2008-07-25 16:17:00 230,904 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
+ 2008-07-25 16:17:00 28,672 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
+ 2008-07-25 16:17:00 65,032 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\InstallUtilLib.dll
+ 2008-07-25 16:17:00 72,192 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\ISymWrapper.dll
+ 2008-07-25 16:16:54 40,960 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe
+ 2008-07-25 16:16:56 348,160 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll
+ 2008-07-25 16:16:56 36,864 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Framework.dll
+ 2008-07-25 16:16:56 655,360 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll
+ 2008-07-25 16:16:56 77,824 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Utilities.dll
+ 2008-07-25 16:16:54 749,568 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll
+ 2008-07-25 16:17:14 110,592 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2008-07-25 16:17:14 372,736 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.dll
+ 2008-07-25 16:17:12 659,456 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.dll
+ 2008-07-25 16:16:38 28,672 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Vsa.dll
+ 2008-07-25 16:17:16 5,632 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualC.Dll
+ 2008-07-25 16:16:38 32,768 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll
+ 2008-07-25 16:16:38 12,800 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2008-07-25 16:16:38 7,168 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft_VsaVb.dll
+ 2008-07-25 16:16:40 97,792 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll
+ 2008-07-25 16:16:56 69,632 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
+ 2008-07-25 16:17:02 998,408 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
+ 2008-07-25 16:17:00 83,456 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordbc.dll
+ 2008-07-25 16:17:00 308,224 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordbi.dll
+ 2008-07-25 16:17:00 46,592 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorie.dll
+ 2008-07-25 16:17:00 367,104 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
+ 2008-07-25 16:17:00 94,208 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorld.dll
+ 2008-07-25 16:17:00 4,546,560 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
+ 2008-07-25 16:17:00 114,176 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll
+ 2008-07-25 16:17:04 345,600 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
+ 2008-07-25 16:17:00 77,312 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll
+ 2008-07-25 16:16:58 18,944 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsn.dll
+ 2008-07-25 16:17:02 230,912 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll
+ 2008-07-25 16:17:02 69,632 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
+ 2008-07-25 16:17:02 19,456 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscortim.dll
+ 2008-07-25 16:16:58 5,815,296 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
+ 2008-07-25 16:17:04 31,744 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\MUI\0409\mscorsecr.dll
+ 2008-07-25 16:17:02 100,856 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe
+ 2008-07-25 16:17:02 24,584 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\normalization.dll
+ 2008-07-25 16:17:02 88,584 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\PerfCounter.dll
+ 2008-07-25 16:16:58 143,360 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\peverify.dll
+ 2008-07-25 16:17:00 53,248 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
+ 2008-07-25 16:17:00 32,768 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
+ 2008-07-25 16:17:06 61,952 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe
+ 2008-07-25 16:17:02 16,896 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\sbscmp20_mscorlib.dll
+ 2008-07-25 16:17:00 118,784 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\shfusion.dll
+ 2008-07-25 16:17:04 95,232 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll
+ 2008-07-25 16:17:02 392,184 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\SOS.dll
+ 2008-07-25 16:17:02 110,592 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll
+ 2008-07-25 16:17:02 425,984 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll
+ 2008-07-25 16:17:00 81,920 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll
+ 2008-07-25 16:17:00 2,933,248 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.dll
+ 2008-07-25 16:17:02 486,400 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll
+ 2008-07-25 16:17:02 745,472 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll
+ 2008-07-25 16:16:46 970,752 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll
+ 2008-07-25 16:17:00 5,062,656 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Design.dll
+ 2008-07-25 16:17:00 401,408 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.dll
+ 2008-07-25 16:17:02 188,416 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll
+ 2008-07-25 16:17:00 3,149,824 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.dll
+ 2008-07-25 16:17:00 81,920 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.Design.dll
+ 2008-07-25 16:17:00 626,688 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll
+ 2008-07-25 16:17:02 258,048 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll
+ 2008-07-25 16:17:02 57,392 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll
+ 2008-07-25 16:17:02 113,664 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Wrapper.dll
+ 2008-07-25 16:17:00 372,736 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Management.dll
+ 2008-07-25 16:17:00 258,048 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Messaging.dll
+ 2008-07-25 16:17:00 303,104 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll
+ 2008-07-25 16:17:00 131,072 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Serialization.Formatters.Soap.dll
+ 2008-07-25 16:17:00 258,048 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Security.dll
+ 2008-07-25 16:17:00 114,688 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.ServiceProcess.dll
+ 2008-07-25 16:17:02 261,632 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll
+ 2008-07-25 16:17:00 5,238,784 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
+ 2008-07-25 16:17:02 835,584 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.Mobile.dll
+ 2008-07-25 16:17:02 77,824 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.RegularExpressions.dll
+ 2008-07-25 16:17:00 839,680 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.Services.dll
+ 2008-07-25 16:17:00 5,025,792 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll
+ 2008-07-25 16:17:00 2,048,000 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.XML.dll
+ 2008-07-25 16:17:02 81,400 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\TLBREF.DLL
+ 2008-07-25 16:17:10 1,172,472 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
+ 2008-07-25 16:16:38 1,344,000 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll
+ 2008-07-25 16:16:40 438,272 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\webengine.dll
+ 2008-07-25 16:17:02 37,896 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\WMINet_Utils.dll
+ 2008-07-30 00:16:38 168,968 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe
+ 2008-07-30 00:24:50 881,664 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
+ 2008-07-30 00:16:38 397,312 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\Microsoft.Transactions.Bridge.dll
+ 2008-07-30 00:16:38 163,840 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\Microsoft.Transactions.Bridge.Dtc.dll
+ 2008-07-30 00:16:38 11,280 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelEvents.dll
+ 2008-07-30 00:16:38 156,688 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe
+ 2008-07-30 00:16:38 20,504 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceMonikerSupport.dll
+ 2008-07-30 00:16:38 110,592 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMdiagnostics.dll
+ 2008-07-30 00:16:38 132,096 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
+ 2008-07-30 00:16:38 966,656 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.Runtime.Serialization.dll
+ 2008-07-30 00:16:38 5,931,008 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.dll
+ 2008-07-30 00:16:38 73,728 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.Install.dll
+ 2008-07-30 00:16:38 32,768 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.WasHosting.dll
+ 2008-07-30 00:16:38 152,576 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe
+ 2008-07-30 00:32:52 17,448 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\PerformanceCounterInstaller.exe
+ 2008-07-30 02:10:04 806,928 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\NaturalLanguage6.dll
+ 2008-07-30 02:10:04 4,883,464 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\NlsData0009.dll
+ 2008-07-30 02:10:04 2,637,840 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\NlsLexicons0009.dll
+ 2008-07-30 02:10:04 71,160 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PenIMC.dll
+ 2008-07-30 00:59:58 32,768 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationCFFRasterizer.dll
+ 2008-07-30 02:10:04 46,104 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
+ 2008-07-30 00:59:58 132,120 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationHostDLL.dll
+ 2008-07-30 01:35:46 864,256 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationUI.dll
+ 2008-07-30 00:59:58 1,738,760 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\wpfgfx_v0300.dll
+ 2008-07-30 04:40:48 168,448 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\1033\cscompui.dll
+ 2008-07-30 04:40:48 233,976 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\1033\vbc7ui.dll
+ 2008-07-30 04:40:48 41,992 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe
+ 2008-07-30 04:40:48 41,992 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe
+ 2008-07-30 04:40:48 41,984 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe
+ 2008-07-30 04:40:48 1,548,280 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\csc.exe
+ 2008-07-30 04:40:48 78,856 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe
+ 2008-07-30 04:40:48 95,224 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\EdmGen.exe
+ 2008-07-30 04:15:24 225,490 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\baseline.dat
+ 2008-07-29 23:47:34 97,280 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\DeleteTemp.exe
+ 2008-07-29 23:47:34 276,984 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\dlmgr.dll
+ 2008-07-29 23:47:34 1,064,448 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\gencomp.dll
+ 2008-07-29 23:47:34 177,152 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\HtmlLite.dll
+ 2008-07-29 23:47:34 269,304 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
+ 2008-07-29 23:47:34 113,152 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1025.dll
+ 2008-07-29 23:47:34 84,992 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1028.dll
+ 2008-07-29 23:47:34 125,440 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1029.dll
+ 2008-07-29 23:47:34 126,464 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1030.dll
+ 2008-07-29 23:47:34 130,048 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1031.dll
+ 2008-07-29 23:47:34 137,728 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1032.dll
+ 2008-07-29 23:47:34 122,368 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1035.dll
+ 2008-07-29 23:47:34 133,120 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1036.dll
+ 2008-07-29 23:47:34 111,104 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1037.dll
+ 2008-07-29 23:47:34 132,096 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1038.dll
+ 2008-07-29 23:47:34 128,512 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1040.dll
+ 2008-07-29 23:47:34 97,792 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1041.dll
+ 2008-07-29 23:47:34 94,720 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1042.dll
+ 2008-07-29 23:47:34 129,024 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1043.dll
+ 2008-07-29 23:47:34 121,856 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1044.dll
+ 2008-07-29 23:47:34 128,512 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1045.dll
+ 2008-07-29 23:47:34 122,880 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1046.dll
+ 2008-07-29 23:47:34 123,904 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1049.dll
+ 2008-07-29 23:47:34 121,344 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1053.dll
+ 2008-07-29 23:47:34 121,344 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1055.dll
+ 2008-07-29 23:47:34 84,480 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.2052.dll
+ 2008-07-29 23:47:34 131,072 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.2070.dll
+ 2008-07-29 23:47:34 131,584 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.3082.dll
+ 2008-07-29 23:47:34 110,080 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.dll
+ 2008-07-29 23:47:34 1,364,992 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\SITSetup.dll
+ 2008-07-29 23:47:34 1,054,208 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vs_setup.dll
+ 2008-07-29 23:47:34 632,320 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vs70uimgr.dll
+ 2008-07-29 23:47:34 413,184 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vsbasereqs.dll
+ 2008-07-29 23:47:34 689,152 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vsscenario.dll
+ 2008-07-29 23:47:34 102,904 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1025.dll
+ 2008-07-29 23:47:34 89,592 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1028.dll
+ 2008-07-29 23:47:34 108,536 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1029.dll
+ 2008-07-29 23:47:34 108,536 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1030.dll
+ 2008-07-29 23:47:34 111,608 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1031.dll
+ 2008-07-29 23:47:34 113,656 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1032.dll
+ 2008-07-29 23:47:34 106,488 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1035.dll
+ 2008-07-29 23:47:34 112,120 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1036.dll
+ 2008-07-29 23:47:34 101,368 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1037.dll
+ 2008-07-29 23:47:34 111,096 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1038.dll
+ 2008-07-29 23:47:34 110,072 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1040.dll
+ 2008-07-29 23:47:34 95,224 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1041.dll
+ 2008-07-29 23:47:34 92,664 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1042.dll
+ 2008-07-29 23:47:34 108,536 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1043.dll
+ 2008-07-29 23:47:34 106,488 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1044.dll
+ 2008-07-29 23:47:34 109,048 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1045.dll
+ 2008-07-29 23:47:34 107,512 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1046.dll
+ 2008-07-29 23:47:34 107,000 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1049.dll
+ 2008-07-29 23:47:34 105,976 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1053.dll
+ 2008-07-29 23:47:34 106,488 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1055.dll
+ 2008-07-29 23:47:34 89,080 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.2052.dll
+ 2008-07-29 23:47:34 110,072 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.2070.dll
+ 2008-07-29 23:47:34 111,096 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.3082.dll
+ 2008-07-29 23:47:34 107,512 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.dll
+ 2008-07-29 23:47:34 984,056 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapUI.dll
+ 2008-07-30 04:40:48 802,816 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft.Build.Tasks.v3.5.dll
+ 2008-07-30 04:40:48 40,960 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft.Data.Entity.Build.Tasks.dll
+ 2008-07-30 04:40:48 41,984 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft.VisualC.STLCLR.dll
+ 2008-07-30 04:40:48 91,136 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\MSBuild.exe
+ 2008-07-30 04:40:48 5,632 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Sentinel.v3.5Client.dll
+ 2008-07-30 04:40:48 1,720,824 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\vbc.exe
+ 2008-07-30 04:40:48 196,104 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe
+ 2008-07-30 04:40:48 70,648 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
+ 2001-07-14 22:32:24 69,632 —-a-w c:\windows\setupupd\temp\wsdueng.dll
- 2008-08-17 01:28:39 124,928 —-a-w c:\windows\system32\advpack.dll
+ 2008-10-16 20:38:34 124,928 —-a-w c:\windows\system32\advpack.dll
+ 2008-07-25 16:16:46 96,760 —-a-w c:\windows\system32\dfshim.dll
- 2005-04-13 18:54:22 331,184 ——w c:\windows\system32\difxapi.dll
+ 2006-11-02 04:21:54 319,456 —-a-w c:\windows\system32\difxapi.dll
- 2007-08-13 23:39:00 123,904 -c—-w c:\windows\system32\dllcache\advpack.dll
+ 2008-10-16 20:38:34 124,928 -c—-w c:\windows\system32\dllcache\advpack.dll
- 2008-06-13 09:52:16 272,128 -c–a-w c:\windows\system32\dllcache\bthport.sys
+ 2008-06-13 11:05:51 272,128 -c–a-w c:\windows\system32\dllcache\bthport.sys
- 2008-07-19 02:10:48 94,920 -c–a-w c:\windows\system32\dllcache\cdm.dll
+ 2008-10-16 19:09:44 92,696 -c–a-w c:\windows\system32\dllcache\cdm.dll
- 2007-08-13 23:35:46 346,624 -c—-w c:\windows\system32\dllcache\dxtmsft.dll
+ 2008-10-16 20:38:34 347,136 -c—-w c:\windows\system32\dllcache\dxtmsft.dll
- 2007-08-13 23:35:38 214,528 -c—-w c:\windows\system32\dllcache\dxtrans.dll
+ 2008-10-16 20:38:34 214,528 -c—-w c:\windows\system32\dllcache\dxtrans.dll
- 2007-08-13 23:54:10 131,584 -c—-w c:\windows\system32\dllcache\extmgr.dll
+ 2008-10-16 20:38:35 133,120 -c—-w c:\windows\system32\dllcache\extmgr.dll
- 2007-08-13 23:39:06 54,784 -c—-w c:\windows\system32\dllcache\ie4uinit.exe
+ 2008-10-16 13:11:09 70,656 -c—-w c:\windows\system32\dllcache\ie4uinit.exe
- 2007-08-13 23:39:26 152,064 -c—-w c:\windows\system32\dllcache\ieakeng.dll
+ 2008-10-16 20:38:35 153,088 -c—-w c:\windows\system32\dllcache\ieakeng.dll
- 2007-08-13 23:39:54 229,376 -c—-w c:\windows\system32\dllcache\ieaksie.dll
+ 2008-10-16 20:38:35 230,400 -c—-w c:\windows\system32\dllcache\ieaksie.dll
- 2007-08-13 22:56:54 161,792 -c—-w c:\windows\system32\dllcache\ieakui.dll
+ 2008-10-15 07:04:53 161,792 -c—-w c:\windows\system32\dllcache\ieakui.dll
- 2007-08-13 23:39:50 382,976 -c—-w c:\windows\system32\dllcache\iedkcs32.dll
+ 2008-10-16 20:38:35 384,512 -c—-w c:\windows\system32\dllcache\iedkcs32.dll
- 2007-08-13 23:39:10 43,008 -c—-w c:\windows\system32\dllcache\iernonce.dll
+ 2008-10-16 20:38:37 44,544 -c—-w c:\windows\system32\dllcache\iernonce.dll
- 2007-08-13 23:43:56 622,080 -c—-w c:\windows\system32\dllcache\iexplore.exe
+ 2008-10-15 07:06:26 633,632 -c—-w c:\windows\system32\dllcache\iexplore.exe
- 2007-08-13 23:54:10 27,136 -c—-w c:\windows\system32\dllcache\jsproxy.dll
+ 2008-10-16 20:38:37 27,648 -c—-w c:\windows\system32\dllcache\jsproxy.dll
- 2008-08-17 01:43:57 100,864 -c–a-w c:\windows\system32\dllcache\logagent.exe
+ 2008-06-18 06:09:22 100,864 -c–a-w c:\windows\system32\dllcache\logagent.exe
- 2008-05-01 15:04:00 331,776 -c–a-w c:\windows\system32\dllcache\msadce.dll
+ 2008-05-01 14:33:02 331,776 -c–a-w c:\windows\system32\dllcache\msadce.dll
- 2007-08-13 23:54:12 3,578,368 -c—-w c:\windows\system32\dllcache\mshtml.dll
+ 2008-12-13 06:40:02 3,593,216 -c—-w c:\windows\system32\dllcache\mshtml.dll
- 2007-08-13 23:54:10 475,648 -c—-w c:\windows\system32\dllcache\mshtmled.dll
+ 2008-10-16 20:38:38 477,696 -c—-w c:\windows\system32\dllcache\mshtmled.dll
- 2007-08-13 23:44:26 192,000 -c—-w c:\windows\system32\dllcache\msrating.dll
+ 2008-10-16 20:38:38 193,024 -c—-w c:\windows\system32\dllcache\msrating.dll
- 2007-08-13 23:54:10 670,720 -c—-w c:\windows\system32\dllcache\mstime.dll
+ 2008-10-16 20:38:39 671,232 -c—-w c:\windows\system32\dllcache\mstime.dll
- 2008-04-14 09:42:02 1,306,624 -c–a-w c:\windows\system32\dllcache\msxml6.dll
+ 2008-09-10 01:14:56 1,307,648 -c–a-w c:\windows\system32\dllcache\msxml6.dll
- 2008-04-23 10:03:16 2,142,720 -c–a-w c:\windows\system32\dllcache\ntkrnlmp.exe
+ 2008-08-14 10:09:26 2,145,280 -c–a-w c:\windows\system32\dllcache\ntkrnlmp.exe
- 2008-04-23 09:30:01 2,062,976 -c–a-w c:\windows\system32\dllcache\ntkrnlpa.exe
+ 2008-08-14 09:33:16 2,066,048 -c–a-w c:\windows\system32\dllcache\ntkrnlpa.exe
- 2008-04-23 09:29:33 2,020,864 -c–a-w c:\windows\system32\dllcache\ntkrpamp.exe
+ 2008-08-14 09:33:16 2,023,936 -c–a-w c:\windows\system32\dllcache\ntkrpamp.exe
- 2008-04-23 10:05:32 2,185,984 -c–a-w c:\windows\system32\dllcache\ntoskrnl.exe
+ 2008-08-14 10:11:02 2,189,184 -c–a-w c:\windows\system32\dllcache\ntoskrnl.exe
- 2007-12-05 06:41:00 7,435,392 -c–a-w c:\windows\system32\dllcache\nv4_mini.sys
+ 2008-09-18 04:55:00 6,132,576 -c–a-w c:\windows\system32\dllcache\nv4_mini.sys
- 2007-08-13 23:44:06 101,376 -c—-w c:\windows\system32\dllcache\occache.dll
+ 2008-10-16 20:38:39 102,912 -c—-w c:\windows\system32\dllcache\occache.dll
- 2007-08-13 23:36:12 44,544 -c—-w c:\windows\system32\dllcache\pngfilt.dll
+ 2008-10-16 20:38:39 44,544 -c—-w c:\windows\system32\dllcache\pngfilt.dll
- 2008-05-07 04:55:40 1,288,192 -c–a-w c:\windows\system32\dllcache\quartz.dll
+ 2008-05-07 05:12:40 1,288,192 -c–a-w c:\windows\system32\dllcache\quartz.dll
- 2008-05-08 12:14:51 203,008 -c–a-w c:\windows\system32\dllcache\rmcast.sys
+ 2008-05-08 14:02:52 203,136 -c–a-w c:\windows\system32\dllcache\rmcast.sys
- 2007-08-13 23:44:30 105,984 -c—-w c:\windows\system32\dllcache\url.dll
+ 2008-10-16 20:38:39 105,984 -c—-w c:\windows\system32\dllcache\url.dll
- 2007-08-13 23:54:10 1,162,240 -c—-w c:\windows\system32\dllcache\urlmon.dll
+ 2008-10-16 20:38:39 1,160,192 -c—-w c:\windows\system32\dllcache\urlmon.dll
- 2007-08-13 23:54:10 765,952 -c—-w c:\windows\system32\dllcache\VGX.dll
+ 2008-05-27 17:23:58 765,952 -c—-w c:\windows\system32\dllcache\vgx.dll
- 2007-08-13 23:54:10 231,424 -c—-w c:\windows\system32\dllcache\webcheck.dll
+ 2008-10-16 20:38:39 233,472 -c—-w c:\windows\system32\dllcache\webcheck.dll
+ 2008-09-06 04:30:42 241,704 -c—-w c:\windows\system32\dllcache\wgaLogon.dll
+ 2008-09-06 04:29:58 917,032 -c—-w c:\windows\system32\dllcache\WgaTray.exe
- 2008-05-30 11:16:47 1,846,272 -c–a-w c:\windows\system32\dllcache\win32k.sys
+ 2008-09-15 12:12:56 1,846,400 -c–a-w c:\windows\system32\dllcache\win32k.sys
- 2007-08-13 23:54:10 818,688 -c—-w c:\windows\system32\dllcache\wininet.dll
+ 2008-10-16 20:38:40 826,368 -c—-w c:\windows\system32\dllcache\wininet.dll
- 2006-10-19 02:47:18 222,208 -c–a-w c:\windows\system32\dllcache\WMASF.dll
+ 2007-10-27 22:40:30 222,720 -c–a-w c:\windows\system32\dllcache\wmasf.dll
- 2008-04-24 14:06:32 937,984 -c–a-w c:\windows\system32\dllcache\wmnetmgr.dll
+ 2008-06-18 10:03:08 938,496 -c–a-w c:\windows\system32\dllcache\WMNetmgr.dll
+ 2008-06-18 10:03:14 2,458,112 -c—-w c:\windows\system32\dllcache\WMVCore.dll
- 2008-07-19 02:09:44 563,912 -c–a-w c:\windows\system32\dllcache\wuapi.dll
+ 2008-10-16 19:12:20 561,688 -c–a-w c:\windows\system32\dllcache\wuapi.dll
- 2008-07-19 02:10:42 53,448 -c–a-w c:\windows\system32\dllcache\wuauclt.exe
+ 2008-10-16 19:09:44 51,224 -c–a-w c:\windows\system32\dllcache\wuauclt.exe
- 2008-07-19 02:09:42 1,811,656 -c–a-w c:\windows\system32\dllcache\wuaueng.dll
+ 2008-10-16 19:13:40 1,809,944 -c–a-w c:\windows\system32\dllcache\wuaueng.dll
- 2008-07-19 02:09:46 325,832 -c–a-w c:\windows\system32\dllcache\wucltui.dll
+ 2008-10-16 19:12:22 323,608 -c–a-w c:\windows\system32\dllcache\wucltui.dll
- 2008-07-19 02:10:20 36,552 -c–a-w c:\windows\system32\dllcache\wups.dll
+ 2008-10-16 19:08:58 34,328 -c–a-w c:\windows\system32\dllcache\wups.dll
- 2008-07-19 02:09:44 205,000 -c–a-w c:\windows\system32\dllcache\wuweb.dll
+ 2008-10-16 19:12:24 202,776 -c–a-w c:\windows\system32\dllcache\wuweb.dll
- 2008-06-20 10:44:08 138,368 —-a-w c:\windows\system32\drivers\afd.sys
+ 2008-08-14 10:04:36 138,496 —-a-w c:\windows\system32\drivers\afd.sys
- 2008-06-13 09:52:16 272,128 —-a-w c:\windows\system32\drivers\bthport.sys
+ 2008-06-13 11:05:51 272,128 —-a-w c:\windows\system32\drivers\bthport.sys
- 2008-07-30 09:44:28 455,936 —-a-w c:\windows\system32\drivers\mrxsmb.sys
+ 2008-10-24 11:21:09 455,296 —-a-w c:\windows\system32\drivers\mrxsmb.sys
- 2007-12-05 06:41:00 7,435,392 —-a-w c:\windows\system32\drivers\nv4_mini.sys
+ 2008-09-18 04:55:00 6,132,576 —-a-w c:\windows\system32\drivers\nv4_mini.sys
+ 2008-04-07 23:16:45 43,872 —-a-w c:\windows\system32\drivers\pxhelp20.sys
- 2008-05-08 12:14:51 203,008 —-a-w c:\windows\system32\drivers\RMCast.sys
+ 2008-05-08 14:02:52 203,136 —-a-w c:\windows\system32\drivers\rmcast.sys
- 2006-08-14 12:00:42 332,928 —-a-w c:\windows\system32\drivers\srv.sys
+ 2008-09-08 10:41:42 333,824 —-a-w c:\windows\system32\drivers\srv.sys
- 2007-08-13 23:35:46 346,624 —-a-w c:\windows\system32\dxtmsft.dll
+ 2008-10-16 20:38:34 347,136 —-a-w c:\windows\system32\dxtmsft.dll
- 2007-08-13 23:35:38 214,528 —-a-w c:\windows\system32\dxtrans.dll
+ 2008-10-16 20:38:34 214,528 —-a-w c:\windows\system32\dxtrans.dll
+ 2008-07-30 02:10:04 73,720 —-a-w c:\windows\system32\dxva2.dll
- 2008-07-07 20:06:43 253,952 —-a-w c:\windows\system32\es.dll
+ 2008-07-07 20:26:58 253,952 —-a-w c:\windows\system32\es.dll
+ 2008-07-30 02:10:04 493,048 —-a-w c:\windows\system32\evr.dll
- 2007-08-13 23:54:10 131,584 —-a-w c:\windows\system32\extmgr.dll
+ 2008-10-16 20:38:35 133,120 —-a-w c:\windows\system32\extmgr.dll
- 2008-12-31 18:51:42 107,808 —-a-w c:\windows\system32\FNTCACHE.DAT
+ 2009-01-01 09:48:36 110,992 —-a-w c:\windows\system32\FNTCACHE.DAT
+ 2008-07-30 00:24:50 622,080 —-a-w c:\windows\system32\icardagt.exe
- 2008-08-17 01:39:04 63,488 —-a-w c:\windows\system32\icardie.dll
+ 2008-10-16 20:38:35 63,488 —-a-w c:\windows\system32\icardie.dll
+ 2008-07-30 00:24:50 11,264 —-a-w c:\windows\system32\icardres.dll
- 2008-08-17 01:32:52 70,656 —-a-w c:\windows\system32\ie4uinit.exe
+ 2008-10-16 13:11:09 70,656 —-a-w c:\windows\system32\ie4uinit.exe
- 2008-08-17 01:32:52 153,088 —-a-w c:\windows\system32\ieakeng.dll
+ 2008-10-16 20:38:35 153,088 —-a-w c:\windows\system32\ieakeng.dll
- 2008-08-17 01:32:53 230,400 —-a-w c:\windows\system32\ieaksie.dll
+ 2008-10-16 20:38:35 230,400 —-a-w c:\windows\system32\ieaksie.dll
- 2008-08-17 01:32:53 161,792 —-a-w c:\windows\system32\ieakui.dll
+ 2008-10-15 07:04:53 161,792 —-a-w c:\windows\system32\ieakui.dll
- 2008-08-17 01:39:10 383,488 —-a-w c:\windows\system32\ieapfltr.dll
+ 2008-10-16 20:38:35 383,488 —-a-w c:\windows\system32\ieapfltr.dll
- 2008-08-17 01:32:54 388,608 —-a-w c:\windows\system32\iedkcs32.dll
+ 2008-10-16 20:38:35 384,512 —-a-w c:\windows\system32\iedkcs32.dll
- 2008-08-17 01:39:24 6,068,224 —-a-w c:\windows\system32\ieframe.dll
+ 2008-10-16 20:38:37 6,066,176 —-a-w c:\windows\system32\ieframe.dll
- 2008-08-17 01:32:56 44,544 —-a-w c:\windows\system32\iernonce.dll
+ 2008-10-16 20:38:37 44,544 —-a-w c:\windows\system32\iernonce.dll
- 2008-08-17 01:39:27 267,776 —-a-w c:\windows\system32\iertutil.dll
+ 2008-10-16 20:38:37 267,776 —-a-w c:\windows\system32\iertutil.dll
- 2007-08-13 23:39:10 13,312 —-a-w c:\windows\system32\ieudinit.exe
+ 2008-10-16 13:11:09 13,824 —-a-w c:\windows\system32\ieudinit.exe
- 2008-04-11 18:39:39 683,520 —-a-w c:\windows\system32\inetcomm.dll
+ 2008-04-11 19:04:26 691,712 —-a-w c:\windows\system32\inetcomm.dll
+ 2008-07-30 00:24:50 97,800 —-a-w c:\windows\system32\infocardapi.dll
- 2007-08-13 23:54:10 27,136 —-a-w c:\windows\system32\jsproxy.dll
+ 2008-10-16 20:38:37 27,648 —-a-w c:\windows\system32\jsproxy.dll
- 2007-12-05 06:41:00 425,984 —-a-w c:\windows\system32\keystone.exe
+ 2008-09-18 04:55:00 436,768 —-a-w c:\windows\system32\keystone.exe
- 2008-08-17 01:39:35 1,480,232 —-a-w c:\windows\system32\LegitCheckControl.dll
+ 2008-09-06 04:30:06 1,480,232 —-a-w c:\windows\system32\LegitCheckControl.dll
- 2008-08-17 01:43:57 100,864 —-a-w c:\windows\system32\logagent.exe
+ 2008-06-18 06:09:22 100,864 —-a-w c:\windows\system32\logagent.exe
+ 2008-10-05 03:16:26 235,936 —-a-r c:\windows\system32\Macromed\Flash\FlashUtil10a.exe
+ 2008-12-31 20:41:10 89,102 —-a-w c:\windows\system32\Macromed\Flash\uninstall_activeX.exe
- 2008-12-31 03:19:12 84,661 —-a-w c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
+ 2009-01-01 10:35:29 84,661 —-a-w c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
+ 2008-12-09 20:24:38 17,593,280 —-a-w c:\windows\system32\MRT.exe
- 2008-06-24 16:28:00 74,240 —-a-w c:\windows\system32\mscms.dll
+ 2008-06-24 16:43:16 74,240 —-a-w c:\windows\system32\mscms.dll
+ 2008-07-25 16:16:58 282,112 —-a-w c:\windows\system32\mscoree.dll
+ 2008-07-25 16:16:58 158,720 —-a-w c:\windows\system32\mscorier.dll
+ 2008-07-25 16:16:58 83,968 —-a-w c:\windows\system32\mscories.dll
- 2008-08-17 01:41:38 459,264 —-a-w c:\windows\system32\msfeeds.dll
+ 2008-10-16 20:38:37 459,264 —-a-w c:\windows\system32\msfeeds.dll
- 2008-08-17 01:41:38 52,224 —-a-w c:\windows\system32\msfeedsbs.dll
+ 2008-10-16 20:38:37 52,224 —-a-w c:\windows\system32\msfeedsbs.dll
- 2007-08-13 23:54:12 3,578,368 —-a-w c:\windows\system32\mshtml.dll
+ 2008-12-13 06:40:02 3,593,216 —-a-w c:\windows\system32\mshtml.dll
- 2007-08-13 23:54:10 475,648 —-a-w c:\windows\system32\mshtmled.dll
+ 2008-10-16 20:38:38 477,696 —-a-w c:\windows\system32\mshtmled.dll
- 2007-08-13 23:44:26 192,000 —-a-w c:\windows\system32\msrating.dll
+ 2008-10-16 20:38:38 193,024 —-a-w c:\windows\system32\msrating.dll
+ 2008-05-27 03:17:44 34,816 ——w c:\windows\system32\msscb.dll
+ 2008-05-27 03:17:26 60,416 ——w c:\windows\system32\msscntrs.dll
+ 2008-05-27 03:17:38 11,776 ——w c:\windows\system32\msshooks.dll
+ 2008-05-27 03:18:34 231,936 ——w c:\windows\system32\msshsq.dll
+ 2008-05-27 03:17:26 87,552 ——w c:\windows\system32\mssitlb.dll
+ 2008-05-27 03:18:26 350,208 ——w c:\windows\system32\mssph.dll
+ 2008-05-27 03:18:56 203,776 ——w c:\windows\system32\mssphtb.dll
+ 2008-05-27 03:17:28 32,768 ——w c:\windows\system32\mssprxy.dll
+ 2008-05-27 03:21:26 1,418,240 ——w c:\windows\system32\mssrch.dll
+ 2008-05-27 03:18:42 44,032 ——w c:\windows\system32\msstrc.dll
- 2007-08-13 23:54:10 670,720 —-a-w c:\windows\system32\mstime.dll
+ 2008-10-16 20:38:39 671,232 —-a-w c:\windows\system32\mstime.dll
- 2007-06-26 06:06:12 1,104,896 —-a-w c:\windows\system32\msxml3.dll
+ 2008-09-04 17:15:04 1,106,944 —-a-w c:\windows\system32\msxml3.dll
- 2007-08-24 22:08:24 1,275,392 —-a-w c:\windows\system32\msxml4.dll
+ 2008-09-30 21:43:34 1,286,152 —-a-w c:\windows\system32\msxml4.dll
- 2008-04-14 09:42:02 1,306,624 —-a-w c:\windows\system32\msxml6.dll
+ 2008-09-10 01:14:56 1,307,648 —-a-w c:\windows\system32\msxml6.dll
+ 2003-02-20 23:43:36 4,096 —-a-w c:\windows\system32\mui\0409\mscoreer.dll
+ 2008-07-25 16:17:04 15,360 —-a-w c:\windows\system32\mui\0409\mscorees.dll
- 2007-07-11 15:42:05 337,408 —-a-w c:\windows\system32\netapi32.dll
+ 2008-10-15 16:34:24 337,408 —-a-w c:\windows\system32\netapi32.dll
+ 2003-02-21 00:16:34 32,768 —-a-w c:\windows\system32\netfxperf.dll
- 2008-04-23 09:30:01 2,062,976 —-a-w c:\windows\system32\ntkrnlpa.exe
+ 2008-08-14 09:33:16 2,066,048 —-a-w c:\windows\system32\ntkrnlpa.exe
- 2008-04-23 10:05:32 2,185,984 —-a-w c:\windows\system32\ntoskrnl.exe
+ 2008-08-14 10:11:02 2,189,184 —-a-w c:\windows\system32\ntoskrnl.exe
- 2007-12-05 06:41:00 5,773,568 —-a-w c:\windows\system32\nv4_disp.dll
+ 2008-09-18 04:55:00 6,057,472 —-a-w c:\windows\system32\nv4_disp.dll
- 2008-07-29 20:36:28 385,024 —-a-w c:\windows\system32\nvapi.dll
+ 2008-09-18 04:55:00 475,136 —-a-w c:\windows\system32\nvapi.dll
- 2007-12-05 06:41:00 442,368 —-a-w c:\windows\system32\nvappbar.exe
+ 2008-09-18 04:55:00 449,056 —-a-w c:\windows\system32\nvappbar.exe
- 2008-07-29 20:36:29 35,328 —-a-w c:\windows\system32\nvcod.dll
+ 2008-09-18 04:55:00 122,880 —-a-w c:\windows\system32\nvcod.dll
- 2007-12-05 06:41:00 35,328 —-a-w c:\windows\system32\nvcodins.dll
+ 2008-09-18 04:55:00 122,880 —-a-w c:\windows\system32\nvcodins.dll
- 2007-12-05 06:41:00 147,456 —-a-w c:\windows\system32\nvcolor.exe
+ 2008-09-18 04:55:00 143,360 —-a-w c:\windows\system32\nvcolor.exe
- 2008-07-29 20:37:05 8,523,776 —-a-w c:\windows\system32\nvcpl.dll
+ 2008-09-18 04:55:00 13,574,144 —-a-w c:\windows\system32\nvcpl.dll
- 2007-12-05 06:41:00 753,664 —-a-w c:\windows\system32\nvcplui.exe
+ 2008-09-18 04:55:00 797,216 —-a-w c:\windows\system32\nvcplui.exe
- 2008-07-29 20:37:16 1,073,152 —-a-w c:\windows\system32\nvcpluir.dll
+ 2008-09-18 04:55:00 1,108,512 —-a-w c:\windows\system32\nvcpluir.dll
- 2007-12-05 06:41:00 1,089,536 —-a-w c:\windows\system32\nvcuda.dll
+ 2008-09-18 04:55:00 1,368,064 —-a-w c:\windows\system32\nvcuda.dll
- 2007-12-05 06:41:00 6,549,504 —-a-w c:\windows\system32\nvdisps.dll
+ 2008-09-18 04:55:00 3,989,504 —-a-w c:\windows\system32\nvdisps.dll
- 2008-07-29 20:37:59 5,611,520 —-a-w c:\windows\system32\nvdispsr.dll
+ 2008-09-18 04:55:00 5,799,936 —-a-w c:\windows\system32\nvdispsr.dll
- 2007-12-05 06:41:00 1,339,392 —-a-w c:\windows\system32\nvdspsch.exe
+ 2008-09-18 04:55:00 1,346,080 —-a-w c:\windows\system32\nvdspsch.exe
- 2007-12-05 06:41:00 3,420,160 —-a-w c:\windows\system32\nvgames.dll
+ 2008-09-18 04:55:00 3,444,736 —-a-w c:\windows\system32\nvgames.dll
- 2008-07-29 20:38:26 3,334,144 —-a-w c:\windows\system32\nvgamesr.dll
+ 2008-09-18 04:55:00 3,457,024 —-a-w c:\windows\system32\nvgamesr.dll
- 2007-12-05 06:41:00 1,474,560 —-a-w c:\windows\system32\nview.dll
+ 2008-09-18 04:55:00 1,503,232 —-a-w c:\windows\system32\nview.dll
- 2007-12-05 06:41:00 229,376 —-a-w c:\windows\system32\nvmccs.dll
+ 2008-09-18 04:55:00 229,376 —-a-w c:\windows\system32\nvmccs.dll
- 2007-12-05 06:41:00 45,056 —-a-w c:\windows\system32\nvmccsrs.dll
+ 2008-09-18 04:55:00 45,056 —-a-w c:\windows\system32\nvmccsrs.dll
- 2007-12-05 06:41:00 188,416 —-a-w c:\windows\system32\nvmccss.dll
+ 2008-09-18 04:55:00 188,416 —-a-w c:\windows\system32\nvmccss.dll
- 2008-07-29 20:38:31 458,752 —-a-w c:\windows\system32\nvmccssr.dll
+ 2008-09-18 04:55:00 458,752 —-a-w c:\windows\system32\nvmccssr.dll
- 2007-12-05 06:41:00 81,920 —-a-w c:\windows\system32\nvmctray.dll
+ 2008-09-18 04:55:00 86,016 —-a-w c:\windows\system32\nvmctray.dll
- 2007-12-05 06:41:00 1,228,800 —-a-w c:\windows\system32\nvmobls.dll
+ 2008-09-18 04:55:00 1,257,472 —-a-w c:\windows\system32\nvmobls.dll
- 2008-07-29 20:38:42 2,854,912 —-a-w c:\windows\system32\nvmoblsr.dll
+ 2008-09-18 04:55:00 2,854,912 —-a-w c:\windows\system32\nvmoblsr.dll
- 2007-12-05 06:41:00 286,720 —-a-w c:\windows\system32\nvnt4cpl.dll
+ 2008-09-18 04:55:00 286,720 —-a-w c:\windows\system32\nvnt4cpl.dll
- 2007-12-05 06:41:00 6,901,760 —-a-w c:\windows\system32\nvoglnt.dll
+ 2008-09-18 04:55:00 8,826,880 —-a-w c:\windows\system32\nvoglnt.dll
- 2008-07-29 20:39:06 327,680 —-a-w c:\windows\system32\nvrsar.dll
+ 2008-09-18 04:55:00 331,776 —-a-w c:\windows\system32\nvrsar.dll
- 2008-07-29 20:39:07 249,856 —-a-w c:\windows\system32\nvrscs.dll
+ 2008-09-18 04:55:00 245,760 —-a-w c:\windows\system32\nvrscs.dll
- 2008-07-29 20:39:08 253,952 —-a-w c:\windows\system32\nvrsda.dll
+ 2008-09-18 04:55:00 253,952 —-a-w c:\windows\system32\nvrsda.dll
- 2008-07-29 20:39:08 278,528 —-a-w c:\windows\system32\nvrsde.dll
+ 2008-09-18 04:55:00 278,528 —-a-w c:\windows\system32\nvrsde.dll
- 2008-07-29 20:39:09 282,624 —-a-w c:\windows\system32\nvrsel.dll
+ 2008-09-18 04:55:00 282,624 —-a-w c:\windows\system32\nvrsel.dll
- 2008-07-29 20:39:10 245,760 —-a-w c:\windows\system32\nvrseng.dll
+ 2008-09-18 04:55:00 245,760 —-a-w c:\windows\system32\nvrseng.dll
- 2008-07-29 20:39:11 282,624 —-a-w c:\windows\system32\nvrses.dll
+ 2008-09-18 04:55:00 282,624 —-a-w c:\windows\system32\nvrses.dll
- 2008-07-29 20:39:12 274,432 —-a-w c:\windows\system32\nvrsesm.dll
+ 2008-09-18 04:55:00 274,432 —-a-w c:\windows\system32\nvrsesm.dll
- 2008-07-29 20:39:12 249,856 —-a-w c:\windows\system32\nvrsfi.dll
+ 2008-09-18 04:55:00 249,856 —-a-w c:\windows\system32\nvrsfi.dll
- 2008-07-29 20:39:13 282,624 —-a-w c:\windows\system32\nvrsfr.dll
+ 2008-09-18 04:55:00 282,624 —-a-w c:\windows\system32\nvrsfr.dll
- 2008-07-29 20:39:14 327,680 —-a-w c:\windows\system32\nvrshe.dll
+ 2008-09-18 04:55:00 331,776 —-a-w c:\windows\system32\nvrshe.dll
- 2008-07-29 20:39:15 258,048 —-a-w c:\windows\system32\nvrshu.dll
+ 2008-09-18 04:55:00 258,048 —-a-w c:\windows\system32\nvrshu.dll
- 2008-07-29 20:39:16 278,528 —-a-w c:\windows\system32\nvrsit.dll
+ 2008-09-18 04:55:00 278,528 —-a-w c:\windows\system32\nvrsit.dll
- 2008-07-29 20:39:16 266,240 —-a-w c:\windows\system32\nvrsja.dll
+ 2008-09-18 04:55:00 270,336 —-a-w c:\windows\system32\nvrsja.dll
- 2008-07-29 20:39:17 258,048 —-a-w c:\windows\system32\nvrsko.dll
+ 2008-09-18 04:55:00 262,144 —-a-w c:\windows\system32\nvrsko.dll
- 2008-07-29 20:39:18 274,432 —-a-w c:\windows\system32\nvrsnl.dll
+ 2008-09-18 04:55:00 274,432 —-a-w c:\windows\system32\nvrsnl.dll
- 2008-07-29 20:39:19 253,952 —-a-w c:\windows\system32\nvrsno.dll
+ 2008-09-18 04:55:00 253,952 —-a-w c:\windows\system32\nvrsno.dll
- 2008-07-29 20:39:19 253,952 —-a-w c:\windows\system32\nvrspl.dll
+ 2008-09-18 04:55:00 253,952 —-a-w c:\windows\system32\nvrspl.dll
- 2008-07-29 20:39:20 274,432 —-a-w c:\windows\system32\nvrspt.dll
+ 2008-09-18 04:55:00 270,336 —-a-w c:\windows\system32\nvrspt.dll
- 2008-07-29 20:39:21 266,240 —-a-w c:\windows\system32\nvrsptb.dll
+ 2008-09-18 04:55:00 266,240 —-a-w c:\windows\system32\nvrsptb.dll
- 2008-07-29 20:39:22 270,336 —-a-w c:\windows\system32\nvrsru.dll
+ 2008-09-18 04:55:00 266,240 —-a-w c:\windows\system32\nvrsru.dll
- 2008-07-29 20:39:23 258,048 —-a-w c:\windows\system32\nvrssk.dll
+ 2008-09-18 04:55:00 258,048 —-a-w c:\windows\system32\nvrssk.dll
- 2008-07-29 20:39:23 258,048 —-a-w c:\windows\system32\nvrssl.dll
+ 2008-09-18 04:55:00 258,048 —-a-w c:\windows\system32\nvrssl.dll
- 2008-07-29 20:39:24 253,952 —-a-w c:\windows\system32\nvrssv.dll
+ 2008-09-18 04:55:00 253,952 —-a-w c:\windows\system32\nvrssv.dll
- 2008-07-29 20:39:25 253,952 —-a-w c:\windows\system32\nvrsth.dll
+ 2008-09-18 04:55:00 253,952 —-a-w c:\windows\system32\nvrsth.dll
- 2008-07-29 20:39:26 258,048 —-a-w c:\windows\system32\nvrstr.dll
+ 2008-09-18 04:55:00 253,952 —-a-w c:\windows\system32\nvrstr.dll
- 2008-07-29 20:39:26 225,280 —-a-w c:\windows\system32\nvrszhc.dll
+ 2008-09-18 04:55:00 225,280 —-a-w c:\windows\system32\nvrszhc.dll
- 2008-07-29 20:39:27 126,976 —-a-w c:\windows\system32\nvrszht.dll
+ 2008-09-18 04:55:00 122,880 —-a-w c:\windows\system32\nvrszht.dll
- 2007-12-05 06:41:00 466,944 —-a-w c:\windows\system32\nvshell.dll
+ 2008-09-18 04:55:00 466,944 —-a-w c:\windows\system32\nvshell.dll
- 2007-12-05 06:41:00 155,716 —-a-w c:\windows\system32\nvsvc32.exe
+ 2008-09-18 04:55:00 163,908 —-a-w c:\windows\system32\nvsvc32.exe
- 2007-12-05 07:53:08 356,352 —-a-w c:\windows\system32\NVUNINST.EXE
+ 2008-09-18 04:55:00 453,152 —-a-w c:\windows\system32\NVUNINST.EXE
- 2007-12-05 06:41:00 3,710,976 —-a-w c:\windows\system32\nvvitvs.dll
+ 2008-09-18 04:55:00 3,764,224 —-a-w c:\windows\system32\nvvitvs.dll
- 2008-07-29 20:39:51 3,715,072 —-a-w c:\windows\system32\nvvitvsr.dll
+ 2008-09-18 04:55:00 4,149,248 —-a-w c:\windows\system32\nvvitvsr.dll
- 2007-12-05 06:41:00 81,920 —-a-w c:\windows\system32\nvwddi.dll
+ 2008-09-18 04:55:00 81,920 —-a-w c:\windows\system32\nvwddi.dll
- 2007-12-05 06:41:00 1,703,936 —-a-w c:\windows\system32\nvwdmcpl.dll
+ 2008-09-18 04:55:00 1,724,416 —-a-w c:\windows\system32\nvwdmcpl.dll
- 2007-12-05 06:41:00 1,019,904 —-a-w c:\windows\system32\nvwimg.dll
+ 2008-09-18 04:55:00 1,101,824 —-a-w c:\windows\system32\nvwimg.dll
- 2008-07-29 20:40:02 282,624 —-a-w c:\windows\system32\nvwrsar.dll
+ 2008-09-18 04:55:00 282,624 —-a-w c:\windows\system32\nvwrsar.dll
- 2008-07-29 20:40:03 286,720 —-a-w c:\windows\system32\nvwrscs.dll
+ 2008-09-18 04:55:00 286,720 —-a-w c:\windows\system32\nvwrscs.dll
- 2008-07-29 20:40:03 294,912 —-a-w c:\windows\system32\nvwrsda.dll
+ 2008-09-18 04:55:00 294,912 —-a-w c:\windows\system32\nvwrsda.dll
- 2008-07-29 20:40:04 311,296 —-a-w c:\windows\system32\nvwrsde.dll
+ 2008-09-18 04:55:00 311,296 —-a-w c:\windows\system32\nvwrsde.dll
- 2008-07-29 20:40:05 335,872 —-a-w c:\windows\system32\nvwrsel.dll
+ 2008-09-18 04:55:00 335,872 —-a-w c:\windows\system32\nvwrsel.dll
- 2008-07-29 20:40:06 286,720 —-a-w c:\windows\system32\nvwrseng.dll
+ 2008-09-18 04:55:00 286,720 —-a-w c:\windows\system32\nvwrseng.dll
- 2008-07-29 20:40:07 335,872 —-a-w c:\windows\system32\nvwrses.dll
+ 2008-09-18 04:55:00 335,872 —-a-w c:\windows\system32\nvwrses.dll
- 2008-07-29 20:40:08 327,680 —-a-w c:\windows\system32\nvwrsesm.dll
+ 2008-09-18 04:55:00 327,680 —-a-w c:\windows\system32\nvwrsesm.dll
- 2008-07-29 20:40:09 303,104 —-a-w c:\windows\system32\nvwrsfi.dll
+ 2008-09-18 04:55:00 303,104 —-a-w c:\windows\system32\nvwrsfi.dll
- 2008-07-29 20:40:09 327,680 —-a-w c:\windows\system32\nvwrsfr.dll
+ 2008-09-18 04:55:00 327,680 —-a-w c:\windows\system32\nvwrsfr.dll
- 2008-07-29 20:40:10 278,528 —-a-w c:\windows\system32\nvwrshe.dll
+ 2008-09-18 04:55:00 278,528 —-a-w c:\windows\system32\nvwrshe.dll
- 2008-07-29 20:40:11 315,392 —-a-w c:\windows\system32\nvwrshu.dll
+ 2008-09-18 04:55:00 315,392 —-a-w c:\windows\system32\nvwrshu.dll
- 2008-07-29 20:40:12 323,584 —-a-w c:\windows\system32\nvwrsit.dll
+ 2008-09-18 04:55:00 323,584 —-a-w c:\windows\system32\nvwrsit.dll
- 2008-07-29 20:40:12 212,992 —-a-w c:\windows\system32\nvwrsja.dll
+ 2008-09-18 04:55:00 212,992 —-a-w c:\windows\system32\nvwrsja.dll
- 2008-07-29 20:40:13 196,608 —-a-w c:\windows\system32\nvwrsko.dll
+ 2008-09-18 04:55:00 196,608 —-a-w c:\windows\system32\nvwrsko.dll
- 2008-07-29 20:40:14 319,488 —-a-w c:\windows\system32\nvwrsnl.dll
+ 2008-09-18 04:55:00 319,488 —-a-w c:\windows\system32\nvwrsnl.dll
- 2008-07-29 20:40:14 299,008 —-a-w c:\windows\system32\nvwrsno.dll
+ 2008-09-18 04:55:00 299,008 —-a-w c:\windows\system32\nvwrsno.dll
- 2008-07-29 20:40:15 294,912 —-a-w c:\windows\system32\nvwrspl.dll
+ 2008-09-18 04:55:00 294,912 —-a-w c:\windows\system32\nvwrspl.dll
- 2008-07-29 20:40:16 323,584 —-a-w c:\windows\system32\nvwrspt.dll
+ 2008-09-18 04:55:00 323,584 —-a-w c:\windows\system32\nvwrspt.dll
- 2008-07-29 20:40:17 319,488 —-a-w c:\windows\system32\nvwrsptb.dll
+ 2008-09-18 04:55:00 319,488 —-a-w c:\windows\system32\nvwrsptb.dll
- 2008-07-29 20:40:18 315,392 —-a-w c:\windows\system32\nvwrsru.dll
+ 2008-09-18 04:55:00 315,392 —-a-w c:\windows\system32\nvwrsru.dll
- 2008-07-29 20:40:19 299,008 —-a-w c:\windows\system32\nvwrssk.dll
+ 2008-09-18 04:55:00 299,008 —-a-w c:\windows\system32\nvwrssk.dll
- 2008-07-29 20:40:20 303,104 —-a-w c:\windows\system32\nvwrssl.dll
+ 2008-09-18 04:55:00 303,104 —-a-w c:\windows\system32\nvwrssl.dll
- 2008-07-29 20:40:20 294,912 —-a-w c:\windows\system32\nvwrssv.dll
+ 2008-09-18 04:55:00 294,912 —-a-w c:\windows\system32\nvwrssv.dll
- 2008-07-29 20:40:21 290,816 —-a-w c:\windows\system32\nvwrsth.dll
+ 2008-09-18 04:55:00 290,816 —-a-w c:\windows\system32\nvwrsth.dll
- 2008-07-29 20:40:22 303,104 —-a-w c:\windows\system32\nvwrstr.dll
+ 2008-09-18 04:55:00 303,104 —-a-w c:\windows\system32\nvwrstr.dll
- 2008-07-29 20:40:22 163,840 —-a-w c:\windows\system32\nvwrszhc.dll
+ 2008-09-18 04:55:00 163,840 —-a-w c:\windows\system32\nvwrszhc.dll
- 2008-07-29 20:40:23 167,936 —-a-w c:\windows\system32\nvwrszht.dll
+ 2008-09-18 04:55:00 167,936 —-a-w c:\windows\system32\nvwrszht.dll
- 2007-12-05 06:41:00 2,498,560 —-a-w c:\windows\system32\nvwss.dll
+ 2008-09-18 04:55:00 2,686,976 —-a-w c:\windows\system32\nvwss.dll
- 2008-07-29 20:40:31 2,519,040 —-a-w c:\windows\system32\nvwssr.dll
+ 2008-09-18 04:55:00 2,981,888 —-a-w c:\windows\system32\nvwssr.dll
- 2007-12-05 06:41:00 1,626,112 —-a-w c:\windows\system32\nwiz.exe
+ 2008-09-18 04:55:00 1,657,376 —-a-w c:\windows\system32\nwiz.exe
- 2008-08-17 01:34:10 102,912 —-a-w c:\windows\system32\occache.dll
+ 2008-10-16 20:38:39 102,912 —-a-w c:\windows\system32\occache.dll
+ 2008-05-27 03:19:36 273,408 ——w c:\windows\system32\oeph.dll
+ 2008-05-27 03:19:16 11,264 ——w c:\windows\system32\oephRes.dll
- 2008-12-31 02:07:55 39,992 —-a-w c:\windows\system32\perfc009.dat
+ 2009-01-01 09:38:15 78,114 —-a-w c:\windows\system32\perfc009.dat
- 2008-12-31 02:07:55 311,604 —-a-w c:\windows\system32\perfh009.dat
+ 2009-01-01 09:38:15 462,168 —-a-w c:\windows\system32\perfh009.dat
- 2007-08-13 23:36:12 44,544 —-a-w c:\windows\system32\pngfilt.dll
+ 2008-10-16 20:38:39 44,544 —-a-w c:\windows\system32\pngfilt.dll
+ 2008-07-30 00:59:58 105,016 —-a-w c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
+ 2008-07-30 01:35:46 326,160 —-a-w c:\windows\system32\PresentationHost.exe
+ 2008-07-30 00:59:58 43,544 —-a-w c:\windows\system32\PresentationHostProxy.dll
+ 2008-07-30 00:59:58 781,344 —-a-w c:\windows\system32\PresentationNative_v0300.dll
+ 2008-05-27 03:18:08 71,680 ——w c:\windows\system32\propdefs.dll
+ 2008-05-27 03:17:48 754,176 ——w c:\windows\system32\propsys.dll
+ 2008-04-07 23:16:45 588,272 ——w c:\windows\system32\px.dll
+ 2008-04-07 23:16:45 543,216 ——w c:\windows\system32\pxdrv.dll
+ 2008-04-07 23:16:45 72,176 ——w c:\windows\system32\pxhpinst.exe
+ 2008-04-07 23:16:45 186,864 ——w c:\windows\system32\pxmas.dll
+ 2008-04-07 23:16:45 379,376 ——w c:\windows\system32\pxwave.dll
- 2008-05-07 04:55:40 1,288,192 —-a-w c:\windows\system32\quartz.dll
+ 2008-05-07 05:12:40 1,288,192 —-a-w c:\windows\system32\quartz.dll
+ 2004-12-16 18:36:30 42,496 —-a-w c:\windows\system32\ReinstallBackups\0000\DriverFiles\fetnd5bv.sys
+ 2004-09-17 22:37:42 61,440 —-a-w c:\windows\system32\ReinstallBackups\0000\DriverFiles\vuins32.dll
+ 2007-12-05 06:41:00 5,773,568 —-a-w c:\windows\system32\ReinstallBackups\0003\DriverFiles\nv4_disp.dll
+ 2007-12-05 06:41:00 7,435,392 —-a-w c:\windows\system32\ReinstallBackups\0003\DriverFiles\nv4_mini.sys
+ 2008-07-29 20:36:28 385,024 —-a-w c:\windows\system32\ReinstallBackups\0003\DriverFiles\nvapi.dll
+ 2007-12-05 06:41:00 35,328 —-a-w c:\windows\system32\ReinstallBackups\0003\DriverFiles\nvcod.dll
+ 2008-07-29 20:37:05 8,523,776 —-a-w c:\windows\system32\ReinstallBackups\0003\DriverFiles\nvcpl.dll
+ 2007-12-05 06:41:00 1,089,536 —-a-w c:\windows\system32\ReinstallBackups\0003\DriverFiles\nvcuda.dll
+ 2007-12-05 06:41:00 6,549,504 —-a-w c:\windows\system32\ReinstallBackups\0003\DriverFiles\nvdisps.dll
+ 2007-12-05 06:41:00 3,420,160 —-a-w c:\windows\system32\ReinstallBackups\0003\DriverFiles\nvgames.dll
+ 2007-12-05 06:41:00 229,376 —-a-w c:\windows\system32\ReinstallBackups\0003\DriverFiles\nvmccs.dll
+ 2007-12-05 06:41:00 188,416 —-a-w c:\windows\system32\ReinstallBackups\0003\DriverFiles\nvmccss.dll
+ 2007-12-05 06:41:00 81,920 —-a-w c:\windows\system32\ReinstallBackups\0003\DriverFiles\nvmctray.dll
+ 2007-12-05 06:41:00 1,228,800 —-a-w c:\windows\system32\ReinstallBackups\0003\DriverFiles\nvmobls.dll
+ 2007-12-05 06:41:00 286,720 —-a-w c:\windows\system32\ReinstallBackups\0003\DriverFiles\nvnt4cpl.dll
+ 2007-12-05 06:41:00 6,901,760 —-a-w c:\windows\system32\ReinstallBackups\0003\DriverFiles\nvoglnt.dll
+ 2007-12-05 06:41:00 155,716 —-a-w c:\windows\system32\ReinstallBackups\0003\DriverFiles\nvsvc32.exe
+ 2007-12-05 06:41:00 3,710,976 —-a-w c:\windows\system32\ReinstallBackups\0003\DriverFiles\nvvitvs.dll
+ 2007-12-05 06:41:00 81,920 —-a-w c:\windows\system32\ReinstallBackups\0003\DriverFiles\nvwddi.dll
+ 2007-12-05 06:41:00 2,498,560 —-a-w c:\windows\system32\ReinstallBackups\0003\DriverFiles\nvwss.dll
+ 2006-08-24 21:15:06 150,808 —-a-w c:\windows\system32\rgb9rast_2.dll
+ 2008-05-27 03:18:32 38,400 ——w c:\windows\system32\rtffilt.dll
+ 2008-05-27 03:17:56 87,552 ——w c:\windows\system32\searchfilterhost.exe
+ 2008-05-27 03:18:44 439,808 ——w c:\windows\system32\searchindexer.exe
+ 2008-05-27 03:18:18 184,832 ——w c:\windows\system32\searchprotocolhost.exe
+ 2008-10-16 19:08:58 34,328 —-a-w c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.2.6001.788\wups.dll
+ 2008-10-16 19:09:44 43,544 —-a-w c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.2.6001.788\wups2.dll
- 2006-09-25 22:58:48 14,640 ——w c:\windows\system32\spmsg.dll
+ 2007-11-30 12:39:22 17,272 ——w c:\windows\system32\spmsg.dll
+ 2008-07-06 12:06:10 765,440 —-a-w c:\windows\system32\spool\drivers\w32x86\3\mxdwdrv.dll
+ 2008-07-06 12:06:10 198,656 —-a-w c:\windows\system32\spool\drivers\w32x86\3\mxdwdui.dll
+ 2008-07-06 12:06:10 373,248 —-a-w c:\windows\system32\spool\drivers\w32x86\3\unidrv.dll
+ 2008-07-06 12:06:10 744,960 —-a-w c:\windows\system32\spool\drivers\w32x86\3\unidrvui.dll
+ 2008-03-13 04:52:36 761,344 —-a-w c:\windows\system32\spool\drivers\w32x86\3\unires.dll
+ 2008-07-06 12:06:10 1,676,288 —-a-w c:\windows\system32\spool\drivers\w32x86\3\XpsSvcs.dll
+ 2008-07-06 12:06:10 89,088 —-a-w c:\windows\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
+ 2008-07-06 10:50:03 597,504 ——w c:\windows\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
+ 2008-07-06 12:06:10 147,456 —-a-w c:\windows\system32\spool\prtprocs\x64\filterpipelineprintproc.dll
+ 2008-07-06 12:06:10 748,032 —-a-w c:\windows\system32\spool\XPSEP\amd64\amd64\mxdwdrv.dll
+ 2008-07-06 22:36:12 2,936,832 —-a-w c:\windows\system32\spool\XPSEP\amd64\amd64\xpssvcs.dll
+ 2008-07-06 12:06:10 748,032 —-a-w c:\windows\system32\spool\XPSEP\amd64\mxdwdrv.dll
+ 2008-07-06 22:36:12 2,936,832 —-a-w c:\windows\system32\spool\XPSEP\amd64\xpssvcs.dll
+ 2008-07-06 12:06:10 765,440 —-a-w c:\windows\system32\spool\XPSEP\i386\i386\mxdwdrv.dll
+ 2008-07-06 12:06:10 1,676,288 —-a-w c:\windows\system32\spool\XPSEP\i386\i386\xpssvcs.dll
+ 2008-07-06 12:06:10 765,440 —-a-w c:\windows\system32\spool\XPSEP\i386\mxdwdrv.dll
+ 2008-07-06 12:06:10 1,676,288 —-a-w c:\windows\system32\spool\XPSEP\i386\xpssvcs.dll
- 2007-08-11 00:46:18 26,488 —-a-w c:\windows\system32\spupdsvc.exe
+ 2007-11-30 11:18:51 26,488 —-a-w c:\windows\system32\spupdsvc.exe
+ 2008-05-27 03:17:30 301,568 ——w c:\windows\system32\srchadmin.dll
+ 2008-05-27 02:59:40 106,605 ——w c:\windows\system32\structuredqueryschema.bin
+ 2008-05-27 02:59:42 18,904 ——w c:\windows\system32\structuredqueryschematrivial.bin
+ 2008-05-27 03:21:08 1,582,592 ——w c:\windows\system32\tquery.dll
+ 2008-07-30 02:10:04 26,112 —-a-w c:\windows\system32\TsWpfWrp.exe
- 2008-07-14 11:03:00 62,976 —-a-w c:\windows\system32\tzchange.exe
+ 2008-10-23 10:06:59 62,976 —-a-w c:\windows\system32\tzchange.exe
+ 2008-07-30 00:59:58 161,296 —-a-w c:\windows\system32\UIAutomationCore.dll
+ 2008-05-27 03:19:20 97,792 ——w c:\windows\system32\UncCplExt.dll
+ 2008-05-27 03:19:22 143,872 ——w c:\windows\system32\UncDMS.dll
+ 2008-05-27 03:19:28 108,032 ——w c:\windows\system32\UncNE.dll
+ 2008-05-27 03:19:28 131,072 ——w c:\windows\system32\UncPH.dll
+ 2008-05-27 03:19:26 2,048 ——w c:\windows\system32\UncRes.dll
- 2008-08-17 01:34:50 105,984 —-a-w c:\windows\system32\url.dll
+ 2008-10-16 20:38:39 105,984 —-a-w c:\windows\system32\url.dll
- 2007-08-13 23:54:10 1,162,240 —-a-w c:\windows\system32\urlmon.dll
+ 2008-10-16 20:38:39 1,160,192 —-a-w c:\windows\system32\urlmon.dll
+ 2003-02-21 00:06:20 282,624 —-a-w c:\windows\system32\URTTemp\fusion.dll
+ 2003-02-21 00:06:24 155,648 —-a-w c:\windows\system32\URTTemp\mscoree.dll
+ 2003-02-21 00:09:18 77,824 —-a-w c:\windows\system32\URTTemp\mscorsn.dll
+ 2003-02-21 00:08:32 2,482,176 —-a-w c:\windows\system32\URTTemp\mscorwks.dll
+ 2003-02-21 09:42:22 348,160 —-a-w c:\windows\system32\URTTemp\msvcr71.dll
+ 2003-02-21 10:16:08 49,152 —-a-w c:\windows\system32\URTTemp\regtlib.exe
+ 2008-11-13 20:18:44 107,408 —-a-w c:\windows\system32\vsdata.dll
+ 2008-11-13 20:19:00 353,680 —-a-w c:\windows\system32\vsdatant.sys
+ 2008-11-13 20:18:44 216,464 —-a-w c:\windows\system32\vsinit.dll
+ 2008-11-13 20:18:44 107,408 —-a-w c:\windows\system32\vsmonapi.dll
+ 2008-11-13 20:18:44 310,160 —-a-w c:\windows\system32\vspubapi.dll
+ 2008-11-13 20:18:44 58,768 —-a-w c:\windows\system32\vsregexp.dll
+ 2008-11-13 20:18:46 475,536 —-a-w c:\windows\system32\vsutil.dll
+ 2008-11-13 20:18:46 30,096 —-a-w c:\windows\system32\vswmi.dll
+ 2008-11-13 20:18:46 110,480 —-a-w c:\windows\system32\vsxml.dll
+ 2006-10-27 13:26:56 69,632 —-a-w c:\windows\system32\vuins32.dll
+ 2008-04-07 23:16:45 88,560 ——w c:\windows\system32\vxblock.dll
- 2008-08-17 01:48:39 396,800 —-a-w c:\windows\system32\webcheck.dll
+ 2008-10-16 20:38:39 233,472 —-a-w c:\windows\system32\webcheck.dll
- 2008-08-17 01:42:14 236,928 —-a-w c:\windows\system32\wgalogon.dll
+ 2008-09-06 04:30:42 241,704 —-a-w c:\windows\system32\WgaLogon.dll
- 2008-08-17 01:42:15 336,768 —-a-w c:\windows\system32\wgatray.exe
+ 2008-09-06 04:29:58 917,032 —-a-w c:\windows\system32\WgaTray.exe
+ 2004-06-19 03:43:16 323,624 —-a-w c:\windows\system32\wiaaut.dll
- 2008-05-30 11:16:47 1,846,272 —-a-w c:\windows\system32\win32k.sys
+ 2008-09-15 12:12:56 1,846,400 —-a-w c:\windows\system32\win32k.sys
- 2006-10-19 02:47:18 222,208 —-a-w c:\windows\system32\WMASF.dll
+ 2007-10-27 22:40:30 222,720 —-a-w c:\windows\system32\wmasf.dll
- 2008-04-24 14:06:32 937,984 —-a-w c:\windows\system32\wmnetmgr.dll
+ 2008-06-18 10:03:08 938,496 —-a-w c:\windows\system32\WMNetmgr.dll
- 2006-10-19 02:47:20 10,834,432 —-a-w c:\windows\system32\wmp.dll
+ 2007-06-12 04:51:12 10,834,944 —-a-w c:\windows\system32\wmp.dll
- 2008-08-17 01:43:29 295,936 —-a-w c:\windows\system32\wmpeffects.dll
+ 2008-06-24 23:12:58 295,936 —-a-w c:\windows\system32\wmpeffects.dll
- 2006-10-19 02:47:22 2,450,944 —-a-w c:\windows\system32\wmvcore.dll
+ 2008-06-18 10:03:14 2,458,112 —-a-w c:\windows\system32\WMVCore.dll
+ 2008-05-27 03:18:34 56,320 ——w c:\windows\system32\xmlfilter.dll
+ 2008-07-30 02:26:06 301,568 —-a-w c:\windows\system32\XPSViewer\XPSViewer.exe
+ 2008-11-13 20:18:46 69,008 —-a-w c:\windows\system32\zlcomm.dll
+ 2008-11-13 20:18:46 106,384 —-a-w c:\windows\system32\zlcommdb.dll
+ 2008-11-13 20:18:40 76,176 —-a-w c:\windows\system32\ZoneLabs\camupd.dll
+ 2008-03-17 21:52:02 813,568 —-a-w c:\windows\system32\ZoneLabs\dbghelp.dll
+ 2008-11-13 20:18:42 98,192 —-a-w c:\windows\system32\ZoneLabs\fbl.dll
+ 2008-11-13 20:18:42 38,288 —-a-w c:\windows\system32\ZoneLabs\featuremap.dll
+ 2008-11-13 20:18:42 159,120 —-a-w c:\windows\system32\ZoneLabs\httpblocker.dll
+ 2008-05-19 19:59:00 525,792 —-a-w c:\windows\system32\ZoneLabs\icslta.dll
+ 2008-11-13 20:19:02 28,048 —-a-w c:\windows\system32\ZoneLabs\lib\Alert.zip.dll
+ 2008-11-13 20:19:02 322,960 —-a-w c:\windows\system32\ZoneLabs\lib\ConfigWizard.zip.dll
+ 2008-11-13 20:19:02 122,768 —-a-w c:\windows\system32\ZoneLabs\lib\DashBoard.zip.dll
+ 2008-11-13 20:19:02 331,664 —-a-w c:\windows\system32\ZoneLabs\lib\LicenseUI.zip.dll
+ 2008-11-13 20:19:02 10,128 —-a-w c:\windows\system32\ZoneLabs\lib\MainLoop.zip.dll
+ 2008-11-13 20:19:04 18,320 —-a-w c:\windows\system32\ZoneLabs\lib\NavBar.zip.dll
+ 2008-11-13 20:19:04 110,992 —-a-w c:\windows\system32\ZoneLabs\lib\Overview.zip.dll
+ 2008-11-13 20:19:04 238,992 —-a-w c:\windows\system32\ZoneLabs\lib\Sandbox.zip.dll
+ 2008-11-13 20:19:04 156,048 —-a-w c:\windows\system32\ZoneLabs\lib\TrayTest.zip.dll
+ 2008-11-13 20:19:04 19,856 —-a-w c:\windows\system32\ZoneLabs\lib\UpdateUI.zip.dll
+ 2008-11-13 20:19:04 43,920 —-a-w c:\windows\system32\ZoneLabs\lib\ZAlert.zip.dll
+ 2008-11-13 20:19:04 19,344 —-a-w c:\windows\system32\ZoneLabs\lib\zic.zip.dll
+ 2008-11-13 20:19:04 13,712 —-a-w c:\windows\system32\ZoneLabs\lib\zmenu.zip.dll
+ 2008-11-13 20:19:04 24,464 —-a-w c:\windows\system32\ZoneLabs\lib\zp4pc.zip.dll
+ 2008-11-13 20:19:04 30,608 —-a-w c:\windows\system32\ZoneLabs\lib\zpdp.zip.dll
+ 2008-11-13 20:19:04 1,536,400 —-a-w c:\windows\system32\ZoneLabs\lib\zpy.zip.dll
+ 2008-11-13 20:19:04 18,832 —-a-w c:\windows\system32\ZoneLabs\lib\zsys.zip.dll
+ 2008-11-13 20:19:04 70,032 —-a-w c:\windows\system32\ZoneLabs\lib\ztv.zip.dll
+ 2008-11-13 20:19:04 114,064 —-a-w c:\windows\system32\ZoneLabs\lib\zui.zip.dll
+ 2008-11-13 20:19:06 59,792 —-a-w c:\windows\system32\ZoneLabs\lib\zvpn.zip.dll
+ 2008-04-21 12:19:42 718,272 —-a-w c:\windows\system32\ZoneLabs\qrbase.dll
+ 2008-04-21 12:19:44 792,000 —-a-w c:\windows\system32\ZoneLabs\qrsrecl.dll
+ 2008-11-13 20:18:42 132,496 —-a-w c:\windows\system32\ZoneLabs\scheduler.dll
+ 2008-04-21 12:19:46 8,790,493 —-a-w c:\windows\system32\ZoneLabs\spyware.dat
+ 2008-04-21 12:19:52 1,516,992 —-a-w c:\windows\system32\ZoneLabs\srescan.dll
+ 2008-04-21 12:19:58 51,648 —-a-w c:\windows\system32\ZoneLabs\srescan.sys
+ 2008-11-13 20:18:44 443,280 —-a-w c:\windows\system32\ZoneLabs\ssleay32.dll
+ 2007-10-11 21:51:34 832,984 —-a-w c:\windows\system32\ZoneLabs\updating.dll
+ 2008-11-13 20:18:54 176,016 —-a-w c:\windows\system32\ZoneLabs\updclient.exe
+ 2008-11-13 20:18:44 106,896 —-a-w c:\windows\system32\ZoneLabs\vsdb.dll
+ 2008-11-13 20:18:56 2,405,776 —-a-w c:\windows\system32\ZoneLabs\vsmon.exe
+ 2008-11-13 20:18:46 1,655,184 —-a-w c:\windows\system32\ZoneLabs\vsruledb.dll
+ 2008-11-13 20:18:46 172,432 —-a-w c:\windows\system32\ZoneLabs\vsvault.dll
+ 2008-04-21 12:19:46 8,790,493 —-a-w c:\windows\system32\ZoneLabs\zlasdbup.dat
+ 2008-11-13 20:18:46 178,576 —-a-w c:\windows\system32\ZoneLabs\zlparser.dll
+ 2008-11-13 20:18:48 98,192 —-a-w c:\windows\system32\ZoneLabs\zlquarantine.dll
+ 2008-11-13 20:18:48 311,696 —-a-w c:\windows\system32\ZoneLabs\zlsre.dll
+ 2008-11-13 20:18:48 110,480 —-a-w c:\windows\system32\ZoneLabs\zlupdate.dll
+ 2008-07-29 10:23:06 59,904 —-a-w c:\windows\WinSxS\amd64_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_bdb5a47a\vcomp90.dll
+ 2009-01-01 09:38:09 8,192 —-a-w c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2009-01-01 00:25:32 1,233,920 —-a-w c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8ff50c5d\msxml4.dll
+ 2008-09-30 21:42:08 1,286,152 —-a-w c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9870.0_x-ww_a32d74cf\msxml4.dll
+ 2008-09-30 21:45:12 91,656 —-a-w c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.1.0_x-ww_2a41bceb\msxml4r.dll
+ 2005-09-23 04:49:12 95,744 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841\ATL80.dll
+ 2008-07-25 16:17:20 479,232 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcm80.dll
+ 2008-07-25 16:17:20 558,080 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcp80.dll
+ 2008-07-25 16:17:20 635,904 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcr80.dll
+ 2005-09-23 12:29:16 479,232 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcm80.dll
+ 2005-09-23 12:29:16 548,864 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcp80.dll
+ 2005-09-23 12:29:16 626,688 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcr80.dll
+ 2005-09-23 06:16:02 1,093,632 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfc80.dll
+ 2005-09-23 06:16:06 1,079,808 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfc80u.dll
+ 2005-09-23 06:16:08 69,632 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfcm80.dll
+ 2005-09-23 06:16:10 57,344 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfcm80u.dll
+ 2005-09-23 05:58:06 40,960 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80CHS.dll
+ 2005-09-23 05:58:06 45,056 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80CHT.dll
+ 2005-09-23 05:58:06 65,536 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80DEU.dll
+ 2005-09-23 05:58:06 57,344 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80ENU.dll
+ 2005-09-23 05:58:06 61,440 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80ESP.dll
+ 2005-09-23 05:58:06 61,440 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80FRA.dll
+ 2005-09-23 05:58:06 61,440 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80ITA.dll
+ 2005-09-23 05:58:06 49,152 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80JPN.dll
+ 2005-09-23 05:58:06 49,152 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80KOR.dll
+ 2005-09-23 06:35:10 65,536 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0ee63867\vcomp.dll
+ 2008-07-29 13:05:08 54,272 —-a-w c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_8babbe9a\vcomp90.dll
+ 2008-04-15 17:47:33 1,724,416 —-a-w c:\windows\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.5581_x-ww_dfbc4fc4\GdiPlus.dll
+ 2009-01-01 09:38:03 258,048 —-a-w c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2009-01-01 09:38:03 113,664 —-a-w c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{73c7d5b0-7b03-444a-84c7-ce1ba03b5573}"= "c:\program files\Foxit\tbFox1.dll" [2008-12-31 1784856]

[HKEY_CLASSES_ROOT\clsid\{73c7d5b0-7b03-444a-84c7-ce1ba03b5573}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{73c7d5b0-7b03-444a-84c7-ce1ba03b5573}]
2008-12-31 13:10 1784856 –a—— c:\program files\Foxit\tbFox1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{73c7d5b0-7b03-444a-84c7-ce1ba03b5573}"= "c:\program files\Foxit\tbFox1.dll" [2008-12-31 1784856]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{73C7D5B0-7B03-444A-84C7-CE1BA03B5573}"= "c:\program files\Foxit\tbFox1.dll" [2008-12-31 1784856]

[HKEY_CLASSES_ROOT\clsid\{73c7d5b0-7b03-444a-84c7-ce1ba03b5573}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"OM2_Monitor"="e:\program files\MMonitor.exe" [2007-02-08 95800]
"Google Update"="c:\documents and settings\Mark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-01-01 133104]
"LClock"="e:\program files\LClock\lclock.exe" [2004-09-19 65536]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144]
"lxcymon.exe"="c:\program files\Lexmark 3400 Series\lxcymon.exe" [2007-06-25 291504]
"EzPrint"="c:\program files\Lexmark 3400 Series\ezprint.exe" [2007-06-25 82608]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2007-06-25 295600]
"AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [2008-12-30 579072]
"Dimension4"="c:\program files\D4\D4.exe" [2004-02-04 200704]
"LXCYCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCYtime.dll" [2006-11-21 106496]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 86016]
"WinPatrol"="e:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2008-01-27 316728]
"ZoneAlarm Client"="e:\program files\ZoneAlarm\zlclient.exe" [2008-11-13 981904]
"MSConfig"="c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2005-09-26 169984]
"SoundMan"="SOUNDMAN.EXE" [2008-07-29 c:\windows\SOUNDMAN.EXE]
"nwiz"="nwiz.exe" [2008-09-17 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2008-12-30 219136]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2008-10-16 c:\windows\system32\advpack.dll]
"_nltide_3"="advpack.dll" [2008-10-16 c:\windows\system32\advpack.dll]

c:\documents and settings\Mark\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - e:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
OpenOffice.org 3.0.lnk - g:\program files\OpenOffice.org 3\program\quickstart.exe [2008-09-12 384000]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
APC UPS Status.lnk - c:\program files\APC\APC PowerChute Personal Edition\Display.exe [2008-12-30 221247]
BlueSoleil.lnk - c:\program files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2006-07-16 626176]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyDocs"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\lxcycoms.exe"=
"c:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"c:\\Program Files\\D4\\D4.exe"=
"e:\\Program Files\\Fighter Ace\\rsync.exe"=
"e:\\Program Files\\Fighter Ace\\FA.exe"=

R2 lxcy_device;lxcy_device;c:\windows\system32\lxcycoms.exe -service []
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\McAfee\SiteAdvisor\McSACore.exe" [2008-12-31 206096]
S3 epmntdrv;epmntdrv;\??\c:\windows\system32\epmntdrv.sys [2008-12-31 8704]
S3 EuGdiDrv;EuGdiDrv;\??\c:\windows\system32\EuGdiDrv.sys [2008-12-31 3072]
.
Contents of the 'Scheduled Tasks' folder

2009-01-01 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-01-01 03:32]

2009-01-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-746137067-1336601894-1417001333-1003.job
- c:\documents and settings\Mark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-01-01 03:24]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.comcast.net/a/
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
Trusted Zone: fighterace.ketsujin.com
Trusted Zone: primary.ketsujin.com
Trusted Zone: update.ketsujin.com
Trusted Zone: www.ketsujin.com
Trusted Zone: www.stormofaces.com
FF - ProfilePath - c:\documents and settings\Mark\Application Data\Mozilla\Firefox\Profiles\vxow49wb.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1048306&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - Web Search
FF - prefs.js: browser.startup.homepage - hxxp://www.centralpafire.com
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1048306&SearchSource=2&q=
FF - component: c:\documents and settings\Mark\Application Data\Mozilla\Firefox\Profiles\vxow49wb.default\extensions\{0784CD66-62FE-4cef-ABF4-F8ED9B654ACC}\components\tab_effect_xpcom.dll
FF - component: c:\documents and settings\Mark\Application Data\Mozilla\Firefox\Profiles\vxow49wb.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayAccessService.dll
FF - component: c:\documents and settings\Mark\Application Data\Mozilla\Firefox\Profiles\vxow49wb.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayFormSubmitObserver.dll
FF - component: c:\documents and settings\Mark\Application Data\Mozilla\Firefox\Profiles\vxow49wb.default\extensions\{73c7d5b0-7b03-444a-84c7-ce1ba03b5573}\components\FFAlert.dll
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - component: c:\program files\Mozilla Firefox\extensions\[removed]\components\qfaservices.dll

ATTENTION: FIREFOX POLICES IS IN FORCE
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-01 18:44:56
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCYCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCYtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(944)
c:\windows\system32\cscui.dll
.
Completion time: 2009-01-01 18:45:51
ComboFix-quarantined-files.txt 2009-01-01 23:45:49
ComboFix2.txt 2008-12-31 20:32:59

Pre-Run: 12,989,071,360 bytes free
Post-Run: 12,980,908,032 bytes free

1596 — E O F — 2009-01-01 23:23:02

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:57:12, on 1/1/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\lxcycoms.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\RUNDLL32.EXE
E:\Program Files\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Mark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
E:\Program Files\LClock\lclock.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\WINDOWS\explorer.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
G:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/a/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Foxit Toolbar - {73c7d5b0-7b03-444a-84c7-ce1ba03b5573} - C:\Program Files\Foxit\tbFox1.dll
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: Foxit Toolbar - {73c7d5b0-7b03-444a-84c7-ce1ba03b5573} - C:\Program Files\Foxit\tbFox1.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: Foxit Toolbar - {73c7d5b0-7b03-444a-84c7-ce1ba03b5573} - C:\Program Files\Foxit\tbFox1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [lxcymon.exe] "C:\Program Files\Lexmark 3400 Series\lxcymon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 3400 Series\ezprint.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Dimension4] C:\Program Files\D4\D4.exe
O4 - HKLM\..\Run: [LXCYCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCYtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinPatrol] E:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [ZoneAlarm Client] "E:\Program Files\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OM2_Monitor] "E:\Program Files\MMonitor.exe" -NoStart
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Mark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [LClock] E:\Program Files\LClock\lclock.exe
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = E:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: OpenOffice.org 3.0.lnk = G:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1230756726015
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1230756711093
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: lxcy_device - - C:\WINDOWS\system32\lxcycoms.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

–
End of file - 7323 bytes

Tomk

Post #13January 2, 2009, 2:25 AM UTC

ExTruckie,

DNS is Comcast so that looks OK.

Looks like your updates all worked.

However, found a little Zlob that we need to kill.

You should print out these instructions, or copy them to a Notepad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Please reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.

Once in Safe Mode, double-click SmitfraudFix.exe
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart anyway into normal Windows. A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply along with a new HijackThis log.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Warning : running option #2 on a non infected computer will remove your Desktop background.

ExTruckie

Post #14January 2, 2009, 1:46 PM UTC

Ok I did as instructed and it seemed to work. My desktop was erased

So I had to restore that.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:45:21, on 1/2/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\lxcycoms.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Lexmark 3400 Series\lxcymon.exe
C:\Program Files\Lexmark 3400 Series\ezprint.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\D4\D4.exe
C:\WINDOWS\system32\RUNDLL32.EXE
E:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
E:\Program Files\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Mark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
E:\Program Files\LClock\lclock.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
G:\Program Files\OpenOffice.org 3\program\soffice.exe
G:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
G:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/a
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Foxit Toolbar - {73c7d5b0-7b03-444a-84c7-ce1ba03b5573} - C:\Program Files\Foxit\tbFox1.dll
O2 - BHO: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: Foxit Toolbar - {73c7d5b0-7b03-444a-84c7-ce1ba03b5573} - C:\Program Files\Foxit\tbFox1.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: Foxit Toolbar - {73c7d5b0-7b03-444a-84c7-ce1ba03b5573} - C:\Program Files\Foxit\tbFox1.dll
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [lxcymon.exe] "C:\Program Files\Lexmark 3400 Series\lxcymon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 3400 Series\ezprint.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Dimension4] C:\Program Files\D4\D4.exe
O4 - HKLM\..\Run: [LXCYCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCYtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinPatrol] E:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [ZoneAlarm Client] "E:\Program Files\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OM2_Monitor] "E:\Program Files\MMonitor.exe" -NoStart
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Mark\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [LClock] E:\Program Files\LClock\lclock.exe
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = E:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: OpenOffice.org 3.0.lnk = G:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1230756726015
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1230756711093
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: lxcy_device - - C:\WINDOWS\system32\lxcycoms.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O24 - Desktop Component 0: (no name) - (no file)

–
End of file - 8159 bytes

SmitFraudFix v2.388

Scan done at 8:30:12.54, Fri 01/02/2009
Run from G:\Downloads\New Folder\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\Program Files\Google\googletoolbar1.dll Deleted

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{34E0A626-7D6E-41D5-8EE5-8542BA7F0E46}: DhcpNameServer=[removed] [removed] [removed]
HKLM\SYSTEM\CS1\Services\Tcpip\..\{34E0A626-7D6E-41D5-8EE5-8542BA7F0E46}: DhcpNameServer=[removed] [removed] [removed]
HKLM\SYSTEM\CS2\Services\Tcpip\..\{34E0A626-7D6E-41D5-8EE5-8542BA7F0E46}: DhcpNameServer=[removed] [removed] [removed]
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed] [removed]

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

Tomk

Post #15January 2, 2009, 4:06 PM UTC

ExTruckie,

It appears that your desktop is set as a blank picture. This should correct that.

Go to start -> control panel -> Display properties -> Desktop -> Customize Desktop… -> Web tab, then uncheck and delete everything you find in there (except for "My current home page"),

Also remove the checkmark from the the Lock Desktop Items box if it is checked.
Apply.
Apply and Exit Display properties.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Windows update cannot phone home

✨ Ask AI

Ask AI