Spyware / Malware / Virus Removal

[Resolved] Have I been infected #2

17 min read

Looking for the outcome? Ask AI

barry35 Topic Starter

Post #1February 4, 2009, 3:03 PM UTC

Here is the combo fix log……..

ComboFix 09-02-03.01 - Barry Vickers 2009-02-04 6:47:38.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.502.256 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: and Settings\Barry Vickers\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1296 [VPS 090203-1] *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\_000116_.tmp.dll
c:\windows\system32\IlUEKRqr.ini
c:\windows\system32\IlUEKRqr.ini2
c:\windows\system32\kfkkvtup.ini
c:\windows\system32\xgghogjr.ini

.
((((((((((((((((((((((((( Files Created from 2009-01-04 to 2009-02-04 )))))))))))))))))))))))))))))))
.

2009-01-29 16:12 . 2009-01-29 16:12 d——– c:\documents and settings\Kristen\Application Data\Viewpoint
2009-01-29 11:26 . 2009-01-29 11:26 d——– c:\documents and settings\Barry Vickers\Application Data\Viewpoint
2009-01-28 14:19 . 2009-01-28 14:19 d——– c:\windows\system32\portraitsofautumn_3125138 dir
2009-01-28 14:19 . 2009-01-28 14:19 520,192 –a—— c:\windows\system32\portraitsofautumn_3125138.scr
2009-01-28 14:16 . 2009-01-28 14:16 d——– c:\windows\system32\mountainscenery_3143988 dir
2009-01-28 14:16 . 2009-01-28 14:16 520,192 –a—— c:\windows\system32\mountainscenery_3143988.scr
2009-01-28 12:50 . 2009-01-28 12:50 410,984 –a—— c:\windows\system32\deploytk.dll
2009-01-28 11:56 . 2009-01-28 11:56 d——– c:\program files\Trend Micro
2009-01-27 13:23 . 2009-01-27 13:23 d——– C:\Users
2009-01-27 13:23 . 2009-01-27 13:23 5,156,864 –a—— C:\SYSTEM
2009-01-27 13:23 . 2009-01-27 13:23 299,008 –a—— C:\DEFAULT
2009-01-27 13:23 . 2009-01-27 13:23 24,576 –a—— C:\SAM
2009-01-27 13:21 . 2009-01-27 13:23 38,973,440 –a—— C:\SOFTWARE
2009-01-27 13:21 . 2009-01-27 13:21 53,248 –a—— C:\SECURITY
2009-01-27 13:07 . 2009-01-27 15:03 d——– c:\program files\PC Tune-Up
2009-01-27 12:52 . 2006-02-15 14:10 397,312 –a—— c:\windows\system32\drivers\ETNADiag.exe
2009-01-27 12:37 . 2009-01-27 12:37 d——– c:\program files\PCCheckupOnline
2009-01-26 17:42 . 2009-01-26 17:42 d——– C:\QuickTimePlayer.Resources
2009-01-26 17:42 . 2009-01-26 17:42 d——– C:\QTSystem
2009-01-26 17:42 . 2009-01-26 17:42 d——– C:\QTComponents
2009-01-26 17:42 . 2009-01-26 17:42 d——– C:\PropertyPanels
2009-01-26 17:42 . 2009-01-26 17:42 d——– C:\Plugins
2009-01-26 17:42 . 2009-01-26 17:42 d——– C:\PictureViewer.Resources
2009-01-26 17:37 . 2009-01-26 17:40 21,878,064 –a—— C:\QuickTimeInstaller.exe
2009-01-26 17:12 . 2009-01-26 17:12 d——– c:\program files\iTunes
2009-01-26 17:12 . 2009-01-26 17:12 d——– c:\program files\iPod
2009-01-26 17:12 . 2009-01-26 17:12 d——– c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-26 17:12 . 2008-04-17 13:12 107,368 –a—— c:\windows\system32\GEARAspi.dll
2009-01-26 17:12 . 2008-04-17 13:12 15,464 –a—— c:\windows\system32\drivers\GEARAspiWDM.sys
2009-01-26 17:10 . 2009-01-26 17:10 d——– c:\program files\Common Files\Apple
2009-01-26 16:47 . 2009-01-26 16:47 d——– c:\program files\Microsoft Calculator Plus
2009-01-26 16:23 . 2009-02-04 06:50 d——– c:\windows\system32\CatRoot2
2009-01-26 15:52 . 2009-01-26 15:52 69,076,264 –a—— C:\Quicktime.exe
2009-01-26 15:40 . 2009-01-26 15:40 d——– c:\windows\system32\config\systemprofile\Application Data\TeamViewer
2009-01-26 15:39 . 2009-01-26 15:39 d——– c:\program files\TeamViewer
2009-01-26 11:56 . 2009-01-26 11:56 d——– c:\program files\Salloway
2009-01-26 10:01 . 2009-01-26 10:13 d——– c:\program files\PowerISO
2009-01-25 21:30 . 2009-01-25 21:30 d——– c:\windows\system32\DRM
2009-01-25 16:37 . 2009-01-25 16:37 d——– c:\documents and settings\Kristen\Application Data\Windows Desktop Search
2009-01-25 16:37 . 2009-01-25 16:37 d——– c:\documents and settings\Kristen\Application Data\Logitech
2009-01-25 15:13 . 2009-01-27 11:13 d——– c:\documents and settings\Barry Vickers\Application Data\OfficeUpdate12
2009-01-25 15:10 . 2009-01-25 15:10 d——– c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-01-25 15:06 . 2009-01-29 12:09 d——– c:\program files\MagicISO
2009-01-25 14:53 . 2009-01-25 14:53 d——– c:\documents and settings\Barry Vickers\Application Data\Runaware
2009-01-25 14:53 . 2009-01-25 14:53 d——– c:\documents and settings\Barry Vickers\Application Data\ICAClient
2009-01-25 13:04 . 2009-01-25 13:04 d——– c:\program files\Common Files\Windows Live
2009-01-25 12:09 . 2009-01-25 12:09 d——– c:\program files\MSBuild
2009-01-25 11:39 . 2009-01-25 11:39 127,034 -r——- c:\windows\bwUnin-8.1.1.50-8876480SL.exe
2009-01-25 11:37 . 2007-01-23 15:45 1,419,024 –a—— c:\windows\system32\WdfCoInstaller01005.dll
2009-01-25 11:37 . 2007-01-23 15:44 101,136 –a—— c:\windows\KHALMNPR.Exe
2009-01-25 11:37 . 2007-01-23 15:45 34,576 –a—— c:\windows\system32\drivers\LHidFilt.Sys
2009-01-25 11:37 . 2007-01-23 15:45 33,296 –a—— c:\windows\system32\drivers\LMouFilt.Sys
2009-01-25 11:36 . 2007-01-30 01:46 163,840 –a—— c:\windows\system32\kemutb.dll
2009-01-25 11:36 . 2007-01-30 01:46 135,168 –a—— c:\windows\system32\KemUtil.dll
2009-01-25 11:36 . 2007-01-30 01:46 110,592 –a—— c:\windows\system32\KemWnd.dll
2009-01-25 11:36 . 2007-01-30 01:46 69,632 –a—— c:\windows\system32\KemXML.dll
2009-01-25 11:25 . 2009-01-25 11:25 d——– c:\documents and settings\Barry Vickers\Application Data\True Sword
2009-01-25 09:45 . 2009-01-25 09:45 d——– c:\documents and settings\Barry Vickers\Application Data\Windows Search
2009-01-25 09:45 . 2009-01-25 09:45 d——– c:\documents and settings\Barry Vickers\Application Data\Windows Desktop Search
2009-01-25 09:44 . 2009-01-26 15:58 d–h—– c:\windows\system32\GroupPolicy
2009-01-25 09:44 . 2009-01-25 09:44 d——– c:\program files\Windows Desktop Search
2009-01-24 19:29 . 2009-01-24 19:29 d——– c:\program files\Microsoft
2009-01-24 16:15 . 2009-01-25 12:10 d——– c:\program files\Microsoft Works
2009-01-24 16:14 . 2009-01-24 16:14 d——– c:\program files\Microsoft.NET
2009-01-24 16:13 . 2009-01-24 16:13 d——– c:\documents and settings\All Users\Application Data\DriverScanner
2009-01-24 15:40 . 2006-10-26 19:56 32,592 –a—— c:\windows\system32\msonpmon.dll
2009-01-24 15:33 . 2009-01-25 12:01 d——– c:\program files\Microsoft Visual Studio 8
2009-01-24 15:32 . 2009-01-25 12:08 d——– c:\windows\SHELLNEW
2009-01-24 15:32 . 2009-01-28 12:34 d——– c:\documents and settings\All Users\Application Data\Microsoft Help
2009-01-24 15:31 . 2009-01-24 15:31 dr-h—– C:\MSOCache
2009-01-23 17:11 . 2009-01-24 16:13 d——– c:\documents and settings\Barry Vickers\Application Data\Uniblue
2009-01-22 18:23 . 2009-01-29 12:09 d——– c:\documents and settings\Barry Vickers\Application Data\TeamViewer
2009-01-22 18:22 . 2009-01-22 18:22 d——– c:\documents and settings\Barry Vickers\temp
2009-01-22 17:58 . 2009-01-25 09:44 1,374 –a—— c:\windows\imsins.BAK
2009-01-22 15:46 . 2008-04-13 17:12 116,224 –a—— c:\windows\system32\dllcache\xrxwiadr.dll
2009-01-22 15:46 . 2001-08-17 22:37 27,648 –a—— c:\windows\system32\dllcache\xrxftplt.exe
2009-01-22 15:46 . 2001-08-17 22:36 23,040 –a—— c:\windows\system32\dllcache\xrxwbtmp.dll
2009-01-22 15:46 . 2008-04-13 17:12 18,944 –a—— c:\windows\system32\dllcache\xrxscnui.dll
2009-01-22 15:45 . 2001-08-17 22:37 99,865 –a—— c:\windows\system32\dllcache\xlog.exe
2009-01-22 15:45 . 2004-08-03 22:29 19,455 –a—— c:\windows\system32\dllcache\wvchntxx.sys
2009-01-22 15:45 . 2008-04-13 11:46 19,200 –a—— c:\windows\system32\dllcache\wstcodec.sys
2009-01-22 15:45 . 2001-08-17 12:11 16,970 –a—— c:\windows\system32\dllcache\xem336n5.sys
2009-01-22 15:45 . 2004-08-03 22:29 12,063 –a—— c:\windows\system32\dllcache\wsiintxx.sys
2009-01-22 15:45 . 2008-04-13 17:12 8,192 –a—— c:\windows\system32\dllcache\wshirda.dll
2009-01-22 15:45 . 2001-08-17 22:37 4,608 –a—— c:\windows\system32\dllcache\xrxflnch.exe
2009-01-22 15:43 . 2001-08-17 13:28 794,399 –a—— c:\windows\system32\dllcache\usr1806v.sys
2009-01-22 15:42 . 2001-08-17 13:28 794,654 –a—— c:\windows\system32\dllcache\usr1801.sys
2009-01-22 15:41 . 2001-08-17 22:36 525,568 –a—— c:\windows\system32\dllcache\tridxp.dll
2009-01-22 15:41 . 2001-08-17 14:56 440,576 –a—— c:\windows\system32\dllcache\tridkb.dll
2009-01-22 15:41 . 2001-08-17 14:56 315,520 –a—— c:\windows\system32\dllcache\trid3d.dll
2009-01-22 15:41 . 2001-08-17 14:01 241,664 –a—— c:\windows\system32\dllcache\tosdvd02.sys
2009-01-22 15:41 . 2001-08-17 14:02 230,912 –a—— c:\windows\system32\dllcache\tosdvd03.sys
2009-01-22 15:41 . 2001-08-17 12:51 222,336 –a—— c:\windows\system32\dllcache\trid3dm.sys
2009-01-22 15:41 . 2001-08-17 12:51 166,784 –a—— c:\windows\system32\dllcache\tridxpm.sys
2009-01-22 15:41 . 2001-08-17 12:51 159,232 –a—— c:\windows\system32\dllcache\tridkbm.sys
2009-01-22 15:41 . 2008-04-13 17:12 82,944 –a—— c:\windows\system32\dllcache\tp4mon.exe
2009-01-22 15:41 . 2001-08-17 22:35 42,496 –a—— c:\windows\system32\dllcache\tp4res.dll
2009-01-22 15:41 . 2001-08-17 12:12 34,375 –a—— c:\windows\system32\dllcache\tpro4.sys
2009-01-22 15:41 . 2001-08-17 22:36 31,744 –a—— c:\windows\system32\dllcache\tp4.dll
2009-01-22 15:41 . 2001-08-17 12:10 28,232 –a—— c:\windows\system32\dllcache\tos4mo.sys
2009-01-22 15:39 . 2001-08-17 12:18 285,760 –a—— c:\windows\system32\dllcache\stlnata.sys
2009-01-22 15:38 . 2001-08-17 14:56 147,200 –a—— c:\windows\system32\dllcache\smidispb.dll
2009-01-22 15:37 . 2001-08-17 14:56 252,032 –a—— c:\windows\system32\dllcache\sis300iv.dll
2009-01-22 15:36 . 2001-08-17 22:36 495,616 –a—— c:\windows\system32\dllcache\sblfx.dll
2009-01-22 15:35 . 2001-08-17 14:56 245,632 –a—— c:\windows\system32\dllcache\s3savmx.dll
2009-01-22 15:34 . 2001-08-17 13:28 899,146 –a—— c:\windows\system32\dllcache\r2mdkxga.sys
2009-01-22 15:33 . 2001-08-17 14:04 173,696 –a—— c:\windows\system32\dllcache\philcam2.sys
2009-01-22 15:32 . 2008-04-13 17:10 259,328 –a—— c:\windows\system32\dllcache\perm3dd.dll
2009-01-22 15:31 . 2001-08-17 14:05 351,616 –a—— c:\windows\system32\dllcache\ovcodek2.sys
2009-01-22 15:30 . 2001-08-17 12:50 198,144 –a—— c:\windows\system32\dllcache\nv3.sys
2009-01-22 15:30 . 2001-08-17 22:36 123,776 –a—— c:\windows\system32\dllcache\nv3.dll
2009-01-22 15:30 . 2001-08-17 12:49 51,552 –a—— c:\windows\system32\dllcache\ntgrip.sys
2009-01-22 15:30 . 2001-08-17 22:36 38,912 –a—— c:\windows\system32\dllcache\EXCH_ntfsdrv.dll
2009-01-22 15:30 . 2008-04-13 11:54 28,672 –a—— c:\windows\system32\dllcache\nscirda.sys
2009-01-22 15:30 . 2001-08-17 13:47 9,344 –a—— c:\windows\system32\dllcache\ntapm.sys
2009-01-22 15:30 . 2001-08-17 13:53 7,552 –a—— c:\windows\system32\dllcache\nsmmc.sys
2009-01-22 15:28 . 2001-08-17 12:11 128,000 –a—— c:\windows\system32\dllcache\n100325.sys
2009-01-22 15:28 . 2001-08-17 12:50 103,296 –a—— c:\windows\system32\dllcache\mtxvideo.sys
2009-01-22 15:28 . 2001-08-17 13:50 75,520 –a—— c:\windows\system32\dllcache\mxport.sys
2009-01-22 15:28 . 2001-08-17 12:11 52,255 –a—— c:\windows\system32\dllcache\n1000nt5.sys
2009-01-22 15:28 . 2008-04-13 11:46 49,024 –a—— c:\windows\system32\dllcache\mstape.sys
2009-01-22 15:28 . 2001-08-17 13:50 21,888 –a—— c:\windows\system32\dllcache\mxcard.sys
2009-01-22 15:28 . 2001-08-17 13:49 19,968 –a—— c:\windows\system32\dllcache\mxnic.sys
2009-01-22 15:28 . 2001-08-17 22:36 19,968 –a—— c:\windows\system32\dllcache\mxicfg.dll
2009-01-22 15:28 . 2001-08-17 13:48 12,416 –a—— c:\windows\system32\dllcache\msriffwv.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-01 02:04 ——— d—–w c:\documents and settings\Barry Vickers\Application Data\LimeWire
2009-01-29 20:09 ——— d—–w c:\program files\LimeWire
2009-01-28 20:55 ——— d—–w c:\program files\Java
2009-01-27 20:53 ——— d–h–w c:\program files\InstallShield Installation Information
2009-01-27 20:53 ——— d—–w c:\program files\Common Files\Sonic Shared
2009-01-27 20:50 ——— d—–w c:\program files\Intel
2009-01-27 20:38 ——— d—–w c:\program files\Dell
2009-01-26 17:54 ——— d—–w c:\program files\MSECache
2009-01-23 04:17 ——— d—–w c:\documents and settings\All Users\Application Data\McAfee
2009-01-23 04:11 ——— d—–w c:\program files\Roxio
2009-01-23 04:08 ——— d—–w c:\program files\Malwarebytes' Anti-Malware
2009-01-22 22:34 ——— d—–w c:\documents and settings\LocalService\Application Data\SACore
2009-01-07 02:45 ——— d—–w c:\program files\WildTangent
2008-12-18 15:38 ——— d—–w c:\program files\Yahoo!
2008-12-18 15:38 ——— d—–w c:\documents and settings\LocalService\Application Data\Yahoo!
2008-12-18 15:38 ——— d—–w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2008-12-11 10:57 333,952 —-a-w c:\windows\system32\drivers\srv.sys
2008-12-08 03:14 ——— d—–w c:\documents and settings\Kristen\Application Data\OLYMPUS
2008-12-08 02:56 ——— d—–w c:\documents and settings\Barry Vickers\Application Data\OLYMPUS
2008-12-08 02:54 ——— d—–w c:\program files\OLYMPUS
2008-12-07 00:54 ——— d—–w c:\program files\Google
2008-12-05 03:54 524,288 —-a-w c:\windows\opuc.dll
2008-11-20 17:24 50,816 —-a-w c:\documents and settings\Barry Vickers\Application Data\GDIPFONTCACHEV1.DAT
2007-11-28 19:12 67,696 —-a-w c:\program files\mozilla firefox\components\jar50.dll
2007-11-28 19:12 54,376 —-a-w c:\program files\mozilla firefox\components\jsd3250.dll
2007-11-28 19:12 34,952 —-a-w c:\program files\mozilla firefox\components\myspell.dll
2007-11-28 19:12 46,720 —-a-w c:\program files\mozilla firefox\components\spellchk.dll
2007-11-28 19:12 172,144 —-a-w c:\program files\mozilla firefox\components\xpinstal.dll
2008-11-02 18:32 104 –sha-r c:\windows\system32\66C874FF70.sys
2008-06-25 21:20 32,768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008062520080626\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"OM_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master\Monitor.exe" [2006-05-16 57344]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"QuickTime Task"="C:\QTTask.exe" [2009-01-05 413696]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-28 136600]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 c:\windows\KHALMNPR.Exe]

c:\documents and settings\Barry Vickers\Start Menu\Programs\Startup\
Microsoft Office Groove.lnk - c:\program files\Microsoft Office\Office12\GROOVE.EXE [2007-08-29 340856]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]
OneNote Table Of Contents.onetoc2 [2009-01-25 3656]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-01-25 67128]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-01-25 688128]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= pvmjpg21.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MpfService"=2 (0x2)
"McSysmon"=3 (0x3)
"McShield"=2 (0x2)
"McProxy"=2 (0x2)
"McODS"=3 (0x3)
"McNASvc"=2 (0x2)
"mcmscsvc"=2 (0x2)
"McAfee SiteAdvisor Service"=2 (0x2)
"bgsvcgen"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-01-27 111184]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-01-27 20560]
.
Contents of the 'Scheduled Tasks' folder

2009-01-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-02-02 c:\windows\Tasks\At1.job
- c:\progra~1\PERFEC~1\PerfectOptimizer.exe [2008-10-02 08:34]

2008-12-30 c:\windows\Tasks\RegistrySmart Scheduled Scan.job
- c:\program files\RegistrySmart\RegistrySmart.exe []

2008-12-30 c:\windows\Tasks\RegistrySmart Scheduled Scan.job
- c:\program files\RegistrySmart []

2009-01-29 c:\windows\Tasks\Schedule Task Weekly.job
- c:\program files\Registry Easy\RE.exe []
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
Notify-mlJDwXpq - mlJDwXpq.dll

.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&fr=yie7c
mWindow Title = Microsoft Internet Explorer
IE: &Search
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
Trusted Zone: musicmatch.com\online
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-04 06:52:29
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\scardsvr.exe
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\dllhost.exe
c:\program files\Common Files\Logitech\khalshared\KHALMNPR.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-02-04 6:55:33 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-04 14:55:30

Pre-Run: 52,824,182,784 bytes free
Post-Run: 52,916,518,912 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

294 — E O F — 2009-01-25 00:01:30

Here is the new hijack this log……..

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:01:20 AM, on 2/4/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\MSN\Toolbar\3.0.0988.2\msntask.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
O4 - Startup: Microsoft Office Groove.lnk = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: OneNote Table Of Contents.onetoc2
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://pccheckup.dellfix.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1214425251765
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

–
End of file - 7637 bytes

Sorry CatByte it took me so long to respond but I was working…..

Thanks
Barry

CatByte

Post #2February 4, 2009, 3:57 PM UTC

That's no problem Barry, we can pick it up from here….give me a little while to look over your log and I'll be back with further instructions:

barry35

Post #3February 4, 2009, 4:18 PM UTC

Thank you very much

CatByte

Post #4February 5, 2009, 10:07 AM UTC

Hi Barry35,

You still have a number of unwanted items on your computer.

I need a fresh list of your installed programs.

Please run HJT and click on Open the Misc Tools section.
· Click Open Uninstall Manager…
· Click Save list... and save it to your Desktop.
· Copy and paste the file uninstall_list.txt into your next reply.

Then scan normally with HJT again and save a logfile.
Please copy/paste that log here also.

In your reply I need:

Uninstall list
Fresh HJT log

barry35

Post #5February 5, 2009, 2:46 PM UTC

Here is the uninstall list from hj……

2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
Acrobat.com
Adobe AIR
Adobe Flash Player ActiveX
Adobe Reader 9
America Online (Choose which version to remove)
AOL Coach Version 1.0(Build:20040229.1 en)
AOL Connectivity Services
AOLIcon
Apple Mobile Device Support
Apple Software Update
avast! Antivirus
Bonjour
CDDRV_Installer
Compatibility Pack for the 2007 Office system
Conexant D850 56K V.9x DFVc Modem
Dell CinePlayer
Dell Digital Jukebox Driver
Dell Driver Reset Tool
Dell Game Console
DellSupport
Digital Content Portal
Digital Line Detect
Documentation & Support Launcher
EarthLink setup files
EducateU
ELIcon
Games, Music, & Photos Launcher
High Definition Audio Driver Package - KB835221
Hijackthis 1.99.1
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 10 (KB903157)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB942288-v3)
Hotfix for Windows XP (KB952287)
Intel® Graphics Media Accelerator Driver
Intel® PRO Network Connections Drivers
Intel® PROSet for Wired Connections
Internet Service Offers Launcher
iTunes
Java 2 Runtime Environment, SE v1.4.2_03
Java™ 6 Update 11
KhalSetup
LimeWire 4.18.8
Logitech Desktop Messenger
Logitech SetPoint
Magic ISO Maker v4.9 (build 0144)
MCE Configuration Reset
MCU
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Calculator Plus
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft National Language Support Downlevel APIs
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Live Add-in 1.3
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Modem Helper
mountainscenery_3143988 Screen Saver
MSN Toolbar
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
Musicmatch for Windows Media Player
Musicmatch® Jukebox
NetWaiting
NetZeroInstallers
OLYMPUS Master
Otto
Perfect Optimizer 3.4
Picasa 3
portraitsofautumn_3125138 Screen Saver
PowerISO
QuickTime
Security Update for 2007 Microsoft Office System (KB951550)
Security Update for 2007 Microsoft Office System (KB951944)
Security Update for 2007 Microsoft Office System (KB958439)
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft Office Excel 2007 (KB958437)
Security Update for Microsoft Office OneNote 2007 (KB950130)
Security Update for Microsoft Office PowerPoint 2007 (KB951338)
Security Update for Microsoft Office Publisher 2007 (KB950114)
Security Update for Microsoft Office system 2007 (KB954326)
Security Update for Microsoft Office system 2007 (KB956828)
Security Update for Microsoft Office Word 2007 (KB956358)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Sonic Activation Module
Sonic Encoders
Sonic Update Manager
TestDrive Client
Update for Microsoft Office 2007 Help for Common Features (KB957244)
Update for Microsoft Office Access 2007 Help (KB957241)
Update for Microsoft Office Excel 2007 Help (KB957242)
Update for Microsoft Office InfoPath 2007 Help (KB957243)
Update for Microsoft Office OneNote 2007 Help (KB957245)
Update for Microsoft Office Outlook 2007 (KB952142)
Update for Microsoft Office Outlook 2007 Help (KB957246)
Update for Microsoft Office PowerPoint 2007 Help (KB957247)
Update for Microsoft Office Publisher 2007 Help (KB957249)
Update for Microsoft Office Word 2007 Help (KB957252)
Update for Microsoft Script Editor Help (KB957253)
Update for Office 2007 (KB946691)
Update for Outlook 2007 Junk Email Filter (kb959141)
Update for Windows Media Player 10 (KB913800)
Update for Windows Media Player 10 (KB926251)
Update for Windows XP (KB943729)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update Rollup 2 for Windows XP Media Center Edition 2005
Viewpoint Media Player
WebCyberCoach 3.2 Dell
Windows Internet Explorer 7
Windows Live installer
Windows Live Sign-in Assistant
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 10
Windows Media Player 10 Hotfix [See EmeraldQFE2 for more information]
Windows Media Player 11
Windows Media Player 11
Windows Rights Management Client Backwards Compatibility SP2
Windows Rights Management Client with Service Pack 2
Windows Search 4.0
Windows XP Media Center Edition 2005 KB908246
Windows XP Media Center Edition 2005 KB925766
Windows XP Service Pack 3
WinRAR archiver
Yahoo! Browser Services
Yahoo! Install Manager
Yahoo! Toolbar

Here is the new hj log…………

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:46:04 AM, on 2/5/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Microsoft Office\Office12\GROOVE.EXE
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\MSN\Toolbar\3.0.0988.2\msntask.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
O4 - Startup: Microsoft Office Groove.lnk = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: OneNote Table Of Contents.onetoc2
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://pccheckup.dellfix.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1214425251765
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

–
End of file - 7798 bytes

CatByte

Post #6February 6, 2009, 12:39 PM UTC

Hi Barry 35,

Couple of things I need you to do.

There is an unknown file I would like to get analyzed

Make sure to use Internet Explorer for this
Please go to VirSCAN.org FREE on-line scan service
Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:
- c:\windows\system32\66C874FF70.sys
Click on the Upload button
If a pop-up appears saying the file has been scanned already, please select the ReScan button.
Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
Paste the contents of the Clipboard in your next reply.

Next:

You have several programs installed that I recommend you remove through Add/Remove programs.

These are optional and your choice if you choose whether to remove them or not, but your computer will be better off without them

1. Perfect Optimizer 3.4 - I don't recommend any registry programs whatsoever, they can do more harm than good.
2. Viewpoint - view point is not necessarily 'bad', it is considered 'foistware' meaning most people don't know it is installed on their computer. It monitors surfing habits.
3. Limewire - peer to peer programs are the main reason why there are so many infected computers - you cannot trust the source of the files you are downloading, you would be doing yourself a favour by removing it.

Go to Start>Control Panel>Add/remove Programs

A list of installed programs will populate,
one by one, locate the above described programs and select REMOVE.
Exit Add/Remove programs

NEXT

Your Java is out of date and you have other old versions still on your computer, those old versions are now a security vulnerability:

Please download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.
Open JavaRa.exe again and select Search For Updates.
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer - Version 6 update 12

NEXT

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box, put your mouse cursor at the very beginning of the text and then hold down the left button and drag your mouse so that all of the text is highlighted. Press Ctrl+C (or right click on the highlighted section and choose 'copy')

File::
c:\windows\bwUnin-8.1.1.50-8876480SL.exe
c:\windows\Tasks\At1.job
c:\windows\Tasks\RegistrySmart Scheduled Scan.job
c:\windows\Tasks\Schedule Task Weekly.job

Folder::
c:\documents and settings\Barry Vickers\Application Data\True Sword
c:\program files\PerfectOptimizer
c:\program files\RegistrySmart
c:\program files\Registry Easy

Now paste the copied text into the open notepad. To do this click in the blank page so that your cursor is flashing there and press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

* Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
* ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
* When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

In your next reply I need

Combofix log

Please also describe how your computer is running now.

barry35

Post #7February 6, 2009, 3:00 PM UTC

Here is what you asked for…………

VirSCAN.org Scanned Report :
Scanned time : 2009/02/06 06:05:55 (PST)
Scanner results: All Scanners reported not find malware!
File Name : 66C874FF70.sys
File Size : 104 byte
File Type : data
MD5 : e67a414f8dd818c5c585b4f9ce217cbf
SHA1 : 48277f4bc7d8674ce6aa398e1fbb8fcdae84d182
Online report : http://virscan.org/report/193cee064fb1ff48…ef53b953fd.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.0.0.29 20090206011617 2009-02-06 2.60 -
AhnLab V3 2009.02.07.00 2009.02.07 2009-02-07 1.49 -
AntiVir 7.9.0.74 7.1.1.237 2009-02-06 1.92 -
Antiy 2.0.18 20090206.2159922 2009-02-06 0.12 -
Authentium 5.1.1 200902051925 2009-02-05 1.08 -
AVAST! 3.0.1 090205-1 2009-02-05 0.00 -
AVG 7.5.52.442 270.10.18/1936 2009-02-05 1.90 -
BitDefender 7.81008.2639993 7.23526 2009-02-06 2.45 -
CA (VET) 9.0.0.143 31.6.6345 2009-02-06 6.60 -
ClamAV 0.94.2 8960 2009-02-06 0.00 -
Comodo 3.0 966 2009-02-06 2.14 -
CP Secure 1.1.0.715 2009.02.06 2009-02-06 6.78 -
Dr.Web 4.44.0.9170 2009.02.06 2009-02-06 4.00 -
F-Prot 4.4.4.56 20090205 2009-02-05 1.19 -
F-Secure 5.51.6100 2009.02.06.02 2009-02-06 4.54 -
Fortinet 2.81-3.117 10.3 2009-02-06 0.57 -
GData 19.2847/19.215 20090206 2009-02-06 5.85 -
ViRobot 20090206 2009.02.06 2009-02-06 0.85 -
Ikarus T3.1.01.45 2009.02.06.72264 2009-02-06 3.70 -
JiangMin 11.0.706 2009.02.06 2009-02-06 3.67 -
Kaspersky 5.5.10 2009.02.06 2009-02-06 0.02 -
KingSoft 2008.9.8.18 2009.2.6.21 2009-02-06 0.60 -
McAfee 5.3.00 5517 2009-02-05 3.10 -
Microsoft 1.4306 2009.02.06 2009-02-06 5.33 -
mks_vir 2.01 2009.02.05 2009-02-05 2.85 -
Norman 6.00.02 6.00.00 2009-02-06 8.01 -
Panda 9.05.01 2009.02.05 2009-02-05 2.13 -
Trend Micro 8.700-1004 5.822.01 2009-02-06 0.02 -
Quick Heal 10.00 2009.02.06 2009-02-06 0.90 -
Rising 20.0 21.15.40.00 2009-02-06 0.26 -
Sophos 2.83.3 4.38 2009-02-06 2.29 -
Sunbelt 4801 4801 2009-02-05 0.79 -
Symantec 1.3.0.24 20090205.007 2009-02-05 0.20 -
nProtect 20090206.03 3110296 2009-02-06 6.09 -
The Hacker [removed] v00248 2009-02-06 0.47 -
VBA32 3.12.8.12 20090205.1235 2009-02-05 1.51 -
VirusBuster 4.5.11.10 10.101.3/894342 2009-02-06 1.13

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:58:51 AM, on 2/6/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Microsoft Office\Office12\GROOVE.EXE
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\MSN\Toolbar\3.0.0988.2\msntask.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
O4 - Startup: Microsoft Office Groove.lnk = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: OneNote Table Of Contents.onetoc2
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://pccheckup.dellfix.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1214425251765
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

–
End of file - 7681 bytes

I hope I did this correctly…….

CatByte

Post #8February 6, 2009, 3:07 PM UTC last edited February 6, 2009, 3:19 PM UTC

Good job. Can you please post the combofix log also please advise how your computer is running now…..

barry35

Post #9February 6, 2009, 6:34 PM UTC

ComboFix 09-02-06.01 - Barry Vickers 2009-02-06 10:26:29.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.502.200 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Barry Vickers\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1296 [VPS 090206-0] *On-access scanning disabled* (Updated)
* Created a new restore point

FILE ::
c:\windows\bwUnin-8.1.1.50-8876480SL.exe
c:\windows\Tasks\At1.job
c:\windows\Tasks\RegistrySmart Scheduled Scan.job
c:\windows\Tasks\Schedule Task Weekly.job
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Barry Vickers\Application Data\True Sword
c:\program files\Registry Easy
c:\program files\Registry Easy\RepairBackup\_20081127_181435.reg
c:\windows\bwUnin-8.1.1.50-8876480SL.exe
c:\windows\Tasks\At1.job
c:\windows\Tasks\RegistrySmart Scheduled Scan.job
c:\windows\Tasks\Schedule Task Weekly.job

.
((((((((((((((((((((((((( Files Created from 2009-01-06 to 2009-02-06 )))))))))))))))))))))))))))))))
.

2009-02-06 06:19 . 2009-02-06 06:25 d——– c:\documents and settings\Barry Vickers\.SunDownloadManager
2009-02-05 07:24 . 2009-02-05 07:24 d——– c:\windows\system32\XPSViewer
2009-02-05 07:24 . 2009-02-05 07:24 d——– c:\program files\Reference Assemblies
2009-02-05 07:23 . 2009-02-05 07:23 d——– C:\afae403cd4a70e42346c87d27d027787
2009-02-05 07:23 . 2008-07-06 04:06 1,676,288 ——— c:\windows\system32\xpssvcs.dll
2009-02-05 07:23 . 2008-07-06 04:06 1,676,288 ——— c:\windows\system32\dllcache\xpssvcs.dll
2009-02-05 07:23 . 2008-07-06 02:50 597,504 ——— c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-05 07:23 . 2008-07-06 04:06 575,488 ——— c:\windows\system32\xpsshhdr.dll
2009-02-05 07:23 . 2008-07-06 04:06 575,488 ——— c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-05 07:23 . 2008-07-06 04:06 117,760 ——— c:\windows\system32\prntvpt.dll
2009-02-05 07:23 . 2008-07-06 04:06 89,088 ——— c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-05 07:22 . 2009-02-05 10:33 d——– c:\windows\SxsCaPendDel
2009-01-29 16:12 . 2009-01-29 16:12 d——– c:\documents and settings\Kristen\Application Data\Viewpoint
2009-01-29 11:26 . 2009-01-29 11:26 d——– c:\documents and settings\Barry Vickers\Application Data\Viewpoint
2009-01-28 14:19 . 2009-01-28 14:19 d——– c:\windows\system32\portraitsofautumn_3125138 dir
2009-01-28 14:19 . 2009-01-28 14:19 520,192 –a—— c:\windows\system32\portraitsofautumn_3125138.scr
2009-01-28 14:16 . 2009-01-28 14:16 d——– c:\windows\system32\mountainscenery_3143988 dir
2009-01-28 14:16 . 2009-01-28 14:16 520,192 –a—— c:\windows\system32\mountainscenery_3143988.scr
2009-01-28 12:50 . 2009-01-28 12:50 410,984 –a—— c:\windows\system32\deploytk.dll
2009-01-28 11:56 . 2009-01-28 11:56 d——– c:\program files\Trend Micro
2009-01-27 13:23 . 2009-01-27 13:23 d——– C:\Users
2009-01-27 13:23 . 2009-01-27 13:23 5,156,864 –a—— C:\SYSTEM
2009-01-27 13:23 . 2009-01-27 13:23 299,008 –a—— C:\DEFAULT
2009-01-27 13:23 . 2009-01-27 13:23 24,576 –a—— C:\SAM
2009-01-27 13:21 . 2009-01-27 13:23 38,973,440 –a—— C:\SOFTWARE
2009-01-27 13:21 . 2009-01-27 13:21 53,248 –a—— C:\SECURITY
2009-01-27 13:07 . 2009-01-27 15:03 d——– c:\program files\PC Tune-Up
2009-01-27 12:52 . 2006-02-15 14:10 397,312 –a—— c:\windows\system32\drivers\ETNADiag.exe
2009-01-27 12:37 . 2009-01-27 12:37 d——– c:\program files\PCCheckupOnline
2009-01-26 17:42 . 2009-01-26 17:42 d——– C:\QuickTimePlayer.Resources
2009-01-26 17:42 . 2009-01-26 17:42 d——– C:\QTSystem
2009-01-26 17:42 . 2009-01-26 17:42 d——– C:\QTComponents
2009-01-26 17:42 . 2009-01-26 17:42 d——– C:\PropertyPanels
2009-01-26 17:42 . 2009-01-26 17:42 d——– C:\Plugins
2009-01-26 17:42 . 2009-01-26 17:42 d——– C:\PictureViewer.Resources
2009-01-26 17:37 . 2009-01-26 17:40 21,878,064 –a—— C:\QuickTimeInstaller.exe
2009-01-26 17:12 . 2009-01-26 17:12 d——– c:\program files\iTunes
2009-01-26 17:12 . 2009-01-26 17:12 d——– c:\program files\iPod
2009-01-26 17:12 . 2009-01-26 17:12 d——– c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-26 17:12 . 2008-04-17 13:12 107,368 –a—— c:\windows\system32\GEARAspi.dll
2009-01-26 17:12 . 2008-04-17 13:12 15,464 –a—— c:\windows\system32\drivers\GEARAspiWDM.sys
2009-01-26 17:10 . 2009-01-26 17:10 d——– c:\program files\Common Files\Apple
2009-01-26 16:47 . 2009-01-26 16:47 d——– c:\program files\Microsoft Calculator Plus
2009-01-26 16:23 . 2009-02-06 10:26 d——– c:\windows\system32\CatRoot2
2009-01-26 15:52 . 2009-01-26 15:52 69,076,264 –a—— C:\Quicktime.exe
2009-01-26 15:40 . 2009-01-26 15:40 d——– c:\windows\system32\config\systemprofile\Application Data\TeamViewer
2009-01-26 15:39 . 2009-01-26 15:39 d——– c:\program files\TeamViewer
2009-01-26 11:56 . 2009-01-26 11:56 d——– c:\program files\Salloway
2009-01-26 10:01 . 2009-01-26 10:13 d——– c:\program files\PowerISO
2009-01-25 21:30 . 2009-01-25 21:30 d——– c:\windows\system32\DRM
2009-01-25 16:37 . 2009-01-25 16:37 d——– c:\documents and settings\Kristen\Application Data\Windows Desktop Search
2009-01-25 16:37 . 2009-01-25 16:37 d——– c:\documents and settings\Kristen\Application Data\Logitech
2009-01-25 15:13 . 2009-01-27 11:13 d——– c:\documents and settings\Barry Vickers\Application Data\OfficeUpdate12
2009-01-25 15:10 . 2009-01-25 15:10 d——– c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-01-25 15:06 . 2009-01-29 12:09 d——– c:\program files\MagicISO
2009-01-25 14:53 . 2009-01-25 14:53 d——– c:\documents and settings\Barry Vickers\Application Data\Runaware
2009-01-25 14:53 . 2009-01-25 14:53 d——– c:\documents and settings\Barry Vickers\Application Data\ICAClient
2009-01-25 13:04 . 2009-01-25 13:04 d——– c:\program files\Common Files\Windows Live
2009-01-25 12:09 . 2009-02-05 07:24 d——– c:\program files\MSBuild
2009-01-25 11:37 . 2007-01-23 15:45 1,419,024 –a—— c:\windows\system32\WdfCoInstaller01005.dll
2009-01-25 11:37 . 2007-01-23 15:44 101,136 –a—— c:\windows\KHALMNPR.Exe
2009-01-25 11:37 . 2007-01-23 15:45 34,576 –a—— c:\windows\system32\drivers\LHidFilt.Sys
2009-01-25 11:37 . 2007-01-23 15:45 33,296 –a—— c:\windows\system32\drivers\LMouFilt.Sys
2009-01-25 11:36 . 2007-01-30 01:46 163,840 –a—— c:\windows\system32\kemutb.dll
2009-01-25 11:36 . 2007-01-30 01:46 135,168 –a—— c:\windows\system32\KemUtil.dll
2009-01-25 11:36 . 2007-01-30 01:46 110,592 –a—— c:\windows\system32\KemWnd.dll
2009-01-25 11:36 . 2007-01-30 01:46 69,632 –a—— c:\windows\system32\KemXML.dll
2009-01-25 09:45 . 2009-01-25 09:45 d——– c:\documents and settings\Barry Vickers\Application Data\Windows Search
2009-01-25 09:45 . 2009-01-25 09:45 d——– c:\documents and settings\Barry Vickers\Application Data\Windows Desktop Search
2009-01-25 09:44 . 2009-01-26 15:58 d–h—– c:\windows\system32\GroupPolicy
2009-01-25 09:44 . 2009-01-25 09:44 d——– c:\program files\Windows Desktop Search
2009-01-24 19:29 . 2009-01-24 19:29 d——– c:\program files\Microsoft
2009-01-24 16:15 . 2009-01-25 12:10 d——– c:\program files\Microsoft Works
2009-01-24 16:14 . 2009-01-24 16:14 d——– c:\program files\Microsoft.NET
2009-01-24 16:13 . 2009-01-24 16:13 d——– c:\documents and settings\All Users\Application Data\DriverScanner
2009-01-24 15:40 . 2006-10-26 19:56 32,592 –a—— c:\windows\system32\msonpmon.dll
2009-01-24 15:33 . 2009-01-25 12:01 d——– c:\program files\Microsoft Visual Studio 8
2009-01-24 15:32 . 2009-01-25 12:08 d——– c:\windows\SHELLNEW
2009-01-24 15:32 . 2009-01-28 12:34 d——– c:\documents and settings\All Users\Application Data\Microsoft Help
2009-01-24 15:31 . 2009-01-24 15:31 dr-h—– C:\MSOCache
2009-01-23 17:11 . 2009-01-24 16:13 d——– c:\documents and settings\Barry Vickers\Application Data\Uniblue
2009-01-22 18:23 . 2009-01-29 12:09 d——– c:\documents and settings\Barry Vickers\Application Data\TeamViewer
2009-01-22 18:22 . 2009-01-22 18:22 d——– c:\documents and settings\Barry Vickers\temp
2009-01-22 17:58 . 2009-01-25 09:44 1,374 –a—— c:\windows\imsins.BAK
2009-01-22 15:46 . 2008-04-13 17:12 116,224 –a—— c:\windows\system32\dllcache\xrxwiadr.dll
2009-01-22 15:46 . 2001-08-17 22:37 27,648 –a—— c:\windows\system32\dllcache\xrxftplt.exe
2009-01-22 15:46 . 2001-08-17 22:36 23,040 –a—— c:\windows\system32\dllcache\xrxwbtmp.dll
2009-01-22 15:46 . 2008-04-13 17:12 18,944 –a—— c:\windows\system32\dllcache\xrxscnui.dll
2009-01-22 15:45 . 2001-08-17 22:37 99,865 –a—— c:\windows\system32\dllcache\xlog.exe
2009-01-22 15:45 . 2004-08-03 22:29 19,455 –a—— c:\windows\system32\dllcache\wvchntxx.sys
2009-01-22 15:45 . 2008-04-13 11:46 19,200 –a—— c:\windows\system32\dllcache\wstcodec.sys
2009-01-22 15:45 . 2001-08-17 12:11 16,970 –a—— c:\windows\system32\dllcache\xem336n5.sys
2009-01-22 15:45 . 2004-08-03 22:29 12,063 –a—— c:\windows\system32\dllcache\wsiintxx.sys
2009-01-22 15:45 . 2008-04-13 17:12 8,192 –a—— c:\windows\system32\dllcache\wshirda.dll
2009-01-22 15:45 . 2001-08-17 22:37 4,608 –a—— c:\windows\system32\dllcache\xrxflnch.exe
2009-01-22 15:43 . 2001-08-17 13:28 794,399 –a—— c:\windows\system32\dllcache\usr1806v.sys
2009-01-22 15:42 . 2001-08-17 13:28 794,654 –a—— c:\windows\system32\dllcache\usr1801.sys
2009-01-22 15:41 . 2001-08-17 22:36 525,568 –a—— c:\windows\system32\dllcache\tridxp.dll
2009-01-22 15:41 . 2001-08-17 14:56 440,576 –a—— c:\windows\system32\dllcache\tridkb.dll
2009-01-22 15:41 . 2001-08-17 14:56 315,520 –a—— c:\windows\system32\dllcache\trid3d.dll
2009-01-22 15:41 . 2001-08-17 14:01 241,664 –a—— c:\windows\system32\dllcache\tosdvd02.sys
2009-01-22 15:41 . 2001-08-17 14:02 230,912 –a—— c:\windows\system32\dllcache\tosdvd03.sys
2009-01-22 15:41 . 2001-08-17 12:51 222,336 –a—— c:\windows\system32\dllcache\trid3dm.sys
2009-01-22 15:41 . 2001-08-17 12:51 166,784 –a—— c:\windows\system32\dllcache\tridxpm.sys
2009-01-22 15:41 . 2001-08-17 12:51 159,232 –a—— c:\windows\system32\dllcache\tridkbm.sys
2009-01-22 15:41 . 2008-04-13 17:12 82,944 –a—— c:\windows\system32\dllcache\tp4mon.exe
2009-01-22 15:41 . 2001-08-17 22:35 42,496 –a—— c:\windows\system32\dllcache\tp4res.dll
2009-01-22 15:41 . 2001-08-17 12:12 34,375 –a—— c:\windows\system32\dllcache\tpro4.sys
2009-01-22 15:41 . 2001-08-17 22:36 31,744 –a—— c:\windows\system32\dllcache\tp4.dll
2009-01-22 15:41 . 2001-08-17 12:10 28,232 –a—— c:\windows\system32\dllcache\tos4mo.sys
2009-01-22 15:39 . 2001-08-17 12:18 285,760 –a—— c:\windows\system32\dllcache\stlnata.sys
2009-01-22 15:38 . 2001-08-17 14:56 147,200 –a—— c:\windows\system32\dllcache\smidispb.dll
2009-01-22 15:37 . 2001-08-17 14:56 252,032 –a—— c:\windows\system32\dllcache\sis300iv.dll
2009-01-22 15:36 . 2001-08-17 22:36 495,616 –a—— c:\windows\system32\dllcache\sblfx.dll
2009-01-22 15:35 . 2001-08-17 14:56 245,632 –a—— c:\windows\system32\dllcache\s3savmx.dll
2009-01-22 15:34 . 2001-08-17 13:28 899,146 –a—— c:\windows\system32\dllcache\r2mdkxga.sys
2009-01-22 15:33 . 2001-08-17 14:04 173,696 –a—— c:\windows\system32\dllcache\philcam2.sys
2009-01-22 15:32 . 2008-04-13 17:10 259,328 –a—— c:\windows\system32\dllcache\perm3dd.dll
2009-01-22 15:31 . 2001-08-17 14:05 351,616 –a—— c:\windows\system32\dllcache\ovcodek2.sys
2009-01-22 15:30 . 2001-08-17 12:50 198,144 –a—— c:\windows\system32\dllcache\nv3.sys
2009-01-22 15:30 . 2001-08-17 22:36 123,776 –a—— c:\windows\system32\dllcache\nv3.dll
2009-01-22 15:30 . 2001-08-17 12:49 51,552 –a—— c:\windows\system32\dllcache\ntgrip.sys
2009-01-22 15:30 . 2001-08-17 22:36 38,912 –a—— c:\windows\system32\dllcache\EXCH_ntfsdrv.dll
2009-01-22 15:30 . 2008-04-13 11:54 28,672 –a—— c:\windows\system32\dllcache\nscirda.sys
2009-01-22 15:30 . 2001-08-17 13:47 9,344 –a—— c:\windows\system32\dllcache\ntapm.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-06 14:33 ——— d—–w c:\program files\Perfect Optimizer
2009-02-06 14:21 ——— d—–w c:\program files\Java
2009-02-01 02:04 ——— d—–w c:\documents and settings\Barry Vickers\Application Data\LimeWire
2009-01-29 20:09 ——— d—–w c:\program files\LimeWire
2009-01-27 20:53 ——— d–h–w c:\program files\InstallShield Installation Information
2009-01-27 20:53 ——— d—–w c:\program files\Common Files\Sonic Shared
2009-01-27 20:50 ——— d—–w c:\program files\Intel
2009-01-27 20:38 ——— d—–w c:\program files\Dell
2009-01-26 17:54 ——— d—–w c:\program files\MSECache
2009-01-23 04:17 ——— d—–w c:\documents and settings\All Users\Application Data\McAfee
2009-01-23 04:11 ——— d—–w c:\program files\Roxio
2009-01-23 04:08 ——— d—–w c:\program files\Malwarebytes' Anti-Malware
2009-01-22 22:34 ——— d—–w c:\documents and settings\LocalService\Application Data\SACore
2009-01-07 02:45 ——— d—–w c:\program files\WildTangent
2009-01-06 00:19 880,640 —-a-w C:\QTOControl.dll
2009-01-06 00:19 806,912 —-a-w C:\QTOLibrary.dll
2009-01-06 00:19 782,336 —-a-w C:\QTInfo.exe
2009-01-06 00:19 7,697,712 —-a-w C:\QuickTimePlayer.exe
2009-01-06 00:19 352,256 —-a-w C:\QTUIPanelControl.dll
2009-01-06 00:18 413,696 —-a-w C:\QTTask.exe
2008-12-18 15:38 ——— d—–w c:\program files\Yahoo!
2008-12-18 15:38 ——— d—–w c:\documents and settings\LocalService\Application Data\Yahoo!
2008-12-18 15:38 ——— d—–w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2008-12-13 06:40 3,593,216 —-a-w c:\windows\system32\dllcache\mshtml.dll
2008-12-11 10:57 333,952 —-a-w c:\windows\system32\drivers\srv.sys
2008-12-11 10:57 333,952 —-a-w c:\windows\system32\dllcache\srv.sys
2008-12-08 03:14 ——— d—–w c:\documents and settings\Kristen\Application Data\OLYMPUS
2008-12-08 02:56 ——— d—–w c:\documents and settings\Barry Vickers\Application Data\OLYMPUS
2008-12-08 02:54 ——— d—–w c:\program files\OLYMPUS
2008-12-07 00:54 ——— d—–w c:\program files\Google
2008-12-05 03:54 524,288 —-a-w c:\windows\opuc.dll
2008-11-24 17:01 6,686 –sha-w c:\windows\system32\KGyGaAvL.sys
2008-11-20 17:24 50,816 —-a-w c:\documents and settings\Barry Vickers\Application Data\GDIPFONTCACHEV1.DAT
2008-11-17 20:04 2,306,113 —-a-w c:\windows\system32\GPhotos.scr
2007-11-28 19:12 67,696 —-a-w c:\program files\mozilla firefox\components\jar50.dll
2007-11-28 19:12 54,376 —-a-w c:\program files\mozilla firefox\components\jsd3250.dll
2007-11-28 19:12 34,952 —-a-w c:\program files\mozilla firefox\components\myspell.dll
2007-11-28 19:12 46,720 —-a-w c:\program files\mozilla firefox\components\spellchk.dll
2007-11-28 19:12 172,144 —-a-w c:\program files\mozilla firefox\components\xpinstal.dll
2008-11-02 18:32 104 –sha-r c:\windows\system32\66C874FF70.sys
2008-06-25 21:20 32,768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008062520080626\index.dat
.

((((((((((((((((((((((((((((( snapshot@2009-02-04_ 6.54.26.65 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-01-25 03:13:34 69,120 —-a-w c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2009-02-05 15:30:26 69,120 —-a-w c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
- 2009-01-25 03:13:41 72,192 —-a-w c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2009-02-05 15:30:33 72,192 —-a-w c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2009-02-05 15:24:18 163,840 —-a-w c:\windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll
- 2009-01-25 03:13:01 4,444,160 —-a-w c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2009-02-05 15:30:27 4,546,560 —-a-w c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2009-02-05 15:24:23 4,210,688 —-a-w c:\windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.dll
- 2009-01-25 03:13:30 483,840 —-a-w c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2009-02-05 15:30:14 486,400 —-a-w c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
- 2009-01-25 03:13:13 3,036,160 —-a-w c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
+ 2009-02-05 15:30:37 2,933,248 —-a-w c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
- 2009-01-25 03:13:26 258,048 —-a-w c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
+ 2009-02-05 15:30:24 258,048 —-a-w c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- 2009-01-25 03:13:26 113,664 —-a-w c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2009-02-05 15:30:24 113,664 —-a-w c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2009-02-05 15:24:25 368,640 —-a-w c:\windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\System.Printing.dll
- 2009-01-25 03:13:21 261,120 —-a-w c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
+ 2009-02-05 15:30:20 261,632 —-a-w c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
- 2009-01-25 03:13:07 5,431,296 —-a-w c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
+ 2009-02-05 15:30:12 5,242,880 —-a-w c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
- 2009-01-25 03:13:33 10,752 —-a-w c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2009-02-05 15:30:25 10,752 —-a-w c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
- 2009-01-25 03:13:17 507,904 —-a-w c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
+ 2009-02-05 15:30:13 507,904 —-a-w c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
- 2009-01-25 03:13:34 13,312 —-a-w c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2009-02-05 15:30:26 13,312 —-a-w c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
- 2009-01-25 03:13:20 8,192 —-a-w c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2009-02-05 15:30:34 8,192 —-a-w c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
- 2009-01-25 03:13:40 77,824 —-a-w c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
+ 2009-02-05 15:30:32 77,824 —-a-w c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
- 2009-01-25 03:13:39 6,656 —-a-w c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
+ 2009-02-05 15:30:29 6,656 —-a-w c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
+ 2009-02-05 15:26:09 106,496 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Conversion.v3.5.dll
- 2009-01-25 03:13:35 348,160 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
+ 2009-02-05 15:30:31 348,160 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
+ 2009-02-05 15:26:09 733,184 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
- 2009-01-25 03:13:36 36,864 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2009-02-05 15:30:30 36,864 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2009-02-05 15:26:10 36,864 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2009-02-05 15:26:10 802,816 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.v3.5.dll
- 2009-01-25 03:13:37 655,360 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
+ 2009-02-05 15:30:31 655,360 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
+ 2009-02-05 15:26:10 94,208 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.v3.5.dll
- 2009-01-25 03:13:38 77,824 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2009-02-05 15:30:30 77,824 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
- 2009-01-25 03:13:20 749,568 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2009-02-05 15:30:19 749,568 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2009-02-05 15:24:17 397,312 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.dll
- 2009-01-25 03:13:27 110,592 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2009-02-05 15:30:21 110,592 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
- 2009-01-25 03:13:28 372,736 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
+ 2009-02-05 15:30:23 372,736 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
- 2009-01-25 03:13:39 28,672 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
+ 2009-02-05 15:30:32 28,672 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- 2009-01-25 03:13:24 671,744 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2009-02-05 15:30:23 659,456 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2009-02-05 15:26:09 41,984 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\1.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.STLCLR.dll
- 2009-01-25 03:13:06 5,632 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
+ 2009-02-05 15:30:29 5,632 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
- 2009-01-25 03:13:36 12,800 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2009-02-05 15:30:33 12,800 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- 2009-01-25 03:13:32 32,768 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
+ 2009-02-05 15:30:19 32,768 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- 2009-01-25 03:13:21 7,168 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
+ 2009-02-05 15:30:20 7,168 —-a-w c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
+ 2009-02-05 15:24:29 598,016 —-a-w c:\windows\assembly\GAC_MSIL\PresentationBuildTasks\3.0.0.0__31bf3856ad364e35\PresentationBuildTasks.dll
+ 2009-02-05 15:24:23 32,768 —-a-w c:\windows\assembly\GAC_MSIL\PresentationCFFRasterizer\3.0.0.0__31bf3856ad364e35\PresentationCFFRasterizer.dll
+ 2009-02-05 15:24:29 46,104 —-a-w c:\windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe
+ 2009-02-05 15:24:31 196,608 —-a-w c:\windows\assembly\GAC_MSIL\PresentationFramework.Aero\3.0.0.0__31bf3856ad364e35\PresentationFramework.Aero.dll
+ 2009-02-05 15:24:31 139,264 —-a-w c:\windows\assembly\GAC_MSIL\PresentationFramework.Classic\3.0.0.0__31bf3856ad364e35\PresentationFramework.Classic.dll
+ 2009-02-05 15:24:31 397,312 —-a-w c:\windows\assembly\GAC_MSIL\PresentationFramework.Luna\3.0.0.0__31bf3856ad364e35\PresentationFramework.Luna.dll
+ 2009-02-05 15:24:31 163,840 —-a-w c:\windows\assembly\GAC_MSIL\PresentationFramework.Royale\3.0.0.0__31bf3856ad364e35\PresentationFramework.Royale.dll
+ 2009-02-05 15:32:16 5,283,840 —-a-w c:\windows\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\PresentationFramework.dll
+ 2009-02-05 15:24:33 864,256 —-a-w c:\windows\assembly\GAC_MSIL\PresentationUI\3.0.0.0__31bf3856ad364e35\PresentationUI.dll
+ 2009-02-05 15:24:24 528,384 —-a-w c:\windows\assembly\GAC_MSIL\ReachFramework\3.0.0.0__31bf3856ad364e35\ReachFramework.dll
+ 2009-02-05 15:26:11 5,632 —-a-w c:\windows\assembly\GAC_MSIL\Sentinel.v3.5Client\3.5.0.0__b03f5f7f11d50a3a\Sentinel.v3.5Client.dll
+ 2009-02-05 15:24:18 110,592 —-a-w c:\windows\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\SMdiagnostics.dll
- 2009-01-25 03:13:32 110,592 —-a-w c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
+ 2009-02-05 15:30:29 110,592 —-a-w c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
- 2009-01-24 23:38:06 47,832 —-a-w c:\windows\assembly\GAC_MSIL\System.AddIn.Contract\2.0.0.0__b03f5f7f11d50a3a\System.AddIn.Contract.dll
+ 2009-02-05 15:26:12 45,056 —-a-w c:\windows\assembly\GAC_MSIL\System.AddIn.Contract\2.0.0.0__b03f5f7f11d50a3a\System.AddIn.Contract.dll
+ 2009-02-05 15:26:12 163,840 —-a-w c:\windows\assembly\GAC_MSIL\System.AddIn\3.5.0.0__b77a5c561934e089\System.AddIn.dll
+ 2009-02-05 15:26:17 57,344 —-a-w c:\windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll
- 2009-01-25 03:13:31 81,920 —-a-w c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2009-02-05 15:30:34 81,920 —-a-w c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
- 2009-01-25 03:13:11 425,984 —-a-w c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2009-02-05 15:30:38 425,984 —-a-w c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2009-02-05 15:26:13 667,648 —-a-w c:\windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.dll
+ 2009-02-05 15:26:13 53,248 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.DataSetExtensions\3.5.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll
+ 2009-02-05 15:26:13 229,376 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.Entity.Design\3.5.0.0__b77a5c561934e089\System.Data.Entity.Design.dll
+ 2009-02-05 15:26:14 2,879,488 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.Entity\3.5.0.0__b77a5c561934e089\System.Data.Entity.dll
+ 2009-02-05 15:26:07 684,032 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.Linq\3.5.0.0__b77a5c561934e089\System.Data.Linq.dll
+ 2009-02-05 15:32:59 294,912 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.Services.Client\3.5.0.0__b77a5c561934e089\System.Data.Services.Client.dll
+ 2009-02-05 15:26:07 114,688 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.Services.Design\3.5.0.0__b77a5c561934e089\System.Data.Services.Design.dll
+ 2009-02-05 15:32:59 442,368 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.Services\3.5.0.0__b77a5c561934e089\System.Data.Services.dll
- 2009-01-25 03:13:14 741,376 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
+ 2009-02-05 15:30:37 745,472 —-a-w c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
- 2009-01-25 03:13:15 933,888 —-a-w c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
+ 2009-02-05 15:30:38 970,752 —-a-w c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
- 2009-01-25 03:13:42 5,070,848 —-a-w c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2009-02-05 15:30:17 5,062,656 —-a-w c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2009-02-05 15:26:07 286,720 —-a-w c:\windows\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\3.5.0.0__b77a5c561934e089\System.DirectoryServices.AccountManagement.dll
- 2009-01-25 03:13:29 188,416 —-a-w c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
+ 2009-02-05 15:30:25 188,416 —-a-w c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
- 2009-01-25 03:13:29 401,408 —-a-w c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2009-02-05 15:30:25 401,408 —-a-w c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
- 2009-01-25 03:13:41 81,920 —-a-w c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2009-02-05 15:30:16 81,920 —-a-w c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
- 2009-01-25 03:13:08 630,784 —-a-w c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2009-02-05 15:30:35 626,688 —-a-w c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2009-02-05 15:24:34 126,976 —-a-w c:\windows\assembly\GAC_MSIL\System.IdentityModel.Selectors\3.0.0.0__b77a5c561934e089\System.IdentityModel.Selectors.dll
+ 2009-02-05 15:24:19 430,080 —-a-w c:\windows\assembly\GAC_MSIL\System.IdentityModel\3.0.0.0__b77a5c561934e089\System.IdentityModel.dll
+ 2009-02-05 15:24:19 131,072 —-a-w c:\windows\assembly\GAC_MSIL\System.IO.Log\3.0.0.0__b03f5f7f11d50a3a\System.IO.Log.dll
+ 2009-02-05 15:26:15 143,360 —-a-w c:\windows\assembly\GAC_MSIL\System.Management.Instrumentation\3.5.0.0__b77a5c561934e089\System.Management.Instrumentation.dll
- 2009-01-25 03:13:25 372,736 —-a-w c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2009-02-05 15:30:22 372,736 —-a-w c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
- 2009-01-25 03:13:24 258,048 —-a-w c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2009-02-05 15:30:22 258,048 —-a-w c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2009-02-05 15:26:18 233,472 —-a-w c:\windows\assembly\GAC_MSIL\System.Net\3.5.0.0__b03f5f7f11d50a3a\System.Net.dll
- 2009-01-25 03:13:23 299,008 —-a-w c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2009-02-05 15:30:21 303,104 —-a-w c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
- 2009-01-25 03:13:22 131,072 —-a-w c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2009-02-05 15:30:20 131,072 —-a-w c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2009-02-05 15:24:19 966,656 —-a-w c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll
- 2009-01-25 03:13:08 258,048 —-a-w c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
+ 2009-02-05 15:30:36 258,048 —-a-w c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
+ 2009-02-05 15:24:22 73,728 —-a-w c:\windows\assembly\GAC_MSIL\System.ServiceModel.Install\3.0.0.0__b77a5c561934e089\System.ServiceModel.Install.dll
+ 2009-02-05 15:24:22 32,768 —-a-w c:\windows\assembly\GAC_MSIL\System.ServiceModel.WasHosting\3.0.0.0__b77a5c561934e089\System.ServiceModel.WasHosting.dll
+ 2009-02-05 15:26:06 569,344 —-a-w c:\windows\assembly\GAC_MSIL\System.ServiceModel.Web\3.5.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll
+ 2009-02-05 15:32:12 5,931,008 —-a-w c:\windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll
- 2009-01-25 03:13:11 114,688 —-a-w c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2009-02-05 15:30:39 114,688 —-a-w c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2009-02-05 15:24:29 688,128 —-a-w c:\windows\assembly\GAC_MSIL\System.Speech\3.0.0.0__31bf3856ad364e35\System.Speech.dll
+ 2009-02-05 15:26:19 77,824 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Abstractions\3.5.0.0__31bf3856ad364e35\System.Web.Abstractions.dll
+ 2009-02-05 15:26:19 32,768 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.DynamicData.Design\3.5.0.0__31bf3856ad364e35\System.Web.DynamicData.Design.dll
+ 2009-02-05 15:33:00 229,376 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.DynamicData\3.5.0.0__31bf3856ad364e35\System.Web.DynamicData.dll
+ 2009-02-05 15:26:16 131,072 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Entity.Design\3.5.0.0__b77a5c561934e089\System.Web.Entity.Design.dll
+ 2009-02-05 15:33:00 139,264 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Entity\3.5.0.0__b77a5c561934e089\System.Web.Entity.dll
+ 2009-02-05 15:26:20 335,872 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Extensions.Design\3.5.0.0__31bf3856ad364e35\System.Web.Extensions.Design.dll
+ 2009-02-05 15:33:00 1,277,952 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Extensions\3.5.0.0__31bf3856ad364e35\System.Web.Extensions.dll
- 2009-01-25 03:13:19 884,736 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2009-02-05 15:30:15 835,584 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
- 2009-01-25 03:13:17 90,112 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2009-02-05 15:30:15 77,824 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2009-02-05 15:26:22 61,440 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Routing\3.5.0.0__31bf3856ad364e35\System.Web.Routing.dll
- 2009-01-25 03:13:18 839,680 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2009-02-05 15:30:14 839,680 —-a-w c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
- 2009-01-25 03:13:26 5,013,504 —-a-w c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2009-02-05 15:30:16 5,025,792 —-a-w c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2009-02-05 15:26:16 12,288 —-a-w c:\windows\assembly\GAC_MSIL\System.Windows.Presentation\3.5.0.0__b77a5c561934e089\System.Windows.Presentation.dll
+ 2009-02-05 15:24:27 1,138,688 —-a-w c:\windows\assembly\GAC_MSIL\System.Workflow.Activities\3.0.0.0__31bf3856ad364e35\System.Workflow.Activities.dll
+ 2009-02-05 15:24:27 1,630,208 —-a-w c:\windows\assembly\GAC_MSIL\System.Workflow.ComponentModel\3.0.0.0__31bf3856ad364e35\System.Workflow.ComponentModel.dll
+ 2009-02-05 15:24:28 540,672 —-a-w c:\windows\assembly\GAC_MSIL\System.Workflow.Runtime\3.0.0.0__31bf3856ad364e35\System.Workflow.Runtime.dll
+ 2009-02-05 15:26:06 507,904 —-a-w c:\windows\assembly\GAC_MSIL\System.WorkflowServices\3.5.0.0__31bf3856ad364e35\System.WorkflowServices.dll
+ 2009-02-05 15:26:17 139,264 —-a-w c:\windows\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\System.Xml.Linq.dll
- 2009-01-25 03:13:10 2,068,480 —-a-w c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
+ 2009-02-05 15:30:36 2,048,000 —-a-w c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
- 2009-01-25 03:13:15 3,076,096 —-a-w c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
+ 2009-02-05 15:30:35 3,149,824 —-a-w c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
+ 2009-02-05 15:24:30 167,936 —-a-w c:\windows\assembly\GAC_MSIL\UIAutomationClient\3.0.0.0__31bf3856ad364e35\UIAutomationClient.dll
+ 2009-02-05 15:24:30 385,024 —-a-w c:\windows\assembly\GAC_MSIL\UIAutomationClientsideProviders\3.0.0.0__31bf3856ad364e35\UIAutomationClientsideProviders.dll
+ 2009-02-05 15:24:25 40,960 —-a-w c:\windows\assembly\GAC_MSIL\UIAutomationProvider\3.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll
+ 2009-02-05 15:24:25 98,304 —-a-w c:\windows\assembly\GAC_MSIL\UIAutomationTypes\3.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll
+ 2009-02-05 15:24:26 1,245,184 —-a-w c:\windows\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\WindowsBase.dll
+ 2009-02-05 15:24:30 94,208 —-a-w c:\windows\assembly\GAC_MSIL\WindowsFormsIntegration\3.0.0.0__31bf3856ad364e35\WindowsFormsIntegration.dll
+ 2009-02-05 15:38:18 25,600 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\11eb4f6606ba01e5128805759121ea6c\Accessibility.ni.dll
+ 2009-02-05 15:38:21 842,240 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\b5b2feadc3943e3976daebc0bcd2b5e2\AspNetMMCExt.ni.dll
+ 2009-02-05 15:38:05 410,112 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\12629e2f3e315459bee67cbbaac85cb2\ComSvcConfig.ni.exe
+ 2009-02-05 15:38:36 220,672 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\9bea05938bee3555c5aa8763d89a68f9\CustomMarshalers.ni.dll
+ 2009-02-05 15:38:23 14,336 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\dfsvc\f4e38208e88cb4cc314a1d6543b9fcc6\dfsvc.ni.exe
+ 2009-02-05 15:38:36 222,720 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\9b321ebf67587237f576df6104a32588\Microsoft.Build.Conversion.v3.5.ni.dll
+ 2009-02-05 15:38:27 1,888,768 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\6cfe582681724965fb817e8ece5f0909\Microsoft.Build.Engine.ni.dll
+ 2009-02-05 15:38:38 839,680 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\96825c34d7e1f7df1923ff2123bed8da\Microsoft.Build.Engine.ni.dll
+ 2009-02-05 15:38:24 74,752 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\28343d470d992f169ca0e7cdb3cc3117\Microsoft.Build.Framework.ni.dll
+ 2009-02-05 15:38:39 65,024 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\e9aba2eab90d647356f65e66053da02b\Microsoft.Build.Framework.ni.dll
+ 2009-02-05 15:38:45 1,966,080 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\a47100d8f4574bed2d49d83d0ab8964e\Microsoft.Build.Tasks.v3.5.ni.dll
+ 2009-02-05 15:38:42 1,620,992 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\bd241492d96db39f20e758c13c845033\Microsoft.Build.Tasks.ni.dll
+ 2009-02-05 15:38:47 175,104 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\4217124db1ea5de5f1a1f3eea75e8d32\Microsoft.Build.Utilities.v3.5.ni.dll
+ 2009-02-05 15:38:46 144,384 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\55b9eff9e23359faed4351386c062238\Microsoft.Build.Utilities.ni.dll
+ 2009-02-05 15:40:17 2,332,160 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\b261961046545831aa60963e84905968\Microsoft.JScript.ni.dll
+ 2009-02-05 15:38:09 386,560 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\1820d6a012fc0e16c3e1d29d973cd2d0\Microsoft.Transactions.Bridge.Dtc.ni.dll
+ 2009-02-05 15:38:08 1,093,120 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\6b2f62f5e981913fce1d223f645d9ddf\Microsoft.Transactions.Bridge.ni.dll
+ 2009-02-05 15:38:49 1,712,128 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\1c86afc399d0fdd8e069266ffbe748d1\Microsoft.VisualBasic.ni.dll
+ 2009-02-05 15:40:17 55,296 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\790cf1edb17ee41b59be62ecbd59613b\Microsoft.Vsa.ni.dll
+ 2009-02-05 15:38:24 133,632 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\MSBuild\6d38e317128608bc4516ea46ab94590e\MSBuild.ni.exe
+ 2009-02-05 15:32:13 11,486,720 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\6d667f19d687361886990f3ca0f49816\mscorlib.ni.dll
+ 2009-02-05 15:33:21 1,451,008 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\e634bc4c4a00635a0a254febab0e2e2c\PresentationBuildTasks.ni.dll
+ 2009-02-05 15:33:24 39,424 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\c8fd2d9233f8ea3031fb16f697635231\PresentationCFFRasterizer.ni.dll
+ 2009-02-05 15:33:57 12,216,320 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\956375d487cbef36165b3250030e3574\PresentationCore.ni.dll
+ 2009-02-05 15:33:59 47,104 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\2d7408a0232f2e2efd0d7adf5dfa733a\PresentationFontCache.ni.exe
+ 2009-02-05 15:34:34 258,048 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\2c980c9a5051d723c6ec2a78a3d0e2b3\PresentationFramework.Royale.ni.dll
+ 2009-02-05 15:34:31 368,128 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\59a67874d8d8475faa5be1d993083d12\PresentationFramework.Aero.ni.dll
+ 2009-02-05 15:34:33 539,648 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8003abaf6bcf70f7eb620d06837e897b\PresentationFramework.Luna.ni.dll
+ 2009-02-05 15:34:29 14,327,808 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\96e710f47c601cba3f2348a8d11ddede\PresentationFramework.ni.dll
+ 2009-02-05 15:34:32 224,768 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\f475294d8c7dc2dd4febeef27bc0417e\PresentationFramework.Classic.ni.dll
+ 2009-02-05 15:34:37 1,657,856 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\6bafb1a2a73794ddb9761cb321c9e7e2\PresentationUI.ni.dll
+ 2009-02-05 15:34:42 2,128,896 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\4bfb3048bf200a6a8592d1b4ba861a7f\ReachFramework.ni.dll
+ 2009-02-05 15:38:11 320,512 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\10a0c9707876fc1f65e64b811a28b020\ServiceModelReg.ni.exe
+ 2009-02-05 15:38:12 256,000 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\9790551187e294b4ed3aaa1c221891c7\SMDiagnostics.ni.dll
+ 2009-02-05 15:38:13 366,080 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\045dd501b7257b1cc26083538ae69045\SMSvcHost.ni.exe
+ 2009-02-05 15:38:52 82,944 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\597b20e1b053d6a510cfe033c07a63e6\System.AddIn.Contract.ni.dll
+ 2009-02-05 15:38:51 633,856 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn\ce984d754e3c0b6be4504b785cc43574\System.AddIn.ni.dll
+ 2009-02-05 15:38:53 94,208 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\532438e2acfcadc469a4d468c51f8451\System.ComponentModel.DataAnnotations.ni.dll
+ 2009-02-05 15:40:11 141,312 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\de514e484e49b04b016949d57ffac03e\System.Configuration.Install.ni.dll
+ 2009-02-05 15:38:29 971,264 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\b82c00e2d24305ad6cb08556e3779b75\System.Configuration.ni.dll
+ 2009-02-05 15:34:46 2,295,296 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\47d87251e93256c635eb73403b8db33e\System.Core.ni.dll
+ 2009-02-05 15:38:55 135,680 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\1db495ff00bbd14df4af6680c4de0653\System.Data.DataSetExtensions.ni.dll
+ 2009-02-05 15:39:51 756,736 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\392de34573f9f8ec885714f2f3e7f07f\System.Data.Entity.Design.ni.dll
+ 2009-02-05 15:39:48 9,924,096 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\6479f975b105808a8d9e7a7fdc762551\System.Data.Entity.ni.dll
+ 2009-02-05 15:35:04 2,516,480 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\0bbec79460b1137df5313f9baf7b246f\System.Data.Linq.ni.dll
+ 2009-02-05 15:39:59 354,816 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\1cf3acad6553d6c59df576794f4e8bd6\System.Data.Services.Design.ni.dll
+ 2009-02-05 15:39:57 939,008 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\a4b887f476fa4b8746a93a9fc2208560\System.Data.Services.Client.ni.dll
+ 2009-02-05 15:39:55 1,328,128 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Services\956a513dcbd44d5a6801840ef2b0b47b\System.Data.Services.ni.dll
+ 2009-02-05 15:38:33 2,510,336 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\826b09ab0d0e36f4d631b4cd335df511\System.Data.SqlXml.ni.dll
+ 2009-02-05 15:34:56 6,616,576 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\c70731047b0022638b3f9fb158948a03\System.Data.ni.dll
+ 2009-02-05 15:40:01 1,801,216 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\a6b58624486714fa71e5e35186850ff0\System.Deployment.ni.dll
+ 2009-02-05 15:35:22 10,683,392 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Design\8ee220bc3cce4f7bbd7818946519ed7f\System.Design.ni.dll
+ 2009-02-05 15:40:03 1,116,672 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\543aced762f6b0c3f8e037955941afc6\System.DirectoryServices.ni.dll
+ 2009-02-05 15:40:05 881,152 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\8b3bb7a2c2f3ffe94c866283f1cd5957\System.DirectoryServices.AccountManagement.ni.dll
+ 2009-02-05 15:40:06 455,680 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\c434a07332ce490711c27fd0edb7562f\System.DirectoryServices.Protocols.ni.dll
+ 2009-02-05 15:35:26 208,384 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\18bbe2b6717e7f1d1dd672526e9889ee\System.Drawing.Design.ni.dll
+ 2009-02-05 15:35:25 1,587,200 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\3da96ee075bab9202626ae44c18d226c\System.Drawing.ni.dll
+ 2009-02-05 15:40:07 627,712 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\4267bd908175603006c6c90bb5d900c7\System.EnterpriseServices.ni.dll
+ 2009-02-05 15:40:07 280,064 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\4267bd908175603006c6c90bb5d900c7\System.EnterpriseServices.Wrapper.dll
+ 2009-02-05 15:37:20 212,992 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\68e71147704ef0d34d9a4bece7767fc5\System.IdentityModel.Selectors.ni.dll
+ 2009-02-05 15:37:19 1,056,768 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\c2de8479e54852f56996f79bc93acb13\System.IdentityModel.ni.dll
+ 2009-02-05 15:37:21 381,440 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.IO.Log\7c367a96b10d626ec8cbf8149272d845\System.IO.Log.ni.dll
+ 2009-02-05 15:40:10 330,752 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\1d3fbbd23ce1e8637ef4f40a8d23cd32\System.Management.Instrumentation.ni.dll
+ 2009-02-05 15:40:14 998,400 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\8642fdfbf02a6cb6f01169fe6fdb5d11\System.Management.ni.dll
+ 2009-02-05 15:40:19 621,056 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Net\519d9c618341b136f9b963ffb7495308\System.Net.ni.dll
+ 2009-02-05 15:35:28 1,035,264 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Printing\646ab52eef343380aa002c220dc31e13\System.Printing.ni.dll
+ 2009-02-05 15:37:26 2,338,304 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\034c91b133dee73d452652c52767b5ea\System.Runtime.Serialization.ni.dll
+ 2009-02-05 15:40:12 311,296 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\bfd6e16d8c3589cd2bd3f8d46f0a5402\System.Runtime.Serialization.Formatters.Soap.ni.dll
+ 2009-02-05 15:38:35 676,352 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\1c8df2da33222c048d683017f2095f04\System.Security.ni.dll
+ 2009-02-05 15:40:24 1,706,496 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\340cad17fe57947eacbc8fa2cea780da\System.ServiceModel.Web.ni.dll
+ 2009-02-05 15:38:01 17,317,888 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\4146033013edebd7e0cb604e504ebfee\System.ServiceModel.ni.dll
+ 2009-02-05 15:40:25 212,992 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\ea3366939280c1715f1c620e33ee3c8a\System.ServiceProcess.ni.dll
+ 2009-02-05 15:35:32 1,917,440 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Speech\63cf639b6e0a3c25c1643c85016e7422\System.Speech.ni.dll
+ 2009-02-05 15:40:26 627,200 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\5a555c9ae6984c40157cf940bb519f7c\System.Transactions.ni.dll
+ 2009-02-05 15:40:41 141,312 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\00ec08741a765c707bd9169346064a81\System.Web.Abstractions.ni.dll
+ 2009-02-05 15:40:47 36,864 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\19ca1747c1ea18a3b639b302bca8df93\System.Web.DynamicData.Design.ni.dll
+ 2009-02-05 15:40:46 547,328 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\b7891f5659db299dbd1b3c72db7edb9f\System.Web.DynamicData.ni.dll
+ 2009-02-05 15:40:50 301,056 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\d3d65e34fa60f0b6c72ca0d12ec89933\System.Web.Entity.Design.ni.dll
+ 2009-02-05 15:40:49 328,704 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\79c29ac85dd57dd485ab60118ac292ff\System.Web.Entity.ni.dll
+ 2009-02-05 15:40:52 859,648 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\58f62044fa702ea6f936071aa5520baa\System.Web.Extensions.Design.ni.dll
+ 2009-02-05 15:40:45 2,403,328 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\7f64c9d25471b72e1e957bdfe67947c8\System.Web.Extensions.ni.dll
+ 2009-02-05 15:40:56 2,209,280 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\81197e32ec931f439b3114e9031b65d6\System.Web.Mobile.ni.dll
+ 2009-02-05 15:40:57 202,240 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\6ee255220d90dcbe80c990e443051cc5\System.Web.RegularExpressions.ni.dll
+ 2009-02-05 15:40:42 129,536 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\bb77ea11f46ab438b2b7ed7c180011a1\System.Web.Routing.ni.dll
+ 2009-02-05 15:41:00 1,840,640 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\b57bb002a655920cbfa2bee29d1e22b7\System.Web.Services.ni.dll
+ 2009-02-05 15:40:39 11,796,992 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\3963ce03d445a8619abbf388d590134b\System.Web.ni.dll
+ 2009-02-05 15:35:46 12,430,848 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\63406259e94d5c0ff5b79401dfe113ce\System.Windows.Forms.ni.dll
+ 2009-02-05 15:41:05 37,888 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\423f794d1f4ed6e120fbb02e436491cb\System.Windows.Presentation.ni.dll
+ 2009-02-05 15:41:11 2,992,640 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\cc99fbbac0b6e4e9ca62093e49b0c16b\System.Workflow.Activities.ni.dll
+ 2009-02-05 15:41:18 4,514,304 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\693a8fbe6f7ad6e4e429052da4317e59\System.Workflow.ComponentModel.ni.dll
+ 2009-02-05 15:41:22 1,908,224 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\d265da36954fcb4cb7ad5adc693ea0f2\System.Workflow.Runtime.ni.dll
+ 2009-02-05 15:41:27 1,356,288 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\ac1750e78d79520dcf19195772eff1b6\System.WorkflowServices.ni.dll
+ 2009-02-05 15:41:28 400,896 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\c338a470b14851ce5987bb0f0869c310\System.Xml.Linq.ni.dll
+ 2009-02-05 15:35:54 5,450,752 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\773a9786013451d3baaeff003dc4230f\System.Xml.ni.dll
+ 2009-02-05 15:33:04 7,868,416 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System\80978a322d7dd39f0a71be1251ae395a\System.ni.dll
+ 2009-02-05 15:35:55 447,488 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\5c028c3d8db6c0f0277673ea4a2d89fb\UIAutomationClient.ni.dll
+ 2009-02-05 15:35:57 1,049,600 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\f3c7957351aec85f526a3350c9718b1e\UIAutomationClientsideProviders.ni.dll
+ 2009-02-05 15:35:58 60,928 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\a715aa442ef87ae99b3ade185599249d\UIAutomationProvider.ni.dll
+ 2009-02-05 15:35:58 187,904 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\a6d9503962d47c722231c1478f180695\UIAutomationTypes.ni.dll
+ 2009-02-05 15:33:35 3,313,664 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\14cd5f4b61d35f9b76327d6be9853755\WindowsBase.ni.dll
+ 2009-02-05 15:36:00 240,128 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\6a818099f0386e2356ae94f886a2196f\WindowsFormsIntegration.ni.dll
+ 2009-02-05 15:38:15 321,536 —-a-w c:\windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\2ef5bc3a2edd7570bb23886a4f32294a\WsatConfig.ni.exe
+ 2008-07-06 12:06:10 89,088 ——w c:\windows\Driver Cache\i386\filterpipelineprintproc.dll
+ 2008-07-06 12:06:10 765,440 ——w c:\windows\Driver Cache\i386\mxdwdrv.dll
+ 2008-07-06 12:06:10 198,656 ——w c:\windows\Driver Cache\i386\mxdwdui.dll
+ 2008-07-06 12:06:10 373,248 ——w c:\windows\Driver Cache\i386\unidrv.dll
+ 2008-07-06 12:06:10 744,960 ——w c:\windows\Driver Cache\i386\unidrvui.dll
+ 2008-03-13 04:52:36 761,344 ——w c:\windows\Driver Cache\i386\unires.dll
- 2007-10-24 09:47:38 82,944 —-a-w c:\windows\Microsoft.NET\Framework\NETFXSBS10.exe
+ 2008-07-25 19:16:58 82,944 —-a-w c:\windows\Microsoft.NET\Framework\NETFXSBS10.exe
- 2007-10-24 09:47:38 16,896 —-a-w c:\windows\Microsoft.NET\Framework\sbscmp10.dll
+ 2008-07-25 19:16:58 16,896 —-a-w c:\windows\Microsoft.NET\Framework\sbscmp10.dll
- 2007-10-24 09:47:40 16,896 —-a-w c:\windows\Microsoft.NET\Framework\sbscmp20_mscorwks.dll
+ 2008-07-25 19:17:02 16,896 —-a-w c:\windows\Microsoft.NET\Framework\sbscmp20_mscorwks.dll
- 2007-10-24 09:47:42 16,896 —-a-w c:\windows\Microsoft.NET\Framework\sbscmp20_perfcounter.dll
+ 2008-07-25 19:17:02 16,896 —-a-w c:\windows\Microsoft.NET\Framework\sbscmp20_perfcounter.dll
- 2007-10-24 09:47:40 16,896 —-a-w c:\windows\Microsoft.NET\Framework\SharedReg12.dll
+ 2008-07-25 19:17:02 16,896 —-a-w c:\windows\Microsoft.NET\Framework\SharedReg12.dll
- 2007-10-24 09:47:38 97,280 —-a-w c:\windows\Microsoft.NET\Framework\v1.0.3705\mscormmc.dll
+ 2008-07-25 19:16:58 96,768 —-a-w c:\windows\Microsoft.NET\Framework\v1.0.3705\mscormmc.dll
- 2007-10-24 09:47:26 28,672 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\alinkui.dll
+ 2008-07-25 19:16:42 28,672 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\alinkui.dll
- 2007-10-24 09:47:30 145,408 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\cscompui.dll
+ 2008-07-25 19:16:48 145,408 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\cscompui.dll
- 2007-10-24 09:47:32 13,824 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\CvtResUI.dll
+ 2008-07-25 19:16:50 13,824 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\CvtResUI.dll
- 2007-10-24 09:47:48 193,016 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\vbc7ui.dll
+ 2008-07-25 19:17:10 193,016 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\vbc7ui.dll
- 2007-10-24 09:47:20 218,112 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\Vsavb7rtUI.dll
+ 2008-07-25 19:16:36 218,112 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\Vsavb7rtUI.dll
- 2007-10-24 09:47:40 10,752 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Accessibility.dll
+ 2008-07-25 19:17:00 10,752 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Accessibility.dll
- 2007-10-24 09:47:42 147,968 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\AdoNetDiag.dll
+ 2008-07-25 19:17:02 147,968 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\AdoNetDiag.dll
- 2007-10-24 09:47:26 99,320 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\alink.dll
+ 2008-07-25 19:16:44 98,808 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\alink.dll
- 2007-10-24 09:47:42 59,392 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
+ 2008-07-25 19:17:02 58,880 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
- 2007-10-24 09:47:22 36,864 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
+ 2008-07-25 19:16:40 36,864 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
- 2007-10-24 09:47:22 22,024 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll
+ 2008-07-25 19:16:40 22,024 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll
- 2007-10-24 09:47:22 17,928 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll
+ 2008-07-25 19:16:40 17,416 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll
- 2007-10-24 09:47:22 33,288 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll
+ 2008-07-25 19:16:40 33,800 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll
- 2007-10-24 09:47:22 84,480 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll
+ 2008-07-25 19:16:38 84,480 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll
- 2007-10-24 09:47:22 24,576 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
+ 2008-07-25 19:16:40 24,576 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
- 2007-10-24 09:47:22 32,776 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
+ 2008-07-25 19:16:40 33,288 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
- 2007-10-24 09:47:22 106,496 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
+ 2008-07-25 19:16:40 106,496 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
- 2007-10-24 09:47:22 33,800 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
+ 2008-07-25 19:16:40 34,312 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
- 2007-10-24 09:47:22 33,280 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
+ 2008-11-25 12:59:18 31,560 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
- 2007-10-24 09:47:22 507,904 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll
+ 2008-07-25 19:16:40 507,904 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll
- 2007-10-24 09:47:40 106,496 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
+ 2008-07-25 19:17:00 106,496 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
- 2007-10-24 09:47:40 101,896 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll
+ 2008-07-25 19:17:00 89,608 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll
- 2007-10-24 09:47:30 80,376 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
+ 2008-07-25 19:16:50 80,376 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
- 2007-10-24 09:47:30 1,162,744 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\cscomp.dll
+ 2008-07-25 19:16:50 1,163,768 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\cscomp.dll
- 2007-10-24 09:47:30 13,312 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\cscompmgd.dll
+ 2008-07-25 19:16:50 13,312 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\cscompmgd.dll
- 2007-10-24 09:47:42 27,136 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
+ 2008-07-25 19:17:02 27,136 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
- 2007-10-24 09:47:40 69,120 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\CustomMarshalers.dll
+ 2008-07-25 19:17:00 69,120 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\CustomMarshalers.dll
- 2007-10-24 09:47:30 35,320 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
+ 2008-07-25 19:16:50 35,320 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
- 2007-10-24 09:47:28 66,552 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\dfdll.dll
+ 2008-07-25 19:16:46 62,968 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\dfdll.dll
- 2007-10-24 09:47:28 5,120 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
+ 2008-07-25 19:16:46 5,120 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
- 2007-10-24 09:47:54 572,936 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
+ 2008-07-25 19:17:16 575,496 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll
- 2007-10-24 09:47:40 798,224 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll
+ 2008-07-25 19:17:00 798,224 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll
- 2007-10-24 09:47:36 18,936 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\fusion.dll
+ 2008-07-25 19:16:58 18,936 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\fusion.dll
- 2007-10-24 09:47:40 9,728 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
+ 2008-07-25 19:17:00 9,728 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
- 2007-10-24 09:47:40 8,192 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\IEExecRemote.dll
+ 2008-07-25 19:17:02 8,192 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\IEExecRemote.dll
- 2007-10-24 09:47:40 77,824 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\IEHost.dll
+ 2008-07-25 19:17:00 77,824 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\IEHost.dll
- 2007-10-24 09:47:40 6,656 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\IIEHost.dll
+ 2008-07-25 19:17:00 6,656 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\IIEHost.dll
- 2007-10-24 09:47:40 230,904 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
+ 2008-07-25 19:17:00 230,904 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
- 2007-10-24 09:47:40 28,672 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
+ 2008-07-25 19:17:00 28,672 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
- 2007-10-24 09:47:40 65,032 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\InstallUtilLib.dll
+ 2008-07-25 19:17:00 65,032 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\InstallUtilLib.dll
- 2007-10-24 09:47:40 72,192 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\ISymWrapper.dll
+ 2008-07-25 19:17:00 72,192 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\ISymWrapper.dll
- 2007-10-24 09:47:34 40,960 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe
+ 2008-07-25 19:16:54 40,960 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe
- 2007-10-24 09:47:36 348,160 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll
+ 2008-07-25 19:16:56 348,160 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll
- 2007-10-24 09:47:36 36,864 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Framework.dll
+ 2008-07-25 19:16:56 36,864 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Framework.dll
- 2007-10-24 09:47:36 655,360 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll
+ 2008-07-25 19:16:56 655,360 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll
- 2007-10-24 09:47:36 77,824 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Utilities.dll
+ 2008-07-25 19:16:56 77,824 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Utilities.dll
- 2007-10-24 09:47:34 749,568 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll
+ 2008-07-25 19:16:54 749,568 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll
- 2007-10-24 09:47:52 110,592 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2008-07-25 19:17:14 110,592 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.Data.dll
- 2007-10-24 09:47:52 372,736 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.dll
+ 2008-07-25 19:17:14 372,736 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.dll
- 2007-10-24 09:47:50 671,744 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.dll
+ 2008-07-25 19:17:12 659,456 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.dll
- 2007-10-24 09:47:20 28,672 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Vsa.dll
+ 2008-07-25 19:16:38 28,672 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Vsa.dll
- 2007-10-24 09:47:52 5,632 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualC.Dll
+ 2008-07-25 19:17:16 5,632 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualC.Dll
- 2007-10-24 09:47:20 32,768 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll
+ 2008-07-25 19:16:38 32,768 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll
- 2007-10-24 09:47:20 12,800 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2008-07-25 19:16:38 12,800 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- 2007-10-24 09:47:20 7,168 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft_VsaVb.dll
+ 2008-07-25 19:16:38 7,168 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft_VsaVb.dll
- 2007-10-24 09:47:22 97,792 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll
+ 2008-07-25 19:16:40 97,792 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll
- 2007-10-24 09:47:36 69,632 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
+ 2008-07-25 19:16:56 69,632 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
- 2007-10-24 09:47:40 822,280 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
+ 2008-11-25 12:59:40 990,032 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
- 2007-10-24 09:47:40 83,456 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordbc.dll
+ 2008-07-25 19:17:00 83,456 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordbc.dll
- 2007-10-24 09:47:40 308,224 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordbi.dll
+ 2008-07-25 19:17:00 308,224 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordbi.dll
- 2007-10-24 09:47:40 47,104 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorie.dll
+ 2008-07-25 19:17:00 46,592 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorie.dll
- 2007-10-24 09:47:40 348,672 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
+ 2008-11-25 12:59:40 364,872 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
- 2007-10-24 09:47:40 94,208 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorld.dll
+ 2008-07-25 19:17:00 94,208 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorld.dll
- 2007-10-24 09:47:40 4,444,160 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
+ 2008-11-25 12:59:40 4,546,560 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
- 2007-10-24 09:47:40 114,688 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll
+ 2008-07-25 19:17:00 114,176 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll
- 2007-10-24 09:47:44 340,992 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
+ 2008-07-25 19:17:04 345,600 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
- 2007-10-24 09:47:40 77,312 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll
+ 2008-07-25 19:17:00 77,312 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll
- 2007-10-24 09:47:36 18,944 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsn.dll
+ 2008-07-25 19:16:58 18,944 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsn.dll
- 2007-10-24 09:47:40 242,688 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll
+ 2008-07-25 19:17:02 230,912 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll
- 2007-10-24 09:47:40 70,144 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
+ 2008-07-25 19:17:02 69,632 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
- 2007-10-24 09:47:40 19,456 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscortim.dll
+ 2008-07-25 19:17:02 19,456 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscortim.dll
- 2007-10-24 09:47:36 5,814,784 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
+ 2008-11-25 12:59:36 5,813,576 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
- 2007-10-24 09:47:44 31,744 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\MUI\0409\mscorsecr.dll
+ 2008-07-25 19:17:04 31,744 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\MUI\0409\mscorsecr.dll
- 2007-10-24 09:47:40 101,880 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe
+ 2008-07-25 19:17:02 100,856 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe
- 2007-10-24 09:47:40 24,584 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\normalization.dll
+ 2008-07-25 19:17:02 24,584 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\normalization.dll
- 2007-10-24 09:47:40 89,096 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\PerfCounter.dll
+ 2008-07-25 19:17:02 88,584 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\PerfCounter.dll
- 2007-10-24 09:47:36 144,896 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\peverify.dll
+ 2008-07-25 19:16:58 143,360 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\peverify.dll
- 2007-10-24 09:47:40 53,248 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
+ 2008-07-25 19:17:00 53,248 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
- 2007-10-24 09:47:40 32,768 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
+ 2008-07-25 19:17:00 32,768 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
- 2007-10-24 09:47:46 61,952 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe
+ 2008-07-25 19:17:06 61,952 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe
- 2007-10-24 09:47:42 16,896 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\sbscmp20_mscorlib.dll
+ 2008-07-25 19:17:02 16,896 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\sbscmp20_mscorlib.dll
- 2007-10-24 09:47:40 119,296 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\shfusion.dll
+ 2008-07-25 19:17:00 118,784 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\shfusion.dll
- 2007-10-24 09:47:44 95,232 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll
+ 2008-07-25 19:17:04 95,232 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll
- 2007-10-24 09:47:40 392,696 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\SOS.dll
+ 2008-07-25 19:17:02 392,184 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\SOS.dll
- 2007-10-24 09:47:40 110,592 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll
+ 2008-07-25 19:17:02 110,592 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll
- 2007-10-24 09:47:42 425,984 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll
+ 2008-07-25 19:17:02 425,984 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll
- 2007-10-24 09:47:40 81,920 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll
+ 2008-07-25 19:17:00 81,920 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll
- 2007-10-24 09:47:40 3,036,160 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.dll
+ 2008-07-25 19:17:00 2,933,248 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.dll
- 2007-10-24 09:47:40 483,840 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll
+ 2008-11-25 12:59:40 486,400 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll
- 2007-10-24 09:47:40 741,376 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll
+ 2008-07-25 19:17:02 745,472 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll
- 2007-10-24 09:47:28 933,888 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll
+ 2008-07-25 19:16:46 970,752 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll
- 2007-10-24 09:47:40 5,070,848 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Design.dll
+ 2008-07-25 19:17:00 5,062,656 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Design.dll
- 2007-10-24 09:47:40 401,408 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.dll
+ 2008-07-25 19:17:00 401,408 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.dll
- 2007-10-24 09:47:40 188,416 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll
+ 2008-07-25 19:17:02 188,416 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll
- 2007-10-24 09:47:40 3,076,096 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.dll
+ 2008-07-25 19:17:00 3,149,824 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.dll
- 2007-10-24 09:47:40 81,920 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.Design.dll
+ 2008-07-25 19:17:00 81,920 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.Design.dll
- 2007-10-24 09:47:40 630,784 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll
+ 2008-07-25 19:17:00 626,688 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll
- 2007-10-24 09:47:40 258,048 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll
+ 2008-07-25 19:17:02 258,048 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll
- 2007-10-24 09:47:40 57,392 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll
+ 2008-07-25 19:17:02 57,392 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll
- 2007-10-24 09:47:40 113,664 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Wrapper.dll
+ 2008-07-25 19:17:02 113,664 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Wrapper.dll
- 2007-10-24 09:47:40 372,736 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Management.dll
+ 2008-07-25 19:17:00 372,736 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Management.dll
- 2007-10-24 09:47:40 258,048 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Messaging.dll
+ 2008-07-25 19:17:00 258,048 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Messaging.dll
- 2007-10-24 09:47:40 299,008 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll
+ 2008-07-25 19:17:00 303,104 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll
- 2007-10-24 09:47:40 131,072 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Serialization.Formatters.Soap.dll
+ 2008-07-25 19:17:00 131,072 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Serialization.Formatters.Soap.dll
- 2007-10-24 09:47:40 258,048 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Security.dll
+ 2008-07-25 19:17:00 258,048 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Security.dll
- 2007-10-24 09:47:40 114,688 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.ServiceProcess.dll
+ 2008-07-25 19:17:00 114,688 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.ServiceProcess.dll
- 2007-10-24 09:47:40 261,120 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll
+ 2008-07-25 19:17:02 261,632 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll
- 2007-10-24 09:47:40 5,431,296 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
+ 2008-11-25 12:59:40 5,242,880 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
- 2007-10-24 09:47:40 884,736 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.Mobile.dll
+ 2008-07-25 19:17:02 835,584 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.Mobile.dll
- 2007-10-24 09:47:40 90,112 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.RegularExpressions.dll
+ 2008-07-25 19:17:02 77,824 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.RegularExpressions.dll
- 2007-10-24 09:47:40 839,680 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.Services.dll
+ 2008-07-25 19:17:00 839,680 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.Services.dll
- 2007-10-24 09:47:40 5,013,504 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll
+ 2008-07-25 19:17:00 5,025,792 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll
- 2007-10-24 09:47:40 2,068,480 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.XML.dll
+ 2008-11-25 12:59:40 2,048,000 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.XML.dll
- 2007-10-24 09:47:40 81,400 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\TLBREF.DLL
+ 2008-07-25 19:17:02 81,400 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\TLBREF.DLL
- 2007-10-24 09:47:48 1,172,472 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
+ 2008-07-25 19:17:10 1,172,472 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
- 2007-10-24 09:47:20 1,344,000 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll
+ 2008-07-25 19:16:38 1,344,000 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll
- 2007-10-24 09:47:22 434,688 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\webengine.dll
+ 2008-11-25 12:59:18 436,040 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\webengine.dll
- 2007-10-24 09:47:40 37,896 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\WMINet_Utils.dll
+ 2008-07-25 19:17:02 37,896 —-a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\WMINet_Utils.dll
+ 2008-07-30 03:16:38 168,968 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe
+ 2008-07-30 03:24:50 881,664 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
+ 2008-07-30 03:16:38 397,312 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\Microsoft.Transactions.Bridge.dll
+ 2008-07-30 03:16:38 163,840 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\Microsoft.Transactions.Bridge.Dtc.dll
+ 2008-07-30 03:16:38 11,280 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelEvents.dll
+ 2008-07-30 03:16:38 156,688 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe
+ 2008-07-30 03:16:38 20,504 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceMonikerSupport.dll
+ 2008-07-30 03:16:38 110,592 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMdiagnostics.dll
+ 2008-07-30 03:16:38 132,096 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
+ 2008-07-30 03:16:38 966,656 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.Runtime.Serialization.dll
+ 2008-12-06 04:12:12 5,931,008 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.dll
+ 2008-07-30 03:16:38 73,728 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.Install.dll
+ 2008-07-30 03:16:38 32,768 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.WasHosting.dll
+ 2008-07-30 03:16:38 152,576 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe
+ 2008-07-30 03:32:52 17,448 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\PerformanceCounterInstaller.exe
+ 2008-07-30 05:10:04 806,928 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\NaturalLanguage6.dll
+ 2008-07-30 05:10:04 4,883,464 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\NlsData0009.dll
+ 2008-07-30 05:10:04 2,637,840 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\NlsLexicons0009.dll
+ 2008-07-30 05:10:04 71,160 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PenIMC.dll
+ 2008-07-30 03:59:58 32,768 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationCFFRasterizer.dll
+ 2008-07-30 05:10:04 46,104 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
+ 2008-07-30 03:59:58 132,120 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationHostDLL.dll
+ 2008-07-30 04:35:46 864,256 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationUI.dll
+ 2008-12-06 03:35:22 1,736,528 —-a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\wpfgfx_v0300.dll
+ 2008-07-30 07:40:48 168,448 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\1033\cscompui.dll
+ 2008-07-30 07:40:48 233,976 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\1033\vbc7ui.dll
+ 2008-07-30 07:40:48 41,992 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe
+ 2008-07-30 07:40:48 41,992 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe
+ 2008-07-30 07:40:48 41,984 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe
+ 2008-07-30 07:40:48 1,548,280 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\csc.exe
+ 2008-07-30 07:40:48 78,856 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe
+ 2008-07-30 07:40:48 95,224 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\EdmGen.exe
+ 2008-07-30 07:15:24 225,490 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\baseline.dat
+ 2008-07-30 02:47:34 97,280 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\DeleteTemp.exe
+ 2008-07-30 02:47:34 276,984 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\dlmgr.dll
+ 2008-07-30 02:47:34 1,064,448 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\gencomp.dll
+ 2008-07-30 02:47:34 177,152 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\HtmlLite.dll
+ 2008-07-30 02:47:34 269,304 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
+ 2008-07-30 02:47:34 113,152 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1025.dll
+ 2008-07-30 02:47:34 84,992 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1028.dll
+ 2008-07-30 02:47:34 125,440 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1029.dll
+ 2008-07-30 02:47:34 126,464 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1030.dll
+ 2008-07-30 02:47:34 130,048 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1031.dll
+ 2008-07-30 02:47:34 137,728 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1032.dll
+ 2008-07-30 02:47:34 122,368 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1035.dll
+ 2008-07-30 02:47:34 133,120 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1036.dll
+ 2008-07-30 02:47:34 111,104 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1037.dll
+ 2008-07-30 02:47:34 132,096 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1038.dll
+ 2008-07-30 02:47:34 128,512 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1040.dll
+ 2008-07-30 02:47:34 97,792 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1041.dll
+ 2008-07-30 02:47:34 94,720 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1042.dll
+ 2008-07-30 02:47:34 129,024 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1043.dll
+ 2008-07-30 02:47:34 121,856 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1044.dll
+ 2008-07-30 02:47:34 128,512 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1045.dll
+ 2008-07-30 02:47:34 122,880 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1046.dll
+ 2008-07-30 02:47:34 123,904 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1049.dll
+ 2008-07-30 02:47:34 121,344 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1053.dll
+ 2008-07-30 02:47:34 121,344 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1055.dll
+ 2008-07-30 02:47:34 84,480 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.2052.dll
+ 2008-07-30 02:47:34 131,072 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.2070.dll
+ 2008-07-30 02:47:34 131,584 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.3082.dll
+ 2008-07-30 02:47:34 110,080 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.dll
+ 2008-07-30 02:47:34 1,364,992 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\SITSetup.dll
+ 2008-07-30 02:47:34 1,054,208 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vs_setup.dll
+ 2008-07-30 02:47:34 632,320 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vs70uimgr.dll
+ 2008-07-30 02:47:34 413,184 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vsbasereqs.dll
+ 2008-07-30 02:47:34 689,152 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vsscenario.dll
+ 2008-07-30 02:47:34 102,904 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1025.dll
+ 2008-07-30 02:47:34 89,592 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1028.dll
+ 2008-07-30 02:47:34 108,536 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1029.dll
+ 2008-07-30 02:47:34 108,536 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1030.dll
+ 2008-07-30 02:47:34 111,608 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1031.dll
+ 2008-07-30 02:47:34 113,656 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1032.dll
+ 2008-07-30 02:47:34 106,488 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1035.dll
+ 2008-07-30 02:47:34 112,120 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1036.dll
+ 2008-07-30 02:47:34 101,368 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1037.dll
+ 2008-07-30 02:47:34 111,096 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1038.dll
+ 2008-07-30 02:47:34 110,072 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1040.dll
+ 2008-07-30 02:47:34 95,224 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1041.dll
+ 2008-07-30 02:47:34 92,664 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1042.dll
+ 2008-07-30 02:47:34 108,536 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1043.dll
+ 2008-07-30 02:47:34 106,488 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1044.dll
+ 2008-07-30 02:47:34 109,048 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1045.dll
+ 2008-07-30 02:47:34 107,512 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1046.dll
+ 2008-07-30 02:47:34 107,000 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1049.dll
+ 2008-07-30 02:47:34 105,976 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1053.dll
+ 2008-07-30 02:47:34 106,488 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1055.dll
+ 2008-07-30 02:47:34 89,080 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.2052.dll
+ 2008-07-30 02:47:34 110,072 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.2070.dll
+ 2008-07-30 02:47:34 111,096 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.3082.dll
+ 2008-07-30 02:47:34 107,512 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.dll
+ 2008-07-30 02:47:34 984,056 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapUI.dll
+ 2008-07-30 07:40:48 802,816 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft.Build.Tasks.v3.5.dll
+ 2008-07-30 07:40:48 40,960 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft.Data.Entity.Build.Tasks.dll
+ 2008-07-30 07:40:48 41,984 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Microsoft.VisualC.STLCLR.dll
+ 2008-07-30 07:40:48 91,136 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\MSBuild.exe
+ 2008-07-30 07:40:48 5,632 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Sentinel.v3.5Client.dll
+ 2008-07-30 07:40:48 1,720,824 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\vbc.exe
+ 2008-07-30 07:40:48 196,104 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe
+ 2008-07-30 07:40:48 70,648 —-a-w c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
- 2007-10-24 09:47:28 96,760 —-a-w c:\windows\system32\dfshim.dll
+ 2008-07-25 19:16:46 96,760 —-a-w c:\windows\system32\dfshim.dll
+ 2008-07-30 05:10:04 73,720 —-a-w c:\windows\system32\dxva2.dll
+ 2008-07-30 05:10:04 493,048 —-a-w c:\windows\system32\evr.dll
- 2009-01-25 22:12:38 273,376 —-a-w c:\windows\system32\FNTCACHE.DAT
+ 2009-02-05 18:33:03 276,560 —-a-w c:\windows\system32\FNTCACHE.DAT
+ 2008-07-30 03:24:50 622,080 —-a-w c:\windows\system32\icardagt.exe
+ 2008-07-30 03:24:50 11,264 —-a-w c:\windows\system32\icardres.dll
+ 2008-07-30 03:24:50 97,800 —-a-w c:\windows\system32\infocardapi.dll
- 2007-10-24 09:47:38 282,112 —-a-w c:\windows\system32\mscoree.dll
+ 2008-07-25 19:16:58 282,112 —-a-w c:\windows\system32\mscoree.dll
- 2007-10-24 09:47:38 158,720 —-a-w c:\windows\system32\mscorier.dll
+ 2008-07-25 19:16:58 158,720 —-a-w c:\windows\system32\mscorier.dll
- 2007-10-24 09:47:38 84,480 —-a-w c:\windows\system32\mscories.dll
+ 2008-07-25 19:16:58 83,968 —-a-w c:\windows\system32\mscories.dll
- 2007-10-24 09:47:44 15,360 —-a-w c:\windows\system32\mui\0409\mscorees.dll
+ 2008-07-25 19:17:04 15,360 —-a-w c:\windows\system32\mui\0409\mscorees.dll
- 2009-01-25 17:44:41 105,720 —-a-w c:\windows\system32\perfc009.dat
+ 2009-02-05 15:30:56 113,252 —-a-w c:\windows\system32\perfc009.dat
- 2009-01-25 17:44:41 524,448 —-a-w c:\windows\system32\perfh009.dat
+ 2009-02-05 15:30:56 559,244 —-a-w c:\windows\system32\perfh009.dat
+ 2008-07-30 03:59:58 105,016 —-a-w c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
+ 2008-07-30 04:35:46 326,160 —-a-w c:\windows\system32\PresentationHost.exe
+ 2008-07-30 03:59:58 43,544 —-a-w c:\windows\system32\PresentationHostProxy.dll
+ 2008-07-30 03:59:58 781,344 —-a-w c:\windows\system32\PresentationNative_v0300.dll
+ 2006-08-25 00:15:06 150,808 —-a-w c:\windows\system32\rgb9rast_2.dll
- 2007-11-30 13:39:22 17,272 ——w c:\windows\system32\spmsg.dll
+ 2007-11-30 12:39:22 17,272 ——w c:\windows\system32\spmsg.dll
+ 2008-07-06 12:06:10 765,440 —-a-w c:\windows\system32\spool\drivers\w32x86\3\mxdwdrv.dll
+ 2008-07-06 12:06:10 198,656 —-a-w c:\windows\system32\spool\drivers\w32x86\3\mxdwdui.dll
+ 2008-07-06 12:06:10 373,248 —-a-w c:\windows\system32\spool\drivers\w32x86\3\unidrv.dll
+ 2008-07-06 12:06:10 744,960 —-a-w c:\windows\system32\spool\drivers\w32x86\3\unidrvui.dll
+ 2008-03-13 04:52:36 761,344 —-a-w c:\windows\system32\spool\drivers\w32x86\3\unires.dll
+ 2008-07-06 12:06:10 1,676,288 —-a-w c:\windows\system32\spool\drivers\w32x86\3\XpsSvcs.dll
+ 2008-07-06 12:06:10 89,088 —-a-w c:\windows\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
+ 2008-07-06 10:50:03 597,504 ——w c:\windows\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
+ 2008-07-06 12:06:10 147,456 —-a-w c:\windows\system32\spool\prtprocs\x64\filterpipelineprintproc.dll
+ 2008-07-06 12:06:10 748,032 —-a-w c:\windows\system32\spool\XPSEP\amd64\amd64\mxdwdrv.dll
+ 2008-07-07 01:36:12 2,936,832 —-a-w c:\windows\system32\spool\XPSEP\amd64\amd64\xpssvcs.dll
+ 2008-07-06 12:06:10 748,032 —-a-w c:\windows\system32\spool\XPSEP\amd64\mxdwdrv.dll
+ 2008-07-07 01:36:12 2,936,832 —-a-w c:\windows\system32\spool\XPSEP\amd64\xpssvcs.dll
+ 2008-07-06 12:06:10 765,440 —-a-w c:\windows\system32\spool\XPSEP\i386\i386\mxdwdrv.dll
+ 2008-07-06 12:06:10 1,676,288 —-a-w c:\windows\system32\spool\XPSEP\i386\i386\xpssvcs.dll
+ 2008-07-06 12:06:10 765,440 —-a-w c:\windows\system32\spool\XPSEP\i386\mxdwdrv.dll
+ 2008-07-06 12:06:10 1,676,288 —-a-w c:\windows\system32\spool\XPSEP\i386\xpssvcs.dll
- 2007-08-11 04:46:18 26,488 —-a-w c:\windows\system32\spupdsvc.exe
+ 2007-11-30 11:18:51 26,488 —-a-w c:\windows\system32\spupdsvc.exe
+ 2008-07-30 05:10:04 26,112 —-a-w c:\windows\system32\TsWpfWrp.exe
+ 2008-07-30 03:59:58 161,296 —-a-w c:\windows\system32\UIAutomationCore.dll
+ 2008-07-30 05:26:06 301,568 —-a-w c:\windows\system32\XPSViewer\XPSViewer.exe
+ 2009-02-06 13:02:35 16,384 —-atw c:\windows\temp\Perflib_Perfdata_57c.dat
+ 2009-02-06 13:02:46 16,384 —-atw c:\windows\temp\Perflib_Perfdata_73c.dat
- 2009-01-25 03:13:20 8,192 —-a-w c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2009-02-05 15:30:34 8,192 —-a-w c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2008-07-25 19:17:20 479,232 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcm80.dll
+ 2008-07-25 19:17:20 558,080 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcp80.dll
+ 2008-07-25 19:17:20 635,904 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcr80.dll
+ 2007-11-07 05:23:56 224,768 —-a-w c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcm90.dll
+ 2007-11-07 10:19:32 568,832 —-a-w c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcp90.dll
+ 2007-11-07 10:19:32 655,872 —-a-w c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcr90.dll
- 2009-01-25 03:13:26 258,048 —-a-w c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2009-02-05 15:30:24 258,048 —-a-w c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
- 2009-01-25 03:13:26 113,664 —-a-w c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
+ 2009-02-05 15:30:24 113,664 —-a-w c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"OM_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master\Monitor.exe" [2006-05-16 57344]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"QuickTime Task"="C:\QTTask.exe" [2009-01-05 413696]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-28 136600]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 c:\windows\KHALMNPR.Exe]

c:\documents and settings\Barry Vickers\Start Menu\Programs\Startup\
Microsoft Office Groove.lnk - c:\program files\Microsoft Office\Office12\GROOVE.EXE [2007-08-29 340856]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]
OneNote Table Of Contents.onetoc2 [2009-01-25 3656]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-01-25 67128]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-01-25 688128]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= pvmjpg21.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MpfService"=2 (0x2)
"McSysmon"=3 (0x3)
"McShield"=2 (0x2)
"McProxy"=2 (0x2)
"McODS"=3 (0x3)
"McNASvc"=2 (0x2)
"mcmscsvc"=2 (0x2)
"McAfee SiteAdvisor Service"=2 (0x2)
"bgsvcgen"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-01-27 111184]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-01-27 20560]
.
Contents of the 'Scheduled Tasks' folder

2009-01-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&fr=yie7c
mWindow Title = Microsoft Internet Explorer
IE: &Search
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
Trusted Zone: musicmatch.com\online
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-06 10:29:27
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-02-06 10:31:30
ComboFix-quarantined-files.txt 2009-02-06 18:31:16
ComboFix2.txt 2009-02-04 14:55:35

Pre-Run: 51,835,695,104 bytes free
Post-Run: 51,917,398,016 bytes free

968 — E O F — 2009-01-25 00:01:30

CatByte

Post #10February 6, 2009, 6:40 PM UTC

Hello Barry35,

Things are looking much better, lets do a couple more checks to make sure we have eliminated everything.

FIRST

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

NEXT

I would like you to do an online scan

This scan can take several hours or longer, please be patient. You will need to use Internet Explorer for this scan.
*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

Please scan with Kaspersky Online Scanner

Click on the Accept button and install any components it needs.
The program will install and then begin downloading the latest definition files.
After the files have been downloaded on the left side of the page in the Scan section select My Computer.
This will start the program and scan your system.
The scan will take a while, so be patient and let it run. (At times it may appear to stall)
Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
- Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
- Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Once the scan is complete, click on View scan report To obtain the report:
Click on: Save Report As
Next, in the Save as prompt, Save in area, select: Desktop
In the File name area, use KScan, or something similar In Save as type, click the drop arrow and select: Text file [*.txt]
Then, click: Save
Please post the Kaspersky Online Scanner Report in your reply.

Now run HJT and select save a log file- post the fresh log in your next reply

In your next response please include

MBAM log
Kaspersky log
Fresh HJT log

barry35

Post #11February 7, 2009, 2:14 AM UTC

OK ..here are the scans you ask for;

#1 HJ Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:07:08 PM, on 2/6/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Microsoft Office\Office12\GROOVE.EXE
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN\Toolbar\3.0.0988.2\msntask.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
O4 - Startup: Microsoft Office Groove.lnk = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: OneNote Table Of Contents.onetoc2
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://pccheckup.dellfix.com/sdccommon/download/tgctlcm.cab
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1214425251765
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

–
End of file - 7847 bytes

#2 Kaspersky Report

——————————————————————————-
KASPERSKY ONLINE SCANNER 7 REPORT
Friday, February 6, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Friday, February 06, 2009 22:52:44
Records in database: 1761559
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Files scanned: 78338
Threat name: 3
Infected objects: 3
Suspicious objects: 0
Duration of the scan: 02:04:15

File name / Threat name / Threats count
C:\Documents and Settings\Barry Vickers\My Documents\LimeWire\Incomplete\T-3545427-where are you christmas.mp3 Infected: Trojan-Downloader.WMA.GetCodec.u 1
C:\Documents and Settings\Barry Vickers\My Documents\LimeWire\Saved\pink flold - greatest hits.wma Infected: Trojan-Downloader.WMA.Wimad.n 1
C:\Documents and Settings\Barry Vickers\My Documents\LimeWire\Saved\where are you christmas CD quality.mp3 Infected: Trojan-Downloader.WMA.GetCodec.f 1

The selected area was scanned.

#3 Malwarewarebytes' log

Malwarebytes' Anti-Malware 1.33
Database version: 1736
Windows 5.1.2600 Service Pack 3

2/6/2009 2:23:00 PM
mbam-log-2009-02-06 (14-23-00).txt

Scan type: Quick Scan
Objects scanned: 63177
Time elapsed: 4 minute(s), 3 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 13
Files Infected: 34

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\Perfect Optimizer (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup\Application (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup\Registry (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup\Registry\FirstBackup (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup\Registry\FullBackup (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup\Service (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Data (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Data\Service (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Res (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Temp (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Update (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Documents and Settings\Barry Vickers\Start Menu\Programs\Perfect Optimizer (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\Perfect Optimizer\Backup\Registry\FirstBackup\20081128064501.Reg (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup\Registry\FullBackup\20081130184351.Reg (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup\Registry\FullBackup\20090125120028.Reg (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup\Service\backup_service.bat (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Backup\Service\Default.bat (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Data\Service\campus_model.bat (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Data\Service\default_model.bat (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Data\Service\home_model.bat (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Data\Service\interner_model.bat (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Data\Service\notebook_model.bat (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Data\Service\office_model.bat (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Res\ActiveX.png (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Res\Bad.jpg (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Res\Check.png (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Res\CleanEvidence.png (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Res\CleanHardDisk.png (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Res\Disk.png (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Res\DotLine.png (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Res\Error.png (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Res\Frame.png (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Res\Good.jpg (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Res\Progrss.bmp (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Res\RegistryClean.png (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Res\SEM_RSO_BG.png (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Res\StartupOptimize.png (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Res\SystemOptimize.png (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Res\Time.png (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Res\Top.png (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Res\Uncheck.png (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Res\Warning.jpg (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Res\Win.png (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Temp\__clean_disk.bat (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Program Files\Perfect Optimizer\Temp\__clean_reg.yds (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.
C:\Documents and Settings\Barry Vickers\Start Menu\Programs\Perfect Optimizer\OneNote Table Of Contents.onetoc2 (Rogue.PerfectOptimzier) -> Quarantined and deleted successfully.

CatByte

Post #12February 7, 2009, 12:51 PM UTC

Hi Barry35,

Things are looking better, just a little more work to do.

I suggest you do this:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

File::
C:\Documents and Settings\Barry Vickers\My Documents\LimeWire\Incomplete\T-3545427-where are you christmas.mp3 
C:\Documents and Settings\Barry Vickers\My Documents\LimeWire\Saved\pink flold - greatest hits.wma 
C:\Documents and Settings\Barry Vickers\My Documents\LimeWire\Saved\where are you christmas CD quality.mp3 

Folder::
C:\Program Files\Perfect Optimizer
C:\Documents and Settings\Barry Vickers\Start Menu\Programs\Perfect Optimizer

Combofix log

Please also advise how your computer is running now.

barry35

Post #13February 7, 2009, 2:48 PM UTC

computer is much better……..

ComboFix 09-02-06.02 - Barry Vickers 2009-02-07 6:40:27.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.502.185 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Barry Vickers\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1296 [VPS 090207-0] *On-access scanning enabled* (Updated)
* Created a new restore point

FILE ::
c:\documents and settings\Barry Vickers\My Documents\LimeWire\Incomplete\T-3545427-where are you christmas.mp3
c:\documents and settings\Barry Vickers\My Documents\LimeWire\Saved\pink flold - greatest hits.wma
c:\documents and settings\Barry Vickers\My Documents\LimeWire\Saved\where are you christmas CD quality.mp3
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Barry Vickers\My Documents\LimeWire\Incomplete\T-3545427-where are you christmas.mp3
c:\documents and settings\Barry Vickers\My Documents\LimeWire\Saved\pink flold - greatest hits.wma
c:\documents and settings\Barry Vickers\My Documents\LimeWire\Saved\where are you christmas CD quality.mp3

.
((((((((((((((((((((((((( Files Created from 2009-01-07 to 2009-02-07 )))))))))))))))))))))))))))))))
.

2009-02-06 20:06 . 2009-02-06 20:06 419 –a—— c:\windows\BRWMARK.INI
2009-02-06 20:06 . 2009-02-06 20:06 242 –a—— c:\windows\Brpfx04a.ini
2009-02-06 20:06 . 2009-02-06 20:06 93 –a—— c:\windows\brpcfx.ini
2009-02-06 20:06 . 2009-02-06 20:06 27 –a—— c:\windows\BRPP2KA.INI
2009-02-06 20:03 . 2009-02-06 20:03 d——– c:\program files\Brother
2009-02-06 20:02 . 2009-02-06 20:02 d——– c:\documents and settings\Barry Vickers\Application Data\InstallShield
2009-02-06 20:01 . 2009-02-06 20:01 d——– c:\program files\Nuance
2009-02-06 20:01 . 2006-10-24 14:34 31,567 –a—— c:\windows\maxlink.ini
2009-02-06 20:00 . 2009-02-06 20:00 d——– c:\program files\ScanSoft
2009-02-06 20:00 . 2009-02-06 20:00 d——– c:\program files\Common Files\ScanSoft Shared
2009-02-06 20:00 . 2009-02-06 20:01 d——– c:\documents and settings\All Users\Application Data\ScanSoft
2009-02-06 19:59 . 2009-02-06 19:59 d——– c:\documents and settings\All Users\Application Data\Brother
2009-02-06 19:51 . 2008-04-14 00:17 25,856 –a—— c:\windows\system32\drivers\usbprint.sys
2009-02-06 19:51 . 2008-04-14 00:17 25,856 –a—— c:\windows\system32\dllcache\usbprint.sys
2009-02-06 14:16 . 2009-01-14 16:11 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-06 14:16 . 2009-01-14 16:11 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2009-02-06 06:19 . 2009-02-06 06:25 d——– c:\documents and settings\Barry Vickers\.SunDownloadManager
2009-02-05 07:24 . 2009-02-05 07:24 d——– c:\windows\system32\XPSViewer
2009-02-05 07:24 . 2009-02-05 07:24 d——– c:\program files\Reference Assemblies
2009-02-05 07:23 . 2009-02-05 07:23 d——– C:\afae403cd4a70e42346c87d27d027787
2009-02-05 07:23 . 2008-07-06 04:06 1,676,288 ——— c:\windows\system32\xpssvcs.dll
2009-02-05 07:23 . 2008-07-06 04:06 1,676,288 ——— c:\windows\system32\dllcache\xpssvcs.dll
2009-02-05 07:23 . 2008-07-06 02:50 597,504 ——— c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-05 07:23 . 2008-07-06 04:06 575,488 ——— c:\windows\system32\xpsshhdr.dll
2009-02-05 07:23 . 2008-07-06 04:06 575,488 ——— c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-05 07:23 . 2008-07-06 04:06 117,760 ——— c:\windows\system32\prntvpt.dll
2009-02-05 07:23 . 2008-07-06 04:06 89,088 ——— c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-05 07:22 . 2009-02-05 10:33 d——– c:\windows\SxsCaPendDel
2009-01-29 16:12 . 2009-01-29 16:12 d——– c:\documents and settings\Kristen\Application Data\Viewpoint
2009-01-29 11:26 . 2009-01-29 11:26 d——– c:\documents and settings\Barry Vickers\Application Data\Viewpoint
2009-01-28 14:19 . 2009-01-28 14:19 d——– c:\windows\system32\portraitsofautumn_3125138 dir
2009-01-28 14:19 . 2009-01-28 14:19 520,192 –a—— c:\windows\system32\portraitsofautumn_3125138.scr
2009-01-28 14:16 . 2009-01-28 14:16 d——– c:\windows\system32\mountainscenery_3143988 dir
2009-01-28 14:16 . 2009-01-28 14:16 520,192 –a—— c:\windows\system32\mountainscenery_3143988.scr
2009-01-28 12:50 . 2009-01-28 12:50 410,984 –a—— c:\windows\system32\deploytk.dll
2009-01-28 11:56 . 2009-01-28 11:56 d——– c:\program files\Trend Micro
2009-01-27 13:23 . 2009-01-27 13:23 d——– C:\Users
2009-01-27 13:23 . 2009-01-27 13:23 5,156,864 –a—— C:\SYSTEM
2009-01-27 13:23 . 2009-01-27 13:23 299,008 –a—— C:\DEFAULT
2009-01-27 13:23 . 2009-01-27 13:23 24,576 –a—— C:\SAM
2009-01-27 13:21 . 2009-01-27 13:23 38,973,440 –a—— C:\SOFTWARE
2009-01-27 13:21 . 2009-01-27 13:21 53,248 –a—— C:\SECURITY
2009-01-27 13:07 . 2009-01-27 15:03 d——– c:\program files\PC Tune-Up
2009-01-27 12:52 . 2006-02-15 14:10 397,312 –a—— c:\windows\system32\drivers\ETNADiag.exe
2009-01-27 12:37 . 2009-01-27 12:37 d——– c:\program files\PCCheckupOnline
2009-01-26 17:42 . 2009-01-26 17:42 d——– C:\QuickTimePlayer.Resources
2009-01-26 17:42 . 2009-01-26 17:42 d——– C:\QTSystem
2009-01-26 17:42 . 2009-01-26 17:42 d——– C:\QTComponents
2009-01-26 17:42 . 2009-01-26 17:42 d——– C:\PropertyPanels
2009-01-26 17:42 . 2009-01-26 17:42 d——– C:\Plugins
2009-01-26 17:42 . 2009-01-26 17:42 d——– C:\PictureViewer.Resources
2009-01-26 17:37 . 2009-01-26 17:40 21,878,064 –a—— C:\QuickTimeInstaller.exe
2009-01-26 17:12 . 2009-01-26 17:12 d——– c:\program files\iTunes
2009-01-26 17:12 . 2009-01-26 17:12 d——– c:\program files\iPod
2009-01-26 17:12 . 2009-01-26 17:12 d——– c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-26 17:12 . 2008-04-17 13:12 107,368 –a—— c:\windows\system32\GEARAspi.dll
2009-01-26 17:12 . 2008-04-17 13:12 15,464 –a—— c:\windows\system32\drivers\GEARAspiWDM.sys
2009-01-26 17:10 . 2009-01-26 17:10 d——– c:\program files\Common Files\Apple
2009-01-26 16:47 . 2009-01-26 16:47 d——– c:\program files\Microsoft Calculator Plus
2009-01-26 16:23 . 2009-02-07 06:40 d——– c:\windows\system32\CatRoot2
2009-01-26 15:52 . 2009-01-26 15:52 69,076,264 –a—— C:\Quicktime.exe
2009-01-26 15:40 . 2009-01-26 15:40 d——– c:\windows\system32\config\systemprofile\Application Data\TeamViewer
2009-01-26 15:39 . 2009-01-26 15:39 d——– c:\program files\TeamViewer
2009-01-26 11:56 . 2009-01-26 11:56 d——– c:\program files\Salloway
2009-01-26 10:01 . 2009-01-26 10:13 d——– c:\program files\PowerISO
2009-01-25 21:30 . 2009-01-25 21:30 d——– c:\windows\system32\DRM
2009-01-25 16:37 . 2009-01-25 16:37 d——– c:\documents and settings\Kristen\Application Data\Windows Desktop Search
2009-01-25 16:37 . 2009-01-25 16:37 d——– c:\documents and settings\Kristen\Application Data\Logitech
2009-01-25 15:13 . 2009-01-27 11:13 d——– c:\documents and settings\Barry Vickers\Application Data\OfficeUpdate12
2009-01-25 15:10 . 2009-01-25 15:10 d——– c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-01-25 15:06 . 2009-01-29 12:09 d——– c:\program files\MagicISO
2009-01-25 14:53 . 2009-01-25 14:53 d——– c:\documents and settings\Barry Vickers\Application Data\Runaware
2009-01-25 14:53 . 2009-01-25 14:53 d——– c:\documents and settings\Barry Vickers\Application Data\ICAClient
2009-01-25 13:04 . 2009-01-25 13:04 d——– c:\program files\Common Files\Windows Live
2009-01-25 12:09 . 2009-02-05 07:24 d——– c:\program files\MSBuild
2009-01-25 11:37 . 2007-01-23 15:45 1,419,024 –a—— c:\windows\system32\WdfCoInstaller01005.dll
2009-01-25 11:37 . 2007-01-23 15:44 101,136 –a—— c:\windows\KHALMNPR.Exe
2009-01-25 11:37 . 2007-01-23 15:45 34,576 –a—— c:\windows\system32\drivers\LHidFilt.Sys
2009-01-25 11:37 . 2007-01-23 15:45 33,296 –a—— c:\windows\system32\drivers\LMouFilt.Sys
2009-01-25 11:36 . 2007-01-30 01:46 163,840 –a—— c:\windows\system32\kemutb.dll
2009-01-25 11:36 . 2007-01-30 01:46 135,168 –a—— c:\windows\system32\KemUtil.dll
2009-01-25 11:36 . 2007-01-30 01:46 110,592 –a—— c:\windows\system32\KemWnd.dll
2009-01-25 11:36 . 2007-01-30 01:46 69,632 –a—— c:\windows\system32\KemXML.dll
2009-01-25 09:45 . 2009-01-25 09:45 d——– c:\documents and settings\Barry Vickers\Application Data\Windows Search
2009-01-25 09:45 . 2009-01-25 09:45 d——– c:\documents and settings\Barry Vickers\Application Data\Windows Desktop Search
2009-01-25 09:44 . 2009-01-26 15:58 d–h—– c:\windows\system32\GroupPolicy
2009-01-25 09:44 . 2009-01-25 09:44 d——– c:\program files\Windows Desktop Search
2009-01-24 19:29 . 2009-01-24 19:29 d——– c:\program files\Microsoft
2009-01-24 16:15 . 2009-01-25 12:10 d——– c:\program files\Microsoft Works
2009-01-24 16:14 . 2009-01-24 16:14 d——– c:\program files\Microsoft.NET
2009-01-24 16:13 . 2009-01-24 16:13 d——– c:\documents and settings\All Users\Application Data\DriverScanner
2009-01-24 15:40 . 2006-10-26 19:56 32,592 –a—— c:\windows\system32\msonpmon.dll
2009-01-24 15:33 . 2009-01-25 12:01 d——– c:\program files\Microsoft Visual Studio 8
2009-01-24 15:32 . 2009-01-25 12:08 d——– c:\windows\SHELLNEW
2009-01-24 15:32 . 2009-01-28 12:34 d——– c:\documents and settings\All Users\Application Data\Microsoft Help
2009-01-24 15:31 . 2009-01-24 15:31 dr-h—– C:\MSOCache
2009-01-23 17:11 . 2009-01-24 16:13 d——– c:\documents and settings\Barry Vickers\Application Data\Uniblue
2009-01-22 18:23 . 2009-01-29 12:09 d——– c:\documents and settings\Barry Vickers\Application Data\TeamViewer
2009-01-22 18:22 . 2009-01-22 18:22 d——– c:\documents and settings\Barry Vickers\temp
2009-01-22 17:58 . 2009-01-25 09:44 1,374 –a—— c:\windows\imsins.BAK
2009-01-22 15:46 . 2008-04-13 17:12 116,224 –a—— c:\windows\system32\dllcache\xrxwiadr.dll
2009-01-22 15:46 . 2001-08-17 22:37 27,648 –a—— c:\windows\system32\dllcache\xrxftplt.exe
2009-01-22 15:46 . 2001-08-17 22:36 23,040 –a—— c:\windows\system32\dllcache\xrxwbtmp.dll
2009-01-22 15:46 . 2008-04-13 17:12 18,944 –a—— c:\windows\system32\dllcache\xrxscnui.dll
2009-01-22 15:45 . 2001-08-17 22:37 99,865 –a—— c:\windows\system32\dllcache\xlog.exe
2009-01-22 15:45 . 2004-08-03 22:29 19,455 –a—— c:\windows\system32\dllcache\wvchntxx.sys
2009-01-22 15:45 . 2008-04-13 11:46 19,200 –a—— c:\windows\system32\dllcache\wstcodec.sys
2009-01-22 15:45 . 2001-08-17 12:11 16,970 –a—— c:\windows\system32\dllcache\xem336n5.sys
2009-01-22 15:45 . 2004-08-03 22:29 12,063 –a—— c:\windows\system32\dllcache\wsiintxx.sys
2009-01-22 15:45 . 2008-04-13 17:12 8,192 –a—— c:\windows\system32\dllcache\wshirda.dll
2009-01-22 15:45 . 2001-08-17 22:37 4,608 –a—— c:\windows\system32\dllcache\xrxflnch.exe
2009-01-22 15:43 . 2001-08-17 13:28 794,399 –a—— c:\windows\system32\dllcache\usr1806v.sys
2009-01-22 15:42 . 2001-08-17 13:28 794,654 –a—— c:\windows\system32\dllcache\usr1801.sys
2009-01-22 15:41 . 2001-08-17 22:36 525,568 –a—— c:\windows\system32\dllcache\tridxp.dll
2009-01-22 15:41 . 2001-08-17 14:56 440,576 –a—— c:\windows\system32\dllcache\tridkb.dll
2009-01-22 15:41 . 2001-08-17 14:56 315,520 –a—— c:\windows\system32\dllcache\trid3d.dll
2009-01-22 15:41 . 2001-08-17 14:01 241,664 –a—— c:\windows\system32\dllcache\tosdvd02.sys
2009-01-22 15:41 . 2001-08-17 14:02 230,912 –a—— c:\windows\system32\dllcache\tosdvd03.sys
2009-01-22 15:41 . 2001-08-17 12:51 222,336 –a—— c:\windows\system32\dllcache\trid3dm.sys
2009-01-22 15:41 . 2001-08-17 12:51 166,784 –a—— c:\windows\system32\dllcache\tridxpm.sys
2009-01-22 15:41 . 2001-08-17 12:51 159,232 –a—— c:\windows\system32\dllcache\tridkbm.sys
2009-01-22 15:41 . 2008-04-13 17:12 82,944 –a—— c:\windows\system32\dllcache\tp4mon.exe
2009-01-22 15:41 . 2001-08-17 22:35 42,496 –a—— c:\windows\system32\dllcache\tp4res.dll
2009-01-22 15:41 . 2001-08-17 12:12 34,375 –a—— c:\windows\system32\dllcache\tpro4.sys
2009-01-22 15:41 . 2001-08-17 22:36 31,744 –a—— c:\windows\system32\dllcache\tp4.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-07 04:03 ——— d–h–w c:\program files\InstallShield Installation Information
2009-02-07 02:20 ——— d—–w c:\program files\LimeWire
2009-02-06 22:16 ——— d—–w c:\program files\Malwarebytes' Anti-Malware
2009-02-06 14:21 ——— d—–w c:\program files\Java
2009-02-01 02:04 ——— d—–w c:\documents and settings\Barry Vickers\Application Data\LimeWire
2009-01-27 20:53 ——— d—–w c:\program files\Common Files\Sonic Shared
2009-01-27 20:50 ——— d—–w c:\program files\Intel
2009-01-27 20:38 ——— d—–w c:\program files\Dell
2009-01-26 17:54 ——— d—–w c:\program files\MSECache
2009-01-23 04:17 ——— d—–w c:\documents and settings\All Users\Application Data\McAfee
2009-01-23 04:11 ——— d—–w c:\program files\Roxio
2009-01-22 22:34 ——— d—–w c:\documents and settings\LocalService\Application Data\SACore
2009-01-07 02:45 ——— d—–w c:\program files\WildTangent
2009-01-06 00:19 880,640 —-a-w C:\QTOControl.dll
2009-01-06 00:19 806,912 —-a-w C:\QTOLibrary.dll
2009-01-06 00:19 782,336 —-a-w C:\QTInfo.exe
2009-01-06 00:19 7,697,712 —-a-w C:\QuickTimePlayer.exe
2009-01-06 00:19 352,256 —-a-w C:\QTUIPanelControl.dll
2009-01-06 00:18 413,696 —-a-w C:\QTTask.exe
2009-01-05 22:33 3,751,995 —-a-w c:\windows\system32\GPhotos.scr
2008-12-18 15:38 ——— d—–w c:\program files\Yahoo!
2008-12-18 15:38 ——— d—–w c:\documents and settings\LocalService\Application Data\Yahoo!
2008-12-18 15:38 ——— d—–w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2008-12-13 06:40 3,593,216 —-a-w c:\windows\system32\dllcache\mshtml.dll
2008-12-11 10:57 333,952 —-a-w c:\windows\system32\drivers\srv.sys
2008-12-11 10:57 333,952 —-a-w c:\windows\system32\dllcache\srv.sys
2008-12-08 03:14 ——— d—–w c:\documents and settings\Kristen\Application Data\OLYMPUS
2008-12-08 02:56 ——— d—–w c:\documents and settings\Barry Vickers\Application Data\OLYMPUS
2008-12-08 02:54 ——— d—–w c:\program files\OLYMPUS
2008-12-07 00:54 ——— d—–w c:\program files\Google
2008-12-05 03:54 524,288 —-a-w c:\windows\opuc.dll
2008-11-24 17:01 6,686 –sha-w c:\windows\system32\KGyGaAvL.sys
2008-11-20 17:24 50,816 —-a-w c:\documents and settings\Barry Vickers\Application Data\GDIPFONTCACHEV1.DAT
2007-11-28 19:12 67,696 —-a-w c:\program files\mozilla firefox\components\jar50.dll
2007-11-28 19:12 54,376 —-a-w c:\program files\mozilla firefox\components\jsd3250.dll
2007-11-28 19:12 34,952 —-a-w c:\program files\mozilla firefox\components\myspell.dll
2007-11-28 19:12 46,720 —-a-w c:\program files\mozilla firefox\components\spellchk.dll
2007-11-28 19:12 172,144 —-a-w c:\program files\mozilla firefox\components\xpinstal.dll
2008-11-02 18:32 104 –sha-r c:\windows\system32\66C874FF70.sys
2008-06-25 21:20 32,768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008062520080626\index.dat
.

((((((((((((((((((((((((((((( SnapShot_2009-02-06_10.30.10.89 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-07 04:00:49 573,440 —-a-r c:\windows\Installer\{7A8FF745-BBC5-482B-88E4-18D3178249A9}\ARPPRODUCTICON.exe
+ 2009-02-07 04:00:50 573,440 —-a-r c:\windows\Installer\{7A8FF745-BBC5-482B-88E4-18D3178249A9}\NewShortcut10_02E73E50651348028600B5A5BA185BE3.exe
+ 2009-02-07 04:00:50 573,440 —-a-r c:\windows\Installer\{7A8FF745-BBC5-482B-88E4-18D3178249A9}\NewShortcut11_02E73E50651348028600B5A5BA185BE3.exe
+ 2009-02-07 04:00:50 573,440 —-a-r c:\windows\Installer\{7A8FF745-BBC5-482B-88E4-18D3178249A9}\NewShortcut12_02E73E50651348028600B5A5BA185BE3.exe
+ 2009-02-07 04:00:50 573,440 —-a-r c:\windows\Installer\{7A8FF745-BBC5-482B-88E4-18D3178249A9}\NewShortcut13_F2CDC39AAD4A470EADF36CE15914D115.exe
+ 2009-02-07 04:00:50 573,440 —-a-r c:\windows\Installer\{7A8FF745-BBC5-482B-88E4-18D3178249A9}\NewShortcut14_F2CDC39AAD4A470EADF36CE15914D115.exe
+ 2009-02-07 04:00:51 573,440 —-a-r c:\windows\Installer\{7A8FF745-BBC5-482B-88E4-18D3178249A9}\NewShortcut15_F2CDC39AAD4A470EADF36CE15914D115.exe
+ 2009-02-07 04:00:51 573,440 —-a-r c:\windows\Installer\{7A8FF745-BBC5-482B-88E4-18D3178249A9}\NewShortcut16_F2CDC39AAD4A470EADF36CE15914D115.exe
+ 2009-02-07 04:00:51 573,440 —-a-r c:\windows\Installer\{7A8FF745-BBC5-482B-88E4-18D3178249A9}\NewShortcut20_F2CDC39AAD4A470EADF36CE15914D115.exe
+ 2009-02-07 04:00:51 573,440 —-a-r c:\windows\Installer\{7A8FF745-BBC5-482B-88E4-18D3178249A9}\NewShortcut4_F2CDC39AAD4A470EADF36CE15914D115.exe
+ 2009-02-07 04:00:53 573,440 —-a-r c:\windows\Installer\{7A8FF745-BBC5-482B-88E4-18D3178249A9}\NewShortcut5_F2CDC39AAD4A470EADF36CE15914D115.exe
+ 2009-02-07 04:00:52 573,440 —-a-r c:\windows\Installer\{7A8FF745-BBC5-482B-88E4-18D3178249A9}\NewShortcut7_02E73E50651348028600B5A5BA185BE3.exe
+ 2009-02-07 04:00:52 573,440 —-a-r c:\windows\Installer\{7A8FF745-BBC5-482B-88E4-18D3178249A9}\NewShortcut8_02E73E50651348028600B5A5BA185BE3.exe
+ 2009-02-07 04:00:53 573,440 —-a-r c:\windows\Installer\{7A8FF745-BBC5-482B-88E4-18D3178249A9}\NewShortcut9_02E73E50651348028600B5A5BA185BE3.exe
+ 2009-02-07 04:00:49 450,560 —-a-r c:\windows\Installer\{7A8FF745-BBC5-482B-88E4-18D3178249A9}\PageViewer.exe
+ 2009-02-07 04:00:49 573,440 —-a-r c:\windows\Installer\{7A8FF745-BBC5-482B-88E4-18D3178249A9}\PaperPort_F2CDC39AAD4A470EADF36CE15914D115.exe
+ 2009-02-07 04:00:48 65,536 —-a-r c:\windows\Installer\{7A8FF745-BBC5-482B-88E4-18D3178249A9}\Shortcut0.C3A146F5_4B48_11D5_A819_00B0D0428C0C.exe
+ 2006-07-07 20:40:24 73,728 ——w c:\windows\system32\BRCrypt.dll
+ 2007-12-14 06:16:24 73,728 ——w c:\windows\system32\BrDctF2.dll
+ 2007-12-14 06:16:20 5,120 ——w c:\windows\system32\BrDctF2L.dll
+ 2007-12-14 06:16:16 3,072 ——w c:\windows\system32\BrDctF2S.dll
+ 2007-10-03 09:05:00 126,976 ——w c:\windows\system32\BrfxD05a.dll
+ 2008-01-25 20:48:42 102,400 ——w c:\windows\system32\BrMfNt.dll
+ 2002-11-26 21:43:18 106,496 ——w c:\windows\system32\BrMuSNMP.dll
+ 2006-12-28 21:39:54 176,128 ——w c:\windows\system32\BroSNMP.dll
+ 2007-12-24 13:24:02 45,056 —-a-w c:\windows\system32\BrUsi08a.dll
+ 2008-03-18 13:35:14 1,522,176 —-a-w c:\windows\system32\BrWia08a.dll
+ 2004-10-15 03:50:20 15,295 —-a-w c:\windows\system32\drivers\BrScnUsb.sys
+ 2006-12-12 19:28:26 52,224 —-a-w c:\windows\system32\drivers\BrSerIf.sys
+ 2006-09-03 17:53:54 11,904 —-a-w c:\windows\system32\drivers\BrUsbSer.sys
+ 2008-01-26 03:49:00 90,112 -c–a-w c:\windows\system32\DRVSTORE\brimbh92_13E45A51090C5B1DD7AFD3F12CACE9C34CC3630E\BrScnDev.dll
+ 2004-10-15 20:50:20 15,295 -c–a-w c:\windows\system32\DRVSTORE\brimbh92_13E45A51090C5B1DD7AFD3F12CACE9C34CC3630E\BrScnUsb.sys
+ 2007-11-23 02:02:48 9,728 -c–a-w c:\windows\system32\DRVSTORE\brimbh92_13E45A51090C5B1DD7AFD3F12CACE9C34CC3630E\BrSti08a.dll
+ 2007-12-15 03:28:50 61,440 -c–a-w c:\windows\system32\DRVSTORE\brimbh92_13E45A51090C5B1DD7AFD3F12CACE9C34CC3630E\BrStiIf.dll
+ 2008-01-26 01:40:10 102,400 -c–a-w c:\windows\system32\DRVSTORE\brimbh92_13E45A51090C5B1DD7AFD3F12CACE9C34CC3630E\BrTwdLng.dll
+ 2008-02-23 01:09:22 159,744 -c–a-w c:\windows\system32\DRVSTORE\brimbh92_13E45A51090C5B1DD7AFD3F12CACE9C34CC3630E\BrTwds.dll
+ 2008-02-23 01:10:18 1,474,560 -c–a-w c:\windows\system32\DRVSTORE\brimbh92_13E45A51090C5B1DD7AFD3F12CACE9C34CC3630E\BrTwdScn.dll
+ 2008-02-27 02:25:46 151,552 -c–a-w c:\windows\system32\DRVSTORE\brimbh92_13E45A51090C5B1DD7AFD3F12CACE9C34CC3630E\BrTwdsUi.dll
+ 2007-12-25 06:24:02 45,056 -c–a-w c:\windows\system32\DRVSTORE\brimbh92_13E45A51090C5B1DD7AFD3F12CACE9C34CC3630E\BrUsi08a.dll
+ 2008-03-19 06:35:14 1,522,176 -c–a-w c:\windows\system32\DRVSTORE\brimbh92_13E45A51090C5B1DD7AFD3F12CACE9C34CC3630E\BrWia08a.dll
+ 2006-12-12 19:28:26 52,224 -c–a-w c:\windows\system32\DRVSTORE\brpobh92_71525E2522F5B873DFB9048DBC93A888F2479DD6\BrSerIf.sys
+ 2006-09-03 17:53:54 11,904 -c–a-w c:\windows\system32\DRVSTORE\brpobh92_71525E2522F5B873DFB9048DBC93A888F2479DD6\BrUsbSer.sys
+ 2008-04-02 00:36:28 53,248 -c–a-w c:\windows\system32\DRVSTORE\brprbh92_68DD8B3065A7EAF41879B6D3C8C21C7F1C0B155C\bril08b.dll
+ 2008-04-02 00:36:22 1,685,504 -c–a-w c:\windows\system32\DRVSTORE\brprbh92_68DD8B3065A7EAF41879B6D3C8C21C7F1C0B155C\brio08b.dll
+ 2008-04-02 00:36:22 2,028,544 -c–a-w c:\windows\system32\DRVSTORE\brprbh92_68DD8B3065A7EAF41879B6D3C8C21C7F1C0B155C\briu08b.dll
+ 2007-01-26 11:06:00 116,544 -c–a-w c:\windows\system32\DRVSTORE\brprbh92_68DD8B3065A7EAF41879B6D3C8C21C7F1C0B155C\brqikmon.exe
- 2009-02-05 18:33:03 276,560 —-a-w c:\windows\system32\FNTCACHE.DAT
+ 2009-02-07 04:08:38 277,352 —-a-w c:\windows\system32\FNTCACHE.DAT
- 2004-09-01 16:56:46 1,060,864 —-a-w c:\windows\system32\mfc71.dll
+ 2006-07-12 02:43:32 1,060,864 —-a-w c:\windows\system32\mfc71.dll
- 2003-03-19 02:12:12 1,047,552 —-a-w c:\windows\system32\mfc71u.dll
+ 2006-07-12 03:02:30 1,053,184 —-a-w c:\windows\system32\mfc71u.dll
- 2005-09-09 00:20:04 348,160 —-a-w c:\windows\system32\msvcr71.dll
+ 2006-07-12 02:35:38 348,160 —-a-w c:\windows\system32\msvcr71.dll
+ 2008-01-25 23:21:30 167,936 ——w c:\windows\system32\NSSearch.dll
+ 2008-04-02 00:36:28 53,248 —-a-w c:\windows\system32\spool\drivers\w32x86\3\bril08b.dll
+ 2008-04-02 00:36:22 1,685,504 —-a-w c:\windows\system32\spool\drivers\w32x86\3\brio08b.dll
+ 2008-04-02 00:36:22 2,028,544 —-a-w c:\windows\system32\spool\drivers\w32x86\3\briu08b.dll
+ 2006-09-16 09:02:00 7,168 —-a-w c:\windows\system32\spool\drivers\w32x86\3\Brlfx05a.dll
+ 2007-11-02 09:22:00 170,496 —-a-w c:\windows\system32\spool\drivers\w32x86\3\BROFX05A.DLL
+ 2007-01-26 11:06:00 116,544 —-a-w c:\windows\system32\spool\drivers\w32x86\3\brqikmon.exe
+ 2007-11-02 09:22:00 161,280 —-a-w c:\windows\system32\spool\drivers\w32x86\3\BRUFX05A.DLL
+ 2007-10-12 03:11:36 87,328 —-a-w c:\windows\system32\spool\drivers\w32x86\3\NuanImageConvert.dll
+ 2007-10-12 03:11:16 189,728 —-a-w c:\windows\system32\spool\drivers\w32x86\3\NuanOemUiRes.dll
+ 2007-10-12 03:11:40 25,376 —-a-w c:\windows\system32\spool\drivers\w32x86\3\NuanUI.dll
+ 2007-10-12 03:11:40 26,912 —-a-w c:\windows\system32\spool\drivers\w32x86\3\NuanUni.dll
+ 2008-04-02 00:36:28 53,248 —-a-w c:\windows\system32\spool\drivers\w32x86\brothermfc_490cw57e3\bril08b.dll
+ 2008-04-02 00:36:22 1,685,504 —-a-w c:\windows\system32\spool\drivers\w32x86\brothermfc_490cw57e3\brio08b.dll
+ 2008-04-02 00:36:22 2,028,544 —-a-w c:\windows\system32\spool\drivers\w32x86\brothermfc_490cw57e3\briu08b.dll
+ 2007-01-26 11:06:00 116,544 —-a-w c:\windows\system32\spool\drivers\w32x86\brothermfc_490cw57e3\brqikmon.exe
+ 2006-09-16 09:02:00 7,168 —-a-w c:\windows\system32\spool\drivers\w32x86\brotherpc_fax_v_2f2e4\Brlfx05a.dll
+ 2007-11-02 09:22:00 170,496 —-a-w c:\windows\system32\spool\drivers\w32x86\brotherpc_fax_v_2f2e4\BROFX05A.DLL
+ 2007-11-02 09:22:00 161,280 —-a-w c:\windows\system32\spool\drivers\w32x86\brotherpc_fax_v_2f2e4\BRUFX05A.DLL
+ 2005-09-07 19:03:40 722,192 —-a-w c:\windows\system32\Vb40032.dll
+ 2009-02-07 14:30:19 16,384 —-atw c:\windows\temp\Perflib_Perfdata_270.dat
+ 2009-02-07 14:30:08 16,384 —-atw c:\windows\temp\Perflib_Perfdata_5a0.dat
+ 2008-01-25 10:49:00 90,112 —-a-w c:\windows\twain_32\BrMfSc08a\Common\BrScnDev.dll
+ 2007-12-14 10:28:50 61,440 —-a-w c:\windows\twain_32\BrMfSc08a\Common\BrStiIf.dll
+ 2008-02-22 08:09:22 159,744 —-a-w c:\windows\twain_32\BrMfSc08a\Common\BrTwds.dll
+ 2008-02-22 08:10:18 1,474,560 —-a-w c:\windows\twain_32\BrMfSc08a\Common\BrTwdScn.dll
+ 2008-02-26 09:25:46 151,552 —-a-w c:\windows\twain_32\BrMfSc08a\Common\BrTwdsUi.dll
+ 2008-01-25 08:40:10 102,400 —-a-w c:\windows\twain_32\BrMfSc08a\Lang\BrTwdLng.dll
+ 2008-03-17 18:30:26 118,784 ——w c:\windows\twain_32\BrMfSc08a\MF490CWU\BrDbgOut.dll
+ 2009-02-07 04:00:27 1,230,336 —-a-w c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.1.0.0_x-ww_b319d8da\msxml4.dll
+ 2009-02-07 04:00:28 82,432 —-a-w c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\msxml4r.dll
+ 2006-12-02 08:46:44 65,536 —-a-w c:\windows\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"OM_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master\Monitor.exe" [2006-05-16 57344]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"QuickTime Task"="C:\QTTask.exe" [2009-01-05 413696]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-28 136600]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-10-11 29984]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-10-11 46368]
"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2008-04-11 1085440]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-12-21 86016]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 c:\windows\KHALMNPR.Exe]

c:\documents and settings\Barry Vickers\Start Menu\Programs\Startup\
Microsoft Office Groove.lnk - c:\program files\Microsoft Office\Office12\GROOVE.EXE [2007-08-29 340856]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]
OneNote Table Of Contents.onetoc2 [2009-01-25 3656]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-01-25 67128]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-01-25 688128]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= pvmjpg21.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MpfService"=2 (0x2)
"McSysmon"=3 (0x3)
"McShield"=2 (0x2)
"McProxy"=2 (0x2)
"McODS"=3 (0x3)
"McNASvc"=2 (0x2)
"mcmscsvc"=2 (0x2)
"McAfee SiteAdvisor Service"=2 (0x2)
"bgsvcgen"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-01-27 111184]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-01-27 20560]
.
Contents of the 'Scheduled Tasks' folder

2009-01-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&fr=yie7c
mWindow Title = Microsoft Internet Explorer
IE: &Search
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
Trusted Zone: musicmatch.com\online
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-07 06:43:30
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-02-07 6:45:33
ComboFix-quarantined-files.txt 2009-02-07 14:45:23
ComboFix2.txt 2009-02-06 18:31:31
ComboFix3.txt 2009-02-04 14:55:35

Pre-Run: 50,943,004,672 bytes free
Post-Run: 51,009,798,144 bytes free

369 — E O F — 2009-01-25 00:01:30

barry35

Post #14February 7, 2009, 3:00 PM UTC

Can you tell if limewire is completely removed from my computer?

CatByte

Post #15February 7, 2009, 3:21 PM UTC

I don't see it Barry35

but run an uninstall list with HJT and lets have another quick look

Run HJT and click on Open the Misc Tools section.

Click Open Uninstall Manager…
Click Save list… and save it to your Desktop.
Copy and paste the file uninstall_list.txt into your reply.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Have I been infected #2

✨ Ask AI

Ask AI