I caught a virus, goes by av.exe in the TM

Hello, I caught a virus. It doesn't let me run mbam.exe, instead it boots itself up, av.exe. Here's the HijackThis log:


Last edited by stevo90277 on 10th April 2010, 5:05 pm; edited 1 time in total

Please download OTS by OldTimer and save it to your Desktop.

Note: You must be logged on to the system with an account that has Administrator privileges to run this program.

• Close ALL OTHER PROGRAMS.
  
• Double-click on OTS to start the program (if you are running on Vista then right-click the program and
  choose Run as Administrator).
  
• At the top, tick on Scan All Users section and Include MD5.
  
• At File Age set it to 90 Days
  
• In the Processes, Modules, Services, Drivers, and Registry
  section, please set on Safe List.
  
• In the Files Created Within and Files Modified Within section, set it to File Age
  
• At the bottom, tick on all Safe List and Use Company Name WhiteList option
  
• Under Additional Scans, tick on the "Extras" button and then click the checkboxes in front of the following items to select them:
  Reg - Disabled MS Config Items
  Reg - Drivers32
  Reg - Ext
  Reg - IE
  Explorer Bar
  Reg - NetSvcs
  Reg - Safeboot Minimal
  Reg - Safeboot Network
  File - Lop Check
  File - Purity Scan
• Do NOT change any other settings.
  
• Then, in the Custom Scans box, place this in:
  
  %systemroot%\*. /mp /s
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\system32\*.exe /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles
  %systemroot%\system32\drivers\*.sys /lockedfiles
  %systemroot%\System32\config\*.sav
  %systemroot%\System32\*.sys
  %systemroot%\System32\drivers\*.dll
  %systemroot%\System32\drivers\*.ini
  %systemroot%\System32\drivers\*.exe
  %SYSTEMDRIVE%\*.*
  %PROGRAMFILES%\*.
  %appdata%\*.*
  
  
• Now click the Run Scan button on the toolbar.
  
• Let it run unhindered until it finishes.
  
• When the scan is complete Notepad will open with the report file loaded in it.
  
• Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Hi Dragonmaster J - the output was too large to copy and paste, please find the non-word wrapped, OTS output text file attached.

Last edited by stevo90277 on 9th April 2010, 4:36 pm; edited 1 time in total (Reason for editing : file attachment)

Could not view the zip file.

Please copy and paste the logs here, in about two or more replies.

Last edited by stevo90277 on 10th April 2010, 5:03 pm; edited 1 time in total

Last edited by stevo90277 on 10th April 2010, 5:02 pm; edited 1 time in total

Last edited by stevo90277 on 10th April 2010, 5:04 pm; edited 1 time in total

Start OTS. Copy/Paste the information in the quotebox below into the panel where it says "Paste fix here" and then click the Run Fix button.



The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here.

I did it. It asked me to reboot. I did. When it booted up, I didn't see any change in the log. Did I do it right?

Do you mean nothing appeared in the fix log from OTS?

that's correct. Also, now none of my programs start up normally - a dialog screen asking what program I want to use to start up the program pops up for everything I try to run.

Download LockSearch to your desktop

• A window will pop up, Press 2 and then Enter. A scan will start, let it run uninterrupted. It should only take a few minutes.
  
• A log will appear when it is finished, it will also be saved in the same location as LockSearch, which should be on your desktop. Post the contents of the log in your reply
  

LockSearch by jpshortstuff (05.11.09.1)
Log created at 18:51 on 11/04/2010 (price)
Scanning C:\


C:\pagefile.sys
-------------------------


C:\Documents and Settings\NetworkService\Local Settings\Application Data\ave.exe
-------------------------


C:\Documents and Settings\price\Local Settings\Application Data\avG\av.exe
-------------------------


C:\Documents and Settings\price\Local Settings\Application Data\avG\ave.exe
-------------------------


C:\Documents and Settings\price\Local Settings\Application Data\avG\MSASCui.exe
-------------------------


C:\Documents and Settings\price\Local Settings\Application Data\avG\vma.exe
-------------------------


C:\Documents and Settings\price\Local Settings\Application Data\Microsoft\Windows Defender\av.exe
-------------------------


C:\Documents and Settings\price\Local Settings\Application Data\Microsoft\Windows Defender\ave.exe
-------------------------


C:\Documents and Settings\price\Local Settings\Application Data\Microsoft\Windows Defender\MSASCui.exe
-------------------------


C:\Documents and Settings\price\Local Settings\Application Data\Microsoft\Windows Defender\vma.exe
-------------------------


C:\System Volume Information\_restore{9D862C0B-DFCE-497A-833E-904DC67CD429}\RP108\A0017061.exe
-------------------------


C:\System Volume Information\_restore{9D862C0B-DFCE-497A-833E-904DC67CD429}\RP108\A0017063.exe
-------------------------


C:\System Volume Information\_restore{9D862C0B-DFCE-497A-833E-904DC67CD429}\RP108\A0017064.exe
-------------------------


C:\System Volume Information\_restore{9D862C0B-DFCE-497A-833E-904DC67CD429}\RP112\A0021121.exe
-------------------------


C:\System Volume Information\_restore{9D862C0B-DFCE-497A-833E-904DC67CD429}\RP112\A0021122.exe
-------------------------


C:\System Volume Information\_restore{9D862C0B-DFCE-497A-833E-904DC67CD429}\RP112\A0021123.exe
-------------------------


C:\System Volume Information\_restore{9D862C0B-DFCE-497A-833E-904DC67CD429}\RP112\A0021124.exe
-------------------------


C:\System Volume Information\_restore{9D862C0B-DFCE-497A-833E-904DC67CD429}\RP112\A0021125.exe
-------------------------


C:\System Volume Information\_restore{9D862C0B-DFCE-497A-833E-904DC67CD429}\RP112\A0021126.exe
-------------------------


C:\System Volume Information\_restore{9D862C0B-DFCE-497A-833E-904DC67CD429}\RP112\A0021127.exe
-------------------------


C:\System Volume Information\_restore{9D862C0B-DFCE-497A-833E-904DC67CD429}\RP112\A0021128.exe
-------------------------


C:\System Volume Information\_restore{9D862C0B-DFCE-497A-833E-904DC67CD429}\RP112\A0021129.exe
-------------------------


C:\_OTS\MovedFiles\04102010_161602\C_Documents and Settings\All Users\Application Data\av.exe
-------------------------


C:\_OTS\MovedFiles\04102010_161602\C_Documents and Settings\All Users\Application Data\ave.exe
-------------------------


C:\_OTS\MovedFiles\04102010_161602\C_Documents and Settings\price\Local Settings\Application Data\ave.exe
-------------------------


C:\_OTS\MovedFiles\04102010_161602\C_Documents and Settings\price\Local Settings\Application Data\MSASCui.exe
-------------------------


C:\_OTS\MovedFiles\04102010_161602\C_Documents and Settings\price\Local Settings\Application Data\vma.exe
-------------------------

-=E.O.F=-

Please download OTM

• Save it to your desktop.
  
• Please double-click OTM to run it. (Note for Vista: Right-click on the file and choose Run As Administrator).
  
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL C (or, after highlighting, right-click and choose Copy):
  
  

  :files C:\Documents and Settings\NetworkService\Local Settings\Application Data\ave.exe C:\Documents and Settings\price\Local Settings\Application Data\avG\av.exe C:\Documents and Settings\price\Local Settings\Application Data\avG\ave.exe C:\Documents and Settings\price\Local Settings\Application Data\avG\MSASCui.exe C:\Documents and Settings\price\Local Settings\Application Data\avG\vma.exe C:\Documents and Settings\price\Local Settings\Application Data\Microsoft\Windows Defender\av.exe C:\Documents and Settings\price\Local Settings\Application Data\Microsoft\Windows Defender\ave.exe C:\Documents and Settings\price\Local Settings\Application Data\Microsoft\Windows Defender\MSASCui.exe C:\Documents and Settings\price\Local Settings\Application Data\Microsoft\Windows Defender\vma.exe :Commands [emptytemp] [purity] [Reboot]

  
  
• Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTM and reboot your PC.

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and
open the newest .log file present, and copy/paste the contents of that document back here in your next post.

All processes killed
========== FILES ==========
File/Folder C:\Documents and Settings\NetworkService\Local Settings\Application Data\ave.exe not found.
File/Folder C:\Documents and Settings\price\Local Settings\Application Data\avG\av.exe not found.
File/Folder C:\Documents and Settings\price\Local Settings\Application Data\avG\ave.exe not found.
File/Folder C:\Documents and Settings\price\Local Settings\Application Data\avG\MSASCui.exe not found.
File/Folder C:\Documents and Settings\price\Local Settings\Application Data\avG\vma.exe not found.
File/Folder C:\Documents and Settings\price\Local Settings\Application Data\Microsoft\Windows Defender\av.exe not found.
File/Folder C:\Documents and Settings\price\Local Settings\Application Data\Microsoft\Windows Defender\ave.exe not found.
File/Folder C:\Documents and Settings\price\Local Settings\Application Data\Microsoft\Windows Defender\MSASCui.exe not found.
File/Folder C:\Documents and Settings\price\Local Settings\Application Data\Microsoft\Windows Defender\vma.exe not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: price
->Temp folder emptied: 16384 bytes
->Temporary Internet Files folder emptied: 868776 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: salesadmin
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: systemaccount
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: zzsttadmin
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 6174 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 313440 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 1.00 mb


OTM by OldTimer - Version 3.1.10.1 log created on 04142010_163412

Files moved on Reboot...
File C:\WINDOWS\temp\Perflib_Perfdata_6c8.dat not found!

Registry entries deleted on Reboot...

That did not work so well.

Please visit this webpage for a tutorial on downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

See the area: Using ComboFix, and when done, post the log back here.

combofix log 1/3

ComboFix 10-04-15.05 - price 04/16/2010 11:05:40.4.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3582.2923 [GMT -7:00]
Running from: c:\documents and settings\price\Desktop\ComboFix.exe
AV: Trend Micro OfficeScan Antivirus *On-access scanning disabled* (Outdated) {0DAA9119-FD08-45C7-A0D4-435C2125DC25}
AV: Trend Micro OfficeScan Antivirus *On-access scanning disabled* (Outdated) {63AEB1F9-3232-41B0-85E9-57A26F039C34}
AV: Trend Micro OfficeScan Antivirus *On-access scanning disabled* (Outdated) {E6508629-3691-4CDC-A98C-DBB1C46CE0E8}
AV: Trend Micro OfficeScan Antivirus *On-access scanning disabled* (Outdated) {EE66AC07-84E2-41D3-A1F6-CAA0156912A4}
AV: Trend Micro OfficeScan Antivirus *On-access scanning enabled* (Updated) {07F71C9E-8DE4-4226-B23A-C065A56821F8}
AV: Trend Micro OfficeScan Antivirus *On-access scanning enabled* (Updated) {0BEAD907-62D3-45B6-91D7-1B7B378434FD}
AV: Trend Micro OfficeScan Antivirus *On-access scanning enabled* (Updated) {495CC023-7AA3-4062-9163-DAFC95BCCB95}
AV: Trend Micro OfficeScan Antivirus *On-access scanning enabled* (Updated) {6789DEB4-4214-4AE8-A310-E2DED4AE8079}
AV: Trend Micro OfficeScan Antivirus *On-access scanning enabled* (Updated) {9DFB6C67-B09B-451B-96C8-8F03241927EE}
AV: Trend Micro OfficeScan Antivirus *On-access scanning enabled* (Updated) {D5C7FEBD-12D0-4782-8AD7-6B290082768C}
AV: Trend Micro OfficeScan Antivirus *On-access scanning enabled* (Updated) {DE57F669-2848-4BDC-83C0-C5C7E3AF3D7B}
FW: Trend Micro OfficeScan Enterprise Client Firewall *disabled* {63AEB1F9-3232-41B0-85E9-57A26F039C34}
FW: Trend Micro OfficeScan Enterprise Client Firewall *enabled* {71A20E43-2C24-456C-AF94-9682743CB5C4}
FW: Trend Micro Personal Firewall *disabled* {3E790E9E-6A5D-4303-A7F9-185EC20F3EB6}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\program files\Cheat Engine\dbk32.sys

----- BITS: Possible infected sites -----

hxxp://sus134
.
((((((((((((((((((((((((( Files Created from 2010-03-16 to 2010-04-16 )))))))))))))))))))))))))))))))
.

2010-04-14 23:34 . 2010-04-14 23:34 -------- d-----w- C:\_OTM
2010-04-10 23:16 . 2010-04-10 23:16 -------- d-----w- C:\_OTS
2010-04-08 02:34 . 2010-04-12 01:51 -------- d-----w- c:\documents and settings\price\Local Settings\Application Data\avG
2010-04-06 14:16 . 2010-04-06 14:16 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-04-06 14:16 . 2010-04-06 14:16 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-04-06 14:07 . 2008-04-13 20:45 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2010-04-06 14:07 . 2008-04-13 20:45 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-03-19 17:52 . 2009-12-14 07:08 33280 -c----w- c:\windows\system32\dllcache\csrsrv.dll
2010-03-19 17:52 . 2009-12-08 09:23 474112 -c----w- c:\windows\system32\dllcache\shlwapi.dll
2010-03-19 17:52 . 2009-12-16 18:43 343040 -c----w- c:\windows\system32\dllcache\mspaint.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-16 18:12 . 2009-10-13 04:05 -------- d-----w- c:\program files\Cheat Engine
2010-04-15 06:20 . 2010-04-14 23:41 6174 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2010-04-15 06:14 . 2008-09-23 06:53 49024 ----a-w- c:\windows\system32\drivers\ql1280.sys
2010-04-15 00:45 . 2008-06-29 05:17 43861 ----a-w- c:\windows\system32\nvModes.dat
2010-04-14 23:46 . 2009-06-08 19:08 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-04-07 19:33 . 2009-09-02 14:43 -------- d-----w- c:\program files\stt
2010-03-20 23:43 . 2008-09-23 04:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-03-04 18:36 . 2009-09-02 14:43 42043 ----a-w- c:\windows\SttService.exe
2010-02-26 05:14 . 2010-02-26 05:14 -------- d-----w- c:\documents and settings\price\Application Data\Apple Computer
2010-02-01 20:23 . 2009-12-28 21:38 165232 ---ha-w- c:\documents and settings\price\Application Data\Microsoft\Virtual PC\VPCKeyboard.dll
2008-06-12 12:53 . 2008-09-22 22:57 3125248 ----a-w- c:\program files\Common Files\sapxlhelper.dll
2008-06-12 12:53 . 2008-09-22 22:57 192512 ----a-w- c:\program files\Common Files\sapconsr3.dll
2008-06-12 12:53 . 2008-09-22 22:57 626688 ----a-w- c:\program files\Common Files\sapconsaccess.dll
2008-06-12 12:53 . 2008-09-22 22:57 949760 ----a-w- c:\program files\Common Files\SAPActiveXL_nosig.xlt
2008-06-12 12:53 . 2008-09-22 22:57 955904 ----a-w- c:\program files\Common Files\SAPActiveXL.xlt
2008-06-12 12:53 . 2008-09-22 22:57 40960 ----a-w- c:\program files\Common Files\DigitalSignature.ocx
2007-07-09 21:30 . 2007-07-09 21:30 57344 ----a-w- c:\program files\internet explorer\plugins\PluginWrapper.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-11-22_18.46.29 )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-04-28 14:50 . 2009-08-07 03:24 44768 c:\windows\system32\wups2.dll
+ 2006-04-28 14:38 . 2009-08-07 03:24 35552 c:\windows\system32\wups.dll
+ 2006-04-28 14:38 . 2009-08-07 03:24 53472 c:\windows\system32\wuauclt.exe
+ 2009-10-09 22:56 . 2009-10-09 22:56 14848 c:\windows\system32\wsmprovhost.exe
+ 2009-10-09 22:56 . 2009-10-09 22:56 12288 c:\windows\system32\wsmplpxy.dll
+ 2009-10-19 21:06 . 2009-10-19 21:06 12800 c:\windows\system32\wksprtPS.dll
+ 2009-10-09 22:56 . 2009-10-09 22:56 12288 c:\windows\system32\winrssrv.dll
+ 2009-10-09 22:56 . 2009-10-09 22:56 22528 c:\windows\system32\winrshost.exe
+ 2009-10-10 00:22 . 2009-10-10 00:22 69632 c:\windows\system32\winrs.exe
+ 2009-10-09 22:56 . 2009-10-09 22:56 25088 c:\windows\system32\winrmprov.dll
+ 2009-10-09 22:56 . 2009-10-09 22:56 24064 c:\windows\system32\WindowsPowerShell\v1.0\pwrshsip.dll
+ 2009-12-12 23:22 . 2001-08-18 06:36 87040 c:\windows\system32\wiafbdrv.dll
+ 2008-09-11 16:43 . 2009-10-28 15:07 46080 c:\windows\system32\tzchange.exe
+ 2009-10-19 21:06 . 2009-10-19 21:06 46080 c:\windows\system32\TSWbPrxy.exe
+ 2008-09-11 16:45 . 2009-10-19 21:06 36864 c:\windows\system32\tsgQec.dll
+ 2006-04-28 15:05 . 2009-06-16 17:58 26144 c:\windows\system32\spupdsvc.exe
+ 2008-03-07 21:00 . 2007-06-22 15:35 92160 c:\windows\system32\spool\drivers\w32x86\3\xxuiwlv7.dll
+ 2008-03-07 21:00 . 2007-06-22 15:35 92672 c:\windows\system32\spool\drivers\w32x86\3\xxstrv7.dll
+ 2008-03-07 21:00 . 2007-06-22 15:35 10752 c:\windows\system32\spool\drivers\w32x86\3\xxresv7.dll
+ 2008-03-07 21:00 . 2007-06-22 15:37 82432 c:\windows\system32\spool\drivers\w32x86\3\xwprenv7.dll
+ 2004-12-07 13:28 . 2004-12-07 14:28 81288 c:\windows\system32\spool\drivers\w32x86\3\XLndAlrt.dat
+ 2007-04-26 20:37 . 2007-04-26 21:37 15360 c:\windows\system32\spool\drivers\w32x86\3\XBD32.DLL
+ 2008-09-12 17:33 . 2009-06-16 17:58 16928 c:\windows\system32\spmsg.dll
+ 2009-12-29 00:06 . 2009-08-07 03:24 44768 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.4.7600.226\wups2.dll
+ 2009-12-29 00:06 . 2009-08-07 03:24 35552 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.4.7600.226\wups.dll
- 2004-08-04 12:00 . 2008-04-14 00:12 79872 c:\windows\system32\raschap.dll
+ 2004-08-04 12:00 . 2009-10-12 13:38 79872 c:\windows\system32\raschap.dll
+ 2009-10-10 00:22 . 2009-10-10 00:22 42496 c:\windows\system32\pwrshplugin.dll
- 2004-08-04 12:00 . 2009-04-29 04:56 44544 c:\windows\system32\pngfilt.dll
+ 2004-08-04 12:00 . 2010-01-05 10:00 44544 c:\windows\system32\pngfilt.dll
+ 2004-08-04 12:00 . 2009-10-08 22:56 20480 c:\windows\system32\oleaccrc.dll
+ 2009-10-19 21:06 . 2009-10-19 21:06 44544 c:\windows\system32\MsRdpWebAccess.dll
- 2007-08-13 22:54 . 2009-04-29 04:55 52224 c:\windows\system32\msfeedsbs.dll
+ 2007-08-13 22:54 . 2010-01-05 10:00 52224 c:\windows\system32\msfeedsbs.dll
+ 2004-08-04 12:00 . 2009-09-04 21:03 58880 c:\windows\system32\msasn1.dll
+ 2009-12-03 14:31 . 2009-12-03 14:31 84661 c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
+ 2008-09-15 17:21 . 2010-02-18 06:03 84507 c:\windows\system32\Macromed\Flash\uninstall_activeX.exe
- 2004-08-04 12:00 . 2009-04-29 04:55 27648 c:\windows\system32\jsproxy.dll
+ 2004-08-04 12:00 . 2010-01-05 10:00 27648 c:\windows\system32\jsproxy.dll
+ 2010-01-27 05:15 . 2009-05-04 18:30 53346 c:\windows\system32\javaw.exe
+ 2010-01-27 05:15 . 2009-05-04 18:29 53344 c:\windows\system32\java.exe
+ 2007-08-13 22:39 . 2009-12-31 15:33 13824 c:\windows\system32\ieudinit.exe
- 2007-08-13 22:39 . 2009-04-28 09:05 13824 c:\windows\system32\ieudinit.exe
+ 2004-08-04 12:00 . 2010-01-05 10:00 44544 c:\windows\system32\iernonce.dll
- 2004-08-04 12:00 . 2009-04-29 04:55 44544 c:\windows\system32\iernonce.dll
+ 2004-08-04 12:00 . 2010-01-05 10:00 78336 c:\windows\system32\ieencode.dll
- 2004-08-04 12:00 . 2009-04-29 04:55 78336 c:\windows\system32\ieencode.dll
+ 2004-08-04 12:00 . 2009-12-31 15:33 70656 c:\windows\system32\ie4uinit.exe
- 2004-08-04 12:00 . 2009-04-28 09:05 70656 c:\windows\system32\ie4uinit.exe
- 2007-08-13 22:36 . 2009-04-29 04:55 63488 c:\windows\system32\icardie.dll
+ 2007-08-13 22:36 . 2010-01-05 10:00 63488 c:\windows\system32\icardie.dll
+ 2009-12-12 23:22 . 2001-08-18 06:36 13312 c:\windows\system32\hpsjmcro.dll
- 2004-08-04 12:00 . 2009-06-16 14:36 81920 c:\windows\system32\fontsub.dll
+ 2004-08-04 12:00 . 2009-10-15 16:28 81920 c:\windows\system32\fontsub.dll
+ 2007-01-29 14:20 . 2007-01-29 14:20 59280 c:\windows\system32\drivers\VMNetSrv.sys
+ 2009-12-12 23:22 . 2008-04-13 21:45 15104 c:\windows\system32\drivers\usbscan.sys
+ 2006-04-28 14:38 . 2009-08-07 03:24 35552 c:\windows\system32\dllcache\wups.dll
+ 2006-04-28 14:38 . 2009-08-07 03:24 53472 c:\windows\system32\dllcache\wuauclt.exe
+ 2009-10-19 21:06 . 2009-10-19 21:06 12800 c:\windows\system32\dllcache\wksprtPS.dll
+ 2009-12-12 23:22 . 2001-08-18 06:36 87040 c:\windows\system32\dllcache\wiafbdrv.dll
+ 2009-12-12 23:22 . 2008-04-13 21:45 15104 c:\windows\system32\dllcache\usbscan.sys
+ 2009-10-19 21:06 . 2009-10-19 21:06 46080 c:\windows\system32\dllcache\TSWbPrxy.exe
+ 2009-10-19 21:06 . 2009-10-19 21:06 36864 c:\windows\system32\dllcache\tsgQec.dll
+ 2010-01-04 16:17 . 2009-10-12 13:38 79872 c:\windows\system32\dllcache\raschap.dll
+ 2008-09-23 06:53 . 2010-04-15 06:14 49024 c:\windows\system32\dllcache\ql1280.sys
- 2008-09-23 06:53 . 2001-08-17 17:52 49024 c:\windows\system32\dllcache\ql1280.sys
- 2004-08-04 12:00 . 2009-04-29 04:56 44544 c:\windows\system32\dllcache\pngfilt.dll
+ 2004-08-04 12:00 . 2010-01-05 10:00 44544 c:\windows\system32\dllcache\pngfilt.dll
+ 2004-08-04 12:00 . 2009-10-08 22:56 20480 c:\windows\system32\dllcache\oleaccrc.dll
+ 2009-10-19 21:06 . 2009-10-19 21:06 44544 c:\windows\system32\dllcache\MsRdpWebAccess.dll
+ 2008-09-12 16:44 . 2010-01-05 10:00 52224 c:\windows\system32\dllcache\msfeedsbs.dll
- 2008-09-12 16:44 . 2009-04-29 04:55 52224 c:\windows\system32\dllcache\msfeedsbs.dll
+ 2010-01-04 16:14 . 2009-09-04 21:03 58880 c:\windows\system32\dllcache\msasn1.dll
- 2004-08-04 12:00 . 2009-04-29 04:55 27648 c:\windows\system32\dllcache\jsproxy.dll
+ 2004-08-04 12:00 . 2010-01-05 10:00 27648 c:\windows\system32\dllcache\jsproxy.dll
+ 2008-09-12 16:44 . 2009-12-31 15:33 13824 c:\windows\system32\dllcache\ieudinit.exe
- 2008-09-12 16:44 . 2009-04-28 09:05 13824 c:\windows\system32\dllcache\ieudinit.exe
+ 2004-08-04 12:00 . 2010-01-05 10:00 44544 c:\windows\system32\dllcache\iernonce.dll
- 2004-08-04 12:00 . 2009-04-29 04:55 44544 c:\windows\system32\dllcache\iernonce.dll
+ 2004-08-04 12:00 . 2010-01-05 10:00 78336 c:\windows\system32\dllcache\ieencode.dll
- 2004-08-04 12:00 . 2009-04-29 04:55 78336 c:\windows\system32\dllcache\ieencode.dll
- 2004-08-04 12:00 . 2009-04-28 09:05 70656 c:\windows\system32\dllcache\ie4uinit.exe
+ 2004-08-04 12:00 . 2009-12-31 15:33 70656 c:\windows\system32\dllcache\ie4uinit.exe
- 2008-09-12 16:44 . 2009-04-29 04:55 63488 c:\windows\system32\dllcache\icardie.dll
+ 2008-09-12 16:44 . 2010-01-05 10:00 63488 c:\windows\system32\dllcache\icardie.dll
+ 2009-12-12 23:22 . 2001-08-18 06:36 13312 c:\windows\system32\dllcache\hpsjmcro.dll
- 2008-06-29 05:23 . 2009-06-16 14:36 81920 c:\windows\system32\dllcache\fontsub.dll
+ 2008-06-29 05:23 . 2009-10-15 16:28 81920 c:\windows\system32\dllcache\fontsub.dll
+ 2010-01-04 16:12 . 2010-01-05 10:00 17408 c:\windows\system32\dllcache\corpol.dll
+ 2004-08-04 12:00 . 2009-08-07 03:24 96480 c:\windows\system32\dllcache\cdm.dll
+ 2004-08-04 12:00 . 2009-12-14 07:08 33280 c:\windows\system32\csrsrv.dll
+ 2004-08-04 12:00 . 2010-01-05 10:00 17408 c:\windows\system32\corpol.dll
+ 2009-07-09 18:24 . 2010-04-07 15:25 70920 c:\windows\system32\config\systemprofile\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
+ 2004-08-04 12:00 . 2009-08-07 03:24 96480 c:\windows\system32\cdm.dll
+ 2010-03-25 05:38 . 2010-03-25 05:38 11412 c:\windows\SoftwareDistribution\EventCache\{C9627E36-FA69-41D3-8473-3683A4D8A63B}.bin
+ 2009-06-25 03:56 . 2009-06-25 03:56 73728 c:\windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe
+ 2008-05-28 08:49 . 2008-05-28 08:49 77824 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll
- 2007-04-14 03:58 . 2007-04-14 03:58 77824 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll
+ 2008-05-28 08:49 . 2008-05-28 08:49 86016 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorie.dll
- 2007-04-14 03:57 . 2007-04-14 03:57 86016 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorie.dll
- 2007-04-14 03:57 . 2007-04-14 03:57 81920 c:\windows\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll
+ 2008-05-28 08:49 . 2008-05-28 08:49 81920 c:\windows\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll
+ 2008-05-28 09:30 . 2008-05-28 09:30 32768 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
- 2007-04-14 04:30 . 2007-04-14 04:30 32768 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
+ 2010-03-17 21:21 . 2010-03-17 21:21 22528 c:\windows\Installer\29b49a57.msi
+ 2010-01-11 01:10 . 2010-01-11 01:10 32768 c:\windows\Installer\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}\icon.exe
+ 2009-08-06 15:29 . 2010-03-20 23:43 35088 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\oisicon.exe
- 2009-08-06 15:29 . 2009-08-06 16:21 35088 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\oisicon.exe
+ 2009-08-06 15:29 . 2010-03-20 23:43 18704 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\mspicons.exe
- 2009-08-06 15:29 . 2009-08-06 16:21 18704 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\mspicons.exe
+ 2009-08-06 15:29 . 2010-03-20 23:43 20240 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\cagicon.exe
- 2009-08-06 15:29 . 2009-08-06 16:21 20240 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\cagicon.exe
+ 2010-01-13 06:54 . 2010-01-13 06:54 90126 c:\windows\Installer\{65826D4C-79E6-4EEB-925F-87AF08206CAF}\NewShortcut4_D6F3B387396040109193E23DA8DCF248.exe
+ 2010-01-13 06:54 . 2010-01-13 06:54 90126 c:\windows\Installer\{65826D4C-79E6-4EEB-925F-87AF08206CAF}\NewShortcut3_D6F3B387396040109193E23DA8DCF248.exe
+ 2010-01-13 06:54 . 2010-01-13 06:54 65536 c:\windows\Installer\{65826D4C-79E6-4EEB-925F-87AF08206CAF}\NewShortcut2_F9E04826A01C4F85B5BA6BA9826F32CF.exe
+ 2010-01-13 06:54 . 2010-01-13 06:54 65536 c:\windows\Installer\{65826D4C-79E6-4EEB-925F-87AF08206CAF}\NewShortcut1.exe
+ 2010-03-20 23:44 . 2009-10-29 07:46 44544 c:\windows\ie7updates\KB978207-IE7\pngfilt.dll
+ 2010-03-20 23:44 . 2009-10-29 07:46 52224 c:\windows\ie7updates\KB978207-IE7\msfeedsbs.dll
+ 2010-03-20 23:44 . 2009-10-29 07:46 27648 c:\windows\ie7updates\KB978207-IE7\jsproxy.dll
+ 2010-03-20 23:44 . 2009-10-28 14:36 13824 c:\windows\ie7updates\KB978207-IE7\ieudinit.exe
+ 2010-03-20 23:44 . 2009-10-29 07:46 44544 c:\windows\ie7updates\KB978207-IE7\iernonce.dll
+ 2010-03-20 23:44 . 2009-10-29 07:46 78336 c:\windows\ie7updates\KB978207-IE7\ieencode.dll
+ 2010-03-20 23:44 . 2009-10-28 14:36 70656 c:\windows\ie7updates\KB978207-IE7\ie4uinit.exe
+ 2010-03-20 23:44 . 2009-10-29 07:46 63488 c:\windows\ie7updates\KB978207-IE7\icardie.dll
+ 2010-03-20 23:44 . 2009-10-29 07:46 17408 c:\windows\ie7updates\KB978207-IE7\corpol.dll
+ 2010-01-11 01:15 . 2009-04-29 04:56 44544 c:\windows\ie7updates\KB976325-IE7\pngfilt.dll
+ 2010-01-11 01:15 . 2009-04-29 04:55 52224 c:\windows\ie7updates\KB976325-IE7\msfeedsbs.dll
+ 2010-01-11 01:15 . 2009-04-29 04:55 27648 c:\windows\ie7updates\KB976325-IE7\jsproxy.dll
+ 2010-01-11 01:15 . 2009-04-28 09:05 13824 c:\windows\ie7updates\KB976325-IE7\ieudinit.exe
+ 2010-01-11 01:15 . 2009-04-29 04:55 44544 c:\windows\ie7updates\KB976325-IE7\iernonce.dll
+ 2010-01-11 01:15 . 2009-04-29 04:55 78336 c:\windows\ie7updates\KB976325-IE7\ieencode.dll
+ 2010-01-11 01:15 . 2009-04-28 09:05 70656 c:\windows\ie7updates\KB976325-IE7\ie4uinit.exe
+ 2010-01-11 01:15 . 2009-04-29 04:55 63488 c:\windows\ie7updates\KB976325-IE7\icardie.dll
+ 2010-01-11 01:15 . 2008-04-14 00:11 35328 c:\windows\ie7updates\KB976325-IE7\corpol.dll
+ 2010-01-11 01:14 . 2010-01-11 01:14 90112 c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_bb845ffa\System.Drawing.Design.dll
+ 2010-01-11 01:14 . 2010-01-11 01:14 61440 c:\windows\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_c7315fc3\CustomMarshalers.dll
+ 2010-01-11 01:24 . 2010-01-11 01:24 60928 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\b4a9e413d5cd6d6ec2d50aa05381e293\UIAutomationProvider.ni.dll
+ 2010-01-11 01:32 . 2010-01-11 01:32 37888 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\8acb476a0d4ee17a12881e17ae74a6af\System.Windows.Presentation.ni.dll
+ 2010-01-11 01:32 . 2010-01-11 01:32 36864 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\4b87ca3482a3c0ee733e028ecee7de65\System.Web.DynamicData.Design.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 94208 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\a0c71055364bd356971791284c3fb910\System.ComponentModel.DataAnnotations.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 82944 c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\f9a75bbdc2ce7db578b5977766a09b99\System.AddIn.Contract.ni.dll
+ 2010-01-11 01:22 . 2010-01-11 01:22 47104 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\3dd0f86c966c75755d62eab8ddf0634c\PresentationFontCache.ni.exe
+ 2010-01-11 01:20 . 2010-01-11 01:20 39424 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\034d081fe294bab1ee1ecc98c1181424\PresentationCFFRasterizer.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 17920 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Run#\2f6d26933767848fd267b84b8b3b0cb3\Microsoft.WSMan.Runtime.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 21504 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\fa5d088b15e4d4f0b8173008fbad39ea\Microsoft.WSMan.Management.resources.ni.dll
+ 2010-01-11 01:31 . 2010-01-11 01:31 55296 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\f2673aec397c52796aef05bb9d2668df\Microsoft.Vsa.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 38912 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\bf5726c79172ad8a45a7114f1b8f3f7e\Microsoft.PowerShell.ConsoleHost.resources.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 67072 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\9b2a698e603d1cf0d19c083dc39d1d7b\Microsoft.PowerShell.Editor.resources.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 18432 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\735a4719bea85fe8b3a54207a95bfcf5\Microsoft.PowerShell.Commands.Diagnostics.resources.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 45568 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\3299617d786b1277c3664ad5ae0d2a42\Microsoft.PowerShell.Commands.Utility.resources.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 36352 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\2f71f3e6224fe2adf9dd89efc712e4a4\Microsoft.PowerShell.GPowerShell.resources.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 24576 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\28aad9ce73d578cbd57efb27966ac255\Microsoft.PowerShell.GraphicalHost.resources.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 16896 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\2601faa66db9e2db95ca019fd9e4000e\Microsoft.PowerShell.Security.resources.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 31744 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\206fb781bef989ee10d70a16f69b0d95\Microsoft.PowerShell.Commands.Management.resources.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 65024 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\d513fe1a81c441e7656a9b062cff4e9f\Microsoft.Build.Framework.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 74752 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\c5d504724d7f351b1d034615dbb72a2a\Microsoft.Build.Framework.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 91648 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Backgroun#\84511052318cb515e2939c9f18160ad3\Microsoft.BackgroundIntelligentTransfer.Management.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 14848 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Backgroun#\6646d2130f7d86a7183a55745dfaf1cb\Microsoft.BackgroundIntelligentTransfer.Management.resources.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 14336 c:\windows\assembly\NativeImages_v2.0.50727_32\dfsvc\a664ccab020f93f1d533919f57131190\dfsvc.ni.exe
+ 2010-01-11 01:29 . 2010-01-11 01:29 25600 c:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\e63d6d26b8a664cfdfbd4ad75e03c14d\Accessibility.ni.dll
- 2009-06-08 19:08 . 2009-06-08 19:08 77824 c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2010-01-11 01:19 . 2010-01-11 01:19 77824 c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2010-01-11 01:19 . 2010-01-11 01:19 81920 c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
- 2009-06-08 19:08 . 2009-06-08 19:08 81920 c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2010-01-11 01:19 . 2010-01-11 01:19 81920 c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
- 2009-06-08 19:08 . 2009-06-08 19:08 81920 c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2010-01-11 01:13 . 2010-01-11 01:13 13824 c:\windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.WSMan.Management.resources.dll
+ 2010-01-11 01:19 . 2010-01-11 01:19 32768 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- 2009-06-08 19:08 . 2009-06-08 19:08 32768 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- 2009-06-08 19:08 . 2009-06-08 19:08 12800 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2010-01-11 01:19 . 2010-01-11 01:19 12800 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- 2009-06-08 19:08 . 2009-06-08 19:08 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
+ 2010-01-11 01:19 . 2010-01-11 01:19 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
+ 2010-01-11 01:13 . 2010-01-11 01:13 69632 c:\windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll
+ 2010-01-11 01:13 . 2010-01-11 01:13 16896 c:\windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.GraphicalHost.resources.dll
+ 2010-01-11 01:13 . 2010-01-11 01:13 40960 c:\windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.GPowerShell.resources.dll
+ 2010-01-11 01:13 . 2010-01-11 01:13 69632 c:\windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.Editor.resources.dll
+ 2010-01-11 01:13 . 2010-01-11 01:13 40960 c:\windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.resources.dll
+ 2010-01-11 01:13 . 2010-01-11 01:13 49152 c:\windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.resources.dll
+ 2010-01-11 01:13 . 2010-01-11 01:13 36864 c:\windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.resources.dll
+ 2010-01-11 01:13 . 2010-01-11 01:13 10752 c:\windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.Commands.Diagnostics.resources.dll
- 2009-06-08 19:08 . 2009-06-08 19:08 77824 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2010-01-11 01:19 . 2010-01-11 01:19 77824 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2010-01-11 01:19 . 2010-01-11 01:19 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
- 2009-06-08 19:08 . 2009-06-08 19:08 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2010-01-11 01:13 . 2010-01-11 01:13 57344 c:\windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll
- 2009-06-08 19:08 . 2009-06-08 19:08 77824 c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
+ 2010-01-11 01:19 . 2010-01-11 01:19 77824 c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
- 2009-06-08 19:08 . 2009-06-08 19:08 13312 c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2010-01-11 01:19 . 2010-01-11 01:19 13312 c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
- 2009-06-08 19:08 . 2009-06-08 19:08 10752 c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2010-01-11 01:19 . 2010-01-11 01:19 10752 c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
- 2009-06-08 19:08 . 2009-06-08 19:08 72192 c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2010-01-11 01:19 . 2010-01-11 01:19 72192 c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
- 2009-06-08 19:08 . 2009-06-08 19:08 69120 c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2010-01-11 01:19 . 2010-01-11 01:19 69120 c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2010-01-11 01:17 . 2008-04-14 00:12 60416 c:\windows\$NtUninstallKB976098-v2$\tzchange.exe
+ 2010-01-11 01:17 . 2009-10-29 02:03 16896 c:\windows\$NtUninstallKB976098-v2$\spuninst\tzchange.dll
+ 2010-01-11 01:16 . 2008-04-14 00:11 57344 c:\windows\$NtUninstallKB974571$\msasn1.dll
+ 2010-01-11 01:17 . 2008-04-14 00:12 79872 c:\windows\$NtUninstallKB974318$\raschap.dll
+ 2010-01-11 01:14 . 2004-08-04 12:00 16896 c:\windows\$NtUninstallKB971513$\oleaccrc.dll
+ 2010-01-11 01:17 . 2008-04-14 00:12 53248 c:\windows\$NtUninstallKB969084$\tsgqec.dll
+ 2010-01-11 01:15 . 2009-05-26 11:40 26488 c:\windows\$hf_mig$\KB976325-IE7\update\spcustom.dll
+ 2010-01-11 01:15 . 2009-05-26 11:40 17272 c:\windows\$hf_mig$\KB976325-IE7\spmsg.dll
+ 2010-01-04 16:12 . 2009-10-29 07:45 44544 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\pngfilt.dll
+ 2010-01-04 16:12 . 2009-10-29 07:45 52224 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\msfeedsbs.dll
+ 2010-01-04 16:12 . 2009-10-29 07:45 27648 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\jsproxy.dll
+ 2010-01-04 16:12 . 2009-10-28 14:05 13824 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\ieudinit.exe
+ 2010-01-04 16:12 . 2009-10-29 07:45 44544 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\iernonce.dll
+ 2010-01-04 16:12 . 2009-10-29 07:45 78336 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\ieencode.dll
+ 2010-01-04 16:12 . 2009-10-28 14:05 70656 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\ie4uinit.exe
+ 2010-01-04 16:12 . 2009-10-29 07:45 63488 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\icardie.dll
+ 2010-01-04 16:12 . 2009-10-29 07:45 17408 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\corpol.dll
+ 2010-01-11 01:16 . 2009-05-26 11:40 26488 c:\windows\$hf_mig$\KB975025\update\spcustom.dll
+ 2010-01-11 01:16 . 2009-05-26 11:40 17272 c:\windows\$hf_mig$\KB975025\spmsg.dll
+ 2010-01-11 01:16 . 2009-05-26 11:40 26488 c:\windows\$hf_mig$\KB974571\update\spcustom.dll
+ 2010-01-11 01:16 . 2009-05-26 11:40 17272 c:\windows\$hf_mig$\KB974571\spmsg.dll
+ 2010-01-04 16:14 . 2009-09-04 20:57 58880 c:\windows\$hf_mig$\KB974571\SP3QFE\msasn1.dll
+ 2010-01-11 01:14 . 2009-05-26 11:40 26488 c:\windows\$hf_mig$\KB974392\update\spcustom.dll
+ 2010-01-11 01:14 . 2009-05-26 11:40 17272 c:\windows\$hf_mig$\KB974392\spmsg.dll
+ 2010-01-11 01:17 . 2009-05-26 11:40 26488 c:\windows\$hf_mig$\KB974318\update\spcustom.dll
+ 2010-01-11 01:17 . 2009-05-26 11:40 17272 c:\windows\$hf_mig$\KB974318\spmsg.dll
+ 2010-01-04 16:17 . 2009-10-12 13:28 79872 c:\windows\$hf_mig$\KB974318\SP3QFE\raschap.dll
+ 2010-01-11 01:16 . 2009-05-26 11:40 26488 c:\windows\$hf_mig$\KB974112\update\spcustom.dll
+ 2010-01-11 01:16 . 2009-05-26 11:40 17272 c:\windows\$hf_mig$\KB974112\spmsg.dll
+ 2010-01-11 01:15 . 2009-05-26 11:40 26488 c:\windows\$hf_mig$\KB973904\update\spcustom.dll
+ 2010-01-11 01:15 . 2009-05-26 11:40 17272 c:\windows\$hf_mig$\KB973904\spmsg.dll
+ 2010-01-11 01:16 . 2008-07-08 13:02 26488 c:\windows\$hf_mig$\KB973687\update\spcustom.dll
+ 2010-01-11 01:16 . 2008-07-08 13:02 17272 c:\windows\$hf_mig$\KB973687\spmsg.dll
+ 2010-01-11 01:12 . 2009-05-26 11:40 26488 c:\windows\$hf_mig$\KB973525\update\spcustom.dll
+ 2010-01-11 01:12 . 2009-05-26 11:40 17272 c:\windows\$hf_mig$\KB973525\spmsg.dll
+ 2010-01-11 01:10 . 2009-05-26 11:40 26488 c:\windows\$hf_mig$\KB971961\update\spcustom.dll
+ 2010-01-11 01:10 . 2009-05-26 11:40 17272 c:\windows\$hf_mig$\KB971961\spmsg.dll
+ 2010-01-11 01:12 . 2009-05-26 11:40 26488 c:\windows\$hf_mig$\KB971486\update\spcustom.dll
+ 2010-01-11 01:12 . 2009-05-26 11:40 17272 c:\windows\$hf_mig$\KB971486\spmsg.dll
+ 2010-01-11 01:10 . 2008-07-08 13:02 26488 c:\windows\$hf_mig$\KB969947\update\spcustom.dll
+ 2010-01-11 01:10 . 2008-07-08 13:02 17272 c:\windows\$hf_mig$\KB969947\spmsg.dll
+ 2010-01-11 01:17 . 2008-07-08 13:02 26488 c:\windows\$hf_mig$\KB969059\update\spcustom.dll
+ 2010-01-11 01:17 . 2008-07-08 13:02 17272 c:\windows\$hf_mig$\KB969059\spmsg.dll
+ 2010-01-11 01:16 . 2008-07-08 13:02 26488 c:\windows\$hf_mig$\KB956844\update\spcustom.dll
+ 2010-01-11 01:16 . 2008-07-08 13:02 17272 c:\windows\$hf_mig$\KB956844\spmsg.dll
+ 2010-01-11 01:17 . 2009-05-26 11:40 26488 c:\windows\$hf_mig$\KB955759\update\spcustom.dll
+ 2010-01-11 01:17 . 2009-05-26 11:40 17272 c:\windows\$hf_mig$\KB955759\spmsg.dll
+ 2009-10-09 22:57 . 2009-10-09 22:57 20480 c:\windows\$968930Uinstall_KB968930$\PSCustomSetupUtil.exe
+ 2010-01-11 01:19 . 2010-01-11 01:19 8192 c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
- 2009-06-08 19:08 . 2009-06-08 19:08 8192 c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2009-10-09 22:56 . 2009-10-09 22:56 2048 c:\windows\system32\winrsmgr.dll
+ 2009-10-10 00:23 . 2009-10-10 00:23 4608 c:\windows\system32\WindowsPowerShell\v1.0\pwrshmsg.dll
+ 2009-10-10 00:23 . 2009-10-10 00:23 4096 c:\windows\system32\WindowsPowerShell\v1.0\powershell_ise.resources.dll
+ 2010-01-11 01:19 . 2010-01-11 01:19 7168 c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
- 2009-06-08 19:08 . 2009-06-08 19:08 7168 c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
+ 2010-01-11 01:13 . 2010-01-11 01:13 7168 c:\windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Runtime.dll
+ 2010-01-11 01:19 . 2010-01-11 01:19 5632 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
- 2009-06-08 19:08 . 2009-06-08 19:08 5632 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
+ 2010-01-11 01:13 . 2010-01-11 01:13 9216 c:\windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.Security.resources.dll
+ 2010-01-11 01:13 . 2010-01-11 01:13 7168 c:\windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.resources.dll
+ 2010-01-11 01:19 . 2010-01-11 01:19 6656 c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
- 2009-06-08 19:08 . 2009-06-08 19:08 6656 c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
- 2009-06-08 19:08 . 2009-06-08 19:08 8192 c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2010-01-11 01:19 . 2010-01-11 01:19 8192 c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2009-10-09 22:56 . 2009-10-09 22:56 9216 c:\windows\$968930Uinstall_KB968930$\PSSetupNativeUtils.exe

combofix log 2/3

combofix log 3/3
+ 2010-01-04 16:12 . 2009-10-29 07:45 124928 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\advpack.dll
+ 2010-01-11 01:16 . 2009-05-26 11:40 382840 c:\windows\$hf_mig$\KB975025\update\updspapi.dll
+ 2010-01-11 01:16 . 2009-05-26 11:40 755576 c:\windows\$hf_mig$\KB975025\update\update.exe
+ 2010-01-11 01:16 . 2009-05-26 11:40 231288 c:\windows\$hf_mig$\KB975025\spuninst.exe
+ 2010-01-11 01:16 . 2009-05-26 11:40 382840 c:\windows\$hf_mig$\KB974571\update\updspapi.dll
+ 2010-01-11 01:16 . 2009-05-26 11:40 755576 c:\windows\$hf_mig$\KB974571\update\update.exe
+ 2010-01-11 01:16 . 2009-05-26 11:40 231288 c:\windows\$hf_mig$\KB974571\spuninst.exe
+ 2010-01-11 01:14 . 2009-05-26 11:40 382840 c:\windows\$hf_mig$\KB974392\update\updspapi.dll
+ 2010-01-11 01:14 . 2009-05-26 11:40 755576 c:\windows\$hf_mig$\KB974392\update\update.exe
+ 2010-01-11 01:14 . 2009-05-26 11:40 231288 c:\windows\$hf_mig$\KB974392\spuninst.exe
+ 2010-01-04 16:11 . 2009-10-13 10:38 270336 c:\windows\$hf_mig$\KB974392\SP3QFE\oakley.dll
+ 2010-01-11 01:17 . 2009-05-26 11:40 382840 c:\windows\$hf_mig$\KB974318\update\updspapi.dll
+ 2010-01-11 01:17 . 2009-05-26 11:40 755576 c:\windows\$hf_mig$\KB974318\update\update.exe
+ 2010-01-11 01:17 . 2009-05-26 11:40 231288 c:\windows\$hf_mig$\KB974318\spuninst.exe
+ 2009-10-13 02:58 . 2009-10-13 02:58 150016 c:\windows\$hf_mig$\KB974318\SP3QFE\rastls.dll
+ 2010-01-11 01:16 . 2009-05-26 11:40 382840 c:\windows\$hf_mig$\KB974112\update\updspapi.dll
+ 2010-01-11 01:16 . 2009-05-26 11:40 755576 c:\windows\$hf_mig$\KB974112\update\update.exe
+ 2010-01-11 01:16 . 2009-05-26 11:40 231288 c:\windows\$hf_mig$\KB974112\spuninst.exe
+ 2010-01-04 16:15 . 2009-08-26 08:03 247326 c:\windows\$hf_mig$\KB974112\SP3QFE\strmdll.dll
+ 2010-01-11 01:15 . 2009-05-26 11:40 382840 c:\windows\$hf_mig$\KB973904\update\updspapi.dll
+ 2010-01-11 01:15 . 2009-05-26 11:40 755576 c:\windows\$hf_mig$\KB973904\update\update.exe
+ 2010-01-11 01:15 . 2009-05-26 11:40 231288 c:\windows\$hf_mig$\KB973904\spuninst.exe
+ 2010-01-04 16:13 . 2009-07-29 14:01 119648 c:\windows\$hf_mig$\KB973904\SP3QFE\msconv97.dll
+ 2010-01-11 01:16 . 2009-05-26 11:40 382840 c:\windows\$hf_mig$\KB973687\update\updspapi.dll
+ 2010-01-11 01:16 . 2008-07-08 13:02 755576 c:\windows\$hf_mig$\KB973687\update\update.exe
+ 2010-01-11 01:16 . 2008-07-08 13:02 231288 c:\windows\$hf_mig$\KB973687\spuninst.exe
+ 2010-01-11 01:12 . 2009-05-26 11:40 382840 c:\windows\$hf_mig$\KB973525\update\updspapi.dll
+ 2010-01-11 01:12 . 2009-05-26 11:40 755576 c:\windows\$hf_mig$\KB973525\update\update.exe
+ 2010-01-11 01:12 . 2009-05-26 11:40 231288 c:\windows\$hf_mig$\KB973525\spuninst.exe
+ 2010-01-11 01:10 . 2009-05-26 11:40 382840 c:\windows\$hf_mig$\KB971961\update\updspapi.dll
+ 2010-01-11 01:10 . 2009-05-26 11:40 755576 c:\windows\$hf_mig$\KB971961\update\update.exe
+ 2010-01-11 01:10 . 2009-05-26 11:40 231288 c:\windows\$hf_mig$\KB971961\spuninst.exe
+ 2010-01-04 16:05 . 2009-08-13 15:02 512000 c:\windows\$hf_mig$\KB971961\SP3QFE\jscript.dll
+ 2010-01-11 01:12 . 2009-05-26 11:40 382840 c:\windows\$hf_mig$\KB971486\update\updspapi.dll
+ 2010-01-11 01:12 . 2009-05-26 11:40 755576 c:\windows\$hf_mig$\KB971486\update\update.exe
+ 2010-01-11 01:12 . 2009-05-26 11:40 231288 c:\windows\$hf_mig$\KB971486\spuninst.exe
+ 2010-01-11 01:10 . 2008-07-08 13:02 382840 c:\windows\$hf_mig$\KB969947\update\updspapi.dll
+ 2010-01-11 01:10 . 2009-05-26 11:40 755576 c:\windows\$hf_mig$\KB969947\update\update.exe
+ 2010-01-11 01:10 . 2008-07-08 13:02 231288 c:\windows\$hf_mig$\KB969947\spuninst.exe
+ 2010-01-11 01:17 . 2008-07-08 13:02 382840 c:\windows\$hf_mig$\KB969059\update\updspapi.dll
+ 2010-01-11 01:17 . 2009-05-26 11:40 755576 c:\windows\$hf_mig$\KB969059\update\update.exe
+ 2010-01-11 01:17 . 2008-07-08 13:02 231288 c:\windows\$hf_mig$\KB969059\spuninst.exe
+ 2010-01-11 01:16 . 2008-07-08 13:02 382840 c:\windows\$hf_mig$\KB956844\update\updspapi.dll
+ 2010-01-11 01:16 . 2008-07-08 13:02 755576 c:\windows\$hf_mig$\KB956844\update\update.exe
+ 2010-01-11 01:16 . 2008-07-08 13:02 231288 c:\windows\$hf_mig$\KB956844\spuninst.exe
+ 2010-01-04 16:15 . 2009-06-21 21:49 153088 c:\windows\$hf_mig$\KB956844\SP3QFE\triedit.dll
+ 2010-01-11 01:17 . 2009-05-27 01:10 382840 c:\windows\$hf_mig$\KB955759\update\updspapi.dll
+ 2010-01-11 01:17 . 2009-05-26 11:40 755576 c:\windows\$hf_mig$\KB955759\update\update.exe
+ 2010-01-11 01:17 . 2009-05-26 11:40 231288 c:\windows\$hf_mig$\KB955759\spuninst.exe
+ 2010-01-04 16:17 . 2009-11-21 15:40 471552 c:\windows\$hf_mig$\KB955759\SP3QFE\aclayers.dll
+ 2010-01-11 01:13 . 2009-06-18 02:59 379184 c:\windows\$968930Uinstall_KB968930$\spuninst\updspapi.dll
+ 2010-01-11 01:13 . 2009-06-18 02:59 221488 c:\windows\$968930Uinstall_KB968930$\spuninst\spuninst.exe
+ 2010-01-04 16:18 . 2009-08-13 13:55 1748992 c:\windows\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\GdiPlus.dll
+ 2009-07-21 08:03 . 2009-07-21 08:03 1348432 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9876.0_x-ww_a621d1d5\msxml4.dll
+ 2006-04-28 14:38 . 2009-08-07 03:23 1929952 c:\windows\system32\wuaueng.dll
+ 2009-10-10 00:23 . 2009-10-10 00:23 1107456 c:\windows\system32\WsmSvc.dll
+ 2004-08-04 12:00 . 2009-05-20 12:56 2458112 c:\windows\system32\WMVCore.dll
- 2004-08-04 12:00 . 2008-06-18 10:03 2458112 c:\windows\system32\WMVCore.dll
+ 2004-08-04 12:00 . 2009-08-14 13:21 1850624 c:\windows\system32\win32k.sys
+ 2004-08-04 12:00 . 2010-01-05 10:00 1168384 c:\windows\system32\urlmon.dll
+ 2008-03-07 21:00 . 2007-06-22 15:37 1414656 c:\windows\system32\spool\drivers\w32x86\3\xwpuiv7.dll
+ 2008-03-07 21:00 . 2007-06-22 15:36 3701760 c:\windows\system32\spool\drivers\w32x86\3\xwprv7.dll
+ 2008-03-07 21:00 . 2007-06-22 15:39 1058816 c:\windows\system32\spool\drivers\w32x86\3\PCL5ERES.DLL
+ 2004-08-04 12:00 . 2009-07-17 16:22 1435648 c:\windows\system32\query.dll
- 2004-08-04 12:00 . 2008-04-14 00:12 1435648 c:\windows\system32\query.dll
+ 2004-08-04 12:00 . 2009-08-04 15:13 2145280 c:\windows\system32\ntoskrnl.exe
- 2004-08-04 12:00 . 2009-02-06 11:06 2145280 c:\windows\system32\ntoskrnl.exe
- 2004-08-03 22:59 . 2009-02-06 10:32 2023936 c:\windows\system32\ntkrnlpa.exe
+ 2004-08-03 22:59 . 2009-08-04 14:20 2023936 c:\windows\system32\ntkrnlpa.exe
+ 2008-08-30 03:06 . 2009-07-31 18:05 1372672 c:\windows\system32\msxml6.dll
+ 2009-07-21 08:05 . 2009-07-21 08:05 1348432 c:\windows\system32\msxml4.dll
+ 2004-08-04 12:00 . 2009-07-31 04:35 1172480 c:\windows\system32\msxml3.dll
+ 2006-04-28 14:37 . 2009-10-19 21:06 2689024 c:\windows\system32\mstscax.dll
+ 2006-04-28 14:37 . 2009-10-19 21:06 1033728 c:\windows\system32\mstsc.exe
+ 2004-08-04 12:00 . 2010-01-05 22:30 3599360 c:\windows\system32\mshtml.dll
+ 2009-07-18 03:21 . 2009-07-18 03:21 3883424 c:\windows\system32\Macromed\Flash\NPSWF32.dll
+ 2007-08-13 22:54 . 2010-01-05 10:00 6067200 c:\windows\system32\ieframe.dll
+ 2007-02-12 20:10 . 2009-06-29 08:33 2452872 c:\windows\system32\ieapfltr.dat
+ 2009-08-18 07:33 . 2009-08-18 07:33 1193832 c:\windows\system32\FM20.DLL
+ 2006-04-28 14:38 . 2009-08-07 03:23 1929952 c:\windows\system32\dllcache\wuaueng.dll
- 2004-08-04 12:00 . 2008-06-18 10:03 2458112 c:\windows\system32\dllcache\WMVCore.dll
+ 2004-08-04 12:00 . 2009-05-20 12:56 2458112 c:\windows\system32\dllcache\WMVCore.dll
+ 2009-02-09 11:13 . 2009-08-14 13:21 1850624 c:\windows\system32\dllcache\win32k.sys
+ 2004-08-04 12:00 . 2010-01-05 10:00 1168384 c:\windows\system32\dllcache\urlmon.dll
+ 2010-01-04 16:16 . 2009-07-17 16:22 1435648 c:\windows\system32\dllcache\query.dll
+ 2009-06-08 18:40 . 2009-08-05 04:44 2189184 c:\windows\system32\dllcache\ntoskrnl.exe
+ 2009-06-08 18:40 . 2009-08-04 14:20 2023936 c:\windows\system32\dllcache\ntkrpamp.exe
- 2009-06-08 18:40 . 2009-02-06 10:32 2023936 c:\windows\system32\dllcache\ntkrpamp.exe
- 2009-02-08 00:02 . 2009-02-08 00:02 2066048 c:\windows\system32\dllcache\ntkrnlpa.exe
+ 2009-02-08 00:02 . 2009-08-04 14:20 2066048 c:\windows\system32\dllcache\ntkrnlpa.exe
+ 2009-06-08 18:40 . 2009-08-04 15:13 2145280 c:\windows\system32\dllcache\ntkrnlmp.exe
- 2009-06-08 18:40 . 2009-02-06 11:06 2145280 c:\windows\system32\dllcache\ntkrnlmp.exe
+ 2008-09-12 16:17 . 2009-07-31 18:05 1372672 c:\windows\system32\dllcache\msxml6.dll
+ 2004-08-04 12:00 . 2009-07-31 04:35 1172480 c:\windows\system32\dllcache\msxml3.dll
+ 2006-04-28 14:37 . 2009-10-19 21:06 2689024 c:\windows\system32\dllcache\mstscax.dll
+ 2006-04-28 14:37 . 2009-10-19 21:06 1033728 c:\windows\system32\dllcache\mstsc.exe
+ 2004-08-04 12:00 . 2010-01-05 22:30 3599360 c:\windows\system32\dllcache\mshtml.dll
+ 2008-09-12 16:44 . 2010-01-05 10:00 6067200 c:\windows\system32\dllcache\ieframe.dll
+ 2008-09-12 16:44 . 2009-06-29 08:33 2452872 c:\windows\system32\dllcache\ieapfltr.dat
+ 2010-02-11 05:10 . 2007-12-27 01:30 1970176 c:\windows\system32\d3dx9.dll
- 2009-10-13 04:05 . 2007-12-27 00:30 1970176 c:\windows\system32\d3dx9.dll
+ 2009-08-08 07:51 . 2009-08-08 07:51 5812560 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
+ 2009-08-08 07:51 . 2009-08-08 07:51 4546560 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
- 2008-11-25 11:59 . 2008-11-25 11:59 4546560 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
- 2007-04-14 04:35 . 2007-04-14 04:35 1265664 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Web.dll
+ 2008-05-28 09:35 . 2008-05-28 09:35 1265664 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Web.dll
+ 2008-05-28 09:35 . 2008-05-28 09:35 1232896 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.dll
- 2007-04-14 04:35 . 2007-04-14 04:35 1232896 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.dll
+ 2008-05-28 08:48 . 2008-05-28 08:48 2514944 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
- 2007-04-14 03:57 . 2007-04-14 03:57 2514944 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
+ 2008-05-28 08:48 . 2008-05-28 08:48 2523136 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll
- 2007-04-14 03:57 . 2007-04-14 03:57 2523136 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll
+ 2008-05-28 08:43 . 2008-05-28 08:43 2142208 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll
- 2007-04-14 03:50 . 2007-04-14 03:50 2142208 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll
+ 2009-08-18 20:58 . 2009-08-18 20:58 8301056 c:\windows\Installer\198dd0e8.msp
+ 2009-07-27 12:31 . 2009-07-27 12:31 3738624 c:\windows\Installer\198dd0d4.msp
+ 2009-08-18 20:57 . 2009-08-18 20:57 9122304 c:\windows\Installer\198dd0c0.msp
+ 2009-10-16 15:09 . 2009-10-16 15:09 2518016 c:\windows\Installer\198dd0ac.msp
+ 2009-08-18 21:08 . 2009-08-18 21:08 1373696 c:\windows\Installer\198dd082.msp
- 2009-08-06 15:29 . 2009-08-06 16:21 1172240 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\xlicons.exe
+ 2009-08-06 15:29 . 2010-03-20 23:43 1172240 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\xlicons.exe
- 2009-08-06 15:29 . 2009-08-06 16:21 1165584 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\accicons.exe
+ 2009-08-06 15:29 . 2010-03-20 23:43 1165584 c:\windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\accicons.exe
+ 2007-10-06 00:31 . 2007-10-06 00:31 5287984 c:\windows\Installer\$PatchCache$\Managed\00002109110000000000000000F01FEC\12.0.6215\IPEDITOR.DLL
+ 2010-03-20 23:44 . 2009-10-29 07:46 1168384 c:\windows\ie7updates\KB978207-IE7\urlmon.dll
+ 2010-03-20 23:44 . 2009-10-29 21:16 3598336 c:\windows\ie7updates\KB978207-IE7\mshtml.dll
+ 2010-03-20 23:44 . 2009-10-29 07:46 6067200 c:\windows\ie7updates\KB978207-IE7\ieframe.dll
+ 2010-01-11 01:15 . 2009-04-29 04:56 1159680 c:\windows\ie7updates\KB976325-IE7\urlmon.dll
+ 2010-01-11 01:15 . 2009-04-29 04:56 3596288 c:\windows\ie7updates\KB976325-IE7\mshtml.dll
+ 2010-01-11 01:15 . 2009-04-29 04:55 6066176 c:\windows\ie7updates\KB976325-IE7\ieframe.dll
+ 2010-01-11 01:15 . 2008-07-09 14:25 2455488 c:\windows\ie7updates\KB976325-IE7\ieapfltr.dat
+ 2009-06-08 18:40 . 2009-08-05 04:44 2189184 c:\windows\Driver Cache\i386\ntoskrnl.exe
+ 2009-06-08 18:40 . 2009-08-04 14:20 2023936 c:\windows\Driver Cache\i386\ntkrpamp.exe
- 2009-06-08 18:40 . 2009-02-06 10:32 2023936 c:\windows\Driver Cache\i386\ntkrpamp.exe
- 2009-02-08 00:02 . 2009-02-08 00:02 2066048 c:\windows\Driver Cache\i386\ntkrnlpa.exe
+ 2009-02-08 00:02 . 2009-08-04 14:20 2066048 c:\windows\Driver Cache\i386\ntkrnlpa.exe
- 2009-06-08 18:40 . 2009-02-06 11:06 2145280 c:\windows\Driver Cache\i386\ntkrnlmp.exe
+ 2009-06-08 18:40 . 2009-08-04 15:13 2145280 c:\windows\Driver Cache\i386\ntkrnlmp.exe
+ 2010-01-11 01:14 . 2010-01-11 01:14 4792320 c:\windows\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_304fb07b\System.dll
+ 2010-01-11 01:14 . 2010-01-11 01:14 1966080 c:\windows\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_2f351576\System.dll
+ 2010-01-11 01:14 . 2010-01-11 01:14 2088960 c:\windows\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_82419471\System.Xml.dll
+ 2010-01-11 01:14 . 2010-01-11 01:14 5513216 c:\windows\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_32b6d1ab\System.Xml.dll
+ 2010-01-11 01:14 . 2010-01-11 01:14 7884800 c:\windows\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_f13c4a50\System.Windows.Forms.dll
+ 2010-01-11 01:14 . 2010-01-11 01:14 3018752 c:\windows\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_295f27d0\System.Windows.Forms.dll
+ 2010-01-11 01:14 . 2010-01-11 01:14 2244608 c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_7b444564\System.Drawing.dll
+ 2010-01-11 01:14 . 2010-01-11 01:14 3395584 c:\windows\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_205d5166\System.Design.dll
+ 2010-01-11 01:14 . 2010-01-11 01:14 1470464 c:\windows\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_06532aa8\System.Design.dll
+ 2010-01-11 01:14 . 2010-01-11 01:14 3391488 c:\windows\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_a4de1ec1\mscorlib.dll
+ 2010-01-11 01:15 . 2010-01-11 01:15 8908800 c:\windows\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_46156929\mscorlib.dll
+ 2010-01-11 01:20 . 2010-01-11 01:20 3313664 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\204d6e5b335134f23ca37638b9227ecf\WindowsBase.ni.dll
+ 2010-01-11 01:24 . 2010-01-11 01:24 1049600 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\0f2ed6a204eb13841e99b77025464afc\UIAutomationClientsideProviders.ni.dll
+ 2010-01-11 01:20 . 2010-01-11 01:20 7868416 c:\windows\assembly\NativeImages_v2.0.50727_32\System\3de5bd01124463d7862bd173af90bc83\System.ni.dll
+ 2010-01-11 01:24 . 2010-01-11 01:24 5450752 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5913d3f81e77194ec833991b1047a532\System.Xml.ni.dll
+ 2010-01-11 01:32 . 2010-01-11 01:32 1356288 c:\windows\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\fa48917b13629d8effa80dd4a2f2973d\System.WorkflowServices.ni.dll
+ 2010-01-11 01:32 . 2010-01-11 01:32 1908224 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\6fe66ee6f3c81996bc148f1ebe7ec030\System.Workflow.Runtime.ni.dll
+ 2010-01-11 01:32 . 2010-01-11 01:32 4514304 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\9d0b61f2f1ebdc300bd970f594c422ef\System.Workflow.ComponentModel.ni.dll
+ 2010-01-11 01:32 . 2010-01-11 01:32 2992640 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\65328898148a720d394f802f192fc2a0\System.Workflow.Activities.ni.dll
+ 2010-01-11 01:32 . 2010-01-11 01:32 1840640 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\ea07ac791bb5cb9f83679e3dd1a0c0cc\System.Web.Services.ni.dll
+ 2010-01-11 01:32 . 2010-01-11 01:32 2209280 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\29e2f8b1fb691ced973acf49fcee6ec1\System.Web.Mobile.ni.dll
+ 2010-01-11 01:32 . 2010-01-11 01:32 2403328 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\981dea02bc63c0c083e335adf9018788\System.Web.Extensions.ni.dll
+ 2010-01-11 01:23 . 2010-01-11 01:23 1917440 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Speech\99594bae1d022502925f5b9dfcdaae9a\System.Speech.ni.dll
+ 2010-01-11 01:31 . 2010-01-11 01:31 1706496 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\e182695d05ea57257568bc5f3208aca7\System.ServiceModel.Web.ni.dll
+ 2010-01-11 01:29 . 2010-01-11 01:29 2338304 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\67ad55827f2542552b576170f0a7dc56\System.Runtime.Serialization.ni.dll
+ 2010-01-11 01:23 . 2010-01-11 01:23 1035264 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Printing\e5313735a40c0800f116e27fba4754db\System.Printing.ni.dll
+ 2010-01-11 01:31 . 2010-01-11 01:31 8365056 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management.A#\4fddbe9c2ff96b543a624459cad647b6\System.Management.Automation.ni.dll
+ 2010-01-11 01:29 . 2010-01-11 01:29 1056768 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\c3b18fef5c6dc3bcdbe5df699fd21a55\System.IdentityModel.ni.dll
+ 2010-01-11 01:23 . 2010-01-11 01:23 1587200 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\abb2ac7e08bee026f857d8fa36f9fe6f\System.Drawing.ni.dll
+ 2010-01-11 01:31 . 2010-01-11 01:31 1116672 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\f47ebb9db460874b1bcbfc391dc970b1\System.DirectoryServices.ni.dll
+ 2010-01-11 01:31 . 2010-01-11 01:31 1801216 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\c94a427baa7683f4221b91f90c18461b\System.Deployment.ni.dll
+ 2010-01-11 01:23 . 2010-01-11 01:23 6616576 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\694c07365e0fd6bba0bc304d4d2404a7\System.Data.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 2510336 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\272152f0cc139490729e215611a4b244\System.Data.SqlXml.ni.dll
+ 2010-01-11 01:31 . 2010-01-11 01:31 1328128 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Services\112a48e34620a0210eb850040da8a31b\System.Data.Services.ni.dll
+ 2010-01-11 01:23 . 2010-01-11 01:23 2516480 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\32788c58ff9f8324460604cf1fe7681b\System.Data.Linq.ni.dll
+ 2010-01-11 01:31 . 2010-01-11 01:31 9924096 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\9012cac7819660f61f1c69cf8e4f2ccf\System.Data.Entity.ni.dll
+ 2010-01-11 01:23 . 2010-01-11 01:23 2295296 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\c0a42d2ad8a4078040b334f6770ea11f\System.Core.ni.dll
+ 2010-01-11 01:23 . 2010-01-11 01:23 2128896 c:\windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\954685c29689d2a6126ceca1fd55e904\ReachFramework.ni.dll
+ 2010-01-11 01:23 . 2010-01-11 01:23 1657856 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\a3a6f52ce1d09a7bdccc8e7fc664792d\PresentationUI.ni.dll
+ 2010-01-11 01:20 . 2010-01-11 01:20 1451008 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\f906701365083c1473db31519147e263\PresentationBuildTasks.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 1712128 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\6eee9b772b6d12d3dbd82f118c2ab2e5\Microsoft.VisualBasic.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 1093120 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\f19e9b439636d0744597fff1331cad04\Microsoft.Transactions.Bridge.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 3722240 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\d7580a8595db77e165a51e2c1add4720\Microsoft.PowerShell.Editor.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 1704448 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\d38b060a0a380c671c5e45c31905d2f0\Microsoft.PowerShell.GPowerShell.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 1609728 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\74362bea6bc8a906a45d74c393969423\Microsoft.PowerShell.Commands.Utility.ni.dll
+ 2010-01-11 01:31 . 2010-01-11 01:31 2332160 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Jscript\5b1af7b5be24c7ace065fe1c81c2b650\Microsoft.Jscript.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 1620992 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\9eec1cc7ac37e0c7f3205e8156149c5a\Microsoft.Build.Tasks.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 1966080 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\28c0730288453d57d5dcd62903c4d31b\Microsoft.Build.Tasks.v3.5.ni.dll
+ 2010-01-11 01:30 . 2010-01-11 01:30 1888768 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\5dd4f58999eed37c12aee7ea9f9863ac\Microsoft.Build.Engine.ni.dll
- 2009-06-08 19:08 . 2009-06-08 19:08 3149824 c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
+ 2010-01-11 01:19 . 2010-01-11 01:19 3149824 c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
+ 2010-01-11 01:19 . 2010-01-11 01:19 2048000 c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
- 2009-06-08 19:08 . 2009-06-08 19:08 2048000 c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
+ 2010-01-11 01:19 . 2010-01-11 01:19 5025792 c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
- 2009-06-08 19:08 . 2009-06-08 19:08 5025792 c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2010-01-11 01:13 . 2010-01-11 01:13 2682880 c:\windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll
+ 2010-01-11 01:19 . 2010-01-11 01:19 5062656 c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
- 2009-06-08 19:08 . 2009-06-08 19:08 5062656 c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
- 2009-06-08 19:08 . 2009-06-08 19:08 5242880 c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
+ 2010-01-11 01:19 . 2010-01-11 01:19 5242880 c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
+ 2010-01-11 01:19 . 2010-01-11 01:19 2933248 c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
- 2009-06-08 19:08 . 2009-06-08 19:08 2933248 c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
- 2009-06-08 19:08 . 2009-06-08 19:08 4546560 c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2010-01-11 01:19 . 2010-01-11 01:19 4546560 c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2010-01-11 01:14 . 2010-01-11 01:14 1232896 c:\windows\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
- 2009-06-19 00:51 . 2009-06-19 00:51 1232896 c:\windows\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
+ 2010-01-11 01:14 . 2010-01-11 01:14 1265664 c:\windows\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
- 2009-06-19 00:51 . 2009-06-19 00:51 1265664 c:\windows\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
+ 2010-01-11 01:16 . 2008-08-30 03:06 1350664 c:\windows\$NtUninstallKB973687$\msxml6.dll
+ 2010-01-11 01:16 . 2008-09-04 17:15 1106944 c:\windows\$NtUninstallKB973687$\msxml3.dll
+ 2010-01-11 01:12 . 2009-02-06 11:06 2145280 c:\windows\$NtUninstallKB971486$\ntoskrnl.exe
+ 2010-01-11 01:12 . 2009-02-06 10:32 2023936 c:\windows\$NtUninstallKB971486$\ntkrpamp.exe
+ 2010-01-11 01:12 . 2009-02-06 10:32 2023936 c:\windows\$NtUninstallKB971486$\ntkrnlpa.exe
+ 2010-01-11 01:12 . 2009-02-06 11:06 2145280 c:\windows\$NtUninstallKB971486$\ntkrnlmp.exe
+ 2010-01-11 01:10 . 2009-04-17 12:26 1847168 c:\windows\$NtUninstallKB969947$\win32k.sys
+ 2010-01-11 01:17 . 2009-06-10 13:19 2066432 c:\windows\$NtUninstallKB969084$\mstscax.dll
+ 2010-01-11 01:17 . 2008-04-14 00:12 1435648 c:\windows\$NtUninstallKB969059$\query.dll
+ 2010-01-11 01:17 . 2008-06-18 10:03 2458112 c:\windows\$NtUninstallKB968816_WM9$\wmvcore.dll
+ 2010-01-04 16:12 . 2009-10-29 07:45 1170944 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\urlmon.dll
+ 2010-01-04 16:12 . 2009-10-29 07:45 3602432 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\mshtml.dll
+ 2010-01-04 16:12 . 2009-10-29 07:45 6070784 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\ieframe.dll
+ 2010-01-04 16:12 . 2009-06-29 08:33 2452872 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\ieapfltr.dat
+ 2010-01-04 16:14 . 2009-07-31 04:24 1447424 c:\windows\$hf_mig$\KB973687\SP3QFE\msxml6.dll
+ 2010-01-04 16:14 . 2009-07-31 04:24 1172480 c:\windows\$hf_mig$\KB973687\SP3QFE\msxml3.dll
+ 2010-01-04 16:08 . 2009-08-04 13:56 2189312 c:\windows\$hf_mig$\KB971486\SP3QFE\ntoskrnl.exe
+ 2010-01-04 16:08 . 2009-08-04 13:17 2023936 c:\windows\$hf_mig$\KB971486\SP3QFE\ntkrpamp.exe
+ 2009-08-05 02:47 . 2009-08-05 02:47 2066176 c:\windows\$hf_mig$\KB971486\SP3QFE\ntkrnlpa.exe
+ 2010-01-04 16:08 . 2009-08-04 13:54 2145280 c:\windows\$hf_mig$\KB971486\SP3QFE\ntkrnlmp.exe
+ 2009-08-15 01:49 . 2009-08-15 01:49 1859712 c:\windows\$hf_mig$\KB969947\SP3QFE\win32k.sys
+ 2010-01-04 16:16 . 2009-07-17 16:01 1435648 c:\windows\$hf_mig$\KB969059\SP3QFE\query.dll
+ 2010-01-09 08:28 . 2010-01-09 08:28 12337752 c:\windows\system32\rktools.exe
+ 2010-01-11 01:11 . 2010-02-01 18:26 30364104 c:\windows\system32\MRT.exe
+ 2009-08-11 05:08 . 2009-08-11 05:08 11315712 c:\windows\Microsoft.NET\Framework\v1.1.4322\Updates\M953297\M953297Uninstall.msp
+ 2009-08-18 19:50 . 2009-08-18 19:50 12022272 c:\windows\Installer\47a8891.msp
+ 2009-08-15 04:32 . 2009-08-15 04:32 11110912 c:\windows\Installer\198dd106.msp
+ 2009-08-18 21:19 . 2009-08-18 21:19 10098688 c:\windows\Installer\198dd0fd.msp
+ 2009-08-10 22:09 . 2009-08-10 22:09 17254912 c:\windows\Installer\198dd099.msp
+ 2010-01-13 06:54 . 2010-01-13 06:54 10829312 c:\windows\Downloaded Installations\{B06DB85F-066C-4871-9FFA-A3A99854E6FC}\Teamcenter's Application Sharing.msi
+ 2010-01-11 01:24 . 2010-01-11 01:24 12430848 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d2ea8d76f015817db1607075812b555f\System.Windows.Forms.ni.dll
+ 2010-01-11 01:32 . 2010-01-11 01:32 11796992 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\5cea03cfb008f2eac1439a9905467f37\System.Web.ni.dll
+ 2010-01-11 01:29 . 2010-01-11 01:29 17317888 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\06d6eab93282d2b136a377bd50b7c5a9\System.ServiceModel.ni.dll
+ 2010-01-11 01:23 . 2010-01-11 01:23 10683392 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Design\8b82e08c008924d51833cb0884bcbfc5\System.Design.ni.dll
+ 2010-01-11 01:23 . 2010-01-11 01:23 14327808 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\58c7ac6b6054038dc9346d7ec8e32b4c\PresentationFramework.ni.dll
+ 2010-01-11 01:22 . 2010-01-11 01:22 12216320 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\94badbd64df59de7da249f71da38b1c2\PresentationCore.ni.dll
+ 2010-01-11 01:20 . 2010-01-11 01:20 11486720 c:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7124a40b9998f7b63c86bd1a2125ce26\mscorlib.ni.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SIECACST"="c:\program files\Siemens\CardOS API\bin\siecacst.exe" [2007-08-02 81920]
"Ptipbmf"="ptipbmf.dll" [2007-10-20 118784]
"PtiuPbmd"="ulutil2.dll" [2003-11-05 110592]
"Communicator"="c:\program files\Microsoft Office Communicator\communicator.exe" [2009-06-04 5069648]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"SigmatelSysTrayApp"="stsystra.exe" [2007-02-19 303104]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-04-29 8429568]
"nwiz"="nwiz.exe" [2007-04-29 1626112]
"NVHotkey"="nvHotkey.dll" [2007-04-29 67584]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-04-29 81920]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-04-18 159744]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2006-10-20 118784]
"OdTray.exe"="c:\program files\Juniper Networks\Odyssey Access Client\OdTray.exe" [2007-03-16 1028160]
"OfficeScanNT Monitor"="c:\program files\Trend Micro\OfficeScan Client\Pccntmon.exe" [2010-02-04 718120]
"AmazonGSDownloaderTray"="c:\program files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe" [2009-10-23 326144]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"LogonType"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoFavoritesMenu"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoStartMenuMyMusic"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OdysseyClient]
2008-06-29 05:49 122949 ----a-w- c:\windows\system32\odyEvent.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 aacsas;Adaptec SAS/SATA-II RAID Miniport Driver;c:\windows\system32\drivers\aacsas.sys [9/15/2008 10:12 AM 81035]
R0 adp94xx;adp94xx;c:\windows\system32\drivers\adp94xx.sys [9/15/2008 10:12 AM 360960]
R0 AFAMgt;AFAMgt;c:\windows\system32\drivers\afamgt.sys [9/15/2008 10:12 AM 91707]
R0 ahcix86;ahcix86;c:\windows\system32\drivers\ahcix86.sys [9/15/2008 10:12 AM 119808]
R0 amdbusdr;amdbusdr;c:\windows\system32\drivers\AmdBusDr.sys [9/15/2008 10:12 AM 29696]
R0 arcm_x86;arcm_x86;c:\windows\system32\drivers\arcm_x86.sys [9/15/2008 10:12 AM 25888]
R0 atiide;atiide;c:\windows\system32\drivers\atiide.sys [9/15/2008 10:12 AM 6016]
R0 dontgo;Promise Removable Disk Control Driver;c:\windows\system32\drivers\dontgo.sys [9/15/2008 10:12 AM 7680]
R0 FastSx;FastSx;c:\windows\system32\drivers\FastSx.sys [9/15/2008 10:12 AM 167424]
R0 fasttrak;fasttrak;c:\windows\system32\drivers\Fasttrak.sys [9/15/2008 10:12 AM 65536]
R0 fttxr5_O;fttxr5_O;c:\windows\system32\drivers\fttxr5_O.sys [9/15/2008 10:12 AM 177152]
R0 fttxr52P;fttxr52P;c:\windows\system32\drivers\fttxr52P.sys [9/15/2008 10:12 AM 160256]
R0 HpCISSm2;HpCISSm2;c:\windows\system32\drivers\HpCISSm2.sys [9/15/2008 10:12 AM 23040]
R0 Hpt366;Hpt366;c:\windows\system32\drivers\Hpt366.sys [9/15/2008 10:12 AM 22880]
R0 hpt374;hpt374;c:\windows\system32\drivers\hpt374.sys [9/15/2008 10:12 AM 108150]
R0 hptiop;hptiop;c:\windows\system32\drivers\hptiop.sys [9/15/2008 10:12 AM 14496]
R0 hptmv;hptmv;c:\windows\system32\drivers\hptmv.sys [9/15/2008 10:12 AM 65024]
R0 iteraid;ITERAID_Service_Install;c:\windows\system32\drivers\iteraid.sys [9/15/2008 10:12 AM 26112]
R0 m5228;m5228;c:\windows\system32\drivers\m5228.sys [9/15/2008 10:12 AM 45069]
R0 m5281;m5281;c:\windows\system32\drivers\m5281.sys [9/15/2008 10:12 AM 51072]
R0 m5287;m5287;c:\windows\system32\drivers\m5287.sys [9/15/2008 10:12 AM 103680]
R0 m5288;m5288;c:\windows\system32\drivers\m5288.sys [9/15/2008 10:12 AM 210304]
R0 m5289;m5289;c:\windows\system32\drivers\m5289.sys [9/15/2008 10:12 AM 52480]
R0 MegaIDE;MegaIDE;c:\windows\system32\drivers\MegaIDE.sys [9/15/2008 10:12 AM 163277]
R0 MegaINTL;MegaINTL;c:\windows\system32\drivers\MegaINTL.sys [9/15/2008 10:12 AM 177536]
R0 mv614x;mv614x;c:\windows\system32\drivers\mv614x.sys [9/15/2008 10:12 AM 34432]
R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [9/15/2008 10:12 AM 143360]
R0 mv64xx;mv64xx;c:\windows\system32\drivers\mv64xx.sys [9/15/2008 10:12 AM 212480]
R0 mvSata;mvSata;c:\windows\system32\drivers\mvsata.sys [9/15/2008 10:12 AM 43520]
R0 nfrd960;IBM ServeRAID 4M/4L/4Mx/4Lx/5i/6M/6i/7k Device Driver;c:\windows\system32\drivers\nfrd960.sys [9/15/2008 10:12 AM 74747]
R0 odFips;odFips;c:\windows\system32\drivers\odFIPS.sys [1/23/2006 2:19 PM 254208]
R0 Pnp649r;CMD IDE Raid Controller;c:\windows\system32\drivers\pnp649r.sys [9/15/2008 10:12 AM 66889]
R0 Pnp680;SiI 680 ATA Controller;c:\windows\system32\drivers\PnP680.sys [9/15/2008 10:12 AM 71720]
R0 raidsrc;raidsrc;c:\windows\system32\drivers\raidsrc.sys [9/15/2008 10:12 AM 45392]
R0 S150sx8;S150sx8;c:\windows\system32\drivers\S150sx8.sys [9/15/2008 10:12 AM 36864]
R0 SI3112r;Silicon Image SiI 3512 SATARaid Controller;c:\windows\system32\drivers\SI3112r.sys [9/15/2008 10:12 AM 110128]
R0 SI3114;SiI-3114 SATALink Controller;c:\windows\system32\drivers\SI3114.sys [9/15/2008 10:12 AM 61952]
R0 SI3124;SiI-3124 SATALink Controller;c:\windows\system32\drivers\SI3124.sys [9/15/2008 10:12 AM 81960]
R0 SI3124r;SiI-3124 SATARaid Controller;c:\windows\system32\drivers\SI3124r.sys [9/15/2008 10:12 AM 100881]
R0 Si3124r5;SiI-3124 SoftRaid 5 Controller;c:\windows\system32\drivers\3124r5A2.sys [9/15/2008 10:12 AM 207152]
R0 Si3531;SiI-3531 SATA Controller;c:\windows\system32\drivers\Si3531.sys [9/15/2008 10:12 AM 210736]
R0 SiSRaid1;SiSRaid1;c:\windows\system32\drivers\SiSRaid1.sys [9/15/2008 10:11 AM 46464]
R0 SiSRaid4;SiSRaid4;c:\windows\system32\drivers\sisraid4.sys [9/15/2008 10:11 AM 68864]
R0 sisraidx;sisraidx;c:\windows\system32\drivers\sisraidx.sys [9/15/2008 10:11 AM 47616]
R0 sptrak;sptrak;c:\windows\system32\drivers\sptrak.sys [9/15/2008 10:12 AM 41216]
R0 ulsata2;ulsata2;c:\windows\system32\drivers\ulsata2.sys [9/15/2008 10:12 AM 125952]
R0 viapdsk;VIA ATA/ATAPI Host Controller;c:\windows\system32\drivers\viapdsk.sys [9/15/2008 10:11 AM 29184]
R0 vmscsi;vmscsi;c:\windows\system32\drivers\vmscsi.sys [4/28/2006 6:57 AM 17968]
R2 JuniperAccessService;Juniper Unified Network Service;c:\program files\Common Files\Juniper Networks\JUNS\dsAccessService.exe [12/11/2006 10:12 AM 87664]
R2 TmPreFilter;Trend Micro PreFilter;c:\program files\Trend Micro\OfficeScan Client\tmpreflt.sys [11/9/2005 6:34 PM 36368]
R3 Eacfilt;Eacfilt Miniport;c:\windows\system32\drivers\eacfilt.sys [8/4/2009 8:15 AM 24521]
R3 jnprna;Juniper Network Agent Miniport;c:\windows\system32\drivers\jnprna.sys [11/14/2006 9:49 AM 398720]
R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [5/25/2009 6:34 AM 338960]
R3 WSUSBDMAN;VMware VDM Virtual Client USB Manager;c:\windows\system32\drivers\WSUSBDMAN.sys [5/8/2008 3:45 PM 21504]
S0 2310_00;2310_00;c:\windows\system32\drivers\2310_00.sys [9/15/2008 10:12 AM 100224]
S0 hptmv6;hptmv6;c:\windows\system32\drivers\hptmv6.sys [9/15/2008 10:12 AM 93696]
S0 hptpro;hptpro;c:\windows\system32\drivers\hptpro.sys [9/15/2008 10:12 AM 9809]
S0 lsi_sas2;lsi_sas2;c:\windows\system32\drivers\lsi_sas2.sys [9/15/2008 10:12 AM 93184]
S0 rr172x;rr172x;c:\windows\system32\drivers\rr172x.sys [9/15/2008 10:12 AM 83200]
S0 rr174x;rr174x;c:\windows\system32\drivers\rr174x.sys [9/15/2008 10:12 AM 107296]
S0 rr232x;rr232x;c:\windows\system32\drivers\rr232x.sys [9/15/2008 10:12 AM 101888]
S0 rr2340;rr2340;c:\windows\system32\drivers\rr2340.sys [9/15/2008 10:12 AM 102400]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/2/2009 11:04 PM 135664]
S2 MobileAutmationAgentService;iPass Endpoint Policy Management Agent;"c:\program files\mobile automation\rstate.exe" --> c:\program files\mobile automation\rstate.exe [?]
S2 SttService;Stt Services;c:\windows\SttService.exe [9/2/2009 7:43 AM 42043]
S2 TmFilter;Trend Micro Filter;c:\program files\Trend Micro\OfficeScan Client\tmxpflt.sys [11/9/2005 6:34 PM 230928]
S2 wsnm;VMware VDM Client Service;c:\program files\VMware\VMware VDM\Client\bin\wsnm.exe [5/8/2008 3:51 PM 131072]
S3 Amazon Download Agent;Amazon Download Agent;c:\program files\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [11/29/2009 3:47 PM 401920]
S3 EacService;Juniper TNC Endpoint Assessment;c:\program files\Common Files\Juniper Networks\TNC Client\jTnccService.exe [3/16/2007 5:33 PM 81992]
S3 ExtranetAccess;Contivity VPN Service;c:\program files\Nortel Networks\Extranet_serv.exe [8/4/2009 8:15 AM 835584]
S3 IPSECEXT;Nortel Extranet Access Protocol;c:\windows\system32\drivers\ipsecw2k.sys [8/4/2009 8:15 AM 155216]
S3 TmPfw;OfficeScan NT Firewall;c:\program files\Trend Micro\OfficeScan Client\TmPfw.exe [5/25/2009 6:34 AM 488768]
S3 TmProxy;OfficeScan NT Proxy Service;c:\program files\Trend Micro\OfficeScan Client\TmProxy.exe [5/25/2009 6:30 AM 652552]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [8/4/2004 5:00 AM 14336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
WINRM REG_MULTI_SZ WINRM
.
Contents of the 'Scheduled Tasks' folder

2010-04-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-03 06:04]

2010-04-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-03 06:04]

2010-04-07 c:\windows\Tasks\stt_inv_report_24.job
- c:\program files\stt\stt_report_controller.bat [2009-09-02 02:48]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: salesforce.com
Trusted Zone: siemens.com\*.industrysoftware.automation
Trusted Zone: siemens.us\ura
Trusted Zone: ugs.com
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Malwarebytes Anti-Malware (reboot) - e:\debug malware\Software\Malwarebytes' Anti-Malware\mbam.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-16 11:13
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: >>UNKNOWN [0x80800000]<< >>UNKNOWN [0xF1A72000]<< >>UNKNOWN [0xF7657000]<< >>UNKNOWN [0xF7647000]<< >>UNKNOWN [0x8B50AAC8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> 0xf765bf28
\Driver\ACPI -> 0xf735ecb8
\Driver\atapi -> 0xf72a7852
\Driver\iaStor -> 0xf7214002
IoDeviceObjectType -> DeleteProcedure -> 0x808ac6a8
ParseProcedure -> 0x808ab7e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> 0x808ac6a8
ParseProcedure -> 0x808ab7e8
NDIS: Broadcom NetXtreme 57xx Gigabit Controller -> SendCompleteHandler -> 0xf694cbb0
PacketIndicateHandler -> 0xf693ba0d
SendHandler -> 0xf694fb40
user & kernel MBR OK

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(840)
c:\windows\system32\WININET.dll
c:\windows\system32\odyEvent.dll

- - - - - - - > 'lsass.exe'(1048)
c:\windows\system32\WININET.dll
.
Completion time: 2010-04-16 11:16:52
ComboFix-quarantined-files.txt 2010-04-16 18:16
ComboFix2.txt 2009-11-23 01:06
ComboFix3.txt 2009-11-22 21:08
ComboFix4.txt 2009-11-22 18:49

Pre-Run: 134,108,975,104 bytes free
Post-Run: 134,172,774,400 bytes free

- - End Of File - - BE96276F6BFAB87EDE309121838AA9EE

Please download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

• Click NO
  
• In the right panel, you will see a bunch of boxes that have been checked ... leave everything checked and ensure the Show all box is un-checked.
  
• Now click the Scan button.
  Once the scan is complete, you may receive another notice about rootkit activity.
  
• Click OK.
  
• GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
  
• Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.