Need help with Google Search results hijack

aardvark42 · Joined: May 10, 2009 Posts: 9

Hi, could someone help me getting rid of this Google Search results hijack problem? The hijackthis log is pasted below. Thanks in advance.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:31:23, on 10/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\ArcSoft\Magic-i 3\uMgiSvr.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\CCM\CcmExec.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Network Associates\Common Framework\udaterui.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Network Associates\Common Framework\McTray.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\MicrosoftOffice97\Office\OSA.EXE
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\u0032610\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = actsvr.comcastonline.com:8100
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = cdn
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\udaterui.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVFX Engine] "C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe"
O4 - HKLM\..\Run: [masqform.exe] C:\Program Files\PureEdge\Viewer 6.0\masqform.exe -UpdateCurrentUser
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Program Files\Octoshape Streaming Services\u0032610\OctoshapeClient.exe" -inv:bootrun
O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Program Files\Creative\Shared Files\CamTray.exe"
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'Default user')
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\MicrosoftOffice97\Office\FINDFAST.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\MicrosoftOffice97\Office\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Button Manager.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Magic-i.lnk = C:\Program Files\ArcSoft\Magic-i 3\Magic-i.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = med.ad10.intern.kuleuven.ac.be
O17 - HKLM\Software\..\Telephony: DomainName = med.ad10.intern.kuleuven.ac.be
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = med.ad10.intern.kuleuven.ac.be
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = med.ad10.intern.kuleuven.ac.be
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = med.ad10.intern.kuleuven.ac.be
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - McAfee, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: MgiSvr - ArcSoft, Inc. - C:\Program Files\ArcSoft\Magic-i 3\uMgiSvr.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\winvnc4.exe

--
End of file - 12712 bytes

greyknight17 · Joined: Feb 03, 2003 Posts: 5674 Location: Brooklyn, NY

Welcome to Lockergnome.

Download GooredFix and save it to your Desktop. Double-click Goored.exe to run it. Select 1. Find Goored (no fix) by typing 1 and pressing Enter. A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called Goored.txt). Note: Do not run Option #2 yet.

Go to http://www.bleepingcomputer.com/combofix/how-to-use-combofix and follow the instructions on how to install the Recovery Console and run ComboFix. Go through all the steps until posting the log part. Post the combofix log here.

aardvark42 · Joined: May 10, 2009 Posts: 9

Hi,
thanks for your help.
Below the Gooredfix log file:

GooredFix v1.92 by jpshortstuff
Log created at 18:16 on 13/05/2009 running Option #1 (u0032610)
Firefox version 3.0.10 (nl)

=====Suspect Goored Entries=====

C:\Program Files\Mozilla Firefox\extensions\{C182AC6B-B045-4C8B-AF20-4527B7C0642B}

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.10\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.10\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

aardvark42 · Joined: May 10, 2009 Posts: 9

Result from Combofix scan:

ComboFix 09-05-13.02 - u0032610 13/05/2009 19:22.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2047.1623 [GMT 2:00]
Running from: c:\documents and settings\u0032610\Desktop\ComboFix.exe
AV: NOD32 antivirus systeem 2.50 *On-access scanning disabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\u0032610\Application Data\inst.exe
c:\windows\system32\dbxDgrevCheck.dll

----- BITS: Possible infected sites -----

hxxp://SMS-SRV-01:80
.
((((((((((((((((((((((((( Files Created from 2009-04-13 to 2009-05-13 )))))))))))))))))))))))))))))))
.

2009-05-13 16:39 . 2009-05-13 16:39 -------- d-----w c:\windows\5DF3D1BB894E4DCD8275159AC9829B43.TMP
2009-05-13 12:02 . 2009-05-13 12:02 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Apple Computer
2009-05-13 12:01 . 2009-05-13 12:01 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\ArcSoft
2009-05-13 12:01 . 2009-05-13 12:02 -------- d-----w c:\documents and settings\Administrator\Application Data\ArcSoft
2009-05-09 23:51 . 2009-05-10 09:47 -------- d-----w c:\documents and settings\u0032610\Local Settings\Application Data\SITEguard
2009-05-09 23:44 . 2009-05-10 09:51 -------- d-----w c:\documents and settings\All Users\Application Data\STOPzilla!
2009-05-03 17:57 . 2009-05-12 11:07 -------- d-----w c:\documents and settings\u0032610\Local Settings\Application Data\Canon Easy-PhotoPrint EX
2009-05-03 17:55 . 2009-05-03 17:55 -------- d--h--w c:\documents and settings\All Users\Application Data\CanonIJEGV
2009-04-30 10:46 . 2009-04-30 10:46 -------- d-----w c:\documents and settings\u0032610\Application Data\QuosaDDM
2009-04-25 11:59 . 2009-04-25 11:59 -------- d--h--w c:\documents and settings\All Users\Application Data\CanonBJ
2009-04-25 11:58 . 2008-10-08 20:00 230912 ----a-w c:\windows\system32\CNMLM9E.DLL
2009-04-25 11:58 . 2009-04-25 11:58 -------- d--h--w c:\windows\system32\CanonIJ Uninstaller Information
2009-04-25 11:58 . 2007-03-15 05:12 188416 ----a-w c:\windows\system32\CNC540O.DLL
2009-04-25 11:58 . 2008-05-30 00:27 270336 ----a-w c:\windows\system32\CNC540L.DLL
2009-04-25 11:58 . 2008-04-07 05:58 98304 ----a-w c:\windows\system32\CNC540I.DLL
2009-04-25 11:58 . 2008-04-07 05:58 1339392 ----a-w c:\windows\system32\CNC540C.DLL
2009-04-25 11:58 . 2009-04-25 11:58 -------- d--h--w c:\program files\CanonBJ
2009-04-21 11:54 . 2009-04-21 11:54 -------- d-----w c:\program files\support.com
2009-04-21 11:54 . 2009-04-21 11:54 -------- d-----w c:\documents and settings\u0032610\Local Settings\Application Data\SupportSoft
2009-04-21 11:53 . 2009-04-21 11:53 -------- d-----w c:\program files\Common Files\SupportSoft
2009-04-16 07:01 . 2009-04-16 07:02 -------- d-----w c:\documents and settings\u0032610\Application Data\U3

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-12 15:20 . 2005-04-25 09:36 164690 ----a-w c:\windows\system32\nvModes.dat
2009-05-12 06:24 . 2005-04-25 17:12 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-11 06:49 . 2006-11-28 09:39 -------- d-----w c:\program files\Mozilla Thunderbird
2009-04-30 01:06 . 2006-02-20 13:30 -------- d-----w c:\program files\Sonic
2009-04-25 12:02 . 2008-01-08 11:13 -------- d-----w c:\program files\Canon
2009-03-29 22:49 . 2009-01-31 07:26 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-03-29 22:37 . 2009-03-29 22:37 132 ----a-w c:\windows\DeleteDll.bat
2009-03-29 15:03 . 2009-01-24 05:03 -------- d-----w c:\program files\ArcSoft
2009-03-26 14:49 . 2009-01-31 07:26 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-26 14:49 . 2009-01-31 07:26 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-03-25 19:04 . 2006-05-02 15:40 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-03-22 17:15 . 2009-03-22 17:15 -------- d-----w c:\program files\VideoLAN
2005-04-14 16:41 . 2005-04-28 19:23 44153 -c--a-w c:\program files\mozilla firefox\components\inspector.dll
2008-01-14 19:12 . 2008-01-14 19:08 24 -csh--w c:\windows\SD6B135B3.tmp
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2006-11-24 20058152]
"Octoshape Streaming Services"="c:\program files\Octoshape Streaming Services\u0032610\OctoshapeClient.exe" [2006-02-13 214648]
"Creative WebCam Tray"="c:\program files\Creative\Shared Files\CamTray.exe" [2005-10-27 299008]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2007-09-20 1410344]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-10 216520]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-09-13 155648]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 57344]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-09-08 7118848]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-09-22 98304]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576]
"AVFX Engine"="c:\program files\Creative\Creative Live! Cam\VideoFX\StartFX.exe" [2007-04-09 20480]
"masqform.exe"="c:\program files\PureEdge\Viewer 6.0\masqform.exe" [2003-12-03 1052672]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-12-11 286720]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 1836328]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2009-04-29 188728]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-10 689488]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-17 1848648]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2005-09-08 1519616]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"TSClientMSIUninstaller"="c:\windows\Installer\TSClientMsiTrans\tscuinst.vbs" [2007-10-30 13801]
"TSClientAXDisabler"="c:\windows\Installer\TSClientMsiTrans\tscdsbl.bat" [2008-01-18 2247]

c:\documents and settings\u0032610\Start Menu\Programs\Startup\
Microsoft Find Fast.lnk - c:\program files\MicrosoftOffice97\Office\FINDFAST.EXE [1996-11-21 111376]
Office Startup.lnk - c:\program files\MicrosoftOffice97\Office\OSA.EXE [1996-11-21 51984]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
HP Button Manager.lnk - c:\program files\HP\Button Manager\BM.exe [2009-1-24 249856]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-9 28672]
Magic-i.lnk - c:\program files\ArcSoft\Magic-i 3\Magic-i.exe [2009-1-24 530944]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.e

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\0\0]
"Script"=AAC.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\1\0]
"Script"=addlocaladmingroup.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-220523388-162531612-1801674531-2260\Scripts\Logon\0\0]
"Script"=\\med-srv-03\public\tvd.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-220523388-162531612-1801674531-2736\Scripts\Logon\0\0]
"Script"=VistaCheck.vbs

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
backup=c:\windows\pss\Adobe Gamma Loader.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\EA GAMES\\Battlefield 1942\\BF1942.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Network Associates\\Common Framework\\FrameworkService.exe"=
"c:\\Program Files\\Octoshape Streaming Services\\u0032610\\OctoshapeClient.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\SSH Secure Shell\\SshClient.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 Ext2fs;Ext2fs;c:\windows\system32\drivers\ext2fs.sys [19/12/2008 19:48 181120]
R1 IfsMount;IfsMount;c:\windows\system32\drivers\ifsmount.sys [19/12/2008 19:48 51072]
R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [24/11/2006 19:06 59904]
R2 DLPortIO;DriverLINX Port I/O Driver;c:\windows\system32\drivers\DLPORTIO.sys [28/04/2005 14:19 3584]
S3 PD1170VID;Creative WebCam Notebook;c:\windows\system32\drivers\P1170vid.sys [2/07/2008 13:38 106496]
S3 PowerLabUSB;ADInstruments PowerLab driver;c:\windows\system32\drivers\PLUSB.sys [27/06/2006 16:35 16896]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [31/01/2009 8:51 356920]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{04eb463b-63e5-11db-b7ff-0012f037e9e3}]
\Shell\AutoRun\command - F:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7515a221-35c5-11de-b8d5-001143782cc0}]
\Shell\Shell00\Command - F:\Start.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fdc9e8d3-40fb-11dd-b87c-001143782cc0}]
\Shell\Shell00\Command - F:\Start.exe
.
Contents of the 'Scheduled Tasks' folder

2009-04-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 13:57]
.
- - - - ORPHANS REMOVED - - - -

Toolbar-SITEguard - (no file)
HKLM-Run-ISUSPM Startup - c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
Notify-WRNotifier - (no file)

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyServer = actsvr.comcastonline.com:8100
uInternet Settings,ProxyOverride = cdn
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\u0032610\Application Data\Mozilla\Firefox\Profiles\xqihsxnj.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.be/
FF - plugin: c:\documents and settings\u0032610\Application Data\Mozilla\plugins\npoctoshape.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdbplug.dll
FF - plugin: c:\program files\Octoshape Streaming Services\u0032610\octoprogram-L03-NMS0810164_SUA_000\npoctoshape.dll
FF - plugin: c:\windows\SYSTEM32\DNAML\npdbplug.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-13 19:24
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-220523388-162531612-1801674531-2736\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:05,14,73,cc,71,3e,6e,9c,47,3f,2d,c8,c0,34,bf,3f,4a,a7,2c,ae,5b,2e,36,
d5,c4,71,9e,65,9c,6a,62,a2,02,51,0d,a2,47,90,a2,18,ee,84,02,04,cf,6c,61,ba,\
"??"=hex:3a,8f,87,66,61,da,a0,69,af,30,24,92,59,fc,9c,d3

[HKEY_LOCAL_MACHINE\software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:24,5d,17,b9,cd,74,14,b8,76,52,7e,50,63,07,cd,b8,38,9c,5a,fb,d0,6f,49,
d5,24,4c,d2,3e,9b,54,4f,57,7f,58,90,4a,2f,a9,22,59,93,03,cc,9c,2c,ca,b4,cb,\
"??"=hex:7d,9d,51,aa,2e,25,26,26,14,ac,27,9f,70,7f,3e,ec
.
Completion time: 2009-05-13 19:26
ComboFix-quarantined-files.txt 2009-05-13 17:26

Pre-Run: 3.785.846.784 bytes free
Post-Run: 3.791.495.168 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

215 --- E O F --- 2008-12-19 08:38

greyknight17 · Joined: Feb 03, 2003 Posts: 5674 Location: Brooklyn, NY

Double-click Goored.exe on your Desktop to run it. Select 2. Fix Goored by typing 2 and pressing Enter. Make sure all instances of Firefox are closed at this point. Type y at the prompt and press Enter again. A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called Goored.txt).

Open up your Notepad editor (Start->Run, type in notepad and click OK). Copy the text from the quotebox below into Notepad:

aardvark42 · Joined: May 10, 2009 Posts: 9

I seem to have a problem with Combofix.exe.
When dragging the CFScript.txt onto the Combofix.exe, I`m asked to allow the program to run, then I see a small window loading the Combofix program, after this nothing happens. Any suggestions?

aardvark42 · Joined: May 10, 2009 Posts: 9

Hi,
Although I didn`t get a second log from Combofix, it appears my Google Results hijack problem has been solved. Should I do additional tests to make sure all is ok again? Thanks in advance for your input.

greyknight17 · Joined: Feb 03, 2003 Posts: 5674 Location: Brooklyn, NY

Did you run Goored.exe option #2?

Run ComboFix manually by double-clicking on it. Post the new log here when ready.

aardvark42 · Joined: May 10, 2009 Posts: 9

yes, I ran Goored.exe, below the log. But after that Combofix.exe doesn`t seem to run correctly. After starting Combofix.exe, it starts loading, after this I don`t get prompted, nothing appears to happen (have waited several hours). Do I need to disable Virusscan when running Combofix again?

GooredFix v1.92 by jpshortstuff
Log created at 13:15 on 14/05/2009 running Option #2 (u0032610)
Firefox version 3.0.10 (nl)

=====Goored Deletions=====
C:\Program Files\Mozilla Firefox\extensions\{C182AC6B-B045-4C8B-AF20-4527B7C0642B}
->Backing up folder... Done.
->Emptying folder... Done.
->Deleting folder... Done.

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.10\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.10\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

greyknight17 · Joined: Feb 03, 2003 Posts: 5674 Location: Brooklyn, NY

You may disable your security programs (after disconnecting from the internet first) to see if ComboFix will run properly. It usually won't block ComboFix, but some may interfere with it.

If that still doesn't work, let's try removing it first. Go to Start->Run, copy/paste in combofix /u and hit OK to remove it. Then download it again. Before you save it, try renamining it to aardvark42.com and then click on Save button to save to your desktop. See if you can run it now.

aardvark42 · Joined: May 10, 2009 Posts: 9

Hi, I guess my virusscanner was preventing Combofix to run properly.
Below the latest log from Combofix:

ComboFix 09-05-18.04 - u0032610 19/05/2009 7:12.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2047.1609 [GMT 2:00]
Running from: c:\documents and settings\u0032610\Desktop\aardvark42.exe
AV: NOD32 antivirus systeem 2.50 *On-access scanning disabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

----- BITS: Possible infected sites -----

hxxp://wsu-srv-02
.
((((((((((((((((((((((((( Files Created from 2009-04-19 to 2009-05-19 )))))))))))))))))))))))))))))))
.

2009-05-18 09:34 . 2009-05-18 09:34 -------- d-----w c:\documents and settings\All Users\Application Data\GroupPolicy
2009-05-18 08:49 . 2009-05-18 08:49 -------- d-----w c:\windows\system32\XPSViewer
2009-05-18 08:49 . 2009-05-18 08:49 -------- d-----w c:\program files\Reference Assemblies
2009-05-18 08:47 . 2009-05-18 08:48 -------- d-----w C:\6ae3fb079f2179ba76a349
2009-05-18 08:46 . 2009-05-19 01:11 -------- d-----w c:\windows\SxsCaPendDel
2009-05-18 08:07 . 2009-05-18 08:07 -------- d-----w c:\program files\Microsoft Silverlight
2009-05-18 02:47 . 2009-02-03 19:59 56832 -c----w c:\windows\system32\dllcache\secur32.dll
2009-05-18 02:46 . 2008-12-05 06:54 144896 -c----w c:\windows\system32\dllcache\schannel.dll
2009-05-18 02:46 . 2009-03-06 14:22 284160 -c----w c:\windows\system32\dllcache\pdh.dll
2009-05-18 02:46 . 2009-02-06 11:11 110592 -c----w c:\windows\system32\dllcache\services.exe
2009-05-18 02:46 . 2009-02-09 12:10 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-05-18 02:46 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-05-18 02:46 . 2009-02-09 12:10 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-18 02:46 . 2009-02-09 12:10 729088 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-05-18 02:45 . 2008-06-12 14:23 91648 -c----w c:\windows\system32\dllcache\mtxoci.dll
2009-05-18 02:45 . 2008-06-12 14:23 161792 -c----w c:\windows\system32\dllcache\msdtcuiu.dll
2009-05-18 02:45 . 2008-06-12 14:23 66560 -c----w c:\windows\system32\dllcache\mtxclu.dll
2009-05-18 02:45 . 2008-06-12 14:23 58880 -c----w c:\windows\system32\dllcache\msdtclog.dll
2009-05-18 02:45 . 2008-06-12 14:23 956928 -c----w c:\windows\system32\dllcache\msdtctm.dll
2009-05-18 02:42 . 2009-02-20 08:10 81920 -c----w c:\windows\system32\dllcache\ieencode.dll
2009-05-18 02:41 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
2009-05-18 02:41 . 2008-04-21 12:08 215552 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-05-16 01:54 . 2009-05-16 01:54 -------- d-----w c:\program files\iPod
2009-05-16 01:54 . 2009-05-16 01:55 -------- d-----w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-16 01:54 . 2009-05-16 01:55 -------- d-----w c:\program files\iTunes
2009-05-16 01:49 . 2009-05-16 01:49 -------- d-----w c:\program files\Apple Software Update
2009-05-16 01:49 . 2009-03-26 13:23 36864 ----a-w c:\windows\system32\drivers\usbaapl.sys
2009-05-16 01:49 . 2009-03-26 13:23 1900544 ----a-w c:\windows\system32\usbaaplrc.dll
2009-05-16 01:48 . 2009-05-16 01:54 -------- d-----w c:\program files\Common Files\Apple
2009-05-15 00:07 . 2009-05-15 00:07 -------- d--h--w c:\documents and settings\All Users\Application Data\CanonIJScan
2009-05-15 00:06 . 2009-05-15 00:07 -------- d-----w c:\documents and settings\u0032610\Application Data\Canon
2009-05-13 16:39 . 2009-05-13 16:39 -------- d-----w c:\windows\5DF3D1BB894E4DCD8275159AC9829B43.TMP
2009-05-13 12:02 . 2009-05-13 12:02 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Apple Computer
2009-05-13 12:01 . 2009-05-13 12:01 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\ArcSoft
2009-05-13 12:01 . 2009-05-13 12:02 -------- d-----w c:\documents and settings\Administrator\Application Data\ArcSoft
2009-05-09 23:51 . 2009-05-10 09:47 -------- d-----w c:\documents and settings\u0032610\Local Settings\Application Data\SITEguard
2009-05-09 23:44 . 2009-05-10 09:51 -------- d-----w c:\documents and settings\All Users\Application Data\STOPzilla!
2009-05-03 17:57 . 2009-05-13 22:59 -------- d-----w c:\documents and settings\u0032610\Local Settings\Application Data\Canon Easy-PhotoPrint EX
2009-05-03 17:55 . 2009-05-03 17:55 -------- d--h--w c:\documents and settings\All Users\Application Data\CanonIJEGV
2009-04-30 10:46 . 2009-04-30 10:46 -------- d-----w c:\documents and settings\u0032610\Application Data\QuosaDDM
2009-04-25 11:59 . 2009-04-25 11:59 -------- d--h--w c:\documents and settings\All Users\Application Data\CanonBJ
2009-04-25 11:58 . 2008-10-08 20:00 230912 ----a-w c:\windows\system32\CNMLM9E.DLL
2009-04-25 11:58 . 2009-04-25 11:58 -------- d--h--w c:\windows\system32\CanonIJ Uninstaller Information
2009-04-25 11:58 . 2007-03-15 05:12 188416 ----a-w c:\windows\system32\CNC540O.DLL
2009-04-25 11:58 . 2008-05-30 00:27 270336 ----a-w c:\windows\system32\CNC540L.DLL
2009-04-25 11:58 . 2008-04-07 05:58 98304 ----a-w c:\windows\system32\CNC540I.DLL
2009-04-25 11:58 . 2008-04-07 05:58 1339392 ----a-w c:\windows\system32\CNC540C.DLL
2009-04-25 11:58 . 2009-04-25 11:58 -------- d--h--w c:\program files\CanonBJ
2009-04-21 11:54 . 2009-04-21 11:54 -------- d-----w c:\program files\support.com
2009-04-21 11:54 . 2009-04-21 11:54 -------- d-----w c:\documents and settings\u0032610\Local Settings\Application Data\SupportSoft
2009-04-21 11:53 . 2009-04-21 11:53 -------- d-----w c:\program files\Common Files\SupportSoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-19 03:54 . 2006-11-28 09:39 -------- d-----w c:\program files\Mozilla Thunderbird
2009-05-18 08:49 . 2008-03-02 09:46 -------- d-----w c:\program files\MSBuild
2009-05-18 08:19 . 2008-03-02 09:47 -------- d-----w c:\program files\Microsoft Works
2009-05-16 16:24 . 2005-04-25 09:36 164690 ----a-w c:\windows\system32\nvModes.dat
2009-05-16 10:51 . 2005-04-25 17:12 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-16 01:53 . 2008-01-08 15:28 -------- d-----w c:\program files\Bonjour
2009-05-16 01:52 . 2006-09-18 09:30 -------- d-----w c:\program files\QuickTime
2009-05-15 13:49 . 2006-05-02 15:40 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-05-14 00:19 . 2005-04-28 14:56 93472 -c--a-w c:\documents and settings\u0032610\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-13 22:11 . 2009-01-24 05:03 -------- d-----w c:\program files\ArcSoft
2009-05-13 22:11 . 2009-01-24 05:03 -------- d-----w c:\program files\Common Files\ArcSoft
2009-04-30 01:06 . 2006-02-20 13:30 -------- d-----w c:\program files\Sonic
2009-04-25 12:02 . 2008-01-08 11:13 -------- d-----w c:\program files\Canon
2009-03-29 22:49 . 2009-01-31 07:26 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-03-29 22:37 . 2009-03-29 22:37 132 ----a-w c:\windows\DeleteDll.bat
2009-03-26 14:49 . 2009-01-31 07:26 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-26 14:49 . 2009-01-31 07:26 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-03-22 17:15 . 2009-03-22 17:15 -------- d-----w c:\program files\VideoLAN
2009-03-19 14:32 . 2006-09-19 14:44 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-06 14:22 . 2004-09-08 12:07 284160 ----a-w c:\windows\system32\pdh.dll
2009-02-20 08:10 . 2004-09-08 12:02 666112 ----a-w c:\windows\system32\wininet.dll
2009-02-20 08:10 . 2004-09-08 12:05 81920 ----a-w c:\windows\system32\ieencode.dll
2005-04-14 16:41 . 2005-04-28 19:23 44153 -c--a-w c:\program files\mozilla firefox\components\inspector.dll
2008-01-14 19:12 . 2008-01-14 19:08 24 -csh--w c:\windows\SD6B135B3.tmp
.

((((((((((((((((((((((((((((( SnapShot.RemoveThis@2009-05-13_17.24.33 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-07-29 19:10 . 2008-07-29 19:10 26112 c:\windows\system32\TsWpfWrp.exe
+ 2005-07-20 10:05 . 2007-11-30 11:18 26488 c:\windows\system32\spupdsvc.exe
- 2005-07-20 10:05 . 2007-08-10 18:46 26488 c:\windows\system32\spupdsvc.exe
+ 2008-10-01 07:22 . 2008-07-06 12:06 89088 c:\windows\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
+ 2008-03-02 09:48 . 2008-11-10 09:41 67472 c:\windows\system32\spool\drivers\w32x86\msonpui.dll
+ 2008-03-02 09:48 . 2008-11-10 09:41 67472 c:\windows\system32\spool\drivers\w32x86\3\msonpui.dll
- 2007-05-30 08:52 . 2007-11-30 12:39 17272 c:\windows\system32\spmsg.dll
+ 2007-05-30 08:52 . 2007-11-30 11:18 17272 c:\windows\system32\spmsg.dll
+ 2004-09-08 12:02 . 2009-02-03 19:59 56832 c:\windows\system32\secur32.dll
+ 2004-09-08 12:07 . 2009-02-06 10:39 35328 c:\windows\system32\sc.exe
+ 2008-07-29 17:59 . 2008-07-29 17:59 43544 c:\windows\system32\PresentationHostProxy.dll
+ 2004-09-08 12:03 . 2009-05-19 01:18 71100 c:\windows\system32\perfc009.dat
- 2007-10-24 00:47 . 2007-10-24 00:47 15360 c:\windows\system32\mui\0409\mscorees.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 15360 c:\windows\system32\mui\0409\mscorees.dll
+ 2005-04-25 09:23 . 2008-06-12 14:23 91648 c:\windows\system32\mtxoci.dll
- 2005-04-25 09:23 . 2008-04-14 03:42 91648 c:\windows\system32\mtxoci.dll
+ 2004-09-08 12:06 . 2008-06-12 14:23 66560 c:\windows\system32\mtxclu.dll
- 2004-09-08 12:06 . 2008-04-14 03:42 66560 c:\windows\system32\mtxclu.dll
+ 2008-03-02 09:48 . 2008-11-10 09:41 32656 c:\windows\system32\msonpmon.dll
- 2005-04-25 09:23 . 2008-04-14 03:42 58880 c:\windows\system32\msdtclog.dll
+ 2005-04-25 09:23 . 2008-06-12 14:23 58880 c:\windows\system32\msdtclog.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 83968 c:\windows\system32\mscories.dll
+ 2008-07-29 17:24 . 2008-07-29 17:24 97800 c:\windows\system32\infocardapi.dll
+ 2008-07-29 17:24 . 2008-07-29 17:24 11264 c:\windows\system32\icardres.dll
+ 2008-07-29 19:10 . 2008-07-29 19:10 73720 c:\windows\system32\dxva2.dll
+ 2009-05-16 01:49 . 2009-03-26 13:23 36864 c:\windows\system32\DRVSTORE\usbaapl_AF109929C2381E41FEF454F3FEDAA257A9E85F92\usbaapl.sys
+ 2009-05-16 01:55 . 2009-03-19 14:32 23400 c:\windows\system32\DRVSTORE\GEARAspiWD_F475AF659D36685632E9BD97B57E9D9661FF3FFD\x86\GEARAspiWDM.sys
+ 2008-12-12 09:11 . 2008-12-12 09:11 61440 c:\windows\system32\dnssd.dll
+ 2008-12-12 09:18 . 2008-12-12 09:18 87336 c:\windows\system32\dns-sd.exe
+ 2004-09-08 12:07 . 2009-02-06 10:39 35328 c:\windows\system32\dllcache\sc.exe
+ 2006-10-14 14:43 . 2008-07-06 12:06 89088 c:\windows\system32\dllcache\filterpipelineprintproc.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 96760 c:\windows\system32\dfshim.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 96760 c:\windows\system32\dfshim.dll
+ 2008-07-29 21:40 . 2008-07-29 21:40 70648 c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
+ 2008-07-29 21:40 . 2008-07-29 21:40 91136 c:\windows\Microsoft.NET\Framework\v3.5\MSBuild.exe
+ 2008-07-29 21:40 . 2008-07-29 21:40 41984 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft.VisualC.STLCLR.dll
+ 2008-07-29 21:40 . 2008-07-29 21:40 40960 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft.Data.Entity.Build.Tasks.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 89080 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.2052.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 92664 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1042.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 95224 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1041.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 89592 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1028.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 84480 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.2052.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 94720 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1042.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 97792 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1041.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 84992 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1028.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 97280 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\DeleteTemp.exe
+ 2008-07-29 21:40 . 2008-07-29 21:40 95224 c:\windows\Microsoft.NET\Framework\v3.5\EdmGen.exe
+ 2008-07-29 21:40 . 2008-07-29 21:40 78856 c:\windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe
+ 2008-07-29 21:40 . 2008-07-29 21:40 41984 c:\windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe
+ 2008-07-29 21:40 . 2008-07-29 21:40 41992 c:\windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe
+ 2008-07-29 21:40 . 2008-07-29 21:40 41992 c:\windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe
+ 2008-07-29 19:10 . 2008-07-29 19:10 46104 c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
+ 2008-07-29 17:59 . 2008-07-29 17:59 32768 c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationCFFRasterizer.dll
+ 2008-07-29 19:10 . 2008-07-29 19:10 71160 c:\windows\Microsoft.NET\Framework\v3.0\WPF\PenIMC.dll
+ 2008-07-29 17:32 . 2008-07-29 17:32 17448 c:\windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\PerformanceCounterInstaller.exe
+ 2008-07-29 17:16 . 2008-07-29 17:16 32768 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.WasHosting.dll
+ 2008-07-29 17:16 . 2008-07-29 17:16 73728 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.Install.dll
+ 2008-07-29 17:16 . 2008-07-29 17:16 20504 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceMonikerSupport.dll
+ 2008-07-29 17:16 . 2008-07-29 17:16 11280 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelEvents.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 37896 c:\windows\Microsoft.NET\Framework\v2.0.50727\WMINet_Utils.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 37896 c:\windows\Microsoft.NET\Framework\v2.0.50727\WMINet_Utils.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 81400 c:\windows\Microsoft.NET\Framework\v2.0.50727\TLBREF.DLL
- 2007-10-24 00:47 . 2007-10-24 00:47 81400 c:\windows\Microsoft.NET\Framework\v2.0.50727\TLBREF.DLL
+ 2008-07-25 09:17 . 2008-07-25 09:17 77824 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.RegularExpressions.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 57392 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 57392 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 81920 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.Design.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 81920 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.Design.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 81920 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 81920 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 95232 c:\windows\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 95232 c:\windows\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 16896 c:\windows\Microsoft.NET\Framework\v2.0.50727\sbscmp20_mscorlib.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 16896 c:\windows\Microsoft.NET\Framework\v2.0.50727\sbscmp20_mscorlib.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 61952 c:\windows\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe
- 2007-10-24 00:47 . 2007-10-24 00:47 61952 c:\windows\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe
+ 2008-07-25 09:17 . 2008-07-25 09:17 32768 c:\windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
- 2007-10-24 00:47 . 2007-10-24 00:47 32768 c:\windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
- 2007-10-24 00:47 . 2007-10-24 00:47 53248 c:\windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
+ 2008-07-25 09:17 . 2008-07-25 09:17 53248 c:\windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
+ 2008-07-25 09:17 . 2008-07-25 09:17 88584 c:\windows\Microsoft.NET\Framework\v2.0.50727\PerfCounter.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 24584 c:\windows\Microsoft.NET\Framework\v2.0.50727\normalization.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 24584 c:\windows\Microsoft.NET\Framework\v2.0.50727\normalization.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 31744 c:\windows\Microsoft.NET\Framework\v2.0.50727\MUI\0409\mscorsecr.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 31744 c:\windows\Microsoft.NET\Framework\v2.0.50727\MUI\0409\mscorsecr.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 19456 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscortim.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 19456 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscortim.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 69632 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
- 2007-10-24 00:47 . 2007-10-24 00:47 18944 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsn.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 18944 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsn.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 77312 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 77312 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 94208 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorld.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 94208 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorld.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 46592 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorie.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 83456 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordbc.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 83456 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordbc.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 69632 c:\windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
+ 2008-07-25 09:16 . 2008-07-25 09:16 69632 c:\windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
+ 2008-07-25 09:16 . 2008-07-25 09:16 97792 c:\windows\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 97792 c:\windows\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 12800 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 12800 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 32768 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 32768 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 28672 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Vsa.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 28672 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Vsa.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 77824 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Utilities.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 77824 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Utilities.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 36864 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Framework.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 36864 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Framework.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 40960 c:\windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe
- 2007-10-24 00:47 . 2007-10-24 00:47 40960 c:\windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe
+ 2008-07-25 09:17 . 2008-07-25 09:17 72192 c:\windows\Microsoft.NET\Framework\v2.0.50727\ISymWrapper.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 72192 c:\windows\Microsoft.NET\Framework\v2.0.50727\ISymWrapper.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 65032 c:\windows\Microsoft.NET\Framework\v2.0.50727\InstallUtilLib.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 65032 c:\windows\Microsoft.NET\Framework\v2.0.50727\InstallUtilLib.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 28672 c:\windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
+ 2008-07-25 09:17 . 2008-07-25 09:17 28672 c:\windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
+ 2008-07-25 09:17 . 2008-07-25 09:17 77824 c:\windows\Microsoft.NET\Framework\v2.0.50727\IEHost.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 77824 c:\windows\Microsoft.NET\Framework\v2.0.50727\IEHost.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 18936 c:\windows\Microsoft.NET\Framework\v2.0.50727\fusion.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 18936 c:\windows\Microsoft.NET\Framework\v2.0.50727\fusion.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 62968 c:\windows\Microsoft.NET\Framework\v2.0.50727\dfdll.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 35320 c:\windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
- 2007-10-24 00:47 . 2007-10-24 00:47 35320 c:\windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
- 2007-10-24 00:47 . 2007-10-24 00:47 69120 c:\windows\Microsoft.NET\Framework\v2.0.50727\CustomMarshalers.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 69120 c:\windows\Microsoft.NET\Framework\v2.0.50727\CustomMarshalers.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 27136 c:\windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 27136 c:\windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 13312 c:\windows\Microsoft.NET\Framework\v2.0.50727\cscompmgd.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 13312 c:\windows\Microsoft.NET\Framework\v2.0.50727\cscompmgd.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 80376 c:\windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
- 2007-10-24 00:47 . 2007-10-24 00:47 80376 c:\windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
+ 2008-07-25 09:17 . 2008-07-25 09:17 89608 c:\windows\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll
+ 2008-11-25 02:59 . 2008-11-25 02:59 31560 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
+ 2008-07-25 09:16 . 2008-07-25 09:16 34312 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
+ 2008-07-25 09:16 . 2008-07-25 09:16 33288 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
+ 2008-07-25 09:16 . 2008-07-25 09:16 24576 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
- 2007-10-24 00:47 . 2007-10-24 00:47 24576 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe
- 2007-10-24 00:47 . 2007-10-24 00:47 84480 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 84480 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 33800 c:\windows\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 17416 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 22024 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 22024 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 36864 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
+ 2008-07-25 09:16 . 2008-07-25 09:16 36864 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
+ 2008-07-25 09:17 . 2008-07-25 09:17 58880 c:\windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
+ 2008-07-25 09:16 . 2008-07-25 09:16 98808 c:\windows\Microsoft.NET\Framework\v2.0.50727\alink.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 10752 c:\windows\Microsoft.NET\Framework\v2.0.50727\Accessibility.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 10752 c:\windows\Microsoft.NET\Framework\v2.0.50727\Accessibility.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 13824 c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\CvtResUI.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 13824 c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\CvtResUI.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 28672 c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\alinkui.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 28672 c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\alinkui.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 96768 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscormmc.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 16896 c:\windows\Microsoft.NET\Framework\SharedReg12.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 16896 c:\windows\Microsoft.NET\Framework\SharedReg12.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 16896 c:\windows\Microsoft.NET\Framework\sbscmp20_perfcounter.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 16896 c:\windows\Microsoft.NET\Framework\sbscmp20_perfcounter.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 16896 c:\windows\Microsoft.NET\Framework\sbscmp20_mscorwks.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 16896 c:\windows\Microsoft.NET\Framework\sbscmp20_mscorwks.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 16896 c:\windows\Microsoft.NET\Framework\sbscmp10.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 16896 c:\windows\Microsoft.NET\Framework\sbscmp10.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 82944 c:\windows\Microsoft.NET\Framework\NETFXSBS10.exe
+ 2008-07-25 09:16 . 2008-07-25 09:16 82944 c:\windows\Microsoft.NET\Framework\NETFXSBS10.exe
- 2008-03-02 09:48 . 2009-02-11 16:52 35088 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
+ 2008-03-02 09:48 . 2009-05-18 08:33 35088 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
- 2008-03-02 09:48 . 2009-02-11 16:52 18704 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
+ 2008-03-02 09:48 . 2009-05-18 08:33 18704 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
+ 2008-03-02 09:48 . 2009-05-18 08:33 20240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
- 2008-03-02 09:48 . 2009-02-11 16:52 20240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
+ 2009-05-16 01:49 . 2009-05-16 01:49 27136 c:\windows\Installer\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}\AppleSoftwareUpdateIco.exe
+ 2009-05-16 01:53 . 2009-05-16 01:53 86016 c:\windows\Installer\{07287123-B8AC-41CE-8346-3D777245C35B}\PrntWzrdIco.exe
+ 2006-07-24 09:50 . 2006-07-24 09:50 47920 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6425\VBAME.DLL
+ 2006-07-24 09:50 . 2006-07-24 09:50 92976 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6425\MSADDNDR.DLL
+ 2006-10-26 20:13 . 2006-10-26 20:13 72472 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\XL12CNVP.DLL
+ 2008-03-02 09:46 . 2008-03-02 09:46 12096 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\WORDPOL.DLL
+ 2008-03-02 09:46 . 2008-03-02 09:46 12080 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\VBIDEPOL.DLL
+ 2008-03-02 09:45 . 2008-03-02 09:45 64288 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\VBIDEPIA.DLL
+ 2006-10-26 18:59 . 2006-10-26 18:59 15672 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\SMARTTAGINSTALL.EXE
+ 2006-10-26 18:49 . 2006-10-26 18:49 34104 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\SETLANG.EXE
+ 2006-10-26 19:55 . 2006-10-26 19:55 55056 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\SCANOST.EXE
+ 2006-10-26 19:55 . 2006-10-26 19:55 76576 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\RM.DLL
+ 2006-10-26 19:12 . 2006-10-26 19:12 40424 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\REFIEBAR.DLL
+ 2006-10-26 19:55 . 2006-10-26 19:55 39208 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\RECALL.DLL
+ 2006-10-26 19:09 . 2006-10-26 19:09 48448 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\PUBTRAP.DLL
+ 2008-03-02 09:46 . 2008-03-02 09:46 12112 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\PPTPOL.DLL
+ 2006-10-26 19:55 . 2006-10-26 19:55 53048 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\OUTLVBA.DLL
+ 2006-10-26 18:59 . 2006-10-26 18:59 46936 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\OSETUPPS.DLL
+ 2006-10-26 18:59 . 2006-10-26 18:59 18760 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\OPHPROXY.DLL
+ 2006-10-26 18:59 . 2006-10-26 18:59 16728 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\OMUOPTINPS.DLL
+ 2006-10-26 19:00 . 2006-10-26 19:00 23392 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\OISCTRL.DLL
+ 2006-10-27 14:11 . 2006-10-27 14:11 54680 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\OFFRHD.DLL
+ 2008-03-02 09:46 . 2008-03-02 09:46 11544 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\OFFICEPL.DLL
+ 2008-03-02 09:46 . 2008-03-02 09:46 12104 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\MSTAGPOL.DLL
+ 2008-03-02 09:45 . 2008-03-02 09:45 20280 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\MSTAGPIA.DLL
+ 2006-10-26 18:59 . 2006-10-26 18:59 43832 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\MSSH.DLL
+ 2006-10-27 14:26 . 2006-10-27 14:26 35152 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\MSOSTYLE.DLL
+ 2006-10-26 18:56 . 2006-10-26 18:56 67408 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\MSONPUI.DLL
+ 2006-10-26 18:56 . 2006-10-26 18:56 32592 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\MSONPMON.DLL
+ 2006-10-26 18:52 . 2006-10-26 18:52 66368 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\MSOMSE.DLL
+ 2006-10-26 19:12 . 2006-10-26 19:12 67896 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\MSOHTMED.EXE
+ 2006-10-27 14:01 . 2006-10-27 14:01 76088 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\MSOHEV.DLL
+ 2006-10-26 18:59 . 2006-10-26 18:59 19768 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\MSMH.DLL
+ 2006-10-26 18:52 . 2006-10-26 18:52 48424 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\MSE7.EXE
+ 2006-10-26 19:55 . 2006-10-26 19:55 21312 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\MLSHEXT.DLL
+ 2006-10-26 19:12 . 2006-10-26 19:12 89400 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\METCONV.DLL
+ 2006-10-26 20:41 . 2006-10-26 20:41 66368 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\INLAUNCH.DLL
+ 2008-03-02 09:45 . 2008-03-02 09:45 12096 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\GRAPHPOL.DLL
+ 2008-03-02 09:44 . 2008-03-02 09:44 12096 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\EXCELPOL.DLL
+ 2006-10-26 19:55 . 2006-10-26 19:55 35160 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\DUMPSTER.DLL
+ 2006-10-26 19:12 . 2006-10-26 19:12 53576 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\AUTHZAX.DLL
+ 2006-10-26 20:18 . 2006-10-26 20:18 94016 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\ACCOLK.DLL
+ 2009-05-18 08:47 . 2008-07-06 12:06 89088 c:\windows\Driver Cache\i386\filterpipelineprintproc.dll
+ 2009-05-18 09:08 . 2009-05-18 09:08 60928 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\a715aa442ef87ae99b3ade185599249d\UIAutomationProvider.ni.dll
+ 2009-05-18 09:13 . 2009-05-18 09:13 37888 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\423f794d1f4ed6e120fbb02e436491cb\System.Windows.Presentation.ni.dll
+ 2009-05-18 09:12 . 2009-05-18 09:12 36864 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\19ca1747c1ea18a3b639b302bca8df93\System.Web.DynamicData.Design.ni.dll
+ 2009-05-18 09:10 . 2009-05-18 09:10 94208 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\532438e2acfcadc469a4d468c51f8451\System.ComponentModel.DataAnnotations.ni.dll
+ 2009-05-18 09:10 . 2009-05-18 09:10 82944 c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\597b20e1b053d6a510cfe033c07a63e6\System.AddIn.Contract.ni.dll
+ 2009-05-18 09:03 . 2009-05-18 09:03 47104 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\2d7408a0232f2e2efd0d7adf5dfa733a\PresentationFontCache.ni.exe
+ 2009-05-18 09:02 . 2009-05-18 09:02 39424 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\c8fd2d9233f8ea3031fb16f697635231\PresentationCFFRasterizer.ni.dll
+ 2009-05-18 09:12 . 2009-05-18 09:12 55296 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\790cf1edb17ee41b59be62ecbd59613b\Microsoft.Vsa.ni.dll
+ 2009-05-18 09:10 . 2009-05-18 09:10 65024 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\e9aba2eab90d647356f65e66053da02b\Microsoft.Build.Framework.ni.dll
+ 2009-05-18 09:10 . 2009-05-18 09:10 74752 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\28343d470d992f169ca0e7cdb3cc3117\Microsoft.Build.Framework.ni.dll
+ 2009-05-18 09:10 . 2009-05-18 09:10 14336 c:\windows\assembly\NativeImages_v2.0.50727_32\dfsvc\f4e38208e88cb4cc314a1d6543b9fcc6\dfsvc.ni.exe
+ 2009-05-18 09:10 . 2009-05-18 09:10 25600 c:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\11eb4f6606ba01e5128805759121ea6c\Accessibility.ni.dll
+ 2009-05-18 08:49 . 2009-05-18 08:49 94208 c:\windows\assembly\GAC_MSIL\WindowsFormsIntegration\3.0.0.0__31bf3856ad364e35\WindowsFormsIntegration.dll
+ 2009-05-18 08:49 . 2009-05-18 08:49 98304 c:\windows\assembly\GAC_MSIL\UIAutomationTypes\3.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll
+ 2009-05-18 08:49 . 2009-05-18 08:49 40960 c:\windows\assembly\GAC_MSIL\UIAutomationProvider\3.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll
+ 2009-05-18 08:52 . 2009-05-18 08:52 12288 c:\windows\assembly\GAC_MSIL\System.Windows.Presentation\3.5.0.0__b77a5c561934e089\System.Windows.Presentation.dll
+ 2009-05-18 08:52 . 2009-05-18 08:52 61440 c:\windows\assembly\GAC_MSIL\System.Web.Routing\3.5.0.0__31bf3856ad364e35\System.Web.Routing.dll
+ 2009-05-18 08:57 . 2009-05-18 08:57 77824 c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2009-05-18 08:52 . 2009-05-18 08:52 32768 c:\windows\assembly\GAC_MSIL\System.Web.DynamicData.Design\3.5.0.0__31bf3856ad364e35\System.Web.DynamicData.Design.dll
+ 2009-05-18 08:52 . 2009-05-18 08:52 77824 c:\windows\assembly\GAC_MSIL\System.Web.Abstractions\3.5.0.0__31bf3856ad364e35\System.Web.Abstractions.dll
+ 2009-05-18 08:49 . 2009-05-18 08:49 32768 c:\windows\assembly\GAC_MSIL\System.ServiceModel.WasHosting\3.0.0.0__b77a5c561934e089\System.ServiceModel.WasHosting.dll
+ 2009-05-18 08:49 . 2009-05-18 08:49 73728 c:\windows\assembly\GAC_MSIL\System.ServiceModel.Install\3.0.0.0__b77a5c561934e089\System.ServiceModel.Install.dll
- 2008-01-10 08:03 . 2008-01-10 08:03 81920 c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2009-05-18 08:58 . 2009-05-18 08:58 81920 c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2009-05-18 08:51 . 2009-05-18 08:51 53248 c:\windows\assembly\GAC_MSIL\System.Data.DataSetExtensions\3.5.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll
- 2008-01-10 08:03 . 2008-01-10 08:03 81920 c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2009-05-18 08:58 . 2009-05-18 08:58 81920 c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2009-05-18 08:52 . 2009-05-18 08:52 57344 c:\windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll
+ 2009-05-18 08:51 . 2009-05-18 08:51 45056 c:\windows\assembly\GAC_MSIL\System.AddIn.Contract\2.0.0.0__b03f5f7f11d50a3a\System.AddIn.Contract.dll
+ 2009-05-18 08:49 . 2009-05-18 08:49 46104 c:\windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe
+ 2009-05-18 08:49 . 2009-05-18 08:49 32768 c:\windows\assembly\GAC_MSIL\PresentationCFFRasterizer\3.0.0.0__31bf3856ad364e35\PresentationCFFRasterizer.dll
- 2008-01-10 08:03 . 2008-01-10 08:03 32768 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
+ 2009-05-18 08:58 . 2009-05-18 08:58 32768 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- 2008-01-10 08:03 . 2008-01-10 08:03 12800 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2009-05-18 08:58 . 2009-05-18 08:58 12800 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2009-05-18 08:51 . 2009-05-18 08:51 41984 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\1.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.STLCLR.dll
- 2008-01-10 08:03 . 2008-01-10 08:03 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
+ 2009-05-18 08:58 . 2009-05-18 08:58 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- 2008-01-10 08:03 . 2008-01-10 08:03 77824 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2009-05-18 08:58 . 2009-05-18 08:58 77824 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2009-05-18 08:51 . 2009-05-18 08:51 94208 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.v3.5.dll
+ 2009-05-18 08:51 . 2009-05-18 08:51 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2009-05-18 08:58 . 2009-05-18 08:58 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
- 2008-01-10 08:03 . 2008-01-10 08:03 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2009-05-18 08:58 . 2009-05-18 08:58 77824 c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
- 2008-01-10 08:03 . 2008-01-10 08:03 77824 c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
+ 2009-05-18 08:58 . 2009-05-18 08:58 13312 c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
- 2008-01-10 08:03 . 2008-01-10 08:03 13312 c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2009-05-18 08:58 . 2009-05-18 08:58 10752 c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
- 2008-01-10 08:03 . 2008-01-10 08:03 10752 c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2009-05-18 08:58 . 2009-05-18 08:58 72192 c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
- 2008-01-10 08:03 . 2008-01-10 08:03 72192 c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
- 2008-01-10 08:03 . 2008-01-10 08:03 69120 c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2009-05-18 08:58 . 2009-05-18 08:58 69120 c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2009-05-18 08:19 . 2009-05-18 08:19 10576 c:\windows\assembly\GAC\Policy.11.0.office\12.0.0.0__71e9bce111e9429c\Policy.11.0.Office.dll
+ 2009-05-18 08:19 . 2009-05-18 08:19 11112 c:\windows\assembly\GAC\Policy.11.0.Microsoft.Vbe.Interop\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Vbe.Interop.dll
+ 2009-05-18 08:23 . 2009-05-18 08:23 11128 c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Word\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Word.dll
+ 2009-05-18 08:19 . 2009-05-18 08:19 11136 c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.SmartTag\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.SmartTag.dll
+ 2009-05-18 08:26 . 2009-05-18 08:26 11152 c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.PowerPoint\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.PowerPoint.dll
+ 2009-05-18 08:19 . 2009-05-18 08:19 11128 c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Graph\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Graph.dll
+ 2009-05-18 08:23 . 2009-05-18 08:23 11144 c:\windows\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Excel\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Excel.dll
+ 2009-05-18 08:19 . 2009-05-18 08:19 63336 c:\windows\assembly\GAC\Microsoft.Vbe.Interop\12.0.0.0__71e9bce111e9429c\Microsoft.Vbe.Interop.dll
+ 2009-05-18 08:19 . 2009-05-18 08:19 19320 c:\windows\assembly\GAC\Microsoft.Office.Interop.SmartTag\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.SmartTag.dll
+ 2009-05-18 08:58 . 2009-05-18 08:58 8192 c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
- 2008-01-10 08:03 . 2008-01-10 08:03 8192 c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2008-07-29 21:40 . 2008-07-29 21:40 5632 c:\windows\Microsoft.NET\Framework\v3.5\Sentinel.v3.5Client.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 7168 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft_VsaVb.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 7168 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft_VsaVb.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 5632 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualC.Dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 5632 c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualC.Dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 6656 c:\windows\Microsoft.NET\Framework\v2.0.50727\IIEHost.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 6656 c:\windows\Microsoft.NET\Framework\v2.0.50727\IIEHost.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 8192 c:\windows\Microsoft.NET\Framework\v2.0.50727\IEExecRemote.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 8192 c:\windows\Microsoft.NET\Framework\v2.0.50727\IEExecRemote.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 9728 c:\windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
+ 2008-07-25 09:17 . 2008-07-25 09:17 9728 c:\windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
+ 2008-07-25 09:16 . 2008-07-25 09:16 5120 c:\windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
- 2007-10-24 00:47 . 2007-10-24 00:47 5120 c:\windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
+ 2009-05-18 08:51 . 2009-05-18 08:51 5632 c:\windows\assembly\GAC_MSIL\Sentinel.v3.5Client\3.5.0.0__b03f5f7f11d50a3a\Sentinel.v3.5Client.dll
+ 2009-05-18 08:58 . 2009-05-18 08:58 7168 c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
- 2008-01-10 08:03 . 2008-01-10 08:03 7168 c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
- 2008-01-10 08:02 . 2008-01-10 08:02 5632 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
+ 2009-05-18 08:58 . 2009-05-18 08:58 5632 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
- 2008-01-10 08:03 . 2008-01-10 08:03 6656 c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
+ 2009-05-18 08:58 . 2009-05-18 08:58 6656 c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
- 2008-01-10 08:03 . 2008-01-10 08:03 8192 c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2009-05-18 08:58 . 2009-05-18 08:58 8192 c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
- 2008-01-10 08:03 . 2008-01-10 08:03 113664 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
+ 2009-05-18 08:58 . 2009-05-18 08:58 113664 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
- 2008-01-10 08:03 . 2008-01-10 08:03 258048 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2009-05-18 08:58 . 2009-05-18 08:58 258048 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2007-11-07 00:19 . 2007-11-07 00:19 655872 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcr90.dll
+ 2007-11-07 00:19 . 2007-11-07 00:19 568832 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcp90.dll
+ 2007-11-06 19:23 . 2007-11-06 19:23 224768 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcm90.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 635904 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcr80.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 558080 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcp80.dll
+ 2008-07-25 09:17 . 2008-07-25 09:17 479232 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcm80.dll
+ 2008-07-29 19:26 . 2008-07-29 19:26 301568 c:\windows\system32\XPSViewer\XPSViewer.exe
+ 2006-10-14 18:21 . 2008-07-06 12:06 575488 c:\windows\system32\xpsshhdr.dll
+ 2004-09-08 12:09 . 2008-12-16 12:30 354304 c:\windows\system32\winhttp.dll
- 2004-09-08 12:09 . 2008-04-14 03:42 354304 c:\windows\system32\winhttp.dll
+ 2005-04-25 09:23 . 2009-02-06 10:10 227840 c:\windows\system32\wbem\wmiprvse.exe
+ 2005-04-25 09:23 . 2009-02-09 12:10 453120 c:\windows\system32\wbem\wmiprvsd.dll
+ 2005-04-25 09:23 . 2009-02-09 12:10 473600 c:\windows\system32\wbem\fastprox.dll
+ 2004-09-08 12:02 . 2009-02-20 08:10 619520 c:\windows\system32\urlmon.dll
- 2004-09-08 12:02 . 2008-10-16 01:00 619520 c:\windows\system32\urlmon.dll
+ 2008-07-29 17:59 . 2008-07-29 17:59 161296 c:\windows\system32\UIAutomationCore.dll
+ 2008-10-01 07:22 . 2008-07-06 12:06 765440 c:\windows\system32\spool\XPSEP\i386\mxdwdrv.dll
+ 2008-10-01 07:22 . 2008-07-06 12:06 765440 c:\windows\system32\spool\XPSEP\i386\i386\mxdwdrv.dll
+ 2008-10-01 07:22 . 2008-07-06 12:06 748032 c:\windows\system32\spool\XPSEP\amd64\mxdwdrv.dll
+ 2008-10-01 07:22 . 2008-07-06 12:06 748032 c:\windows\system32\spool\XPSEP\amd64\amd64\mxdwdrv.dll
+ 2008-10-01 07:22 . 2008-07-06 12:06 147456 c:\windows\system32\spool\prtprocs\x64\filterpipelineprintproc.dll
+ 2006-10-14 14:44 . 2008-07-06 10:50 597504 c:\windows\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
+ 2008-03-02 09:48 . 2008-11-10 09:41 864144 c:\windows\system32\spool\drivers\w32x86\msonpdrv.dll
- 2005-05-19 06:48 . 2007-05-15 11:38 761344 c:\windows\system32\spool\drivers\w32x86\3\unires.dll
+ 2005-05-19 06:48 . 2008-03-13 04:52 761344 c:\windows\system32\spool\drivers\w32x86\3\unires.dll
+ 2005-05-19 06:48 . 2008-07-06 12:06 744960 c:\windows\system32\spool\drivers\w32x86\3\unidrvui.dll
- 2005-05-19 06:48 . 2008-04-14 03:42 373248 c:\windows\system32\spool\drivers\w32x86\3\unidrv.dll
+ 2005-05-19 06:48 . 2008-07-06 12:06 373248 c:\windows\system32\spool\drivers\w32x86\3\unidrv.dll
+ 2006-10-14 14:42 . 2008-07-06 12:06 198656 c:\windows\system32\spool\drivers\w32x86\3\mxdwdui.dll
+ 2006-10-14 14:43 . 2008-07-06 12:06 765440 c:\windows\system32\spool\drivers\w32x86\3\mxdwdrv.dll
+ 2008-03-02 09:48 . 2008-11-10 09:41 864144 c:\windows\system32\spool\drivers\w32x86\3\msonpdrv.dll
+ 2004-09-08 12:02 . 2009-02-06 11:11 110592 c:\windows\system32\services.exe
+ 2004-09-08 12:02 . 2008-12-05 06:54 144896 c:\windows\system32\schannel.dll
+ 2004-09-08 12:02 . 2009-02-09 12:10 401408 c:\windows\system32\rpcss.dll
+ 2006-10-14 14:43 . 2008-07-06 12:06 117760 c:\windows\system32\prntvpt.dll
+ 2008-07-29 17:59 . 2008-07-29 17:59 781344 c:\windows\system32\PresentationNative_v0300.dll
+ 2008-07-29 18:35 . 2008-07-29 18:35 326160 c:\windows\system32\PresentationHost.exe
+ 2008-07-29 17:59 . 2008-07-29 17:59 105016 c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
+ 2004-09-08 12:03 . 2009-05-19 01:18 440674 c:\windows\system32\perfh009.dat
+ 2004-09-08 12:02 . 2009-02-09 12:10 714752 c:\windows\system32\ntdll.dll
+ 2005-04-25 09:23 . 2008-06-12 14:23 161792 c:\windows\system32\msdtcuiu.dll
- 2005-04-25 09:23 . 2008-04-14 03:42 161792 c:\windows\system32\msdtcuiu.dll
- 2005-04-25 09:23 . 2008-04-14 03:42 956928 c:\windows\system32\msdtctm.dll
+ 2005-04-25 09:23 . 2008-06-12 14:23 956928 c:\windows\system32\msdtctm.dll
+ 2005-04-25 09:23 . 2008-06-12 17:53 428032 c:\windows\system32\msdtcprx.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 158720 c:\windows\system32\mscorier.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 158720 c:\windows\system32\mscorier.dll
- 2007-10-24 00:47 . 2007-10-24 00:47 282112 c:\windows\system32\mscoree.dll
+ 2008-07-25 09:16 . 2008-07-25 09:16 282112 c:\windows\system32\mscoree.dll
+ 2004-09-08 12:02 . 2009-02-09 12:10 729088 c:\windows\system32\lsasrv.dll
+ 2004-09-08 12:02 . 2009-03-21 14:06 989696 c:\windows\system32\kernel32.dll
- 2004-09-08 12:02 . 2008-04-14 03:41 989696 c:\windows\system32\kernel32.dll
+ 2008-07-29 17:24 . 2008-07-29 17:24 622080 c:\windows\system32\icardagt.exe
+ 2008-05-29 09:16 . 2008-05-29 09:16 633344 c:\windows\system32\gpprefcl.dll
+ 2006-09-19 14:43 . 2008-04-17 10:12 107368 c:\windows\system32\GEARAspi.dll
+ 2008-07-29 19:10 . 2008-07-29 19:10 493048 c:\windows\system32\evr.dll
+ 2009-05-16 01:55 . 2008-04-17 10:12 107368 c:\windows\system32\DRVSTORE\GEARAspiWD_F475AF659D36685632E9BD97B57E9D9661FF3FFD\x86\GEARAspi.dll
+ 2004-09-08 12:03 . 2008-12-11 10:57 333952 c:\windows\system32\drivers\srv.sys
+ 2006-10-14 18:21 . 2008-07-06 12:06 575488 c:\windows\system32\dllcache\xpsshhdr.dll
+ 2004-09-08 12:02 . 2009-02-20 08:10 666112 c:\windows\system32\dllcache\wininet.dll
- 2004-09-08 12:02 . 2008-10-16 01:00 666112 c:\windows\system32\dllcache\wininet.dll
+ 2004-09-08 12:09 . 2008-12-16 12:30 354304 c:\windows\system32\dllcache\winhttp.dll
- 2004-09-08 12:09 . 2008-04-14 03:42 354304 c:\windows\system32\dllcache\winhttp.dll
- 2008-08-13 06:05 . 2008-10-16 01:00 619520 c:\windows\system32\dllcache\urlmon.dll
+ 2008-08-13 06:05 . 2009-02-20 08:10 619520 c:\windows\system32\dllcache\urlmon.dll
+ 2008-10-15 09:00 . 2008-12-11 10:57 333952 c:\windows\system32\dllcache\srv.sys
+ 2004-09-08 12:02 . 2009-02-09 12:10 401408 c:\windows\system32\dllcache\rpcss.dll
+ 2006-10-14 14:44 . 2008-07-06 10:50 597504 c:\windows\system32\dllcache\printfilterpipelinesvc.exe
+ 2004-09-08 12:02 . 2009-02-09 12:10 714752 c:\windows\system32\dllcache\ntdll.dll
+ 2008-06-12 17:53 . 2008-06-12 17:53 428032 c:\windows\system32\dllcache\msdtcprx.dll
+ 2004-09-08 12:02 . 2009-03-21 14:06 989696 c:\windows\system32\dllcache\kernel32.dll
- 2004-09-08 12:02 . 2008-04-14 03:41 989696 c:\windows\system32\dllcache\kernel32.dll
+ 2004-09-08 12:02 . 2009-02-09 12:10 617472 c:\windows\system32\dllcache\advapi32.dll
- 2004-09-08 12:02 . 2008-04-14 03:41 617472 c:\windows\system32\dllcache\advapi32.dll
+ 2004-09-08 12:02 . 2009-02-09 12:10 617472 c:\windows\system32\advapi32.dll
- 2004-09-08 12:02 . 2008-04-14 03:41 617472 c:\windows\system32\advapi32.dll
+ 2008-07-29 21:40 . 2008-07-29 21:40 196104 c:\windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe
+ 2008-07-29 21:40 . 2008-07-29 21:40 802816 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft.Build.Tasks.v3.5.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 984056 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapUI.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 107512 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 111096 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.3082.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 110072 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.2070.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 106488 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1055.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 105976 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1053.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 107000 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1049.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 107512 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1046.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 109048 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1045.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 106488 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1044.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 108536 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1043.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 110072 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1040.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 111096 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1038.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 101368 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1037.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 112120 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1036.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 106488 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1035.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 113656 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1032.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 111608 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1031.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 108536 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1030.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 108536 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1029.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 102904 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1025.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 689152 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vsscenario.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 413184 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vsbasereqs.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 632320 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vs70uimgr.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 110080 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 131584 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.3082.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 131072 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.2070.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 121344 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1055.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 121344 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1053.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 123904 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1049.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 122880 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1046.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 128512 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1045.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 121856 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1044.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 129024 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1043.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 128512 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1040.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 132096 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1038.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 111104 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1037.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 133120 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1036.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 122368 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1035.dll
+ 2008-07-29 16:47 . 2008-07-29 16:47 137728 c:\windows\Micros

greyknight17 · Joined: Feb 03, 2003 Posts: 5674 Location: Brooklyn, NY

The log was too big and couldn't fit in one post. Open up your ComboFix log at C:\ComboFix\ComboFix.txt and open it up. Search for:

((((((((((((((((((((((((((((( SnapShot.TakeThisOut@2009-05-13_17.24.33 )))))))))))))))))))))))))))))))))))))))))

I want you to skip that entire SnapShot section. It's taking a majority of the lines here. When you reach the next section, start copying all the text there to the very bottom. Copy and paste them here.

aardvark42 · Joined: May 10, 2009 Posts: 9

Ok, here is the log without the SnapShot part

ComboFix 09-05-18.04 - u0032610 19/05/2009 7:12.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2047.1609 [GMT 2:00]
Running from: c:\documents and settings\u0032610\Desktop\aardvark42.exe
AV: NOD32 antivirus systeem 2.50 *On-access scanning disabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

----- BITS: Possible infected sites -----

hxxp://wsu-srv-02
.
((((((((((((((((((((((((( Files Created from 2009-04-19 to 2009-05-19 )))))))))))))))))))))))))))))))
.

2009-05-18 09:34 . 2009-05-18 09:34 -------- d-----w c:\documents and settings\All Users\Application Data\GroupPolicy
2009-05-18 08:49 . 2009-05-18 08:49 -------- d-----w c:\windows\system32\XPSViewer
2009-05-18 08:49 . 2009-05-18 08:49 -------- d-----w c:\program files\Reference Assemblies
2009-05-18 08:47 . 2009-05-18 08:48 -------- d-----w C:\6ae3fb079f2179ba76a349
2009-05-18 08:46 . 2009-05-19 01:11 -------- d-----w c:\windows\SxsCaPendDel
2009-05-18 08:07 . 2009-05-18 08:07 -------- d-----w c:\program files\Microsoft Silverlight
2009-05-18 02:47 . 2009-02-03 19:59 56832 -c----w c:\windows\system32\dllcache\secur32.dll
2009-05-18 02:46 . 2008-12-05 06:54 144896 -c----w c:\windows\system32\dllcache\schannel.dll
2009-05-18 02:46 . 2009-03-06 14:22 284160 -c----w c:\windows\system32\dllcache\pdh.dll
2009-05-18 02:46 . 2009-02-06 11:11 110592 -c----w c:\windows\system32\dllcache\services.exe
2009-05-18 02:46 . 2009-02-09 12:10 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-05-18 02:46 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-05-18 02:46 . 2009-02-09 12:10 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-18 02:46 . 2009-02-09 12:10 729088 -c----w c:\windows\system32\dllcache\lsasrv.dll
2009-05-18 02:45 . 2008-06-12 14:23 91648 -c----w c:\windows\system32\dllcache\mtxoci.dll
2009-05-18 02:45 . 2008-06-12 14:23 161792 -c----w c:\windows\system32\dllcache\msdtcuiu.dll
2009-05-18 02:45 . 2008-06-12 14:23 66560 -c----w c:\windows\system32\dllcache\mtxclu.dll
2009-05-18 02:45 . 2008-06-12 14:23 58880 -c----w c:\windows\system32\dllcache\msdtclog.dll
2009-05-18 02:45 . 2008-06-12 14:23 956928 -c----w c:\windows\system32\dllcache\msdtctm.dll
2009-05-18 02:42 . 2009-02-20 08:10 81920 -c----w c:\windows\system32\dllcache\ieencode.dll
2009-05-18 02:41 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
2009-05-18 02:41 . 2008-04-21 12:08 215552 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-05-16 01:54 . 2009-05-16 01:54 -------- d-----w c:\program files\iPod
2009-05-16 01:54 . 2009-05-16 01:55 -------- d-----w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-16 01:54 . 2009-05-16 01:55 -------- d-----w c:\program files\iTunes
2009-05-16 01:49 . 2009-05-16 01:49 -------- d-----w c:\program files\Apple Software Update
2009-05-16 01:49 . 2009-03-26 13:23 36864 ----a-w c:\windows\system32\drivers\usbaapl.sys
2009-05-16 01:49 . 2009-03-26 13:23 1900544 ----a-w c:\windows\system32\usbaaplrc.dll
2009-05-16 01:48 . 2009-05-16 01:54 -------- d-----w c:\program files\Common Files\Apple
2009-05-15 00:07 . 2009-05-15 00:07 -------- d--h--w c:\documents and settings\All Users\Application Data\CanonIJScan
2009-05-15 00:06 . 2009-05-15 00:07 -------- d-----w c:\documents and settings\u0032610\Application Data\Canon
2009-05-13 16:39 . 2009-05-13 16:39 -------- d-----w c:\windows\5DF3D1BB894E4DCD8275159AC9829B43.TMP
2009-05-13 12:02 . 2009-05-13 12:02 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Apple Computer
2009-05-13 12:01 . 2009-05-13 12:01 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\ArcSoft
2009-05-13 12:01 . 2009-05-13 12:02 -------- d-----w c:\documents and settings\Administrator\Application Data\ArcSoft
2009-05-09 23:51 . 2009-05-10 09:47 -------- d-----w c:\documents and settings\u0032610\Local Settings\Application Data\SITEguard
2009-05-09 23:44 . 2009-05-10 09:51 -------- d-----w c:\documents and settings\All Users\Application Data\STOPzilla!
2009-05-03 17:57 . 2009-05-13 22:59 -------- d-----w c:\documents and settings\u0032610\Local Settings\Application Data\Canon Easy-PhotoPrint EX
2009-05-03 17:55 . 2009-05-03 17:55 -------- d--h--w c:\documents and settings\All Users\Application Data\CanonIJEGV
2009-04-30 10:46 . 2009-04-30 10:46 -------- d-----w c:\documents and settings\u0032610\Application Data\QuosaDDM
2009-04-25 11:59 . 2009-04-25 11:59 -------- d--h--w c:\documents and settings\All Users\Application Data\CanonBJ
2009-04-25 11:58 . 2008-10-08 20:00 230912 ----a-w c:\windows\system32\CNMLM9E.DLL
2009-04-25 11:58 . 2009-04-25 11:58 -------- d--h--w c:\windows\system32\CanonIJ Uninstaller Information
2009-04-25 11:58 . 2007-03-15 05:12 188416 ----a-w c:\windows\system32\CNC540O.DLL
2009-04-25 11:58 . 2008-05-30 00:27 270336 ----a-w c:\windows\system32\CNC540L.DLL
2009-04-25 11:58 . 2008-04-07 05:58 98304 ----a-w c:\windows\system32\CNC540I.DLL
2009-04-25 11:58 . 2008-04-07 05:58 1339392 ----a-w c:\windows\system32\CNC540C.DLL
2009-04-25 11:58 . 2009-04-25 11:58 -------- d--h--w c:\program files\CanonBJ
2009-04-21 11:54 . 2009-04-21 11:54 -------- d-----w c:\program files\support.com
2009-04-21 11:54 . 2009-04-21 11:54 -------- d-----w c:\documents and settings\u0032610\Local Settings\Application Data\SupportSoft
2009-04-21 11:53 . 2009-04-21 11:53 -------- d-----w c:\program files\Common Files\SupportSoft

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-19 03:54 . 2006-11-28 09:39 -------- d-----w c:\program files\Mozilla Thunderbird
2009-05-18 08:49 . 2008-03-02 09:46 -------- d-----w c:\program files\MSBuild
2009-05-18 08:19 . 2008-03-02 09:47 -------- d-----w c:\program files\Microsoft Works
2009-05-16 16:24 . 2005-04-25 09:36 164690 ----a-w c:\windows\system32\nvModes.dat
2009-05-16 10:51 . 2005-04-25 17:12 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-16 01:53 . 2008-01-08 15:28 -------- d-----w c:\program files\Bonjour
2009-05-16 01:52 . 2006-09-18 09:30 -------- d-----w c:\program files\QuickTime
2009-05-15 13:49 . 2006-05-02 15:40 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-05-14 00:19 . 2005-04-28 14:56 93472 -c--a-w c:\documents and settings\u0032610\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-13 22:11 . 2009-01-24 05:03 -------- d-----w c:\program files\ArcSoft
2009-05-13 22:11 . 2009-01-24 05:03 -------- d-----w c:\program files\Common Files\ArcSoft
2009-04-30 01:06 . 2006-02-20 13:30 -------- d-----w c:\program files\Sonic
2009-04-25 12:02 . 2008-01-08 11:13 -------- d-----w c:\program files\Canon
2009-03-29 22:49 . 2009-01-31 07:26 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-03-29 22:37 . 2009-03-29 22:37 132 ----a-w c:\windows\DeleteDll.bat
2009-03-26 14:49 . 2009-01-31 07:26 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-26 14:49 . 2009-01-31 07:26 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-03-22 17:15 . 2009-03-22 17:15 -------- d-----w c:\program files\VideoLAN
2009-03-19 14:32 . 2006-09-19 14:44 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-06 14:22 . 2004-09-08 12:07 284160 ----a-w c:\windows\system32\pdh.dll
2009-02-20 08:10 . 2004-09-08 12:02 666112 ----a-w c:\windows\system32\wininet.dll
2009-02-20 08:10 . 2004-09-08 12:05 81920 ----a-w c:\windows\system32\ieencode.dll
2005-04-14 16:41 . 2005-04-28 19:23 44153 -c--a-w c:\program files\mozilla firefox\components\inspector.dll
2008-01-14 19:12 . 2008-01-14 19:08 24 -csh--w c:\windows\SD6B135B3.tmp

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2006-11-24 20058152]
"Octoshape Streaming Services"="c:\program files\Octoshape Streaming Services\u0032610\OctoshapeClient.exe" [2006-02-13 214648]
"Creative WebCam Tray"="c:\program files\Creative\Shared Files\CamTray.exe" [2005-10-27 299008]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2007-09-20 1410344]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-10 216520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-09-13 155648]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 57344]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-09-08 7118848]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]
"AVFX Engine"="c:\program files\Creative\Creative Live! Cam\VideoFX\StartFX.exe" [2007-04-09 20480]
"masqform.exe"="c:\program files\PureEdge\Viewer 6.0\masqform.exe" [2003-12-03 1052672]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 1836328]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-10 689488]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-17 1848648]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2005-09-08 1519616]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"TSClientMSIUninstaller"="c:\windows\Installer\TSClientMsiTrans\tscuinst.vbs" [2007-10-30 13801]
"TSClientAXDisabler"="c:\windows\Installer\TSClientMsiTrans\tscdsbl.bat" [2008-01-18 2247]

c:\documents and settings\u0032610\Start Menu\Programs\Startup\
Microsoft Find Fast.lnk - c:\program files\MicrosoftOffice97\Office\FINDFAST.EXE [1996-11-21 111376]
Office Startup.lnk - c:\program files\MicrosoftOffice97\Office\OSA.EXE [1996-11-21 51984]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
HP Button Manager.lnk - c:\program files\HP\Button Manager\BM.exe [2009-1-24 249856]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-9 28672]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.e

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\0\0]
"Script"=AAC.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\1\0]
"Script"=addlocaladmingroup.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-220523388-162531612-1801674531-2260\Scripts\Logon\0\0]
"Script"=\\med-srv-03\public\tvd.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-220523388-162531612-1801674531-2736\Scripts\Logon\0\0]
"Script"=VistaCheck.vbs

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
backup=c:\windows\pss\Adobe Gamma Loader.exe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Network Associates\\Common Framework\\FrameworkService.exe"=
"c:\\Program Files\\Octoshape Streaming Services\\u0032610\\OctoshapeClient.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\SSH Secure Shell\\SshClient.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 Ext2fs;Ext2fs;c:\windows\system32\drivers\ext2fs.sys [19/12/2008 19:48 181120]
R1 IfsMount;IfsMount;c:\windows\system32\drivers\ifsmount.sys [19/12/2008 19:48 51072]
R2 DLPortIO;DriverLINX Port I/O Driver;c:\windows\system32\drivers\DLPORTIO.sys [28/04/2005 14:19 3584]
S3 PD1170VID;Creative WebCam Notebook;c:\windows\system32\drivers\P1170vid.sys [2/07/2008 13:38 106496]
S3 PowerLabUSB;ADInstruments PowerLab driver;c:\windows\system32\drivers\PLUSB.sys [27/06/2006 16:35 16896]
S4 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [24/11/2006 19:06 59904]
.
Contents of the 'Scheduled Tasks' folder

2009-05-16 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyServer = actsvr.comcastonline.com:8100
uInternet Settings,ProxyOverride = cdn;*.local
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: E&xporteren naar Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\u0032610\Application Data\Mozilla\Firefox\Profiles\xqihsxnj.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.be/
FF - plugin: c:\documents and settings\u0032610\Application Data\Mozilla\plugins\npoctoshape.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdbplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\Octoshape Streaming Services\u0032610\octoprogram-L03-NMS0810164_SUA_000\npoctoshape.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
FF - plugin: c:\windows\SYSTEM32\DNAML\npdbplug.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-19 07:16
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-220523388-162531612-1801674531-2736\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:05,14,73,cc,71,3e,6e,9c,47,3f,2d,c8,c0,34,bf,3f,4a,a7,2c,ae,5b,2e,36,
d5,c4,71,9e,65,9c,6a,62,a2,02,51,0d,a2,47,90,a2,18,ee,84,02,04,cf,6c,61,ba,\
"??"=hex:3a,8f,87,66,61,da,a0,69,af,30,24,92,59,fc,9c,d3

[HKEY_LOCAL_MACHINE\software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:24,5d,17,b9,cd,74,14,b8,76,52,7e,50,63,07,cd,b8,38,9c,5a,fb,d0,6f,49,
d5,24,4c,d2,3e,9b,54,4f,57,7f,58,90,4a,2f,a9,22,59,93,03,cc,9c,2c,ca,b4,cb,\
"??"=hex:7d,9d,51,aa,2e,25,26,26,14,ac,27,9f,70,7f,3e,ec
.
Completion time: 2009-05-19 7:18
ComboFix-quarantined-files.txt 2009-05-19 05:18
ComboFix2.txt 2009-05-13 17:26

Pre-Run: 1.472.864.256 bytes free
Post-Run: 1.495.564.288 bytes free

1066 --- E O F --- 2009-05-19 01:08

greyknight17 · Joined: Feb 03, 2003 Posts: 5674 Location: Brooklyn, NY

Go to Start->Run and type in regedit and hit OK. Go to File->Export and save the registry somewhere as a backup. Close the Registry Editor now. Go to Start->Run and type in notepad and hit OK. Then copy and paste the following into Notepad:

REGEDIT4
Registry::
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
"BootExecute"=hex(7):61,75,74,6f,63,68,65,63,6b,20,61,75,74,6f,63,68,6b,20,2a,00,00

Save the file as "delete.reg". Make sure to save it with the quotes. Close Notepad. Double click on the delete.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards.

Good job. Your log is clean.

To help prevent future spyware infections, read the Anti-Spyware Tutorial and use the tools provided.

Are there any problems now? If none, go to Start->Run, copy/paste in combofix /u and hit OK to remove it. You should be set to go.

aardvark42 · Joined: May 10, 2009 Posts: 9

Hi greyknight17,

I`ve no problems anymore with Google Search Results! Laptop runs smoother than before.
Thanks again for your expert input and patience.

Aardvark42