Police Pro block EVERYthing

Norton expired a few months ago...I had disabled the auto update because it took up so much memory. Im not on it now, but can I go online when I copy paste like above? Or should I use a drive?

Hello.
We'll uninstall Norton later.


Please install Avira antivirus otherwise you won't be protected.

1) Antivir PersonalEditionClassic
-Free anti-virus software for Windows.
-Detects and removes more than 50,000 viruses. Free support.

It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts.

Perform a full scan with Avira and let it delete everything it is finding.
Then reboot.
After reboot, open your Avira and select "reports".
There doubleclick the report from the Full scan you have done. Click the "Report File" button and copy and paste this report in your next reply.
Then we'll start from there, because it really makes no sense otherwise that we clean this up manually if an Antivirusscan is not present which should be able to deal with most and prevent further reinfection.

Hi.


Avira AntiVir Personal
Report file date: Tuesday, September 22, 2009 21:49

Scanning for 1740103 virus strains and unwanted programs.

Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : SYSTEM
Computer name : LAPTOP

Version information:
BUILD.DAT : 9.0.0.407 17961 Bytes 7/29/2009 10:34:00
AVSCAN.EXE : 9.0.3.7 466689 Bytes 7/21/2009 18:36:14
AVSCAN.DLL : 9.0.3.0 40705 Bytes 2/27/2009 15:58:24
LUKE.DLL : 9.0.3.2 209665 Bytes 2/20/2009 16:35:49
LUKERES.DLL : 9.0.2.0 12033 Bytes 2/27/2009 15:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 10/27/2008 17:30:36
ANTIVIR1.VDF : 7.1.4.132 5707264 Bytes 6/24/2009 14:21:42
ANTIVIR2.VDF : 7.1.6.1 3857920 Bytes 9/16/2009 01:47:31
ANTIVIR3.VDF : 7.1.6.24 313344 Bytes 9/22/2009 01:47:33
Engineversion : 8.2.1.23
AEVDF.DLL : 8.1.1.2 106867 Bytes 9/23/2009 01:47:53
AESCRIPT.DLL : 8.1.2.33 479611 Bytes 9/23/2009 01:47:53
AESCN.DLL : 8.1.2.5 127346 Bytes 9/23/2009 01:47:51
AERDL.DLL : 8.1.2.4 430452 Bytes 7/23/2009 14:59:39
AEPACK.DLL : 8.2.0.0 422261 Bytes 9/23/2009 01:47:50
AEOFFICE.DLL : 8.1.0.38 196987 Bytes 7/23/2009 14:59:39
AEHEUR.DLL : 8.1.0.155 1921400 Bytes 9/23/2009 01:47:48
AEHELP.DLL : 8.1.7.0 237940 Bytes 9/23/2009 01:47:41
AEGEN.DLL : 8.1.1.63 364916 Bytes 9/23/2009 01:47:40
AEEMU.DLL : 8.1.0.9 393588 Bytes 10/9/2008 19:32:40
AECORE.DLL : 8.1.8.1 184693 Bytes 9/23/2009 01:47:39
AEBB.DLL : 8.1.0.3 53618 Bytes 10/9/2008 19:32:40
AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 13:47:59
AVPREF.DLL : 9.0.0.1 43777 Bytes 12/5/2008 15:32:15
AVREP.DLL : 8.0.0.3 155905 Bytes 1/20/2009 19:34:28
AVREG.DLL : 9.0.0.0 36609 Bytes 12/5/2008 15:32:09
AVARKT.DLL : 9.0.0.3 292609 Bytes 3/24/2009 20:05:41
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 1/30/2009 15:37:08
SQLITE3.DLL : 3.6.1.0 326401 Bytes 1/28/2009 20:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 2/2/2009 13:21:33
NETNT.DLL : 9.0.0.0 11521 Bytes 12/5/2008 15:32:10
RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 5/15/2009 20:39:58
RCTEXT.DLL : 9.0.37.0 86785 Bytes 4/17/2009 15:19:48

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:,
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium
Deviating risk categories...........: +APPL,+GAME,+JOKE,+PCK,+SPR,

Start of the scan: Tuesday, September 22, 2009 21:49

Starting search for hidden objects.
'67943' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'msiexec.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'fxssvc.exe' - '1' Module(s) have been scanned
Scan process 'BCMWLTRY.EXE' - '1' Module(s) have been scanned
Scan process 'WLTRYSVC.EXE' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'VentC.exe' - '1' Module(s) have been scanned
Scan process 'tcsd_win32.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'HPZIPM12.EXE' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'NicConfigSvc.exe' - '1' Module(s) have been scanned
Scan process 'sqlservr.exe' - '1' Module(s) have been scanned
Scan process 'MDM.EXE' - '1' Module(s) have been scanned
Scan process 'dlbtcoms.exe' - '1' Module(s) have been scanned
Scan process 'DataServer.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'scardsvr.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'lexbces.exE' - '1' Module(s) have been scanned
Scan process 'ccSvcHst.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
43 processes with 43 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!

Starting to scan executable files (registry).
c:\WINDOWS\system32\dibiyowa.dll
[DETECTION] Is the TR/Monder.bzea.74 Trojan

The registry was scanned ( '59' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\hiberfil.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:\pagefile.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:\Program Files\M1N1\mbam.exe
[WARNING] The file could not be opened!
C:\Program Files\M1N1\winlogon.exe
[WARNING] The file could not be opened!
C:\Qoobox\Quarantine\[4]-Submit_2009-09-17_21.15.35.zip
[0] Archive type: ZIP
--> jobobuwi.dll
[DETECTION] Is the TR/Vundo.gmm.1204 Trojan
--> jubawiro.dll
[DETECTION] Is the TR/Vundo.gmm.1208 Trojan
--> ropasaje.dll
[DETECTION] Is the TR/Vundo.gmm.1168 Trojan
--> tesifeke.dll
[DETECTION] Is the TR/Vundo.gmm.1469 Trojan
--> vugivodi.dll
[DETECTION] Is the TR/Vundo.gmm.1192 Trojan
--> yoyijite.dll
[DETECTION] Is the TR/Vundo.gmm.1065 Trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\fosowefe.dll.vir
[DETECTION] Is the TR/Vundo.38400BK Trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\gasfkyoirqnejx.dll.vir
[DETECTION] Is the TR/Alureon.19968U.10 Trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\gehufidu.dll.vir
[DETECTION] Is the TR/Vundo.38400BK.1 Trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\koyahune.exe.vir
[DETECTION] Is the TR/Dldr.FraudLo.amc Trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\lavogana.dll.vir
[DETECTION] Contains recognition pattern of the SPR/Tool.37888.2 program
C:\Qoobox\Quarantine\C\WINDOWS\system32\sohojire.dll.vir
[DETECTION] Contains recognition pattern of the RKIT/Agent.pri root kit
C:\Qoobox\Quarantine\C\WINDOWS\system32\wevetora.dll.vir
[DETECTION] Is the TR/Monderb.azpe Trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\yimipivu.dll.vir
[DETECTION] Contains recognition pattern of the SPR/Tool.38400.2 program
C:\Qoobox\Quarantine\C\WINDOWS\system32\yugovuji.dll.vir
[DETECTION] Is the TR/Vundo.gmm.1047 Trojan
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1\A0000028.dll
[DETECTION] Contains recognition pattern of the RKIT/Agent.pri root kit
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1\snapshot\MFEX-3.DAT
[DETECTION] Is the TR/Monder.bzea.74 Trojan
C:\WINDOWS\pchealth\helpctr\binaries\helpsvc.exe
[WARNING] The file could not be opened!
C:\WINDOWS\system32\dibiyowa.dll
[DETECTION] Is the TR/Monder.bzea.74 Trojan
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\01234567\firewall[1].dll
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\89ABCDEF\firewall[1].dll
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\GHIJKLMN\SetupAdvancedVirusRemover[1].exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\_OTM\MovedFiles\09012009_143758\WINDOWS\svchasts.exe
[DETECTION] Contains recognition pattern of the PHISH/Fraud.WinAntiVirus.IV phishing file/email
C:\_OTM\MovedFiles\09012009_143758\WINDOWS\system32\dddesot.dll
[DETECTION] Is the TR/FakeScanti.A.20 Trojan

Beginning disinfection:
c:\WINDOWS\system32\dibiyowa.dll
[DETECTION] Is the TR/Monder.bzea.74 Trojan
[WARNING] An error has occurred and the file was not deleted. ErrorID: 26003
[WARNING] The file could not be deleted!
[NOTE] Attempting to perform action using the ARK library.
[NOTE] The file was moved to '4b1c16c1.qua'!
C:\Qoobox\Quarantine\[4]-Submit_2009-09-17_21.15.35.zip
[NOTE] The file was moved to '4b17168f.qua'!
C:\Qoobox\Quarantine\C\WINDOWS\system32\fosowefe.dll.vir
[DETECTION] Is the TR/Vundo.38400BK Trojan
[NOTE] The file was moved to '4b2d16ca.qua'!
C:\Qoobox\Quarantine\C\WINDOWS\system32\gasfkyoirqnejx.dll.vir
[DETECTION] Is the TR/Alureon.19968U.10 Trojan
[NOTE] The file was moved to '4b2d16bd.qua'!
C:\Qoobox\Quarantine\C\WINDOWS\system32\gehufidu.dll.vir
[DETECTION] Is the TR/Vundo.38400BK.1 Trojan
[NOTE] The file was moved to '4b2216c1.qua'!
C:\Qoobox\Quarantine\C\WINDOWS\system32\koyahune.exe.vir
[DETECTION] Is the TR/Dldr.FraudLo.amc Trojan
[NOTE] The file was moved to '4b3316cb.qua'!
C:\Qoobox\Quarantine\C\WINDOWS\system32\lavogana.dll.vir
[DETECTION] Contains recognition pattern of the SPR/Tool.37888.2 program
[NOTE] The file was moved to '4b3016be.qua'!
C:\Qoobox\Quarantine\C\WINDOWS\system32\sohojire.dll.vir
[DETECTION] Contains recognition pattern of the RKIT/Agent.pri root kit
[NOTE] The file was moved to '4b2216cc.qua'!
C:\Qoobox\Quarantine\C\WINDOWS\system32\wevetora.dll.vir
[DETECTION] Is the TR/Monderb.azpe Trojan
[NOTE] The file was moved to '4b3016c2.qua'!
C:\Qoobox\Quarantine\C\WINDOWS\system32\yimipivu.dll.vir
[DETECTION] Contains recognition pattern of the SPR/Tool.38400.2 program
[NOTE] The file was moved to '4b2716c6.qua'!
C:\Qoobox\Quarantine\C\WINDOWS\system32\yugovuji.dll.vir
[DETECTION] Is the TR/Vundo.gmm.1047 Trojan
[NOTE] The file was moved to '4b2116d2.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1\A0000028.dll
[DETECTION] Contains recognition pattern of the RKIT/Agent.pri root kit
[NOTE] The file was moved to '4aea168d.qua'!
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1\snapshot\MFEX-3.DAT
[DETECTION] Is the TR/Monder.bzea.74 Trojan
[NOTE] The file was moved to '4aff16a4.qua'!
C:\WINDOWS\system32\dibiyowa.dll
[DETECTION] Is the TR/Monder.bzea.74 Trojan
[WARNING] An error has occurred and the file was not deleted. ErrorID: 26004
[WARNING] The source file could not be found.
[NOTE] Attempting to perform action using the ARK library.
[WARNING] Error in ARK library
[NOTE] The file is scheduled for deleting after reboot.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\01234567\firewall[1].dll
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '4b2c16f1.qua'!
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\89ABCDEF\firewall[1].dll
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '4d6065ea.qua'!
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\GHIJKLMN\SetupAdvancedVirusRemover[1].exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '4b2e16ed.qua'!
C:\_OTM\MovedFiles\09012009_143758\WINDOWS\svchasts.exe
[DETECTION] Contains recognition pattern of the PHISH/Fraud.WinAntiVirus.IV phishing file/email
[NOTE] The file was moved to '4b1d1700.qua'!
C:\_OTM\MovedFiles\09012009_143758\WINDOWS\system32\dddesot.dll
[DETECTION] Is the TR/FakeScanti.A.20 Trojan
[NOTE] The file was moved to '4b1e16f2.qua'!


End of the scan: Wednesday, September 23, 2009 08:37
Used time: 10:37:16 Hour(s)

The scan has been done completely.

11050 Scanned directories
422582 Files were scanned
24 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
18 Files were moved to quarantine
0 Files were renamed
5 Files cannot be scanned
422553 Files not concerned
6280 Archives were scanned
7 Warnings
21 Notes
67943 Objects were scanned with rootkit scan
0 Hidden objects were found

Hello.
Did you select everything Avira found for removal?

Completely Uninstall Norton software using:

• SymNRT.exe
  

Instructions

1. Please download and save SymNRT.exe to your desktop.
   
2. Close all programs and double click on the tool.
   
3. Follow the on-screen instructions.
   
4. Restart the computer if asked.
   
5. Then delete the SymNRT.exe tool from your desktop.
   
6. Open the Program Files folder on your local disk ( normally C: )
   
7. Find and delete the following folders (if present):
   
   
   
   • Norton AntiVirus
     
   • Norton Internet Security
     
   • Norton SystemWorks
     
   • Norton Personal Firewall
     

After that, re-run Combofix.

While running Avira,windows popped up on top of each other so fast!! and the default was (not delete) i may have clicked ok, maybe to quarintine or ignore (i forget what the default was) should I also re run Avira too? Im doing the norton now...what should i do after running combofix?

Launched SymNRT.exe on the machine...it told me the version was out of date.

Followed link (yes,online) to Norton site. Asked me to download two programs,one to remove temp files (this program froze several times).
the second was an updated SymNRT.exe. Running it now.

The only program i could find is called Norton Security Scan should i delete it?

Yes.
Please re-run Combofix after that.

Ok.
I have been getting a Rundll error when I turn my computer on:
"Error loading c:\windows\system32\dibiyowa.dll" should I click ok...?
also recieved popup to buy Avira and notification that the program was updated...? Just ignore?

Here's the cobofix report...


ComboFix 09-09-23.02 - Cubby 09/24/2009 17:28.5.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.567 [GMT -4:00]
Running from: c:\documents and settings\cubby.MACDONALDWOOD\Desktop\Combo-Fix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_DDNSFILTER


((((((((((((((((((((((((( Files Created from 2009-08-24 to 2009-09-24 )))))))))))))))))))))))))))))))
.

2009-09-23 01:45 . 2009-07-28 20:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-09-23 01:45 . 2009-03-30 14:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-09-23 01:45 . 2009-02-13 16:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-09-23 01:45 . 2009-02-13 16:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-09-23 01:45 . 2009-09-23 01:45 -------- d-----w- c:\program files\Avira
2009-09-23 01:45 . 2009-09-23 01:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-09-18 22:45 . 2004-08-04 10:00 55808 -c--a-w- c:\windows\system32\dllcache\eventlog.dll
2009-09-18 22:45 . 2004-08-04 10:00 55808 ------w- c:\windows\system32\eventlog.dll
2009-09-18 22:45 . 2004-08-04 10:00 4224 -c--a-w- c:\windows\system32\dllcache\beep.sys
2009-09-18 22:45 . 2004-08-04 10:00 4224 ------w- c:\windows\system32\drivers\beep.sys
2009-09-16 23:57 . 2009-06-21 21:44 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2009-09-16 17:14 . 2009-09-16 17:14 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-09-13 00:07 . 2009-09-10 18:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-13 00:07 . 2009-09-16 17:07 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-13 00:07 . 2009-09-10 18:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-01 18:37 . 2009-09-01 18:37 -------- d-----w- C:\_OTM
2009-09-01 15:53 . 2009-09-01 18:48 -------- d-----w- c:\program files\M1N1
2009-09-01 14:35 . 2009-09-01 14:35 -------- d-----w- c:\documents and settings\cubby.MACDONALDWOOD\Application Data\Malwarebytes
2009-09-01 14:35 . 2009-09-01 14:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-01 10:10 . 2009-09-01 10:10 -------- d-sh--w- c:\documents and settings\Cubby\PrivacIE
2009-09-01 10:01 . 2009-09-01 10:01 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-09-01 10:00 . 2009-09-01 10:00 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
2009-08-31 20:54 . 2009-08-31 20:54 -------- d-sh--w- c:\documents and settings\Cubby\IETldCache
2009-08-31 20:28 . 2009-08-31 20:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-26 11:20 . 2009-08-26 11:20 -------- d-----w- c:\program files\Media5 Software
2009-08-26 11:17 . 2002-12-03 07:11 143872 ----a-w- c:\windows\system32\NCTWMAFile.dll
2009-08-26 11:17 . 2002-12-03 07:07 168448 ----a-w- c:\windows\system32\NCTAudioPlayer.dll
2009-08-26 11:17 . 2002-12-03 07:02 491520 ----a-w- c:\windows\system32\NCTAudioFile.dll
2009-08-26 11:13 . 2009-08-26 11:13 -------- d-----w- c:\program files\WMA WAV MP3 to Audio CD Maker

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-24 00:28 . 2007-09-13 16:05 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-09-24 00:17 . 2007-09-13 16:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-09-23 11:47 . 2006-08-22 06:06 35001 ----a-w- c:\windows\system32\nvModes.dat
2009-09-18 01:23 . 2009-03-28 23:35 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-17 01:25 . 2007-04-13 00:07 -------- d-----w- c:\program files\dl_Cats
2009-09-01 10:13 . 2006-08-22 06:33 -------- d-----w- c:\program files\Google
2009-09-01 00:58 . 2006-12-28 01:31 -------- d-----w- c:\documents and settings\cubby.MACDONALDWOOD\Application Data\Azureus
2009-08-31 20:04 . 2007-11-15 02:48 -------- d-----w- c:\documents and settings\cubby.MACDONALDWOOD\Application Data\Wave Systems Corp
2009-08-25 15:19 . 2009-08-21 00:40 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-25 01:46 . 2008-01-08 19:03 -------- d-----w- c:\program files\MediaCoder
2009-08-25 01:27 . 2009-08-25 01:27 -------- d-----w- c:\documents and settings\cubby.MACDONALDWOOD\Application Data\AVS4YOU
2009-08-25 01:27 . 2009-08-25 01:27 -------- d-----w- c:\documents and settings\All Users\Application Data\AVS4YOU
2009-08-25 01:27 . 2009-08-25 01:26 -------- d-----w- c:\program files\AVS4YOU
2009-08-25 01:27 . 2009-08-25 01:26 -------- d-----w- c:\program files\Common Files\AVSMedia
2009-08-24 23:56 . 2009-08-24 23:56 -------- d-----w- c:\documents and settings\cubby.MACDONALDWOOD\Application Data\iMeshMediabarTb
2009-08-24 23:56 . 2009-08-24 23:56 -------- d-----w- c:\program files\iMeshMediabarTb
2009-08-24 23:56 . 2009-08-24 23:56 -------- d-----w- c:\program files\iMesh Applications
2009-08-24 18:58 . 2009-08-24 18:58 -------- d-----w- c:\documents and settings\All Users\Application Data\2BAB
2009-08-22 14:03 . 2009-08-22 13:55 -------- d-----w- c:\documents and settings\cubby.MACDONALDWOOD\Application Data\CVS
2009-08-22 13:39 . 2009-08-22 13:39 -------- d-----w- c:\program files\Microsoft Office Outlook Connector
2009-08-22 13:38 . 2007-10-17 16:18 -------- d-----w- c:\program files\MSECache
2009-08-21 00:39 . 2009-08-21 00:39 -------- d-----w- c:\program files\LitexMedia
2009-08-07 13:39 . 2006-09-13 17:27 93472 ----a-w- c:\documents and settings\cubby.MACDONALDWOOD\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-06 07:07 . 2009-08-06 07:07 -------- d-----w- c:\program files\MSBuild
2009-08-06 07:07 . 2009-08-06 07:07 -------- d-----w- c:\program files\Reference Assemblies
2009-08-05 09:01 . 2004-08-04 10:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-31 19:27 . 2006-09-13 15:35 -------- d-----w- c:\documents and settings\cubby.MACDONALDWOOD\Application Data\AdobeUM
2009-07-17 19:01 . 2004-08-04 10:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 03:43 . 2004-08-04 10:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2006-03-04 03:33 915456 ------w- c:\windows\system32\wininet.dll
2006-12-17 21:20 . 2006-12-17 21:20 36206039 -c--a-w- c:\program files\Top Producer Outlook Connector.EXE
2006-12-13 03:12 . 2007-02-08 21:35 66648 -c--a-w- c:\program files\mozilla firefox\components\jar50.dll
2006-12-13 03:12 . 2007-02-08 21:35 54352 -c--a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2006-12-13 03:12 . 2007-02-08 21:35 34928 -c--a-w- c:\program files\mozilla firefox\components\myspell.dll
2006-12-13 03:12 . 2007-02-08 21:35 46696 -c--a-w- c:\program files\mozilla firefox\components\spellchk.dll
2006-12-13 03:12 . 2007-02-08 21:35 172120 -c--a-w- c:\program files\mozilla firefox\components\xpinstal.dll
2007-03-15 21:30 . 2007-03-15 21:30 80 -csha-r- c:\windows\system32\67F454E4E8.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-09-17_00.01.40 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-24 21:37 . 2009-09-24 21:37 16384 c:\windows\Temp\Perflib_Perfdata_4f0.dat
+ 2009-09-23 01:45 . 2009-05-11 14:12 28520 c:\windows\system32\drivers\ssmdrv.sys
- 2006-09-13 16:48 . 2009-08-27 12:57 23040 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2006-09-13 16:48 . 2009-09-18 01:07 23040 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2006-09-13 16:48 . 2009-08-27 12:57 61440 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\pubs.exe
+ 2006-09-13 16:48 . 2009-09-18 01:07 61440 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2006-09-13 16:48 . 2009-08-27 12:57 27136 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2006-09-13 16:48 . 2009-09-18 01:07 27136 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2006-09-13 16:48 . 2009-08-27 12:57 11264 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2006-09-13 16:48 . 2009-09-18 01:07 11264 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2006-09-13 16:48 . 2009-08-27 12:57 12288 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2006-09-13 16:48 . 2009-09-18 01:07 12288 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2006-09-13 16:48 . 2009-08-27 12:57 4096 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2006-09-13 16:48 . 2009-09-18 01:07 4096 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2004-08-04 10:00 . 2009-03-08 08:33 726528 c:\windows\system32\jscript.dll
+ 2004-08-04 10:00 . 2009-06-22 06:44 726528 c:\windows\system32\jscript.dll
+ 2008-05-09 10:53 . 2009-06-22 06:44 726528 c:\windows\system32\dllcache\jscript.dll
- 2008-05-09 10:53 . 2009-03-08 08:33 726528 c:\windows\system32\dllcache\jscript.dll
+ 2006-09-13 16:48 . 2009-09-18 01:07 409600 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2006-09-13 16:48 . 2009-08-27 12:57 409600 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2006-09-13 16:48 . 2009-09-18 01:07 286720 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2006-09-13 16:48 . 2009-08-27 12:57 286720 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2006-09-13 16:48 . 2009-09-18 01:07 249856 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2006-09-13 16:48 . 2009-08-27 12:57 249856 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2006-09-13 16:48 . 2009-09-18 01:07 794624 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2006-09-13 16:48 . 2009-08-27 12:57 794624 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2006-09-13 16:48 . 2009-08-27 12:57 135168 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2006-09-13 16:48 . 2009-09-18 01:07 135168 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2009-09-18 01:05 . 2008-07-08 13:02 382840 c:\windows\ie8updates\KB971961-IE8\spuninst\updspapi.dll
+ 2009-09-18 01:05 . 2008-07-08 13:02 231288 c:\windows\ie8updates\KB971961-IE8\spuninst\spuninst.exe
+ 2009-09-18 01:05 . 2009-03-08 08:33 726528 c:\windows\ie8updates\KB971961-IE8\jscript.dll
+ 2004-08-04 10:00 . 2009-05-20 08:56 2458112 c:\windows\system32\WMVCore.dll
- 2004-08-04 10:00 . 2008-06-18 10:03 2458112 c:\windows\system32\WMVCore.dll
- 2004-08-04 10:00 . 2008-06-18 10:03 2458112 c:\windows\system32\dllcache\WMVCore.dll
+ 2004-08-04 10:00 . 2009-05-20 08:56 2458112 c:\windows\system32\dllcache\WMVCore.dll
+ 2009-08-25 18:57 . 2009-08-25 18:57 5518336 c:\windows\Installer\567e188.msp
+ 2009-09-18 01:07 . 2009-08-28 18:38 24689600 c:\windows\system32\MRT.exe
+ 2009-09-18 01:06 . 2009-09-18 01:06 15709696 c:\windows\Installer\567e176.msp
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F}"= "c:\program files\iMeshMediabarTb\iMeshMediaBarDx.dll" [2009-07-31 91568]

[HKEY_CLASSES_ROOT\clsid\{abb49b3b-ab7d-4ed0-9135-93fd5aa4f69f}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-07-14 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-24 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DLBTCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll" [2007-02-12 73728]
"domezudim"="c:\windows\system32\dibiyowa.dll" [BU]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

c:\documents and settings\Cubby\Start Menu\Programs\Startup\
VZAccess Manager.lnk - c:\program files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe [2007-5-17 1220608]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{a292acc6-cf08-4d50-83ab-cb5c6eef5773}"= "c:\windows\system32\dibiyowa.dll" [BU]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-04-24 282624]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"sagujesur"= {a292acc6-cf08-4d50-83ab-cb5c6eef5773} - c:\windows\system32\dibiyowa.dll [BU]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 wvauth nwprovau

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
backup=c:\windows\pss\Acrobat Assistant.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
backup=c:\windows\pss\Adobe Gamma Loader.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^EMBASSY Trust Suite Secure Update.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\EMBASSY Trust Suite Secure Update.lnk
backup=c:\windows\pss\EMBASSY Trust Suite Secure Update.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Service Manager.lnk
backup=c:\windows\pss\Service Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^cubby.MACDONALDWOOD^Start Menu^Programs^Startup^Anapod Manager.lnk]
path=c:\documents and settings\cubby.MACDONALDWOOD\Start Menu\Programs\Startup\Anapod Manager.lnk
backup=c:\windows\pss\Anapod Manager.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^cubby.MACDONALDWOOD^Start Menu^Programs^Startup^RCA Detective.lnk]
path=c:\documents and settings\cubby.MACDONALDWOOD\Start Menu\Programs\Startup\RCA Detective.lnk
backup=c:\windows\pss\RCA Detective.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\WINDOWS\\system32\\dlbtcoms.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\dlbtpswx.exe"=
"c:\\Program Files\\Red Chair Software\\Anapod Explorer\\anamgr.exe"=
"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\PMSRegisterFile.exe"=
"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\umi.exe"=
"c:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\VideoSpin.exe"=
"c:\\WebC_ActiveX4.22\\ptermX.exe"=
"c:\\Program Files\\Ericom Software\\PowerTerm WebConnect 5.6\\151.203.99.51\\ptermX.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\iMesh Applications\\iMesh\\iMesh.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [9/22/2009 9:45 PM 108289]
R2 WILPAR;Wordcraft Parallel Driver;c:\windows\system32\drivers\WILPAR.SYS [9/1/2006 11:40 AM 22976]
S3 cur_bus;Curitel USB Composite Device driver (WDM);c:\windows\system32\drivers\cur_bus.sys [9/5/2006 10:41 AM 50176]
S3 cur_mdfl;Curitel Packet Service Filter;c:\windows\system32\drivers\cur_mdfl.sys [9/5/2006 10:41 AM 6096]
S3 cur_mdm;Curitel Packet Service Drivers;c:\windows\system32\drivers\cur_mdm.sys [9/5/2006 10:41 AM 81056]
S3 pwi_bus;Curitel PC Card Composite Device driver (WDM);c:\windows\system32\drivers\pwi_bus.sys [5/17/2007 2:28 PM 55344]
S3 pwi_mdfl;Curitel PC Card Filter;c:\windows\system32\drivers\pwi_mdfl.sys [5/17/2007 2:28 PM 9200]
S3 pwi_mdm;Curitel PC Card Drivers;c:\windows\system32\drivers\pwi_mdm.sys [5/17/2007 2:28 PM 89936]
S3 pwi_oflt;Curitel PC Card OHCI Filter;c:\windows\system32\drivers\pwi_oflt.sys [5/17/2007 2:28 PM 9472]
S3 pwi_serd;Curitel PC Card Diagnostic Serial Port (WDM);c:\windows\system32\drivers\pwi_serd.sys [5/17/2007 2:28 PM 69632]
S3 SMC2208;SMC Compact USB to Ethernet converter;c:\windows\system32\drivers\SMC2208.SYS [2/16/2008 12:40 PM 26525]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-08-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34]

2009-09-24 c:\windows\Tasks\User_Feed_Synchronization-{522C9FDF-90D3-4175-A7FB-7B976A9CAC8A}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 08:31]

2009-09-24 c:\windows\Tasks\{CB904F16-01AA-4E35-81DF-0F9BCF531682}_MACDONALDWOOD_Cubby.job
- c:\windows\system32\mobsync.exe [2004-08-04 00:12]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
IE: &ieSpell Options - c:\program files\ieSpell\iespell.dll/SPELLOPTION.HTM
IE: Check &Spelling - c:\program files\ieSpell\iespell.dll/SPELLCHECK.HTM
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Lookup on Merriam Webster - file://c:\program files\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\ieSpell\wikipedia.HTM
LSP: vlsp.dll
Trusted Zone: stumbleupon.com
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: PUFLITE - hxxp://cubbyfitts.point2agent.com/Office/ColpaControls/Photo/Control/PUFLITE.CAB
DPF: {42D06124-98A2-47EC-8098-3778B58CE7D5} - hxxps://actsvr.comcastonline.com/techtools/dl/Comcast%20Activation%20Controls.cab
DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} - hxxp://www.facebook.com/controls/contactx.dll
DPF: {7EC816D4-6FC3-4C58-A7DA-A770EE461602} - hxxp://151.203.99.51/Ericom/WebConnect%205.6/web/windows/ptdownloader.cab
FF - ProfilePath - c:\documents and settings\cubby.MACDONALDWOOD\Application Data\Mozilla\Firefox\Profiles\xf0e1ri2.default\
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

AddRemove-NSS - c:\program files\NortonInstaller\{397E31AA-0D78-4649-A01C-339D73A2ED35}\NSS\LicenseType\2.3.0.44\InstStub.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-24 18:04
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLBTCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,97,65,98,77,df,
c4,d9,d5,e2,63,26,f1,3f,c8,ff,68,26,da,4a,51,2c,18,5c,9b,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:46,47,15,b0,92,4b,c7,ef,c0,d8,10,c6,fc,
d8,85,02,6a,9c,d6,61,af,45,84,18,63,98,aa,41,9d,27,22,f8,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,77,6b,0f,1c,e2,
18,6e,17,ff,7c,85,e0,43,d4,0e,fe,42,e8,9f,e8,ec,72,c5,99,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,93,ca,7f,74,98,
a9,19,16,86,8c,21,01,be,91,eb,e7,18,97,a8,58,fe,a9,4e,79,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,3c,0e,eb,90,42,
fa,06,cb,f5,1d,4d,73,a8,13,5c,05,6b,83,dc,d8,36,37,17,f7,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,50,cf,42,b4,96,
4a,7b,52,df,20,58,62,78,6b,cf,c8,df,e7,7e,bd,d5,e9,01,09,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,cb,53,db,0d,94,
5e,6e,68,fb,a7,78,e6,12,2f,9a,ea,6f,2a,ed,60,b2,d1,47,83,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,ff,57,35,74,eb,
c0,05,20,01,3a,48,fc,e8,04,4a,f1,f1,75,68,bb,bf,e2,2e,a4,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,a9,be,9e,98,8b,
17,38,7b,f6,0f,4e,58,98,5b,89,c9,42,b2,98,75,e4,2f,3b,36,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,c2,82,54,f6,10,
e3,07,8e,3d,ce,ea,26,2d,45,aa,78,ee,29,88,ea,c4,c6,75,12,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,2d,db,c2,de,4b,
e1,3d,b4,2a,b7,cc,b5,b9,7f,41,e7,68,33,58,56,d5,cb,db,4d,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,62,be,74,45,21,
51,65,c7,6c,43,2d,1e,aa,22,2f,9c,08,b7,02,b6,70,38,f2,30,6c,43,2d,1e,aa,22,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(764)
c:\windows\system32\wvauth.dll
c:\windows\system32\biolsp.dll
c:\windows\system32\vlsp.dll

- - - - - - - > 'explorer.exe'(3104)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\vlsp.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\lexbces.exE
c:\windows\system32\scardsvr.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Wave Systems Corp\common\DataServer.exe
c:\windows\system32\dlbtcoms.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
c:\program files\Dell\QuickSet\NicConfigSvc.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\spool\drivers\w32x86\3\HPZIPM12.EXE
c:\program files\Verizon Wireless\venturi\Client\VentC.exe
c:\windows\system32\BCMWLTRY.EXE
c:\windows\system32\fxssvc.exe
.
**************************************************************************
.
Completion time: 2009-09-24 18:08 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-24 22:08
ComboFix2.txt 2009-09-18 22:52
ComboFix3.txt 2009-09-18 12:38
ComboFix4.txt 2009-09-18 01:29
ComboFix5.txt 2009-09-24 21:27

Pre-Run: 36,201,574,400 bytes free
Post-Run: 36,150,185,984 bytes free

393 --- E O F --- 2009-09-18 01:09

Hello.
Two more things to do, I think these are having an effect on this infection.

• Open HijackThis.
  
• When Hijack This opens, click "Open the Misc Tools section"
  
• Then select "Open Uninstall Manager"
  
• Click on "Save List..." (generates uninstall_list.txt)
  
• Click Save, copy and paste the results in your next post.
  

I assume i should run the same version you gave me on page 1? (downloads as "winlogon.scr")

7-Zip 4.57
Adobe Acrobat - Reader 6.0.2 Update
Adobe Acrobat 6.0.1 Professional
Adobe Flash Player 10 ActiveX
Adobe Reader 6.0.1
Adobe Shockwave Player 11.5
Advanced WMA MP3 Converter version 1.2
All To MP3 Converter 2.65
ALPS Touch Pad Driver
Amara - Flash Photo Animation Software
Anapod CopyGear (remove only)
Anapod Explorer (remove only)
Apple Mobile Device Support
Apple Software Update
Ask Toolbar
AudioConverter Studio 5.9
Audiovox USB Drivers
AusLogics System Information
AVI to iPod Converter 1.00
Avira AntiVir Personal - Free Antivirus
AVS Update Manager 1.0
AVS Video Converter 6
AVS4YOU Software Navigator 1.3
Azureus Vuze
BitPim 1.0.1
Bonjour
Broadcom Advanced Control Suite
Broadcom TPM Driver Installer
Conexant HDA D110 MDC V.92 Modem
Critical Update for Windows Media Player 11 (KB959772)
Curitel PC Card Software
Dell Embassy Trust Suite by Wave Systems
Dell Laser Printer 1110 Software Uninstall
Dell Wireless WLAN Card
Digital Line Detect
DivX Codec
DivX Content Uploader
DivX Converter
DivX Player
DivX Web Player
Document Manager Lite
EMBASSY Security Center
EMBASSY Trust Suite by Wave Systems
eMusic - 50 Free MP3 offer
ETS Launch Pad
FairStars Audio Converter 1.79
FLV Player 2.0, build 23
FormViewer
Free Video to Mp3 Converter version 3.1
FurthurNET 1.7.5
GearDrvs
Google Desktop
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
HijackThis 2.0.2
Hotfix 2055 for SQL Server 2000 ENU (KB960082)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
ieSpell
iMesh
iTunes
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java(TM) 6 Update 2
Java(TM) SE Runtime Environment 6 Update 1
Lernout & Hauspie TruVoice American English TTS Engine
Lexmark Printer Software Uninstall
LG USB Modem driver
Lightning 2000i
Lightning CMA Plus
Malwarebytes' Anti-Malware
MediaBar
MediaCoder 0.6.1
Memorex exPressit Label Design Studio
MetaFrame Presentation Server Client
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft ActiveSync
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft National Language Support Downlevel APIs
Microsoft Office Outlook 2003 with Business Contact Manager Update
Microsoft Office Outlook Connector
Microsoft Office Small Business Edition 2003
Microsoft Silverlight
Microsoft SQL Server Desktop Engine (MICROSOFTSMLBIZ)
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual Studio 2005 Tools for Office Runtime
Microsoft Visual Studio 2005 Tools for Office Runtime
mkw Audio Compression Toolkit
Modem Helper
Mozilla Firefox (2.0.0.1)
MSN
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 6.0 Parser (KB933579)
NetWaiting
NTRU Hybrid TSS v2.0.7
NVIDIA Drivers
OpD2d
Ovis pdf-Recover Professional 4.0
PerSonoCall
Pinnacle VideoSpin
PowerDVD 5.7
Preboot Manager
Private Information Manager
QuickLink Mobile Phonebook
QuickSet
QuickTime
RealPlayer
Rhapsody Player Engine
Roxio DLA
Roxio Express Labeler
Roxio RecordNow Audio
Roxio RecordNow Copy
Roxio RecordNow Data
Search Assist
Secure Update
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Media Encoder (KB954156)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Wizards
Skylook
Skype 2.5
Sonic Update Manager
TOP PRODUCER 7i Data Transfer Wizard
Top Producer Outlook Connector
TOSHIBA e-STUDIO230-280 Series Client
Uninstall 1.0.0.1
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973815)
URGE
URL Assistant
Venturi Client 3.1.4
Video to Audio Converter 1.12
Virtual Earth 3D (Beta)
VZAccess Manager
Wave Infrastructure Installer
Wave Support Software
WebEx
Winamp
Windows Imaging Component
Windows Internet Explorer 8
Windows Media Encoder 9 Series
Windows Media Encoder 9 Series
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Service Pack 3
WMA WAV MP3 to Audio CD Maker 1.0.2
Xilisoft 3GP Video Converter
Xvid Codec 1.1.3
Yahoo! SiteBuilder

I see that you are running Azureus.
P2P(Peer to peer) applications are designed to help you easily share and distribute files between you and a group of people. But they can also be used to distribute malware, and thus are not considered safe.
The removal of these programs is optional, but highly recommended.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

Ask Toolbar
Azureus Vuze
BitPim 1.0.1
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java(TM) 6 Update 2
Java(TM) SE Runtime Environment 6 Update 1
MediaBar

Next, please update Firefox.

Please download Firefox 3.5.2 and install it. It will install over version 2.0 you currently have installed, so you won't lose any bookmarked websites.

Ok...Done.

Now post one final Hijack This log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:04:28 PM, on 9/25/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Wave Systems Corp\Common\DataServer.exe
C:\WINDOWS\system32\dlbtcoms.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
c:\program files\verizon wireless\venturi\Client\ventc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\cubby.MACDONALDWOOD\Desktop\winlogon.scr

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [DLBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [domezudim] Rundll32.exe "c:\windows\system32\dibiyowa.dll",a
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (file missing)
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: *.stumbleupon.com
O16 - DPF: PUFLITE - http://cubbyfitts.point2agent.com/Office/ColpaControls/Photo/Control/PUFLITE.CAB
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} (Microsoft VM) - https://www.topproduceronline.com/downloads/msjavx86.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - https://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {42D06124-98A2-47EC-8098-3778B58CE7D5} (SupportSoft External Control) - https://actsvr.comcastonline.com/techtools/dl/Comcast%20Activation%20Controls.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1158085892421
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} (ContactExtractor Class) - https://www.facebook.com/controls/contactx.dll
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.kw.com/websiteTemplateAdmin/include/imageUploader/ImageUploader4.cab
O16 - DPF: {7EC816D4-6FC3-4C58-A7DA-A770EE461602} (PowerTerm Downloader Class) - http://151.203.99.51/Ericom/WebConnect%205.6/web/windows/ptdownloader.cab
O16 - DPF: {8569D715-FF88-44BA-8D1D-AD3E59543DDE} (ActiveReports Viewer2) - https://www.topproduceronline.com/Downloads/arview2.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O16 - DPF: {DC765522-D5BE-49C9-AF5F-8C715A44BA28} (MS Investor Ticker) - http://fdl.msn.com/public/investor/v9/ticker.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://sothebysrealty.webex.com/client/T25L/training/ieatgpc.cab
O16 - DPF: {F7A05BAC-9778-410A-9CDE-BFBD4D5D2B7F} (iPIX Media Send Class) - http://216.249.24.62/code/iPIX-ImageWell-ipix.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = MACDONALDWOOD.INT
O17 - HKLM\Software\..\Telephony: DomainName = MACDONALDWOOD.INT
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = MACDONALDWOOD.INT
O21 - SSODL: sagujesur - {a292acc6-cf08-4d50-83ab-cb5c6eef5773} - c:\windows\system32\dibiyowa.dll (file missing)
O22 - SharedTaskScheduler: tokatiluy - {a292acc6-cf08-4d50-83ab-cb5c6eef5773} - c:\windows\system32\dibiyowa.dll (file missing)
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Common\DataServer.exe
O23 - Service: dlbt_device - - C:\WINDOWS\system32\dlbtcoms.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZipm12.exe
O23 - Service: NTRU Hybrid TSS v2.0.7 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe
O23 - Service: Venturi Client (Venturi2) - Venturi Wireless - c:\program files\verizon wireless\venturi\Client\ventc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O24 - Desktop Component 1: Microsoft Investor Active Desktop Ticker - http://www.microsoft.com/windows/ie/gallery/components/ticker.htm

--
End of file - 10326 bytes

Hello.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O4 - HKLM\..\Run: [domezudim] Rundll32.exe "c:\windows\system32\dibiyowa.dll",a
  O21 - SSODL: sagujesur - {a292acc6-cf08-4d50-83ab-cb5c6eef5773} - c:\windows\system32\dibiyowa.dll (file missing)
  O22 - SharedTaskScheduler: tokatiluy - {a292acc6-cf08-4d50-83ab-cb5c6eef5773} - c:\windows\system32\dibiyowa.dll (file missing)
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

This should be fine now.

How is the machine running?

Hi again.
I am afraid the police pro is back with a vengence...blocked any program that I try to launch. I rebooted and now i can get to the desk top but no icons show up, just desktop background ...i tried recovery console but it just brings me to a black screen w/ a "prompt". Totally screwed.

I thank you again for your invaluable help so far...but it seems I am back at square1...
Cub

Hi again.
I am afraid the police pro is back with a vengence...blocked any program that I try to launch. I rebooted and now i can get to the desk top but no icons show up, just desktop background ...i tried recovery console but it just brings me to a black screen w/ a "prompt". Totally screwed.

I thank you again for your invaluable help so far...but it seems I am back at square1...
Cub

Please delete any copies of ComboFix.

Please download ComboFix from BleepingComputer.com

Rename ComboFix.exe to commy.exe before you save it to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools A guide to do this can be found here
  
• Click Start>Run then copy paste the following command into the Run box & click OK "%userprofile%\desktop\commy.exe" /stepdel
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console

Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

• Click on Yes, to continue scanning for malware.
  
• When finished, it shall produce a log for you. Please include the contents of C:\ComboFix.txt in your next reply.
  

I would also like to see a list of installed programs, so please do this:
Click Start > Run then copy/paste the following single-line command into the Run box and click OK:

C:\Qoobox\Add-Remove Programs.txt

In your next reply, please include the ComboFix log and the Add-Remove Programs log.

i can get to the desk top but no icons show up, just desktop background

OK I finallygot thru to the system, but can not run programs...i.e. commy..instead i get a warning "application can not be executed the file pev.exe is infected. Do you want to want to activate your antivirus software now?" same thing on the run command ... I can not access this site from my browser/machine so I used a CD...tons of popup windows from "Antivirus System Pro".
Thanks for your help.

Your computer is infected with a dangerous infection:
http://www.helpmyos.com/malware-threat-removal-f6/virut-information-t879.htm

We have hit a dead end. Please tell me when you have completed a reformat and reinstall.

I am sorry for the bad news. I do not understand why these mean people make such harsh viruses, and I wish there was a way to clean your system without everything being damaged. But, the problem is, cleaning the system, most files will be damaged. It is like trying to clean up a city that just had a tornado or hurricane run through it. Takes rebuilding, and time to set back up.

In this thread
is an example of a fix that worked around a virut and allowed programs to run...could go back and re do what was recomended by your collegue?

Hello.
I don't think this is Virut.
Are you able to run Hijack This normally.

Hey!
Hijack started to run (i.e. find files) but then closed. Now it wont even open (from desktop). "Windows cannot access the specified ....may not have permission..."
I tried from a cd...same, except i can get to the welcome screen...once i run system scan and logfile, the virus shuts it down agives me a security warning : "Application can not be executed: The file wwwin.exe is infected. Do you want to activate your antivirus now?"

I made a mistake...the security warning is "dwwin.exe is infected" not wwwin.exe

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
  
• Copy the content of the following codebox into the main textfield:
  

  Code:

  
:filefind
scecli.dll
netlogon.dll
eventlog.dll
cngaudit.dll

  
  
  
• Click the Look button to start the scan.
  
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
  

Note: The log can also be found on your Desktop entitled SystemLook.txt

SystemLook v1.0 by jpshortstuff (29.08.09)
Log created at 11:58 on 27/10/2009 by Cubby (Administrator - Elevation successful)

========== filefind ==========

Searching for "scecli.dll"
C:\i386\scecli.dll --a--c 180224 bytes [12:02 30/08/2006] [10:00 04/08/2004] 0F78E27F563F2AAF74B91A49E2ABF19A
C:\WINDOWS\$NtServicePackUninstall$\scecli.dll -----c 180224 bytes [14:00 29/08/2008] [10:00 04/08/2004] 0F78E27F563F2AAF74B91A49E2ABF19A
C:\WINDOWS\ERDNT\cache\scecli.dll --a--- 181248 bytes [00:04 17/09/2009] [00:12 14/04/2008] A86BB5E61BF3E39B62AB4C7E7085A084
C:\WINDOWS\ServicePackFiles\i386\scecli.dll -----c 181248 bytes [10:55 28/08/2008] [00:12 14/04/2008] A86BB5E61BF3E39B62AB4C7E7085A084
C:\WINDOWS\system32\scecli.dll ------ 181248 bytes [10:00 04/08/2004] [00:12 14/04/2008] A86BB5E61BF3E39B62AB4C7E7085A084

Searching for "netlogon.dll"
C:\i386\netlogon.dll --a--c 407040 bytes [11:59 30/08/2006] [10:00 04/08/2004] 96353FCECBA774BB8DA74A1C6507015A
C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll -----c 407040 bytes [14:01 29/08/2008] [10:00 04/08/2004] 96353FCECBA774BB8DA74A1C6507015A
C:\WINDOWS\ERDNT\cache\netlogon.dll --a--- 407040 bytes [00:04 17/09/2009] [00:12 14/04/2008] 1B7F071C51B77C272875C3A23E1E4550
C:\WINDOWS\ServicePackFiles\i386\netlogon.dll -----c 407040 bytes [10:54 28/08/2008] [00:12 14/04/2008] 1B7F071C51B77C272875C3A23E1E4550
C:\WINDOWS\system32\netlogon.dll ------ 407040 bytes [10:00 04/08/2004] [00:12 14/04/2008] 1B7F071C51B77C272875C3A23E1E4550

Searching for "eventlog.dll"
C:\i386\eventlog.dll -----c 55808 bytes [11:58 30/08/2006] [10:00 04/08/2004] 82B24CB70E5944E6E34662205A2A5B78
C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll -----c 55808 bytes [14:01 29/08/2008] [10:00 04/08/2004] 82B24CB70E5944E6E34662205A2A5B78
C:\WINDOWS\ERDNT\cache\eventlog.dll --a--- 55808 bytes [22:50 18/09/2009] [10:00 04/08/2004] 82B24CB70E5944E6E34662205A2A5B78
C:\WINDOWS\ServicePackFiles\i386\eventlog.dll -----c 56320 bytes [10:52 28/08/2008] [00:11 14/04/2008] 6D4FEB43EE538FC5428CC7F0565AA656
C:\WINDOWS\system32\dllcache\eventlog.dll --a--c 55808 bytes [22:45 18/09/2009] [10:00 04/08/2004] 82B24CB70E5944E6E34662205A2A5B78
C:\WINDOWS\system32\eventlog.dll --a--- 61952 bytes [22:45 18/09/2009] [10:00 04/08/2004] (Unable to calculate MD5)

Searching for "cngaudit.dll"
No files found.

-=End Of File=-

1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE

• Click on Avenger.zip to open the file
  
• Extract avenger.exe to your desktop
  

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to delete:
C:\WINDOWS\system32\eventlog.dll

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

4. Please copy/paste the content of c:\avenger.txt into your reply.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\system32\eventlog.dll" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Malwarebytes would not load/update at first...Error code: 732(0,0)
...but then ran ok:

Malwarebytes' Anti-Malware 1.41
Database version: 2775
Windows 5.1.2600 Service Pack 3

10/28/2009 8:16:29 AM
mbam-log-2009-10-28 (08-16-29).txt

Scan type: Quick Scan
Objects scanned: 132449
Time elapsed: 12 minute(s), 23 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 5
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 18

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{a2234b15-23f2-42ad-f4e4-00aac39c0004} (Trojan.Zlob.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\{79007602-0cdb-4405-9dbf-1257bb3226ee} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f5f14e7a-f59d-45a0-bdc5-a9f5454f0bcf} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f5f14e7a-f59d-45a0-bdc5-a9f5454f0bcf} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\AvScan (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{a2234b15-23f2-42ad-f4e4-00aac39c0004} (Trojan.Zlob.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\idstrf (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\WINID (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System Tool (Fake.SystemTool) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System Tool (Fake.SystemTool) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\as9u7u.dll (Trojan.Zlob.H) -> Delete on reboot.
C:\WINDOWS\system32\iehelper.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Desktop\nudetube.com.lnk (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Desktop\pornotube.com.lnk (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Desktop\youporn.com.lnk (Rogue.Link) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\~.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\cubby.MACDONALDWOOD\Local Settings\temp\csrss.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\cubby.MACDONALDWOOD\Local Settings\temp\lsass.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\cubby.MACDONALDWOOD\Local Settings\temp\nsrbgxod.bak (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\cubby.MACDONALDWOOD\Local Settings\temp\services.exe (Password.Stealer) -> Quarantined and deleted successfully.
C:\Documents and Settings\cubby.MACDONALDWOOD\Local Settings\temp\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\cubby.MACDONALDWOOD\Local Settings\temp\taskmgr.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\cubby.MACDONALDWOOD\Local Settings\temp\win32.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\cubby.MACDONALDWOOD\Local Settings\temp\winlogon.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\syssvc.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\win32k.sys (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Program Files\qywgjx\wrxysysguard.exe (Fake.SystemTool) -> Quarantined and deleted successfully.
C:\Documents and Settings\cubby.MACDONALDWOOD\Desktop\winlogon.scr (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

Hello.

• Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
  Link 1
  Link 2
  
• Double click DDS.scr to run.
  
• When complete, two logs will open. Save both of the report to your Desktop.
  
• Copy and paste BOTH LOGS back here, use more than one post if needed.
  

I just noticed that the Malware program did not finish before I copied the log file (i.e.some fileswere not removed)...it did need to reboot (should I repost the logfile?)

Just a note, I get a rundll32.exe - Bad Image error when the machine starts...The application or DLL c:\DOCUME~1\NETWOR~1\ntuser.dll is not a valid Windows image. Please check this against your installation diskette.
AND
RUNDLL Erro: Error loading c:\DOCUME~1\NETWOR~1\ntuser.dll

DDS ran. A popup screen told me to save them (2 log files) to my desktop, but there are no files to save...?
Ran again...same message:
"These 2 log files shall disapear when you close them. So save them to your desktop now.
# DDS.txt
Post this to the forums.

# Attach.txt
Must be zipped, then attached (not posted) to your forum post."

But there's no sign of a log file...am i missing something?

No, maybe something stopping it.
Did you try DDS more than once?

Yes...3 X

Please re-open Malwarebytes, click the Update tab, and click Check for Updates. Then, click the Scanner tab, select Perform Quick Scan, and press Scan.

Still will not allow Update.
Run anyway?

Hello.

• Download combofix from here
  Link 1
  Link 2
  
  1. If you are using Firefox, make sure that your download settings are as follows:
  
  * Tools->Options->Main tab
  * Set to "Always ask me where to Save the files".
  
  2. During the download, rename Combofix to Combo-Fix as follows:
  
  
  
  
  
  3. It is important you rename Combofix during the download, but not after.
  4. Please do not rename Combofix to other names, but only to the one indicated.
  5. Close any open browsers.
  6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
  
• We need to disable your local AV (Anti-virus) before running Combofix.
  
• See HERE for how to disable your AV.
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will then get this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

ComboFix 09-10-28.08 - Cubby 10/29/2009 21:25.6.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.561 [GMT -4:00]
Running from: c:\documents and settings\cubby.MACDONALDWOOD\Desktop\Combo-Fix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\cubby.MACDONALDWOOD\ntuser.dll
c:\documents and settings\cubby.MACDONALDWOOD\Start Menu\Programs\Startup\scandisk.dll
c:\documents and settings\cubby.MACDONALDWOOD\Start Menu\Programs\Startup\scandisk.lnk
c:\documents and settings\LocalService\ntuser.dll
c:\documents and settings\NetworkService\ntuser.dll
C:\dtacmawh.exe
c:\program files\Active Security
c:\program files\Active Security\asecurity.exe
c:\program files\Active Security\core.cga
c:\program files\Active Security\coreext.dll
c:\program files\Active Security\help.ico
c:\program files\Active Security\uninstall.exe
c:\windows\irejajuda._sy
c:\windows\system32\calc.dll
c:\windows\zuvuropof._sy

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}
-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE}


((((((((((((((((((((((((( Files Created from 2009-09-28 to 2009-10-30 )))))))))))))))))))))))))))))))
.

2009-10-24 18:20 . 2009-10-24 18:24 -------- d-----w- C:\32788R22FWJFW.1.tmp
2009-10-22 03:04 . 2009-10-28 12:16 -------- d-----w- c:\program files\qywgjx
2009-10-14 15:42 . 2009-09-03 14:37 16640 ----a-w- c:\windows\system32\drivers\WsAudio_DeviceS(1).sys
2009-10-14 12:33 . 2008-04-17 17:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2009-10-14 12:31 . 2009-10-14 12:31 -------- d-----w- c:\program files\iPod
2009-10-14 12:30 . 2009-10-14 12:33 -------- d-----w- c:\program files\iTunes
2009-10-14 12:30 . 2009-10-14 12:33 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-10-14 12:28 . 2009-10-14 12:28 -------- d-----w- c:\documents and settings\cubby.MACDONALDWOOD\Local Settings\Application Data\WMA-MP3.com
2009-10-14 12:25 . 2009-10-14 12:26 -------- d-----w- c:\program files\QuickTime
2009-09-30 12:56 . 2009-09-30 12:56 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-09-30 11:08 . 2007-04-04 22:55 261480 ----a-w- c:\windows\system32\xactengine2_7.dll
2009-09-30 11:06 . 2009-09-30 11:06 -------- d-----w- c:\windows\Logs

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-28 11:59 . 2009-09-13 00:07 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-26 11:56 . 2007-04-13 00:07 -------- d-----w- c:\program files\dl_Cats
2009-10-24 13:31 . 2006-08-22 06:06 35001 ----a-w- c:\windows\system32\nvModes.dat
2009-10-16 15:49 . 2007-11-15 02:48 -------- d-----w- c:\documents and settings\cubby.MACDONALDWOOD\Application Data\Wave Systems Corp
2009-10-15 16:17 . 2006-09-13 17:27 87200 ----a-w- c:\documents and settings\cubby.MACDONALDWOOD\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-15 11:51 . 2008-08-19 01:06 -------- d-----w- c:\program files\Pinnacle
2009-10-14 23:35 . 2006-12-28 23:02 -------- d-----w- c:\program files\Winamp
2009-10-14 12:53 . 2006-12-25 22:35 -------- d-----w- c:\documents and settings\cubby.MACDONALDWOOD\Application Data\Apple Computer
2009-10-14 12:31 . 2007-09-13 00:45 -------- d-----w- c:\program files\Common Files\Apple
2009-10-13 15:18 . 2009-10-13 15:18 411036 ----a-w- c:\documents and settings\All Users\SPL4DA.tmp
2009-10-09 14:02 . 2006-09-13 15:35 -------- d-----w- c:\documents and settings\cubby.MACDONALDWOOD\Application Data\AdobeUM
2009-09-30 12:56 . 2006-08-22 06:18 -------- d-----w- c:\program files\Java
2009-09-30 11:49 . 2007-12-23 14:54 -------- d-----w- c:\program files\Xilisoft
2009-09-30 11:48 . 2008-08-28 20:07 -------- d-----w- c:\program files\Common Files\DVDVideoSoft
2009-09-30 11:46 . 2009-08-25 01:26 -------- d-----w- c:\program files\AVS4YOU
2009-09-30 11:46 . 2009-08-25 01:26 -------- d-----w- c:\program files\Common Files\AVSMedia
2009-09-30 11:00 . 2009-08-21 00:40 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-30 10:42 . 2006-12-22 16:00 5 -c--a-w- c:\windows\system32\SySVid.dat
2009-09-25 13:16 . 2006-12-28 01:31 -------- d-----w- c:\program files\Azureus
2009-09-24 00:28 . 2007-09-13 16:05 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-09-24 00:17 . 2007-09-13 16:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-09-18 01:23 . 2009-03-28 23:35 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-11 14:18 . 2004-08-04 10:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-10 18:54 . 2009-09-13 00:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 18:53 . 2009-09-13 00:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-04 21:44 . 2009-09-30 11:09 515416 ----a-w- c:\windows\system32\XAudio2_5.dll
2009-09-04 21:44 . 2009-09-30 11:09 238936 ----a-w- c:\windows\system32\xactengine3_5.dll
2009-09-04 21:44 . 2009-09-30 11:09 69464 ----a-w- c:\windows\system32\XAPOFX1_3.dll
2009-09-04 21:29 . 2009-09-30 11:09 453456 ----a-w- c:\windows\system32\d3dx10_42.dll
2009-09-04 21:29 . 2009-09-30 11:09 235344 ----a-w- c:\windows\system32\d3dx11_42.dll
2009-09-04 21:29 . 2009-09-30 11:09 5501792 ----a-w- c:\windows\system32\d3dcsx_42.dll
2009-09-04 21:29 . 2009-09-30 11:09 1974616 ----a-w- c:\windows\system32\D3DCompiler_42.dll
2009-09-04 21:29 . 2009-09-30 11:09 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll
2009-09-04 21:03 . 2004-08-04 10:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-09-01 18:48 . 2009-09-01 15:53 -------- d-----w- c:\program files\M1N1
2009-09-01 14:35 . 2009-09-01 14:35 -------- d-----w- c:\documents and settings\cubby.MACDONALDWOOD\Application Data\Malwarebytes
2009-09-01 14:35 . 2009-09-01 14:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-01 10:13 . 2006-08-22 06:33 -------- d-----w- c:\program files\Google
2009-09-01 00:58 . 2006-12-28 01:31 -------- d-----w- c:\documents and settings\cubby.MACDONALDWOOD\Application Data\Azureus
2009-08-31 20:28 . 2009-08-31 20:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-29 08:08 . 2006-03-04 03:33 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-28 23:42 . 2009-03-22 11:06 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-08-28 23:42 . 2009-03-22 11:06 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-08-26 08:00 . 2004-08-04 10:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-06 23:24 . 2004-08-10 18:02 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-06 23:24 . 2004-08-10 18:02 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-06 23:24 . 2005-05-26 08:16 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-06 23:24 . 2004-08-10 18:02 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-06 23:24 . 2004-08-10 18:02 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-08-06 23:24 . 2004-08-04 10:00 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-06 23:23 . 2004-08-10 18:02 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-06 23:23 . 2009-03-29 23:54 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-08-06 23:23 . 2009-03-29 23:54 215920 ----a-w- c:\windows\system32\muweb.dll
2009-08-06 23:23 . 2004-08-10 18:02 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 09:01 . 2004-08-04 10:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 23:52 . 2009-08-04 23:52 1193832 ----a-w- c:\windows\system32\FM20.DLL
2009-08-04 15:13 . 2005-03-30 01:21 2145280 ------w- c:\windows\system32\ntoskrnl.exe
2009-08-04 14:20 . 2005-03-30 01:01 2023936 ------w- c:\windows\system32\ntkrnlpa.exe
2006-12-17 21:20 . 2006-12-17 21:20 36206039 -c--a-w- c:\program files\Top Producer Outlook Connector.EXE
2007-03-15 21:30 . 2007-03-15 21:30 80 -csha-r- c:\windows\system32\67F454E4E8.dll
.

------- Sigcheck -------

[7] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\eventlog.dll
[7] 2004-08-04 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\eventlog.dll
[7] 2004-08-04 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . c:\windows\ERDNT\cache\eventlog.dll
[7] 2004-08-04 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\eventlog.dll

c:\windows\system32\eventlog.dll ... is missing !!
.
((((((((((((((((((((((((((((( SnapShot@2009-09-17_00.01.40 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-10-30 01:35 . 2009-10-30 01:35 16384 c:\windows\Temp\Perflib_Perfdata_64c.dat
+ 2009-10-30 01:35 . 2009-10-30 01:35 16384 c:\windows\Temp\Perflib_Perfdata_5d4.dat
+ 2009-09-30 11:09 . 2007-04-04 22:53 81768 c:\windows\system32\xinput1_3.dll
+ 2009-09-30 11:08 . 2006-07-28 13:30 62744 c:\windows\system32\xinput1_2.dll
+ 2009-09-30 11:08 . 2006-03-31 16:39 62672 c:\windows\system32\xinput1_1.dll
+ 2009-09-30 11:09 . 2008-10-27 14:04 70992 c:\windows\system32\XAPOFX1_2.dll
+ 2009-09-30 11:09 . 2008-07-31 14:41 68616 c:\windows\system32\XAPOFX1_1.dll
+ 2009-09-30 11:09 . 2008-05-30 18:17 65032 c:\windows\system32\XAPOFX1_0.dll
+ 2009-09-30 11:09 . 2009-03-16 18:18 22360 c:\windows\system32\X3DAudio1_6.dll
+ 2009-09-30 11:09 . 2008-10-27 14:04 23376 c:\windows\system32\X3DAudio1_5.dll
+ 2009-09-30 11:09 . 2008-05-30 18:17 25608 c:\windows\system32\X3DAudio1_4.dll
+ 2009-09-30 11:09 . 2008-03-05 20:00 25608 c:\windows\system32\X3DAudio1_3.dll
+ 2009-09-30 11:09 . 2007-10-22 07:37 17928 c:\windows\system32\X3DAudio1_2.dll
+ 2009-09-30 11:08 . 2007-03-05 16:42 15128 c:\windows\system32\x3daudio1_1.dll
+ 2009-09-30 11:08 . 2006-02-03 12:41 14032 c:\windows\system32\x3daudio1_0.dll
+ 2009-10-02 10:55 . 2009-08-06 23:24 44768 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.4.7600.226\wups2.dll
+ 2009-10-02 10:55 . 2009-08-06 23:24 35552 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.4.7600.226\wups.dll
+ 2009-10-14 15:43 . 2009-09-03 14:37 16640 c:\windows\system32\ReinstallBackups\0023\DriverFiles\WsAudio_DeviceS(1).sys
+ 2009-10-14 15:43 . 2008-04-14 00:12 23552 c:\windows\system32\ReinstallBackups\0023\DriverFiles\i386\wdmaud.drv
+ 2009-10-14 15:43 . 2008-04-13 18:45 49408 c:\windows\system32\ReinstallBackups\0023\DriverFiles\i386\stream.sys
+ 2009-10-14 15:43 . 2008-04-13 18:45 60160 c:\windows\system32\ReinstallBackups\0023\DriverFiles\i386\drmk.sys
+ 2009-10-14 12:22 . 2009-03-06 03:59 36864 c:\windows\system32\ReinstallBackups\0022\DriverFiles\usbaapl.sys
+ 2004-08-10 17:51 . 2009-10-14 11:11 90550 c:\windows\system32\perfc009.dat
+ 2006-11-08 02:03 . 2009-08-29 08:08 55296 c:\windows\system32\msfeedsbs.dll
- 2006-11-08 02:03 . 2009-07-03 17:09 55296 c:\windows\system32\msfeedsbs.dll
+ 2009-09-26 02:42 . 2009-09-26 02:42 85173 c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
+ 2009-09-18 22:45 . 2004-08-04 10:00 55808 c:\windows\system32\logevent.dll
+ 2004-08-04 10:00 . 2009-08-29 08:08 25600 c:\windows\system32\jsproxy.dll
- 2004-08-04 10:00 . 2009-07-03 17:09 25600 c:\windows\system32\jsproxy.dll
+ 2009-10-14 12:21 . 2009-08-28 23:42 40448 c:\windows\system32\DRVSTORE\usbaapl_6DA28B91FF48C57089E4D2436654AFA4ECAD0622\usbaapl.sys
+ 2009-10-14 12:22 . 2009-08-28 23:42 17408 c:\windows\system32\DRVSTORE\netaapl_F433E854B3FF3BEE74986FDE8E16A64162342BFF\netaapl.sys
+ 2009-10-14 12:33 . 2009-05-18 18:17 26600 c:\windows\system32\DRVSTORE\GEARAspiWD_3B7AACF0636A2C042EB7AD2AFF76D37B27BDD28C\x86\GEARAspiWDM.sys
+ 2004-08-03 23:08 . 2008-04-13 18:45 49408 c:\windows\system32\drivers\stream.sys
- 2004-08-03 23:08 . 2008-04-13 18:45 49408 c:\windows\system32\drivers\stream.sys
+ 2006-09-19 16:44 . 2009-05-18 18:17 26600 c:\windows\system32\drivers\GEARAspiWDM.sys
+ 2009-09-23 01:45 . 2009-07-28 20:33 55656 c:\windows\system32\drivers\avgntflt.sys
+ 2009-06-10 10:20 . 2009-08-29 08:08 12800 c:\windows\system32\dllcache\xpshims.dll
- 2009-06-10 10:20 . 2009-07-03 17:09 12800 c:\windows\system32\dllcache\xpshims.dll
+ 2004-08-10 18:02 . 2009-08-06 23:24 35552 c:\windows\system32\dllcache\wups.dll
+ 2004-08-10 18:02 . 2009-08-06 23:24 53472 c:\windows\system32\dllcache\wuauclt.exe
+ 2004-08-03 23:08 . 2008-04-13 18:45 49408 c:\windows\system32\dllcache\stream.sys
+ 2007-05-09 10:42 . 2009-08-29 08:08 55296 c:\windows\system32\dllcache\msfeedsbs.dll
- 2007-05-09 10:42 . 2009-07-03 17:09 55296 c:\windows\system32\dllcache\msfeedsbs.dll
+ 2009-09-04 21:03 . 2009-09-04 21:03 58880 c:\windows\system32\dllcache\msasn1.dll
+ 2004-08-04 10:00 . 2009-08-29 08:08 25600 c:\windows\system32\dllcache\jsproxy.dll
- 2004-08-04 10:00 . 2009-07-03 17:09 25600 c:\windows\system32\dllcache\jsproxy.dll
+ 2004-08-03 23:08 . 2008-04-13 18:45 60160 c:\windows\system32\dllcache\drmk.sys
+ 2004-08-04 10:00 . 2009-08-06 23:24 96480 c:\windows\system32\dllcache\cdm.dll
+ 2004-08-04 10:00 . 2008-04-14 00:12 48640 c:\windows\sjgsti.dll
+ 2009-06-24 23:56 . 2009-06-24 23:56 73728 c:\windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe
+ 2008-05-28 04:49 . 2008-05-28 04:49 77824 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll
- 2007-04-14 00:58 . 2007-04-14 00:58 77824 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll
+ 2008-05-28 04:49 . 2008-05-28 04:49 86016 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorie.dll
- 2007-04-14 00:57 . 2007-04-14 00:57 86016 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorie.dll
- 2007-04-14 00:57 . 2007-04-14 00:57 81920 c:\windows\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll
+ 2008-05-28 04:49 . 2008-05-28 04:49 81920 c:\windows\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll
- 2007-04-14 01:30 . 2007-04-14 01:30 32768 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
+ 2008-05-28 05:30 . 2008-05-28 05:30 32768 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
+ 2009-09-30 11:08 . 2005-03-18 20:23 12800 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Diagnostics.dll
+ 2009-09-30 11:08 . 2005-03-18 20:23 53248 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.AudioVideoPlayback.dll
+ 2006-09-13 16:48 . 2009-10-14 07:09 23040 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2006-09-13 16:48 . 2009-08-27 12:57 23040 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2006-09-13 16:48 . 2009-10-14 07:09 61440 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2006-09-13 16:48 . 2009-08-27 12:57 61440 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2006-09-13 16:48 . 2009-08-27 12:57 27136 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2006-09-13 16:48 . 2009-10-14 07:09 27136 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2006-09-13 16:48 . 2009-08-27 12:57 11264 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2006-09-13 16:48 . 2009-10-14 07:09 11264 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2006-09-13 16:48 . 2009-08-27 12:57 12288 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2006-09-13 16:48 . 2009-10-14 07:09 12288 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2008-01-08 16:43 . 2009-10-07 12:26 53248 c:\windows\Installer\{58E6A969-8215-4ABC-BD73-FCB25EA6F544}\ARPPRODUCTICON.exe
- 2008-01-08 16:43 . 2008-05-14 12:30 53248 c:\windows\Installer\{58E6A969-8215-4ABC-BD73-FCB25EA6F544}\ARPPRODUCTICON.exe
+ 2009-10-14 07:09 . 2009-07-03 17:09 12800 c:\windows\ie8updates\KB974455-IE8\xpshims.dll
+ 2009-10-14 07:09 . 2009-07-03 17:09 55296 c:\windows\ie8updates\KB974455-IE8\msfeedsbs.dll
+ 2009-10-14 07:09 . 2009-07-03 17:09 25600 c:\windows\ie8updates\KB974455-IE8\jsproxy.dll
+ 2009-10-14 07:04 . 2009-10-14 07:04 90112 c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_e818c812\System.Drawing.Design.dll
+ 2009-10-14 07:04 . 2009-10-14 07:04 61440 c:\windows\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_a14f378c\CustomMarshalers.dll
+ 2009-10-14 11:16 . 2009-10-14 11:16 60928 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\b4a9e413d5cd6d6ec2d50aa05381e293\UIAutomationProvider.ni.dll
+ 2009-10-14 11:58 . 2009-10-14 11:58 37888 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\8acb476a0d4ee17a12881e17ae74a6af\System.Windows.Presentation.ni.dll
+ 2009-10-14 11:57 . 2009-10-14 11:57 36864 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\4b87ca3482a3c0ee733e028ecee7de65\System.Web.DynamicData.Design.ni.dll
+ 2009-10-14 11:56 . 2009-10-14 11:56 94208 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\a0c71055364bd356971791284c3fb910\System.ComponentModel.DataAnnotations.ni.dll
+ 2009-10-14 11:56 . 2009-10-14 11:56 82944 c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\f9a75bbdc2ce7db578b5977766a09b99\System.AddIn.Contract.ni.dll
+ 2009-10-14 11:14 . 2009-10-14 11:14 47104 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\3dd0f86c966c75755d62eab8ddf0634c\PresentationFontCache.ni.exe
+ 2009-10-14 11:13 . 2009-10-14 11:13 39424 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\034d081fe294bab1ee1ecc98c1181424\PresentationCFFRasterizer.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 55296 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\f2673aec397c52796aef05bb9d2668df\Microsoft.Vsa.ni.dll
+ 2009-10-14 11:54 . 2009-10-14 11:54 15872 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\1ded203bd27031c3a5e3441f94b528c0\Microsoft.VisualC.ni.dll
+ 2009-10-14 11:56 . 2009-10-14 11:56 74752 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\50a4a9c3fec79845675b69acd6bfec64\Microsoft.SqlServer.CustomControls.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 17408 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\163fd5e08c8b82b7e895e37d65a1ac54\Microsoft.MapPoint.MassiveManagedWrapper.ni.dll
+ 2009-10-14 11:56 . 2009-10-14 11:56 65024 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\d513fe1a81c441e7656a9b062cff4e9f\Microsoft.Build.Framework.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 74752 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\c5d504724d7f351b1d034615dbb72a2a\Microsoft.Build.Framework.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 14336 c:\windows\assembly\NativeImages_v2.0.50727_32\dfsvc\a664ccab020f93f1d533919f57131190\dfsvc.ni.exe
+ 2009-10-14 11:55 . 2009-10-14 11:55 83968 c:\windows\assembly\NativeImages_v2.0.50727_32\DemCodecClient\a6394487217de3b79d80d00fd325e73e\DemCodecClient.ni.dll
+ 2009-10-14 11:53 . 2009-10-14 11:53 25600 c:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\e63d6d26b8a664cfdfbd4ad75e03c14d\Accessibility.ni.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 77824 c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 77824 c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 81920 c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 81920 c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2009-10-14 11:10 . 2009-10-14 11:10 81920 c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 81920 c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 32768 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 32768 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 12800 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 12800 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 77824 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 77824 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 77824 c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 77824 c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 13312 c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 13312 c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 10752 c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 10752 c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 72192 c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 72192 c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 69120 c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 69120 c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2009-09-30 11:08 . 2009-09-30 11:08 12800 c:\windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
+ 2009-09-30 11:08 . 2009-09-30 11:08 53248 c:\windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
+ 2009-09-18 01:05 . 2008-07-08 13:02 26488 c:\windows\$hf_mig$\KB971961-IE8\update\spcustom.dll
+ 2009-09-18 01:05 . 2008-07-08 13:02 17272 c:\windows\$hf_mig$\KB971961-IE8\spmsg.dll
+ 2009-09-18 01:06 . 2008-07-08 13:02 26488 c:\windows\$hf_mig$\KB956844\update\spcustom.dll
+ 2009-09-18 01:06 . 2008-07-08 13:02 17272 c:\windows\$hf_mig$\KB956844\spmsg.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 8192 c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 8192 c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2009-10-14 15:43 . 2008-04-14 00:11 4096 c:\windows\system32\ReinstallBackups\0023\DriverFiles\i386\ksuser.dll
+ 2009-09-18 22:45 . 2004-08-04 10:00 4224 c:\windows\system32\drivers\beep.sys
+ 2006-08-22 06:22 . 2008-04-14 00:11 4096 c:\windows\system32\dllcache\ksuser.dll
+ 2009-09-18 22:45 . 2004-08-04 10:00 4224 c:\windows\system32\dllcache\beep.sys
+ 2006-09-13 16:48 . 2009-10-14 07:09 4096 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2006-09-13 16:48 . 2009-08-27 12:57 4096 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2009-08-06 07:12 . 2009-08-06 07:12 7168 c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 7168 c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 5632 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
+ 2009-10-14 11:10 . 2009-10-14 11:10 5632 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
- 2009-08-06 07:12 . 2009-08-06 07:12 6656 c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 6656 c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 8192 c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 8192 c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 113664 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 113664 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 258048 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 258048 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2009-09-30 11:09 . 2009-03-16 18:18 517448 c:\windows\system32\XAudio2_4.dll
+ 2009-09-30 11:09 . 2008-10-27 14:04 514384 c:\windows\system32\XAudio2_3.dll
+ 2009-09-30 11:09 . 2008-07-31 14:40 509448 c:\windows\system32\XAudio2_2.dll
+ 2009-09-30 11:09 . 2008-05-30 18:19 507400 c:\windows\system32\XAudio2_1.dll
+ 2009-09-30 11:09 . 2008-03-05 20:03 479752 c:\windows\system32\XAudio2_0.dll
+ 2009-09-30 11:09 . 2009-03-16 18:18 235352 c:\windows\system32\xactengine3_4.dll
+ 2009-09-30 11:09 . 2008-10-27 14:04 235856 c:\windows\system32\xactengine3_3.dll
+ 2009-09-30 11:09 . 2008-07-31 14:41 238088 c:\windows\system32\xactengine3_2.dll
+ 2009-09-30 11:09 . 2008-05-30 18:18 238088 c:\windows\system32\xactengine3_1.dll
+ 2009-09-30 11:09 . 2008-03-05 20:03 238088 c:\windows\system32\xactengine3_0.dll
+ 2009-09-30 11:09 . 2007-07-20 04:57 267112 c:\windows\system32\xactengine2_9.dll
+ 2009-09-30 11:09 . 2007-06-21 00:46 266088 c:\windows\system32\xactengine2_8.dll
+ 2009-09-30 11:08 . 2007-01-24 19:27 255848 c:\windows\system32\xactengine2_6.dll
+ 2009-09-30 11:08 . 2006-12-08 16:02 251672 c:\windows\system32\xactengine2_5.dll
+ 2009-09-30 11:08 . 2006-09-28 20:05 237848 c:\windows\system32\xactengine2_4.dll
+ 2009-09-30 11:08 . 2006-07-28 13:30 236824 c:\windows\system32\xactengine2_3.dll
+ 2009-09-30 11:08 . 2006-05-31 11:24 230168 c:\windows\system32\xactengine2_2.dll
+ 2009-09-30 11:09 . 2007-10-22 07:39 267272 c:\windows\system32\xactengine2_10.dll
+ 2009-09-30 11:08 . 2006-03-31 16:39 229584 c:\windows\system32\xactengine2_1.dll
+ 2009-09-30 11:08 . 2006-02-03 12:42 230096 c:\windows\system32\xactengine2_0.dll
+ 2004-08-04 10:00 . 2009-04-02 03:02 604160 c:\windows\system32\wmspdmod.dll
+ 2001-04-27 15:37 . 2001-04-27 15:37 345536 c:\windows\system32\stdvcl32.dll
+ 2009-10-14 15:43 . 2008-04-13 19:19 146048 c:\windows\system32\ReinstallBackups\0023\DriverFiles\i386\portcls.sys
+ 2009-10-14 15:43 . 2008-04-13 19:16 141056 c:\windows\system32\ReinstallBackups\0023\DriverFiles\i386\ks.sys
+ 2004-08-10 17:51 . 2009-10-14 11:11 489182 c:\windows\system32\perfh009.dat
+ 2004-08-04 10:00 . 2009-08-29 08:08 206848 c:\windows\system32\occache.dll
- 2004-08-04 10:00 . 2009-07-03 17:09 206848 c:\windows\system32\occache.dll
- 2006-11-08 02:03 . 2009-07-03 17:09 594432 c:\windows\system32\msfeeds.dll
+ 2006-11-08 02:03 . 2009-08-29 08:08 594432 c:\windows\system32\msfeeds.dll
+ 2009-07-18 03:21 . 2009-07-18 03:21 257440 c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2004-08-04 10:00 . 2009-06-22 06:44 726528 c:\windows\system32\jscript.dll
- 2004-08-04 10:00 . 2009-03-08 08:33 726528 c:\windows\system32\jscript.dll
+ 2009-09-30 12:56 . 2009-09-30 12:56 148888 c:\windows\system32\javaws.exe
+ 2009-09-30 12:56 . 2009-09-30 12:56 144792 c:\windows\system32\javaw.exe
+ 2009-09-30 12:56 . 2009-09-30 12:56 144792 c:\windows\system32\java.exe
+ 2006-03-04 03:33 . 2009-08-29 08:08 184320 c:\windows\system32\iepeers.dll
- 2006-03-04 03:33 . 2009-07-03 17:09 184320 c:\windows\system32\iepeers.dll
+ 2004-08-04 10:00 . 2009-08-29 08:08 387584 c:\windows\system32\iedkcs32.dll
- 2004-08-04 10:00 . 2009-07-03 11:01 173056 c:\windows\system32\ie4uinit.exe
+ 2004-08-04 10:00 . 2009-08-28 10:35 173056 c:\windows\system32\ie4uinit.exe
+ 2004-08-10 17:57 . 2009-10-17 01:23 313176 c:\windows\system32\FNTCACHE.DAT
+ 2009-10-14 12:33 . 2008-04-17 17:12 107368 c:\windows\system32\DRVSTORE\GEARAspiWD_3B7AACF0636A2C042EB7AD2AFF76D37B27BDD28C\x86\GEARAspi.dll
+ 2004-08-03 23:15 . 2008-04-13 19:19 146048 c:\windows\system32\drivers\portcls.sys
- 2004-08-03 23:15 . 2008-04-13 19:19 146048 c:\windows\system32\drivers\portcls.sys
+ 2004-08-10 18:02 . 2009-08-06 23:24 209632 c:\windows\system32\dllcache\wuweb.dll
+ 2004-08-10 18:02 . 2009-08-06 23:24 327896 c:\windows\system32\dllcache\wucltui.dll
+ 2004-08-10 18:02 . 2009-08-06 23:23 575704 c:\windows\system32\dllcache\wuapi.dll
+ 2004-08-04 10:00 . 2009-04-02 03:02 604160 c:\windows\system32\dllcache\wmspdmod.dll
+ 2006-03-04 03:33 . 2009-08-29 08:08 916480 c:\windows\system32\dllcache\wininet.dll
+ 2009-09-16 23:57 . 2009-06-21 21:44 153088 c:\windows\system32\dllcache\triedit.dll
+ 2004-08-04 10:00 . 2009-08-26 08:00 247326 c:\windows\system32\dllcache\strmdll.dll
- 2004-08-04 10:00 . 2008-10-03 10:02 247326 c:\windows\system32\dllcache\strmdll.dll
+ 2004-08-03 23:15 . 2008-04-13 19:19 146048 c:\windows\system32\dllcache\portcls.sys
- 2004-08-04 10:00 . 2009-07-03 17:09 206848 c:\windows\system32\dllcache\occache.dll
+ 2004-08-04 10:00 . 2009-08-29 08:08 206848 c:\windows\system32\dllcache\occache.dll
- 2009-06-25 08:25 . 2009-06-25 08:25 136192 c:\windows\system32\dllcache\msv1_0.dll
+ 2009-06-25 08:25 . 2009-09-11 14:18 136192 c:\windows\system32\dllcache\msv1_0.dll
+ 2007-05-09 10:42 . 2009-08-29 08:08 594432 c:\windows\system32\dllcache\msfeeds.dll
- 2007-05-09 10:42 . 2009-07-03 17:09 594432 c:\windows\system32\dllcache\msfeeds.dll
+ 2004-08-03 23:15 . 2008-04-13 19:16 141056 c:\windows\system32\dllcache\ks.sys
- 2008-05-09 10:53 . 2009-03-08 08:33 726528 c:\windows\system32\dllcache\jscript.dll
+ 2008-05-09 10:53 . 2009-06-22 06:44 726528 c:\windows\system32\dllcache\jscript.dll
+ 2009-06-10 10:20 . 2009-08-29 08:08 246272 c:\windows\system32\dllcache\ieproxy.dll
- 2009-06-10 10:20 . 2009-07-03 17:09 246272 c:\windows\system32\dllcache\ieproxy.dll
+ 2006-03-04 03:33 . 2009-08-29 08:08 184320 c:\windows\system32\dllcache\iepeers.dll
- 2006-03-04 03:33 . 2009-07-03 17:09 184320 c:\windows\system32\dllcache\iepeers.dll
+ 2004-08-04 10:00 . 2009-08-29 08:08 387584 c:\windows\system32\dllcache\iedkcs32.dll
+ 2004-08-04 10:00 . 2009-08-28 10:35 173056 c:\windows\system32\dllcache\ie4uinit.exe
- 2004-08-04 10:00 . 2009-07-03 11:01 173056 c:\windows\system32\dllcache\ie4uinit.exe
+ 2009-09-30 11:09 . 2009-03-09 19:27 453456 c:\windows\system32\d3dx10_41.dll
+ 2009-09-30 11:09 . 2008-10-10 08:52 452440 c:\windows\system32\d3dx10_40.dll
+ 2009-09-30 11:09 . 2008-07-10 15:01 467984 c:\windows\system32\d3dx10_39.dll
+ 2009-09-30 11:09 . 2008-05-30 18:11 467984 c:\windows\system32\d3dx10_38.dll
+ 2009-09-30 11:09 . 2008-02-06 03:07 462864 c:\windows\system32\d3dx10_37.dll
+ 2009-09-30 11:09 . 2007-10-02 13:56 444776 c:\windows\system32\d3dx10_36.dll
+ 2009-09-30 11:09 . 2007-07-19 22:14 444776 c:\windows\system32\d3dx10_35.dll
+ 2009-09-30 11:09 . 2007-05-16 20:45 443752 c:\windows\system32\d3dx10_34.dll
+ 2009-09-30 11:08 . 2007-03-15 20:57 443752 c:\windows\system32\d3dx10_33.dll
+ 2009-08-08 03:51 . 2009-08-08 03:51 989016 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
- 2007-04-14 00:58 . 2007-04-14 00:58 102400 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorld.dll
+ 2008-05-28 04:49 . 2008-05-28 04:49 102400 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorld.dll
+ 2008-05-28 04:48 . 2008-05-28 04:48 315392 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll
- 2007-04-14 00:56 . 2007-04-14 00:56 315392 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll
+ 2008-05-28 05:30 . 2008-05-28 05:30 258048 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
- 2007-04-14 01:30 . 2007-04-14 01:30 258048 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
+ 2009-09-30 11:08 . 2006-03-31 15:27 578560 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2911.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-09-30 11:08 . 2006-02-03 11:40 578560 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2910.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-09-30 11:08 . 2005-12-05 21:20 577536 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2909.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-09-30 11:08 . 2005-09-28 18:11 577536 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2908.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-09-30 11:08 . 2005-07-22 21:21 577024 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2907.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-09-30 11:08 . 2005-05-26 19:15 576000 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2906.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-09-30 11:08 . 2005-03-18 21:23 567296 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2905.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-09-30 11:08 . 2005-02-05 23:32 563712 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2904.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-09-30 11:08 . 2005-03-18 20:23 223232 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.dll
+ 2009-09-30 11:08 . 2005-03-18 20:23 178176 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectSound.dll
+ 2009-09-30 11:08 . 2005-03-18 20:23 364544 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectPlay.dll
+ 2009-09-30 11:08 . 2005-03-18 20:23 159232 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectInput.dll
+ 2009-09-30 11:08 . 2005-03-18 20:23 145920 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectDraw.dll
+ 2009-09-30 11:08 . 2005-03-18 20:23 473600 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3D.dll
+ 2009-09-30 12:56 . 2009-09-30 12:56 536576 c:\windows\Installer\2c6f524.msi
+ 2009-10-14 12:23 . 2009-10-14 12:23 694272 c:\windows\Installer\10c14ec.msi
+ 2009-10-14 12:34 . 2009-10-14 12:34 102400 c:\windows\Installer\{DA34FE93-5DC5-48E0-ACC8-A5389E05BB51}\iTunesIco.exe
- 2006-09-13 16:48 . 2009-08-27 12:57 409600 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2006-09-13 16:48 . 2009-10-14 07:09 409600 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2006-09-13 16:48 . 2009-08-27 12:57 286720 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2006-09-13 16:48 . 2009-10-14 07:09 286720 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2006-09-13 16:48 . 2009-08-27 12:57 249856 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2006-09-13 16:48 . 2009-10-14 07:09 249856 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2006-09-13 16:48 . 2009-08-27 12:57 794624 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2006-09-13 16:48 . 2009-10-14 07:09 794624 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2006-09-13 16:48 . 2009-08-27 12:57 135168 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2006-09-13 16:48 . 2009-10-14 07:09 135168 c:\windows\Installer\{91CA0409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2009-10-14 07:09 . 2009-07-03 17:09 915456 c:\windows\ie8updates\KB974455-IE8\wininet.dll
+ 2009-10-14 07:09 . 2009-05-26 11:40 382840 c:\windows\ie8updates\KB974455-IE8\spuninst\updspapi.dll
+ 2009-10-14 07:09 . 2008-07-08 13:02 231288 c:\windows\ie8updates\KB974455-IE8\spuninst\spuninst.exe
+ 2009-10-14 07:09 . 2009-07-03 17:09 206848 c:\windows\ie8updates\KB974455-IE8\occache.dll
+ 2009-10-14 07:09 . 2009-07-03 17:09 594432 c:\windows\ie8updates\KB974455-IE8\msfeeds.dll
+ 2009-10-14 07:09 . 2009-07-03 17:09 246272 c:\windows\ie8updates\KB974455-IE8\ieproxy.dll
+ 2009-10-14 07:09 . 2009-07-03 17:09 184320 c:\windows\ie8updates\KB974455-IE8\iepeers.dll
+ 2009-10-14 07:09 . 2009-07-03 17:09 386048 c:\windows\ie8updates\KB974455-IE8\iedkcs32.dll
+ 2009-10-14 07:09 . 2009-07-03 11:01 173056 c:\windows\ie8updates\KB974455-IE8\ie4uinit.exe
+ 2009-09-18 01:05 . 2008-07-08 13:02 382840 c:\windows\ie8updates\KB971961-IE8\spuninst\updspapi.dll
+ 2009-09-18 01:05 . 2008-07-08 13:02 231288 c:\windows\ie8updates\KB971961-IE8\spuninst\spuninst.exe
+ 2009-09-18 01:05 . 2009-03-08 08:33 726528 c:\windows\ie8updates\KB971961-IE8\jscript.dll
+ 2004-08-04 10:00 . 2008-04-14 00:12 164352 c:\windows\enulicome.dll
+ 2009-10-14 07:04 . 2009-10-14 07:04 835584 c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_8f0d7750\System.Drawing.dll
+ 2009-10-14 07:04 . 2009-10-14 07:04 192512 c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_06ec139b\System.Drawing.Design.dll
+ 2009-10-14 07:04 . 2009-10-14 07:04 118784 c:\windows\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_a88388e3\CustomMarshalers.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 321536 c:\windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\e2098e43d115155d6ba91ba3a7e577cf\WsatConfig.ni.exe
+ 2009-10-14 11:16 . 2009-10-14 11:16 240128 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\bf92bc207f927cbbd6dfc9dc0c3eae68\WindowsFormsIntegration.ni.dll
+ 2009-10-14 11:16 . 2009-10-14 11:16 187904 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\6f488b7644dc50a083868e91a4014466\UIAutomationTypes.ni.dll
+ 2009-10-14 11:16 . 2009-10-14 11:16 447488 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\c2fbf25609b704061a93500efa6f241d\UIAutomationClient.ni.dll
+ 2009-10-14 11:58 . 2009-10-14 11:58 400896 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\eb23b78564687badff1bd1f1d0a0ec97\System.Xml.Linq.ni.dll
+ 2009-10-14 11:57 . 2009-10-14 11:57 129536 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\e7666364bf9f3ba5f4833c9efedd8218\System.Web.Routing.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 202240 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\b5f1b8791e6c47e5bd5e7018c346c586\System.Web.RegularExpressions.ni.dll
+ 2009-10-14 11:57 . 2009-10-14 11:57 859648 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\884eacddf339b8b342f66aedff5f8ef9\System.Web.Extensions.Design.ni.dll
+ 2009-10-14 11:57 . 2009-10-14 11:57 328704 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\9e199645bd26f1afe58ebe185d1e7f0f\System.Web.Entity.ni.dll
+ 2009-10-14 11:57 . 2009-10-14 11:57 301056 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\652017ebe962ab2eb271c2524f31cd61\System.Web.Entity.Design.ni.dll
+ 2009-10-14 11:57 . 2009-10-14 11:57 547328 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\d0070c1c1a642ae30394e00bc0d82336\System.Web.DynamicData.ni.dll
+ 2009-10-14 11:57 . 2009-10-14 11:57 141312 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\1896753d02d146be1988d32241300f51\System.Web.Abstractions.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 627200 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\408e637346ef628a3f54fb1b9b83ac9f\System.Transactions.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 212992 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\1f61bccb700d687775cf778dd77752e9\System.ServiceProcess.ni.dll
+ 2009-10-14 11:54 . 2009-10-14 11:54 676352 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\a9e9b885a6601469c4058375cc74d856\System.Security.ni.dll
+ 2009-10-14 11:54 . 2009-10-14 11:54 311296 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\9bc34a79af9c3ed2cf17a0226c769b4c\System.Runtime.Serialization.Formatters.Soap.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 771584 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\af21e3011fb4e107b13ea5c40c351ec4\System.Runtime.Remoting.ni.dll
+ 2009-10-14 11:57 . 2009-10-14 11:57 621056 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Net\5f74a84e9d28c2332c51f6e30da0e125\System.Net.ni.dll
+ 2009-10-14 11:54 . 2009-10-14 11:54 998400 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\2c208e4c5521f31057ea7d6e93c6a567\System.Management.ni.dll
+ 2009-10-14 11:57 . 2009-10-14 11:57 330752 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\818b20a7c6f3b2fe97bf008ca24080c1\System.Management.Instrumentation.ni.dll
+ 2009-10-14 11:53 . 2009-10-14 11:53 381440 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IO.Log\6c273eb9d1ee8b66b5ecb073de4b785d\System.IO.Log.ni.dll
+ 2009-10-14 11:53 . 2009-10-14 11:53 212992 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\7222db518afb4eaaa138824278249bc7\System.IdentityModel.Selectors.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 280064 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\8a7d0bd0057a8ed38291d5662248f7a1\System.EnterpriseServices.Wrapper.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 627712 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\8a7d0bd0057a8ed38291d5662248f7a1\System.EnterpriseServices.ni.dll
+ 2009-10-14 11:16 . 2009-10-14 11:16 208384 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\ca6d7208c0fb72ff97429f2636ced321\System.Drawing.Design.ni.dll
+ 2009-10-14 11:57 . 2009-10-14 11:57 881152 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\c92fc19800e701c90f90ab7a2ab44c47\System.DirectoryServices.AccountManagement.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 455680 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\a601f47a98ee67df424685c9a66ea449\System.DirectoryServices.Protocols.ni.dll
+ 2009-10-14 11:57 . 2009-10-14 11:57 939008 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\b91b44015859163646f210d284f7166a\System.Data.Services.Client.ni.dll
+ 2009-10-14 11:57 . 2009-10-14 11:57 354816 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\1b35297e07b85071daecdb06f96750a1\System.Data.Services.Design.ni.dll
+ 2009-10-14 11:57 . 2009-10-14 11:57 756736 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\cf906bf9146d1f0013451ec63b58e064\System.Data.Entity.Design.ni.dll
+ 2009-10-14 11:56 . 2009-10-14 11:56 135680 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\4ff4134b0d490c090e03d74e104517c4\System.Data.DataSetExtensions.ni.dll
+ 2009-10-14 11:54 . 2009-10-14 11:54 971264 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\7c743462baccf29b3567b0e3ec9ac134\System.Configuration.ni.dll
+ 2009-10-14 11:54 . 2009-10-14 11:54 141312 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\443e3a85c491b2de4a2ac654cb957484\System.Configuration.Install.ni.dll
+ 2009-10-14 11:56 . 2009-10-14 11:56 633856 c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn\cba35f47925431a54d0e6ae147a292f1\System.AddIn.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 366080 c:\windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\6af32fe5cbec0aa54e2efa6910c73651\SMSvcHost.ni.exe
+ 2009-10-14 11:55 . 2009-10-14 11:55 256000 c:\windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\7602d7687fb9bd21cd9ae60d2b187c99\SMDiagnostics.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 320512 c:\windows\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\a23dc25782df04533a13e348203e4dc5\ServiceModelReg.ni.exe
+ 2009-10-14 11:15 . 2009-10-14 11:15 258048 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\96f74da5fc40b92f09069230bc0df4f0\PresentationFramework.Royale.ni.dll
+ 2009-10-14 11:14 . 2009-10-14 11:14 539648 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\3bb4d16b042b72c2c85a0f8ac9d48f28\PresentationFramework.Luna.ni.dll
+ 2009-10-14 11:14 . 2009-10-14 11:14 368128 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\30c5c2682d3c5bdaa83bb9a36ee48afa\PresentationFramework.Aero.ni.dll
+ 2009-10-14 11:14 . 2009-10-14 11:14 224768 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\07e952efd70f5608e221a008e6231ace\PresentationFramework.Classic.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 133632 c:\windows\assembly\NativeImages_v2.0.50727_32\MSBuild\eade8c1c9c1e8e5ffb50e6c9b9af0f6a\MSBuild.ni.exe
+ 2009-10-14 11:56 . 2009-10-14 11:56 465408 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\c8eaa2ca376ff1765b4e835bb2abd911\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 386560

continued from previous./.


c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\fc4d66e0a92b3767006a84f2519d2457\Microsoft.Transactions.Bridge.Dtc.ni.dll
+ 2009-10-14 11:56 . 2009-10-14 11:56 529920 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\ce995aaf81fa2a5e929b18ab3f70d607\Microsoft.SqlServer.GridControl.ni.dll
+ 2009-10-14 11:56 . 2009-10-14 11:56 355840 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\79a9771d47bca274e3a50e071d1dac3f\Microsoft.SqlServer.Setup.ni.dll
+ 2009-10-14 11:56 . 2009-10-14 11:56 989184 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.SqlServer#\6635f08fc70448a06f5cfa95850eb1fd\Microsoft.SqlServer.WizardFrameworkLite.ni.dll
+ 2009-10-14 11:56 . 2009-10-14 11:56 231936 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.NetEnterp#\6baf27968b8e8b7ff927d9a64afac181\Microsoft.NetEnterpriseServers.ExceptionMessageBox.ni.dll
+ 2009-10-14 11:54 . 2009-10-14 11:54 816128 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\a90faf467041af67b1c18aaa486cfcf1\Microsoft.MapPoint.Data.VirtualEarthTileDataSource.ni.dll
+ 2009-10-14 11:54 . 2009-10-14 11:54 396800 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\a29609215386d29073040328a7e60a01\Microsoft.MapPoint.Utility.ni.dll
+ 2009-10-14 11:54 . 2009-10-14 11:54 210432 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\9411230a4255fff251430773cdb376b1\Microsoft.MapPoint.MapControl3D.ni.dll
+ 2009-10-14 11:54 . 2009-10-14 11:54 375808 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\14a5e72e477769bbb6949676d74d9e68\Microsoft.MapPoint.Geometry.ni.dll
+ 2009-10-14 11:54 . 2009-10-14 11:54 447488 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\09b88a6b9e22794c6080a2fe6a0155c9\Microsoft.MapPoint.Data.CompactMapFile.ni.dll
+ 2009-10-14 11:56 . 2009-10-14 11:56 144384 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\58ca3ecc52b7246b448c109817198a0b\Microsoft.Build.Utilities.ni.dll
+ 2009-10-14 11:56 . 2009-10-14 11:56 175104 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\4dd43724dd92026577c6f588270137a0\Microsoft.Build.Utilities.v3.5.ni.dll
+ 2009-10-14 11:56 . 2009-10-14 11:56 839680 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\8c651f75bb741330370986dcad8e9e5b\Microsoft.Build.Engine.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 222720 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\a6dcbae619ccd938bfe808c54d6d3ae0\Microsoft.Build.Conversion.v3.5.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 207872 c:\windows\assembly\NativeImages_v2.0.50727_32\ImageCodec\f750fb22bf3e4602460616055891bf2c\ImageCodec.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 220672 c:\windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\77688ce14f221ed94a9f442ae4736123\CustomMarshalers.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 410112 c:\windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\a17c65f0cffaa4f792dd38d50df9d526\ComSvcConfig.ni.exe
+ 2009-10-14 11:53 . 2009-10-14 11:53 842240 c:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\85d7c111956b478766d90625b35d963f\AspNetMMCExt.ni.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 839680 c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 839680 c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 835584 c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 835584 c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 114688 c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 114688 c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 258048 c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 258048 c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 131072 c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 131072 c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 303104 c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 303104 c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 258048 c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 258048 c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 372736 c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 372736 c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 626688 c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 626688 c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 401408 c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 401408 c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 188416 c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 188416 c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 970752 c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
+ 2009-10-14 11:10 . 2009-10-14 11:10 970752 c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
+ 2009-10-14 11:10 . 2009-10-14 11:10 745472 c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 745472 c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
+ 2009-10-14 11:10 . 2009-10-14 11:10 425984 c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 425984 c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2009-10-14 11:10 . 2009-10-14 11:10 110592 c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 110592 c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 659456 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 659456 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 372736 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 372736 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 110592 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 110592 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 749568 c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 749568 c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 655360 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 655360 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 348160 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 348160 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 507904 c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 507904 c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 261632 c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 261632 c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 113664 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 113664 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 258048 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 258048 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 486400 c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2009-10-14 11:10 . 2009-10-14 11:10 486400 c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2009-09-30 11:08 . 2009-09-30 11:08 223232 c:\windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
+ 2009-09-30 11:08 . 2009-09-30 11:08 178176 c:\windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
+ 2009-09-30 11:08 . 2009-09-30 11:08 364544 c:\windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
+ 2009-09-30 11:08 . 2009-09-30 11:08 159232 c:\windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
+ 2009-09-30 11:08 . 2009-09-30 11:08 145920 c:\windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
+ 2009-09-30 11:08 . 2009-09-30 11:08 578560 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-09-30 11:08 . 2009-09-30 11:08 578560 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-09-30 11:08 . 2009-09-30 11:08 577536 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-09-30 11:08 . 2009-09-30 11:08 577536 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-09-30 11:08 . 2009-09-30 11:08 577024 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-09-30 11:08 . 2009-09-30 11:08 576000 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-09-30 11:08 . 2009-09-30 11:08 567296 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-09-30 11:08 . 2009-09-30 11:08 563712 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-09-30 11:08 . 2009-09-30 11:08 473600 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
+ 2009-09-18 01:07 . 2007-07-27 14:41 382840 c:\windows\$NtUninstallKB968816_WM9$\spuninst\updspapi.dll
+ 2009-09-18 01:07 . 2007-07-27 14:41 231288 c:\windows\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe
+ 2009-09-18 01:06 . 2008-04-14 00:12 153088 c:\windows\$NtUninstallKB956844$\triedit.dll
+ 2009-09-18 01:06 . 2008-07-08 13:02 382840 c:\windows\$NtUninstallKB956844$\spuninst\updspapi.dll
+ 2009-09-18 01:06 . 2008-07-08 13:02 231288 c:\windows\$NtUninstallKB956844$\spuninst\spuninst.exe
+ 2009-09-18 01:05 . 2008-07-08 13:02 382840 c:\windows\$hf_mig$\KB971961-IE8\update\updspapi.dll
+ 2009-09-18 01:05 . 2008-07-08 13:02 755576 c:\windows\$hf_mig$\KB971961-IE8\update\update.exe
+ 2009-09-18 01:05 . 2008-07-08 13:02 231288 c:\windows\$hf_mig$\KB971961-IE8\spuninst.exe
+ 2009-09-16 23:57 . 2009-06-22 06:47 726528 c:\windows\$hf_mig$\KB971961-IE8\SP3QFE\jscript.dll
+ 2009-09-18 01:06 . 2008-07-08 13:02 382840 c:\windows\$hf_mig$\KB956844\update\updspapi.dll
+ 2009-09-18 01:06 . 2008-07-08 13:02 755576 c:\windows\$hf_mig$\KB956844\update\update.exe
+ 2009-09-18 01:06 . 2008-07-08 13:02 231288 c:\windows\$hf_mig$\KB956844\spuninst.exe
+ 2009-09-16 23:57 . 2009-06-21 21:49 153088 c:\windows\$hf_mig$\KB956844\SP3QFE\triedit.dll
+ 2009-10-14 06:58 . 2009-08-13 13:55 1748992 c:\windows\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\GdiPlus.dll
+ 2004-08-04 10:00 . 2009-05-20 08:56 2458112 c:\windows\system32\WMVCore.dll
- 2004-08-04 10:00 . 2008-06-18 10:03 2458112 c:\windows\system32\WMVCore.dll
+ 2006-03-18 11:09 . 2009-08-29 08:08 1208832 c:\windows\system32\urlmon.dll
- 2006-03-18 11:09 . 2009-07-03 17:09 1208832 c:\windows\system32\urlmon.dll
+ 2009-10-14 12:22 . 2009-03-06 03:59 1900544 c:\windows\system32\ReinstallBackups\0022\DriverFiles\usbaaplrc.dll
+ 2004-08-04 10:00 . 2009-07-17 16:22 1435648 c:\windows\system32\query.dll
- 2004-08-04 10:00 . 2008-04-14 00:12 1435648 c:\windows\system32\query.dll
+ 2006-03-23 17:32 . 2009-08-29 08:08 5940224 c:\windows\system32\mshtml.dll
+ 2009-07-18 03:21 . 2009-07-18 03:21 3883424 c:\windows\system32\Macromed\Flash\NPSWF32.dll
+ 2006-10-17 16:57 . 2009-08-29 08:08 1985536 c:\windows\system32\iertutil.dll
- 2006-10-17 16:57 . 2009-07-03 17:09 1985536 c:\windows\system32\iertutil.dll
+ 2009-10-14 12:21 . 2009-08-28 23:42 2065696 c:\windows\system32\DRVSTORE\usbaapl_6DA28B91FF48C57089E4D2436654AFA4ECAD0622\usbaaplrc.dll
+ 2009-10-14 12:22 . 2009-08-28 23:42 1417504 c:\windows\system32\DRVSTORE\netaapl_F433E854B3FF3BEE74986FDE8E16A64162342BFF\wdfcoinstaller01005.dll
+ 2004-08-10 18:02 . 2009-08-06 23:23 1929952 c:\windows\system32\dllcache\wuaueng.dll
+ 2004-08-04 10:00 . 2009-05-20 08:56 2458112 c:\windows\system32\dllcache\WMVCore.dll
- 2004-08-04 10:00 . 2008-06-18 10:03 2458112 c:\windows\system32\dllcache\WMVCore.dll
+ 2006-03-18 11:09 . 2009-08-29 08:08 1208832 c:\windows\system32\dllcache\urlmon.dll
- 2006-03-18 11:09 . 2009-07-03 17:09 1208832 c:\windows\system32\dllcache\urlmon.dll
+ 2009-07-17 16:22 . 2009-07-17 16:22 1435648 c:\windows\system32\dllcache\query.dll
+ 2008-10-15 14:21 . 2009-08-05 00:44 2189184 c:\windows\system32\dllcache\ntoskrnl.exe
- 2008-10-15 14:21 . 2009-02-06 10:32 2023936 c:\windows\system32\dllcache\ntkrpamp.exe
+ 2008-10-15 14:21 . 2009-08-04 14:20 2023936 c:\windows\system32\dllcache\ntkrpamp.exe
- 2008-10-15 14:21 . 2009-02-07 23:02 2066048 c:\windows\system32\dllcache\ntkrnlpa.exe
+ 2008-10-15 14:21 . 2009-08-04 14:20 2066048 c:\windows\system32\dllcache\ntkrnlpa.exe
+ 2008-10-15 14:21 . 2009-08-04 15:13 2145280 c:\windows\system32\dllcache\ntkrnlmp.exe
- 2008-10-15 14:21 . 2009-02-06 11:06 2145280 c:\windows\system32\dllcache\ntkrnlmp.exe
+ 2006-03-23 17:32 . 2009-08-29 08:08 5940224 c:\windows\system32\dllcache\mshtml.dll
+ 2007-05-09 10:42 . 2009-08-29 08:08 1985536 c:\windows\system32\dllcache\iertutil.dll
- 2007-05-09 10:42 . 2009-07-03 17:09 1985536 c:\windows\system32\dllcache\iertutil.dll
+ 2009-09-30 11:09 . 2009-03-09 19:27 4178264 c:\windows\system32\D3DX9_41.dll
+ 2009-09-30 11:09 . 2008-10-10 08:52 4379984 c:\windows\system32\D3DX9_40.dll
+ 2009-09-30 11:09 . 2008-07-10 15:00 3851784 c:\windows\system32\D3DX9_39.dll
+ 2009-09-30 11:09 . 2008-05-30 18:11 3850760 c:\windows\system32\D3DX9_38.dll
+ 2009-09-30 11:09 . 2008-03-05 19:56 3786760 c:\windows\system32\D3DX9_37.dll
+ 2009-09-30 11:09 . 2007-10-12 19:14 3734536 c:\windows\system32\d3dx9_36.dll
+ 2009-09-30 11:09 . 2007-07-19 22:14 3727720 c:\windows\system32\d3dx9_35.dll
+ 2009-09-30 11:09 . 2007-05-16 20:45 3497832 c:\windows\system32\d3dx9_34.dll
+ 2009-09-30 11:08 . 2007-03-12 20:42 3495784 c:\windows\system32\d3dx9_33.dll
+ 2009-09-30 11:08 . 2006-11-29 17:06 3426072 c:\windows\system32\d3dx9_32.dll
+ 2009-09-30 11:08 . 2006-09-28 20:05 2414360 c:\windows\system32\d3dx9_31.dll
+ 2009-09-30 11:08 . 2006-03-31 16:40 2388176 c:\windows\system32\d3dx9_30.dll
+ 2009-09-30 11:08 . 2005-12-05 22:09 2323664 c:\windows\system32\d3dx9_28.dll
+ 2009-09-30 11:08 . 2005-07-22 23:59 2319568 c:\windows\system32\d3dx9_27.dll
+ 2009-09-30 11:08 . 2005-05-26 19:34 2297552 c:\windows\system32\d3dx9_26.dll
+ 2009-09-30 11:08 . 2005-03-18 21:19 2337488 c:\windows\system32\d3dx9_25.dll
+ 2009-09-30 11:08 . 2005-02-05 23:45 2222800 c:\windows\system32\d3dx9_24.dll
+ 2009-09-30 11:09 . 2009-03-09 19:27 1846632 c:\windows\system32\D3DCompiler_41.dll
+ 2009-09-30 11:09 . 2008-10-10 08:52 2036576 c:\windows\system32\D3DCompiler_40.dll
+ 2009-09-30 11:09 . 2008-07-10 15:00 1493528 c:\windows\system32\D3DCompiler_39.dll
+ 2009-09-30 11:09 . 2008-05-30 18:11 1491992 c:\windows\system32\D3DCompiler_38.dll
+ 2009-09-30 11:09 . 2008-03-05 19:56 1420824 c:\windows\system32\D3DCompiler_37.dll
+ 2009-09-30 11:09 . 2007-10-12 19:14 1374232 c:\windows\system32\D3DCompiler_36.dll
+ 2009-09-30 11:09 . 2007-07-19 22:14 1358192 c:\windows\system32\D3DCompiler_35.dll
+ 2009-09-30 11:09 . 2007-05-16 20:45 1124720 c:\windows\system32\D3DCompiler_34.dll
+ 2009-09-30 11:08 . 2007-03-12 20:42 1123696 c:\windows\system32\D3DCompiler_33.dll
+ 2009-08-08 03:51 . 2009-08-08 03:51 5812560 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
+ 2009-08-08 03:51 . 2009-08-08 03:51 4546560 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
- 2008-11-25 08:59 . 2008-11-25 08:59 4546560 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
+ 2008-05-28 05:35 . 2008-05-28 05:35 1265664 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Web.dll
- 2007-04-14 01:35 . 2007-04-14 01:35 1265664 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Web.dll
+ 2008-05-28 05:35 . 2008-05-28 05:35 1232896 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.dll
- 2007-04-14 01:35 . 2007-04-14 01:35 1232896 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.dll
- 2007-04-14 00:57 . 2007-04-14 00:57 2514944 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
+ 2008-05-28 04:48 . 2008-05-28 04:48 2514944 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
+ 2008-05-28 04:48 . 2008-05-28 04:48 2523136 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll
- 2007-04-14 00:57 . 2007-04-14 00:57 2523136 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll
- 2007-04-14 00:50 . 2007-04-14 00:50 2142208 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll
+ 2008-05-28 04:43 . 2008-05-28 04:43 2142208 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll
+ 2009-09-30 11:08 . 2004-12-01 19:53 2846720 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2903.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-09-30 11:08 . 2004-09-29 16:38 2676224 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-08-25 18:57 . 2009-08-25 18:57 5518336 c:\windows\Installer\567e188.msp
+ 2009-10-07 12:26 . 2009-10-07 12:26 7419392 c:\windows\Installer\47bfdbd.msi
+ 2009-08-21 14:14 . 2009-08-21 14:14 8363008 c:\windows\Installer\1a9da19.msp
+ 2009-08-20 09:02 . 2009-08-20 09:02 5204992 c:\windows\Installer\1a9da00.msp
+ 2009-09-29 13:08 . 2009-09-29 13:08 6747648 c:\windows\Installer\1a9d9ed.msp
+ 2009-09-21 20:53 . 2009-09-21 20:53 5518848 c:\windows\Installer\1a9d9c4.msp
+ 2009-10-14 12:34 . 2009-10-14 12:34 4405248 c:\windows\Installer\10c1aad.msi
+ 2009-10-14 12:26 . 2009-10-14 12:26 9013760 c:\windows\Installer\10c1779.msi
+ 2009-10-14 12:22 . 2009-10-14 12:22 3310592 c:\windows\Installer\10c14df.msi
+ 2009-10-14 07:09 . 2009-07-03 17:09 1208832 c:\windows\ie8updates\KB974455-IE8\urlmon.dll
+ 2009-10-14 07:09 . 2009-07-19 13:18 5937152 c:\windows\ie8updates\KB974455-IE8\mshtml.dll
+ 2009-10-14 07:09 . 2009-07-03 17:09 1985536 c:\windows\ie8updates\KB974455-IE8\iertutil.dll
+ 2008-10-15 14:21 . 2009-08-05 00:44 2189184 c:\windows\Driver Cache\i386\ntoskrnl.exe
- 2008-10-15 14:21 . 2009-02-06 10:32 2023936 c:\windows\Driver Cache\i386\ntkrpamp.exe
+ 2008-10-15 14:21 . 2009-08-04 14:20 2023936 c:\windows\Driver Cache\i386\ntkrpamp.exe
- 2008-10-15 14:21 . 2009-02-07 23:02 2066048 c:\windows\Driver Cache\i386\ntkrnlpa.exe
+ 2008-10-15 14:21 . 2009-08-04 14:20 2066048 c:\windows\Driver Cache\i386\ntkrnlpa.exe
+ 2008-10-15 14:21 . 2009-08-04 15:13 2145280 c:\windows\Driver Cache\i386\ntkrnlmp.exe
- 2008-10-15 14:21 . 2009-02-06 11:06 2145280 c:\windows\Driver Cache\i386\ntkrnlmp.exe
+ 2009-10-14 07:04 . 2009-10-14 07:04 4792320 c:\windows\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_d180be1a\System.dll
+ 2009-10-14 07:04 . 2009-10-14 07:04 1966080 c:\windows\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_bbb37b7c\System.dll
+ 2009-10-14 07:04 . 2009-10-14 07:04 2088960 c:\windows\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_2b45f0c0\System.Xml.dll
+ 2009-10-14 07:04 . 2009-10-14 07:04 5513216 c:\windows\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_06ac72b1\System.Xml.dll
+ 2009-10-14 07:04 . 2009-10-14 07:04 3018752 c:\windows\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_583dd383\System.Windows.Forms.dll
+ 2009-10-14 07:04 . 2009-10-14 07:04 7884800 c:\windows\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_570f1f19\System.Windows.Forms.dll
+ 2009-10-14 07:04 . 2009-10-14 07:04 2244608 c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_16d22c6c\System.Drawing.dll
+ 2009-10-14 07:04 . 2009-10-14 07:04 3395584 c:\windows\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_928a042e\System.Design.dll
+ 2009-10-14 07:04 . 2009-10-14 07:04 1470464 c:\windows\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_278ead22\System.Design.dll
+ 2009-10-14 07:05 . 2009-10-14 07:05 8908800 c:\windows\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_fd4b3df7\mscorlib.dll
+ 2009-10-14 07:04 . 2009-10-14 07:04 3391488 c:\windows\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_6513f975\mscorlib.dll
+ 2009-10-14 11:13 . 2009-10-14 11:13 3313664 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\204d6e5b335134f23ca37638b9227ecf\WindowsBase.ni.dll
+ 2009-10-14 11:16 . 2009-10-14 11:16 1049600 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\0f2ed6a204eb13841e99b77025464afc\UIAutomationClientsideProviders.ni.dll
+ 2009-10-14 11:13 . 2009-10-14 11:13 7868416 c:\windows\assembly\NativeImages_v2.0.50727_32\System\3de5bd01124463d7862bd173af90bc83\System.ni.dll
+ 2009-10-14 11:16 . 2009-10-14 11:16 5450752 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5913d3f81e77194ec833991b1047a532\System.Xml.ni.dll
+ 2009-10-14 11:58 . 2009-10-14 11:58 1356288 c:\windows\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\fa48917b13629d8effa80dd4a2f2973d\System.WorkflowServices.ni.dll
+ 2009-10-14 11:58 . 2009-10-14 11:58 1908224 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\6fe66ee6f3c81996bc148f1ebe7ec030\System.Workflow.Runtime.ni.dll
+ 2009-10-14 11:58 . 2009-10-14 11:58 4514304 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\9d0b61f2f1ebdc300bd970f594c422ef\System.Workflow.ComponentModel.ni.dll
+ 2009-10-14 11:58 . 2009-10-14 11:58 2992640 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\65328898148a720d394f802f192fc2a0\System.Workflow.Activities.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 1840640 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\ea07ac791bb5cb9f83679e3dd1a0c0cc\System.Web.Services.ni.dll
+ 2009-10-14 11:58 . 2009-10-14 11:58 2209280 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\29e2f8b1fb691ced973acf49fcee6ec1\System.Web.Mobile.ni.dll
+ 2009-10-14 11:57 . 2009-10-14 11:57 2403328 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\981dea02bc63c0c083e335adf9018788\System.Web.Extensions.ni.dll
+ 2009-10-14 11:16 . 2009-10-14 11:16 1917440 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Speech\99594bae1d022502925f5b9dfcdaae9a\System.Speech.ni.dll
+ 2009-10-14 11:57 . 2009-10-14 11:57 1706496 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\e182695d05ea57257568bc5f3208aca7\System.ServiceModel.Web.ni.dll
+ 2009-10-14 11:53 . 2009-10-14 11:53 2338304 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\67ad55827f2542552b576170f0a7dc56\System.Runtime.Serialization.ni.dll
+ 2009-10-14 11:16 . 2009-10-14 11:16 1035264 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Printing\e5313735a40c0800f116e27fba4754db\System.Printing.ni.dll
+ 2009-10-14 11:53 . 2009-10-14 11:53 1056768 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\c3b18fef5c6dc3bcdbe5df699fd21a55\System.IdentityModel.ni.dll
+ 2009-10-14 11:16 . 2009-10-14 11:16 1587200 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\abb2ac7e08bee026f857d8fa36f9fe6f\System.Drawing.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 1116672 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\f47ebb9db460874b1bcbfc391dc970b1\System.DirectoryServices.ni.dll
+ 2009-10-14 11:54 . 2009-10-14 11:54 1801216 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\c94a427baa7683f4221b91f90c18461b\System.Deployment.ni.dll
+ 2009-10-14 11:15 . 2009-10-14 11:15 6616576 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\694c07365e0fd6bba0bc304d4d2404a7\System.Data.ni.dll
+ 2009-10-14 11:54 . 2009-10-14 11:54 2510336 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\272152f0cc139490729e215611a4b244\System.Data.SqlXml.ni.dll
+ 2009-10-14 11:57 . 2009-10-14 11:57 1328128 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Services\112a48e34620a0210eb850040da8a31b\System.Data.Services.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 1115136 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\ffa1018e8022964eb51025c2c6d8727a\System.Data.OracleClient.ni.dll
+ 2009-10-14 11:15 . 2009-10-14 11:15 2516480 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\32788c58ff9f8324460604cf1fe7681b\System.Data.Linq.ni.dll
+ 2009-10-14 11:57 . 2009-10-14 11:57 9924096 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\9012cac7819660f61f1c69cf8e4f2ccf\System.Data.Entity.ni.dll
+ 2009-10-14 11:15 . 2009-10-14 11:15 2295296 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\c0a42d2ad8a4078040b334f6770ea11f\System.Core.ni.dll
+ 2009-10-14 11:15 . 2009-10-14 11:15 2128896 c:\windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\954685c29689d2a6126ceca1fd55e904\ReachFramework.ni.dll
+ 2009-10-14 11:15 . 2009-10-14 11:15 1657856 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\a3a6f52ce1d09a7bdccc8e7fc664792d\PresentationUI.ni.dll
+ 2009-10-14 11:13 . 2009-10-14 11:13 1451008 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\f906701365083c1473db31519147e263\PresentationBuildTasks.ni.dll
+ 2009-10-14 11:56 . 2009-10-14 11:56 1712128 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\6eee9b772b6d12d3dbd82f118c2ab2e5\Microsoft.VisualBasic.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 1093120 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\f19e9b439636d0744597fff1331cad04\Microsoft.Transactions.Bridge.ni.dll
+ 2009-10-14 11:54 . 2009-10-14 11:54 1635328 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\e99eb4d7073d355949e0de78ec9c0e7d\Microsoft.MapPoint.Graphics3D.ni.dll
+ 2009-10-14 11:54 . 2009-10-14 11:54 1021952 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\a4e7eb383a0549369985b195474b7b61\Microsoft.MapPoint.Data.ni.dll
+ 2009-10-14 11:54 . 2009-10-14 11:54 3334144 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\3e6c6fc78a23914f11ca24b9e3db60ba\Microsoft.MapPoint.Rendering3D.ni.dll
+ 2009-10-14 11:54 . 2009-10-14 11:54 2500096 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\2c13052a8d9a898369372fd03cf1569a\Microsoft.MapPoint.GraphicsAPI.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 2332160 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\5b1af7b5be24c7ace065fe1c81c2b650\Microsoft.JScript.ni.dll
+ 2009-10-14 11:56 . 2009-10-14 11:56 1620992 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\9eec1cc7ac37e0c7f3205e8156149c5a\Microsoft.Build.Tasks.ni.dll
+ 2009-10-14 11:56 . 2009-10-14 11:56 1966080 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\28c0730288453d57d5dcd62903c4d31b\Microsoft.Build.Tasks.v3.5.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 1888768 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\5dd4f58999eed37c12aee7ea9f9863ac\Microsoft.Build.Engine.ni.dll
+ 2009-10-14 11:10 . 2009-10-14 11:10 3149824 c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 3149824 c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
+ 2009-10-14 11:10 . 2009-10-14 11:10 2048000 c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 2048000 c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 5025792 c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 5025792 c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 5062656 c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 5062656 c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2009-10-14 11:08 . 2009-10-14 11:08 5242880 c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 5242880 c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 2933248 c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
+ 2009-10-14 11:10 . 2009-10-14 11:10 2933248 c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
+ 2009-10-14 11:09 . 2009-10-14 11:09 4546560 c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
- 2009-08-06 07:12 . 2009-08-06 07:12 4546560 c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2009-10-14 07:03 . 2009-10-14 07:03 1232896 c:\windows\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
- 2007-07-11 11:02 . 2007-07-11 11:02 1232896 c:\windows\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
+ 2009-10-14 07:03 . 2009-10-14 07:03 1265664 c:\windows\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
- 2007-07-11 11:02 . 2007-07-11 11:02 1265664 c:\windows\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
+ 2009-09-30 11:08 . 2009-09-30 11:08 2846720 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-09-30 11:08 . 2009-09-30 11:08 2676224 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-09-18 01:07 . 2008-06-18 10:03 2458112 c:\windows\$NtUninstallKB968816_WM9$\wmvcore.dll
+ 2009-09-18 01:07 . 2009-10-02 18:01 25198016 c:\windows\system32\MRT.exe
+ 2006-11-08 02:03 . 2009-08-29 08:08 11069440 c:\windows\system32\ieframe.dll
+ 2007-05-09 10:42 . 2009-08-29 08:08 11069440 c:\windows\system32\dllcache\ieframe.dll
+ 2009-08-11 01:08 . 2009-08-11 01:08 11315712 c:\windows\Microsoft.NET\Framework\v1.1.4322\Updates\M953297\M953297Uninstall.msp
+ 2009-08-15 00:32 . 2009-08-15 00:32 11110912 c:\windows\Installer\c91c86.msp
+ 2009-09-18 01:06 . 2009-09-18 01:06 15709696 c:\windows\Installer\567e176.msp
+ 2009-08-10 18:09 . 2009-08-10 18:09 17254912 c:\windows\Installer\1a9d9db.msp
+ 2009-10-14 07:09 . 2009-07-19 22:48 11067392 c:\windows\ie8updates\KB974455-IE8\ieframe.dll
+ 2009-10-07 12:25 . 2009-10-07 12:25 15595520 c:\windows\Downloaded Installations\{76564605-71B8-4261-A1AC-0DD34CC058CA}\FormViewer.msi
+ 2009-10-14 11:16 . 2009-10-14 11:16 12430848 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d2ea8d76f015817db1607075812b555f\System.Windows.Forms.ni.dll
+ 2009-10-14 11:55 . 2009-10-14 11:55 11796992 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\5cea03cfb008f2eac1439a9905467f37\System.Web.ni.dll
+ 2009-10-14 11:54 . 2009-10-14 11:54 17317888 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\06d6eab93282d2b136a377bd50b7c5a9\System.ServiceModel.ni.dll
+ 2009-10-14 11:16 . 2009-10-14 11:16 10683392 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Design\8b82e08c008924d51833cb0884bcbfc5\System.Design.ni.dll
+ 2009-10-14 11:14 . 2009-10-14 11:14 14327808 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\58c7ac6b6054038dc9346d7ec8e32b4c\PresentationFramework.ni.dll
+ 2009-10-14 11:13 . 2009-10-14 11:13 12216320 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\94badbd64df59de7da249f71da38b1c2\PresentationCore.ni.dll
+ 2009-10-14 11:12 . 2009-10-14 11:12 11486720 c:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7124a40b9998f7b63c86bd1a2125ce26\mscorlib.ni.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-24 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DLBTCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll" [2007-02-12 73728]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

c:\documents and settings\Cubby\Start Menu\Programs\Startup\
VZAccess Manager.lnk - c:\program files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe [2007-5-17 1220608]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-04-24 282624]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 wvauth nwprovau

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
backup=c:\windows\pss\Acrobat Assistant.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
backup=c:\windows\pss\Adobe Gamma Loader.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^EMBASSY Trust Suite Secure Update.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\EMBASSY Trust Suite Secure Update.lnk
backup=c:\windows\pss\EMBASSY Trust Suite Secure Update.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Service Manager.lnk
backup=c:\windows\pss\Service Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^cubby.MACDONALDWOOD^Start Menu^Programs^Startup^Anapod Manager.lnk]
path=c:\documents and settings\cubby.MACDONALDWOOD\Start Menu\Programs\Startup\Anapod Manager.lnk
backup=c:\windows\pss\Anapod Manager.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^cubby.MACDONALDWOOD^Start Menu^Programs^Startup^RCA Detective.lnk]
path=c:\documents and settings\cubby.MACDONALDWOOD\Start Menu\Programs\Startup\RCA Detective.lnk
backup=c:\windows\pss\RCA Detective.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\WINDOWS\\system32\\dlbtcoms.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\dlbtpswx.exe"=
"c:\\Program Files\\Red Chair Software\\Anapod Explorer\\anamgr.exe"=
"c:\\WebC_ActiveX4.22\\ptermX.exe"=
"c:\\Program Files\\Ericom Software\\PowerTerm WebConnect 5.6\\151.203.99.51\\ptermX.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\iMesh Applications\\iMesh\\iMesh.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

R2 DLBTCustomerConnect;DLBTCustomerConnect;c:\windows\system32\spool\drivers\w32x86\3\dlbtserv.exe [2/28/2007 6:24 PM 62960]
R2 WILPAR;Wordcraft Parallel Driver;c:\windows\system32\drivers\WILPAR.SYS [9/1/2006 11:40 AM 22976]
R3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [10/14/2009 11:42 AM 16640]
S0 ntcdrdrv;ntcdrdrv;c:\windows\system32\DRIVERS\ntcdrdrv.sys --> c:\windows\system32\DRIVERS\ntcdrdrv.sys [?]
S3 cur_bus;Curitel USB Composite Device driver (WDM);c:\windows\system32\drivers\cur_bus.sys [9/5/2006 10:41 AM 50176]
S3 cur_mdfl;Curitel Packet Service Filter;c:\windows\system32\drivers\cur_mdfl.sys [9/5/2006 10:41 AM 6096]
S3 cur_mdm;Curitel Packet Service Drivers;c:\windows\system32\drivers\cur_mdm.sys [9/5/2006 10:41 AM 81056]
S3 pwi_bus;Curitel PC Card Composite Device driver (WDM);c:\windows\system32\drivers\pwi_bus.sys [5/17/2007 2:28 PM 55344]
S3 pwi_mdfl;Curitel PC Card Filter;c:\windows\system32\drivers\pwi_mdfl.sys [5/17/2007 2:28 PM 9200]
S3 pwi_mdm;Curitel PC Card Drivers;c:\windows\system32\drivers\pwi_mdm.sys [5/17/2007 2:28 PM 89936]
S3 pwi_oflt;Curitel PC Card OHCI Filter;c:\windows\system32\drivers\pwi_oflt.sys [5/17/2007 2:28 PM 9472]
S3 pwi_serd;Curitel PC Card Diagnostic Serial Port (WDM);c:\windows\system32\drivers\pwi_serd.sys [5/17/2007 2:28 PM 69632]
S3 SMC2208;SMC Compact USB to Ethernet converter;c:\windows\system32\drivers\SMC2208.SYS [2/16/2008 12:40 PM 26525]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - CLASSPNP_2
*NewlyCreated* - MBR
*Deregistered* - CLASSPNP_2
*Deregistered* - mbr
.
Contents of the 'Scheduled Tasks' folder

2009-10-17 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34]

2009-10-27 c:\windows\Tasks\User_Feed_Synchronization-{522C9FDF-90D3-4175-A7FB-7B976A9CAC8A}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 08:31]

2009-10-24 c:\windows\Tasks\{CB904F16-01AA-4E35-81DF-0F9BCF531682}_MACDONALDWOOD_Cubby.job
- c:\windows\system32\mobsync.exe [2004-08-04 00:12]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
IE: &ieSpell Options - c:\program files\ieSpell\iespell.dll/SPELLOPTION.HTM
IE: Check &Spelling - c:\program files\ieSpell\iespell.dll/SPELLCHECK.HTM
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Lookup on Merriam Webster - file://c:\program files\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\ieSpell\wikipedia.HTM
LSP: vlsp.dll
Trusted Zone: stumbleupon.com
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: PUFLITE - hxxp://cubbyfitts.point2agent.com/Office/ColpaControls/Photo/Control/PUFLITE.CAB
DPF: {42D06124-98A2-47EC-8098-3778B58CE7D5} - hxxps://actsvr.comcastonline.com/techtools/dl/Comcast%20Activation%20Controls.cab
DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} - hxxp://www.facebook.com/controls/contactx.dll
DPF: {7EC816D4-6FC3-4C58-A7DA-A770EE461602} - hxxp://151.203.99.51/Ericom/WebConnect%205.6/web/windows/ptdownloader.cab
FF - ProfilePath - c:\documents and settings\cubby.MACDONALDWOOD\Application Data\Mozilla\Firefox\Profiles\xf0e1ri2.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.nytimes.com/|http://www.nytimes.com/
FF - component: c:\documents and settings\cubby.MACDONALDWOOD\Application Data\Mozilla\Firefox\Profiles\xf0e1ri2.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll
FF - hȋdden: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-NoteBurner - c:\program files\NoteBurner\VTBurnerGUI.exe
AddRemove-Active Security - c:\program files\Active Security\Uninstall.exe
AddRemove-HijackThis - c:\documents and settings\cubby.MACDONALDWOOD\Desktop\HijackThis.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-29 21:36
Windows 5.1.2600 Service Pack 3 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLBTCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1823468856-3774011236-2554016227-1605\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{1C9602E9-0078-28D7-9D74-7CB879902A53}*]
"iamoongcjdkkmbbope"=hex:6a,61,6c,70,6a,64,6d,67,66,69,68,70,6d,6f,6d,64,6d,6a,
6c,64,00,00
"hakohkpfpeeclemj"=hex:6a,61,64,62,65,65,6a,69,64,70,66,65,62,68,67,68,64,6e,
6b,62,00,f1
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(576)
c:\windows\system32\wvauth.dll
c:\windows\system32\biolsp.dll
c:\windows\system32\vlsp.dll

- - - - - - - > 'explorer.exe'(788)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\vlsp.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\LEXBCES.EXE
c:\windows\System32\SCardSvr.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Wave Systems Corp\Common\DataServer.exe
c:\windows\system32\dlbtcoms.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
c:\program files\Dell\QuickSet\NICCONFIGSVC.exe
c:\windows\system32\nvsvc32.exe
c:\windows\System32\spool\DRIVERS\W32X86\3\HPZipm12.exe
c:\windows\System32\bcmwltry.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-10-30 21:40 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-30 01:40
ComboFix2.txt 2009-09-24 22:08
ComboFix3.txt 2009-09-18 22:52
ComboFix4.txt 2009-09-18 12:38
ComboFix5.txt 2009-10-30 01:24

Pre-Run: 33,983,250,432 bytes free
Post-Run: 34,226,749,440 bytes free

- - End Of File - - 3AE4CE6974A897F604744BCAC9B2D1F2

Here it is:

ComboFix 09-10-28.08 - Cubby 10/30/2009 18:56.7.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.631 [GMT -4:00]
Running from: c:\documents and settings\cubby.MACDONALDWOOD\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\cubby.MACDONALDWOOD\Desktop\CFScript.txt
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\qywgjx

.
--------------- FCopy ---------------

c:\windows\system32\dllcache\eventlog.dll --> c:\windows\system32\eventlog.dll
.
((((((((((((((((((((((((( Files Created from 2009-09-28 to 2009-10-30 )))))))))))))))))))))))))))))))
.

2009-10-30 22:56 . 2004-08-04 10:00 55808 -c--a-w- c:\windows\system32\dllcache\eventlog.dll
2009-10-30 22:56 . 2004-08-04 10:00 55808 ----a-w- c:\windows\system32\eventlog.dll
2009-10-24 18:20 . 2009-10-24 18:24 -------- d-----w- C:\32788R22FWJFW.1.tmp
2009-10-14 15:42 . 2009-09-03 14:37 16640 ----a-w- c:\windows\system32\drivers\WsAudio_DeviceS(1).sys
2009-10-14 12:33 . 2008-04-17 17:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2009-10-14 12:31 . 2009-10-14 12:31 -------- d-----w- c:\program files\iPod
2009-10-14 12:30 . 2009-10-14 12:33 -------- d-----w- c:\program files\iTunes
2009-10-14 12:30 . 2009-10-14 12:33 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-10-14 12:28 . 2009-10-14 12:28 -------- d-----w- c:\documents and settings\cubby.MACDONALDWOOD\Local Settings\Application Data\WMA-MP3.com
2009-10-14 12:25 . 2009-10-14 12:26 -------- d-----w- c:\program files\QuickTime

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-28 11:59 . 2009-09-13 00:07 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-26 11:56 . 2007-04-13 00:07 -------- d-----w- c:\program files\dl_Cats
2009-10-24 13:31 . 2006-08-22 06:06 35001 ----a-w- c:\windows\system32\nvModes.dat
2009-10-16 15:49 . 2007-11-15 02:48 -------- d-----w- c:\documents and settings\cubby.MACDONALDWOOD\Application Data\Wave Systems Corp
2009-10-15 16:17 . 2006-09-13 17:27 87200 ----a-w- c:\documents and settings\cubby.MACDONALDWOOD\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-15 11:51 . 2008-08-19 01:06 -------- d-----w- c:\program files\Pinnacle
2009-10-14 23:35 . 2006-12-28 23:02 -------- d-----w- c:\program files\Winamp
2009-10-14 12:53 . 2006-12-25 22:35 -------- d-----w- c:\documents and settings\cubby.MACDONALDWOOD\Application Data\Apple Computer
2009-10-14 12:31 . 2007-09-13 00:45 -------- d-----w- c:\program files\Common Files\Apple
2009-10-13 15:18 . 2009-10-13 15:18 411036 ----a-w- c:\documents and settings\All Users\SPL4DA.tmp
2009-10-09 14:02 . 2006-09-13 15:35 -------- d-----w- c:\documents and settings\cubby.MACDONALDWOOD\Application Data\AdobeUM
2009-09-30 12:56 . 2009-09-30 12:56 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-09-30 12:56 . 2006-08-22 06:18 -------- d-----w- c:\program files\Java
2009-09-30 11:49 . 2007-12-23 14:54 -------- d-----w- c:\program files\Xilisoft
2009-09-30 11:48 . 2008-08-28 20:07 -------- d-----w- c:\program files\Common Files\DVDVideoSoft
2009-09-30 11:46 . 2009-08-25 01:26 -------- d-----w- c:\program files\AVS4YOU
2009-09-30 11:46 . 2009-08-25 01:26 -------- d-----w- c:\program files\Common Files\AVSMedia
2009-09-30 11:00 . 2009-08-21 00:40 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-30 10:42 . 2006-12-22 16:00 5 -c--a-w- c:\windows\system32\SySVid.dat
2009-09-25 13:16 . 2006-12-28 01:31 -------- d-----w- c:\program files\Azureus
2009-09-24 00:28 . 2007-09-13 16:05 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-09-24 00:17 . 2007-09-13 16:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-09-18 01:23 . 2009-03-28 23:35 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-11 14:18 . 2004-08-04 10:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-10 18:54 . 2009-09-13 00:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 18:53 . 2009-09-13 00:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-04 21:44 . 2009-09-30 11:09 515416 ----a-w- c:\windows\system32\XAudio2_5.dll
2009-09-04 21:44 . 2009-09-30 11:09 238936 ----a-w- c:\windows\system32\xactengine3_5.dll
2009-09-04 21:44 . 2009-09-30 11:09 69464 ----a-w- c:\windows\system32\XAPOFX1_3.dll
2009-09-04 21:29 . 2009-09-30 11:09 453456 ----a-w- c:\windows\system32\d3dx10_42.dll
2009-09-04 21:29 . 2009-09-30 11:09 235344 ----a-w- c:\windows\system32\d3dx11_42.dll
2009-09-04 21:29 . 2009-09-30 11:09 5501792 ----a-w- c:\windows\system32\d3dcsx_42.dll
2009-09-04 21:29 . 2009-09-30 11:09 1974616 ----a-w- c:\windows\system32\D3DCompiler_42.dll
2009-09-04 21:29 . 2009-09-30 11:09 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll
2009-09-04 21:03 . 2004-08-04 10:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-09-01 18:48 . 2009-09-01 15:53 -------- d-----w- c:\program files\M1N1
2009-09-01 14:35 . 2009-09-01 14:35 -------- d-----w- c:\documents and settings\cubby.MACDONALDWOOD\Application Data\Malwarebytes
2009-09-01 14:35 . 2009-09-01 14:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-01 10:13 . 2006-08-22 06:33 -------- d-----w- c:\program files\Google
2009-09-01 00:58 . 2006-12-28 01:31 -------- d-----w- c:\documents and settings\cubby.MACDONALDWOOD\Application Data\Azureus
2009-08-29 08:08 . 2006-03-04 03:33 916480 ------w- c:\windows\system32\wininet.dll
2009-08-28 23:42 . 2009-03-22 11:06 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-08-28 23:42 . 2009-03-22 11:06 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-08-26 08:00 . 2004-08-04 10:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-06 23:24 . 2004-08-10 18:02 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-06 23:24 . 2004-08-10 18:02 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-06 23:24 . 2005-05-26 08:16 44768 ----a-w- c:\windows\system32\wups2.dll
2009-08-06 23:24 . 2004-08-10 18:02 35552 ----a-w- c:\windows\system32\wups.dll
2009-08-06 23:24 . 2004-08-10 18:02 53472 ------w- c:\windows\system32\wuauclt.exe
2009-08-06 23:24 . 2004-08-04 10:00 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-06 23:23 . 2004-08-10 18:02 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-06 23:23 . 2009-03-29 23:54 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-08-06 23:23 . 2009-03-29 23:54 215920 ----a-w- c:\windows\system32\muweb.dll
2009-08-06 23:23 . 2004-08-10 18:02 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 09:01 . 2004-08-04 10:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 23:52 . 2009-08-04 23:52 1193832 ----a-w- c:\windows\system32\FM20.DLL
2009-08-04 15:13 . 2005-03-30 01:21 2145280 ------w- c:\windows\system32\ntoskrnl.exe
2009-08-04 14:20 . 2005-03-30 01:01 2023936 ------w- c:\windows\system32\ntkrnlpa.exe
2006-12-17 21:20 . 2006-12-17 21:20 36206039 -c--a-w- c:\program files\Top Producer Outlook Connector.EXE
2007-03-15 21:30 . 2007-03-15 21:30 80 -csha-r- c:\windows\system32\67F454E4E8.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-24 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DLBTCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll" [2007-02-12 73728]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

c:\documents and settings\Cubby\Start Menu\Programs\Startup\
VZAccess Manager.lnk - c:\program files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe [2007-5-17 1220608]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-04-24 282624]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 wvauth nwprovau

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk
backup=c:\windows\pss\Acrobat Assistant.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
backup=c:\windows\pss\Adobe Gamma Loader.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^EMBASSY Trust Suite Secure Update.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\EMBASSY Trust Suite Secure Update.lnk
backup=c:\windows\pss\EMBASSY Trust Suite Secure Update.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Service Manager.lnk
backup=c:\windows\pss\Service Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^cubby.MACDONALDWOOD^Start Menu^Programs^Startup^Anapod Manager.lnk]
path=c:\documents and settings\cubby.MACDONALDWOOD\Start Menu\Programs\Startup\Anapod Manager.lnk
backup=c:\windows\pss\Anapod Manager.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^cubby.MACDONALDWOOD^Start Menu^Programs^Startup^RCA Detective.lnk]
path=c:\documents and settings\cubby.MACDONALDWOOD\Start Menu\Programs\Startup\RCA Detective.lnk
backup=c:\windows\pss\RCA Detective.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\WINDOWS\\system32\\dlbtcoms.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\dlbtpswx.exe"=
"c:\\Program Files\\Red Chair Software\\Anapod Explorer\\anamgr.exe"=
"c:\\WebC_ActiveX4.22\\ptermX.exe"=
"c:\\Program Files\\Ericom Software\\PowerTerm WebConnect 5.6\\151.203.99.51\\ptermX.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\iMesh Applications\\iMesh\\iMesh.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"135:TCP"= 135:TCP:TCP Port 135
"5000:TCP"= 5000:TCP:TCP Port 5000
"5001:TCP"= 5001:TCP:TCP Port 5001
"5002:TCP"= 5002:TCP:TCP Port 5002
"5003:TCP"= 5003:TCP:TCP Port 5003
"5004:TCP"= 5004:TCP:TCP Port 5004
"5005:TCP"= 5005:TCP:TCP Port 5005
"5006:TCP"= 5006:TCP:TCP Port 5006
"5007:TCP"= 5007:TCP:TCP Port 5007
"5008:TCP"= 5008:TCP:TCP Port 5008
"5009:TCP"= 5009:TCP:TCP Port 5009
"5010:TCP"= 5010:TCP:TCP Port 5010
"5011:TCP"= 5011:TCP:TCP Port 5011
"5012:TCP"= 5012:TCP:TCP Port 5012
"5013:TCP"= 5013:TCP:TCP Port 5013
"5014:TCP"= 5014:TCP:TCP Port 5014
"5015:TCP"= 5015:TCP:TCP Port 5015
"5016:TCP"= 5016:TCP:TCP Port 5016
"5017:TCP"= 5017:TCP:TCP Port 5017
"5018:TCP"= 5018:TCP:TCP Port 5018
"5019:TCP"= 5019:TCP:TCP Port 5019
"5020:TCP"= 5020:TCP:TCP Port 5020
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

R2 DLBTCustomerConnect;DLBTCustomerConnect;c:\windows\system32\spool\drivers\w32x86\3\dlbtserv.exe [2/28/2007 6:24 PM 62960]
R2 WILPAR;Wordcraft Parallel Driver;c:\windows\system32\drivers\WILPAR.SYS [9/1/2006 11:40 AM 22976]
R3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [10/14/2009 11:42 AM 16640]
S0 ntcdrdrv;ntcdrdrv;c:\windows\system32\DRIVERS\ntcdrdrv.sys --> c:\windows\system32\DRIVERS\ntcdrdrv.sys [?]
S3 cur_bus;Curitel USB Composite Device driver (WDM);c:\windows\system32\drivers\cur_bus.sys [9/5/2006 10:41 AM 50176]
S3 cur_mdfl;Curitel Packet Service Filter;c:\windows\system32\drivers\cur_mdfl.sys [9/5/2006 10:41 AM 6096]
S3 cur_mdm;Curitel Packet Service Drivers;c:\windows\system32\drivers\cur_mdm.sys [9/5/2006 10:41 AM 81056]
S3 pwi_bus;Curitel PC Card Composite Device driver (WDM);c:\windows\system32\drivers\pwi_bus.sys [5/17/2007 2:28 PM 55344]
S3 pwi_mdfl;Curitel PC Card Filter;c:\windows\system32\drivers\pwi_mdfl.sys [5/17/2007 2:28 PM 9200]
S3 pwi_mdm;Curitel PC Card Drivers;c:\windows\system32\drivers\pwi_mdm.sys [5/17/2007 2:28 PM 89936]
S3 pwi_oflt;Curitel PC Card OHCI Filter;c:\windows\system32\drivers\pwi_oflt.sys [5/17/2007 2:28 PM 9472]
S3 pwi_serd;Curitel PC Card Diagnostic Serial Port (WDM);c:\windows\system32\drivers\pwi_serd.sys [5/17/2007 2:28 PM 69632]
S3 SMC2208;SMC Compact USB to Ethernet converter;c:\windows\system32\drivers\SMC2208.SYS [2/16/2008 12:40 PM 26525]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - CLASSPNP_2
*NewlyCreated* - MBR
*NewlyCreated* - PCIIDEX_2
*Deregistered* - CLASSPNP_2
*Deregistered* - mbr
*Deregistered* - PCIIDEX_2
.
Contents of the 'Scheduled Tasks' folder

2009-10-17 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34]

2009-10-27 c:\windows\Tasks\User_Feed_Synchronization-{522C9FDF-90D3-4175-A7FB-7B976A9CAC8A}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 08:31]

2009-10-24 c:\windows\Tasks\{CB904F16-01AA-4E35-81DF-0F9BCF531682}_MACDONALDWOOD_Cubby.job
- c:\windows\system32\mobsync.exe [2004-08-04 00:12]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
IE: &ieSpell Options - c:\program files\ieSpell\iespell.dll/SPELLOPTION.HTM
IE: Check &Spelling - c:\program files\ieSpell\iespell.dll/SPELLCHECK.HTM
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Lookup on Merriam Webster - file://c:\program files\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\ieSpell\wikipedia.HTM
LSP: vlsp.dll
Trusted Zone: stumbleupon.com
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: PUFLITE - hxxp://cubbyfitts.point2agent.com/Office/ColpaControls/Photo/Control/PUFLITE.CAB
DPF: {42D06124-98A2-47EC-8098-3778B58CE7D5} - hxxps://actsvr.comcastonline.com/techtools/dl/Comcast%20Activation%20Controls.cab
DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} - hxxp://www.facebook.com/controls/contactx.dll
DPF: {7EC816D4-6FC3-4C58-A7DA-A770EE461602} - hxxp://151.203.99.51/Ericom/WebConnect%205.6/web/windows/ptdownloader.cab
FF - ProfilePath - c:\documents and settings\cubby.MACDONALDWOOD\Application Data\Mozilla\Firefox\Profiles\xf0e1ri2.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.nytimes.com/|http://www.nytimes.com/
FF - component: c:\documents and settings\cubby.MACDONALDWOOD\Application Data\Mozilla\Firefox\Profiles\xf0e1ri2.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll
FF - hȋdden: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-30 19:02
Windows 5.1.2600 Service Pack 3 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLBTCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(576)
c:\windows\system32\wvauth.dll
c:\windows\system32\biolsp.dll
c:\windows\system32\vlsp.dll

- - - - - - - > 'explorer.exe'(1868)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\vlsp.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-10-30 19:04
ComboFix-quarantined-files.txt 2009-10-30 23:04
ComboFix2.txt 2009-10-30 01:40
ComboFix3.txt 2009-09-24 22:08
ComboFix4.txt 2009-09-18 22:52
ComboFix5.txt 2009-10-30 22:55

Pre-Run: 34,212,810,752 bytes free
Post-Run: 34,160,496,640 bytes free

- - End Of File - - 47EE8CBFA5EF05DC035428FEEAF7B27D

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

How is the machine running now?

Hey this is GREAT.
Thanks for ALL of your help....You are a Genius!