also @ TechSpot: Dell's thumb drive-sized computer will ship in July for $100

Appear to be infected eith expiro.x

Discussion in 'Virus and Malware Removal' started by luddite, Nov 13, 2011.

Post New Reply
Page 1 of 6

  1. luddite Newcomer, in training Posts: 82

    Hello
    My laptop has been getting warnings about expiro.x infections. Appear to have lost windows media player and audicity.

    Here are my logsMalwarebytes' Anti-Malware 1.51.2.1300
    www.malwarebytes.org

    Database version: 8152

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 8.0.6001.18702

    11/13/2011 8:37:30 AM
    mbam-log-2011-11-13 (08-37-30).txt

    Scan type: Quick scan
    Objects scanned: 179418
    Time elapsed: 6 minute(s), 49 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 10
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 14

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcLocator (Virus.Expiro) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\TypeLib\{97AEFDD8-2F60-11D3-8A39-00C04F72D8E3} (Virus.Expiro) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS (Virus.Expiro) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSDTC (Virus.Expiro) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSIServer (Virus.Expiro) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft .NET Framework 1.1 (1033) (Virus.Expiro) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmiApSrv (Virus.Expiro) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\TypeLib\{9C757116-4367-4DA9-AC0E-6C6577AD5560} (Virus.Expiro) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{A0B2DD9A-7F53-4E65-8547-851952EC8C96} (Virus.Expiro) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\TypeLib\{80D45A3E-3CD8-4FF4-9E99-43A2109049D6} (Virus.Expiro) -> Quarantined and deleted successfully.

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    c:\WINDOWS\system32\locator.exe (Virus.Expiro) -> Quarantined and deleted successfully.
    c:\WINDOWS\system32\vssvc.exe (Virus.Expiro) -> Quarantined and deleted successfully.
    c:\WINDOWS\system32\msdtc.exe (Virus.Expiro) -> Quarantined and deleted successfully.
    c:\WINDOWS\system32\msiexec.exe (Virus.Expiro) -> Quarantined and deleted successfully.
    c:\WINDOWS\system32\wbem\wmiapsrv.exe (Virus.Expiro) -> Quarantined and deleted successfully.
    c:\WINDOWS\system32\mstsc.exe (Virus.Expiro) -> Quarantined and deleted successfully.
    c:\WINDOWS\system32\utilman.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
    c:\WINDOWS\system32\cleanmgr.exe (Virus.Expiro) -> Quarantined and deleted successfully.
    c:\WINDOWS\system32\mspaint.exe (Virus.Expiro) -> Quarantined and deleted successfully.
    c:\WINDOWS\system32\odbcad32.exe (Virus.Expiro) -> Quarantined and deleted successfully.
    c:\WINDOWS\system32\wiaacmgr.exe (Virus.Expiro) -> Quarantined and deleted successfully.
    c:\WINDOWS\system32\calc.exe (Virus.Expiro) -> Quarantined and deleted successfully.
    c:\WINDOWS\system32\charmap.exe (Virus.Expiro) -> Quarantined and deleted successfully.
    c:\documents and settings\Willy\local settings\Temp\wpbt0.dll (Exploit.Drop) -> Quarantined and deleted successfully.

    GMER 1.0.15.15641 - http://www.gmer.net
    Rootkit scan 2011-11-13 10:13:23
    Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e TOSHIBA_MK5056GSYF rev.LJ001D
    Running: g5wc9831.exe; Driver: C:\DOCUME~1\Willy\LOCALS~1\Temp\fxtdipow.sys


    ---- System - GMER 1.0.15 ----

    SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0xB2207F3C]
    SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateProcess [0xB2207FE4]
    SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0xB2208080]
    SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0xB220811C]

    ---- Kernel code sections - GMER 1.0.15 ----

    ? edoygsx.sys The system cannot find the file specified. !
    .text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB956F360, 0x3061D7, 0xE8000020]
    ? C:\DOCUME~1\Willy\LOCALS~1\Temp\fxtdipob.sys The system cannot find the file specified. !

    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
    AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
    AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
    AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 snapman.sys (Apricorn Snapshot API/Apricorn)
    AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 snapman.sys (Apricorn Snapshot API/Apricorn)
    AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume3 snapman.sys (Apricorn Snapshot API/Apricorn)
    AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume4 snapman.sys (Apricorn Snapshot API/Apricorn)
    AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

    Device \FileSystem\Fastfat \Fat B03F9D20
    Device \FileSystem\Fastfat \Fat B04008C1

    AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
    AttachedDevice \FileSystem\Fastfat \Fat AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )

    ---- EOF - GMER 1.0.15 ----
    .
    DDS (Ver_2011-08-26.01) - NTFSx86
    Internet Explorer: 8.0.6001.18702
    Run by Willy at 10:17:33 on 2011-11-13
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2232 [GMT -5:00]
    .
    AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    .
    ============== Running Processes ===============
    .
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    svchost.exe
    C:\Program Files\Common Files\Apricorn\Schedule2\schedul2.exe
    C:\Program Files\AVG\AVG2012\avgwdsvc.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    C:\Program Files\AVG\AVG2012\avgnsx.exe
    C:\Program Files\AVG\AVG2012\avgemcx.exe
    C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
    C:\WINDOWS\system32\STacSV.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\OEM02Mon.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\LCDMon.exe
    C:\WINDOWS\system32\KADxMain.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDClock.exe
    C:\Program Files\Dell\MediaDirect\PCMService.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDPOP3.exe
    C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDMedia.exe
    C:\Program Files\Apricorn\EZ Gig II\EZGigMonitor.exe
    C:\Program Files\Apricorn\EZ Gig II\TimounterMonitor.exe
    C:\Program Files\Common Files\Apricorn\Schedule2\schedhlp.exe
    C:\Program Files\AVG\AVG2012\avgtray.exe
    C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
    C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    C:\Documents and Settings\Willy\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
    C:\Program Files\Common Files\SupportSoft\bin\bcont.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    C:\Program Files\AVG\AVG2012\avgui.exe
    C:\Program Files\AVG\AVG2012\avgrsx.exe
    C:\Program Files\AVG\AVG2012\avgcsrvx.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\wscntfy.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.google.com/
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg2012\avgssie.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    uRun: [SansaDispatch] c:\documents and settings\willy\application data\sandisk\sansa updater\SansaDispatch.exe
    uRun: [Desktop Software] "c:\program files\common files\supportsoft\bin\bcont.exe" /ini "c:\program files\comcastui\desktop software\uinstaller.ini" /fromrun /starthidden
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [nwiz] nwiz.exe /installquiet
    mRun: [NVHotkey] rundll32.exe nvHotkey.dll,Start
    mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
    mRun: [OEM02Mon.exe] c:\windows\OEM02Mon.exe
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [IntelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe"
    mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    mRun: [Dell QuickSet] c:\program files\dell\quickset\quickset.exe
    mRun: [Launch LCDMon] "c:\program files\common files\logitech\lcd manager\LCDMon.exe"
    mRun: [KADxMain] c:\windows\system32\KADxMain.exe
    mRun: [PCMService] "c:\program files\dell\mediadirect\PCMService.exe"
    mRun: [EZGigMonitor.exe] c:\program files\apricorn\ez gig ii\EZGigMonitor.exe
    mRun: [AcronisTimounterMonitor] c:\program files\apricorn\ez gig ii\TimounterMonitor.exe
    mRun: [Apricorn Scheduler Service] "c:\program files\common files\apricorn\schedule2\schedhlp.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    mRun: [AVG_TRAY] "c:\program files\avg\avg2012\avgtray.exe"
    mRun: [ddoctorv2] "c:\program files\comcast\desktop doctor\bin\sprtcmd.exe" /P ddoctorv2
    mRun: [<NO NAME>]
    mRun: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
    StartupFolder: c:\documents and settings\willy\start menu\programs\startup\desktop.ini~NFDCDVNA
    StartupFolder: c:\docume~1\willy\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
    StartupFolder: c:\documents and settings\all users\start menu\programs\startup\desktop.ini~QAQP9CP6
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\nkbmon~1.lnk - c:\program files\nikon\pictureproject\NkbMonitor.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~2.lnk - c:\program files\windows desktop search\WindowsSearch.exe
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444552440000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg2012\avgpp.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    LSA: Authentication Packages = msv1_0 relog_ap
    Hosts: 127.0.0.1 www.spywareinfo.com
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-11-12 23120]
    R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-11-12 32592]
    R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-11-12 230608]
    R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-11-12 40016]
    R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-11-12 295248]
    R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2012\AVGIDSAgent.exe [2011-10-12 4433248]
    R2 avgwd;AVG WatchDog;c:\program files\avg\avg2012\avgwdsvc.exe [2011-8-2 192776]
    R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-11-13 366152]
    R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-11-12 134608]
    R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-11-12 24272]
    R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-11-12 16720]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-11-13 22216]
    S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2008-4-25 14336]
    .
    =============== File Associations ===============
    .
    inffile=%windir%\NOTEPAD.EXE %1
    txtfile=%windir%\NOTEPAD.EXE %1
    .
    =============== Created Last 30 ================
    .
    2011-11-13 13:45:46 4033376 ----a-w- c:\windows\system32\avgr41e.nt
    2011-11-13 13:28:28 -------- d-----w- c:\documents and settings\willy\application data\Malwarebytes
    2011-11-13 13:28:21 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
    2011-11-13 13:28:17 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-11-13 13:28:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-11-13 01:48:26 24272 ----a-w- c:\windows\system32\drivers\AVGIDSFilter.sys
    2011-11-13 01:48:26 23120 ----a-w- c:\windows\system32\drivers\AVGIDSEH.sys
    2011-11-13 01:48:26 134608 ----a-w- c:\windows\system32\drivers\AVGIDSDriver.sys
    2011-11-13 01:48:25 16720 ----a-w- c:\windows\system32\drivers\AVGIDSShim.sys
    2011-11-13 01:48:24 295248 ----a-w- c:\windows\system32\drivers\avgtdix.sys
    2011-11-13 01:48:20 32592 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
    2011-11-13 01:48:20 230608 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2011-11-13 01:38:33 -------- d-----w- c:\program files\CCleaner
    2011-11-13 01:02:02 18727 ----a-w- c:\documents and settings\willy\local settings\application data\dfl20z32.dll
    2011-11-13 00:59:07 134 ----a-w- c:\documents and settings\willy\local settings\application data\wsr20zt32.dll
    .
    ==================== Find3M ====================
    .
    2011-11-13 00:59:04 536576 ----a-w- c:\windows\system32\cmd.exe
    2011-11-13 00:59:04 216576 ----a-w- c:\windows\system32\notepad.exe
    2011-11-13 00:59:03 363008 ----a-w- c:\windows\system32\osk.exe
    2011-11-13 00:59:03 220160 ----a-w- c:\windows\system32\magnify.exe
    2011-10-18 23:04:03 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2011-10-10 14:22:41 692736 ----a-w- c:\windows\system32\inetcomm.dll
    2011-09-28 07:06:50 599040 ----a-w- c:\windows\system32\crypt32.dll
    2011-09-26 15:41:20 611328 ----a-w- c:\windows\system32\uiautomationcore.dll
    2011-09-26 15:41:20 220160 ----a-w- c:\windows\system32\oleacc.dll
    2011-09-26 15:41:14 20480 ----a-w- c:\windows\system32\oleaccrc.dll
    2011-09-06 13:25:11 1867904 ----a-w- c:\windows\system32\win32k.sys
    2011-08-22 23:48:55 916480 ----a-w- c:\windows\system32\wininet.dll
    2011-08-22 23:48:54 43520 ----a-w- c:\windows\system32\licmgr10.dll
    2011-08-22 23:48:54 1469440 ------w- c:\windows\system32\inetcpl.cpl
    2011-08-22 11:56:39 385024 ----a-w- c:\windows\system32\html.iec
    2011-08-17 13:49:54 138496 ----a-w- c:\windows\system32\drivers\afd.sys
    .
    ============= FINISH: 10:18:03.68 ===============
    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume2
    Install Date: 5/4/2010 6:44:21 PM
    System Uptime: 11/13/2011 8:38:34 AM (2 hours ago)
    .
    Motherboard: Dell Inc. | |
    Processor: Intel(R) Core(TM)2 Duo CPU T9300 @ 2.50GHz | Microprocessor | 2468/200mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 453 GiB total, 314.183 GiB free.
    D: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID:
    Description:
    Device ID: ROOT\APRICORNDEVICES\SOFTWARE
    Manufacturer:
    Name:
    PNP Device ID: ROOT\APRICORNDEVICES\SOFTWARE
    Service:
    .
    ==== System Restore Points ===================
    .
    RP274: 8/13/2011 8:59:00 PM - System Checkpoint
    RP275: 8/15/2011 8:04:01 AM - System Checkpoint
    RP276: 8/15/2011 7:17:38 PM - Configured Microsoft Office Home and Student 2007
    RP277: 8/17/2011 7:48:00 PM - System Checkpoint
    RP278: 8/18/2011 1:38:09 PM - Installed HiJackThis
    RP279: 8/18/2011 1:40:18 PM - Configured Microsoft Office Home and Student 2007
    RP280: 8/19/2011 6:47:19 PM - System Checkpoint
    RP281: 8/21/2011 10:57:21 AM - System Checkpoint
    RP282: 8/21/2011 8:07:53 PM - Configured Microsoft Office Home and Student 2007
    RP283: 8/21/2011 8:09:14 PM - Configured Microsoft Office Home and Student 2007
    RP284: 8/22/2011 10:35:27 PM - System Checkpoint
    RP285: 8/27/2011 5:51:15 PM - Software Distribution Service 3.0
    RP286: 9/1/2011 3:24:23 PM - System Checkpoint
    RP287: 9/3/2011 7:56:11 PM - System Checkpoint
    RP288: 9/5/2011 1:35:08 AM - System Checkpoint
    RP289: 9/5/2011 12:56:31 PM - Configured Microsoft Office Home and Student 2007
    RP290: 9/8/2011 7:18:13 AM - System Checkpoint
    RP291: 9/8/2011 8:16:36 PM - Software Distribution Service 3.0
    RP292: 9/27/2011 11:59:46 PM - Installed Java(TM) 6 Update 26
    RP293: 9/29/2011 11:05:10 AM - System Checkpoint
    RP294: 10/1/2011 9:59:22 AM - Installed AVG 2012
    RP295: 10/1/2011 9:59:46 AM - Removed AVG 2011
    RP296: 10/1/2011 10:00:16 AM - Installed AVG 2012
    RP297: 10/1/2011 10:05:15 AM - Removed AVG 2011
    RP298: 10/3/2011 8:06:53 PM - System Checkpoint
    RP299: 10/4/2011 8:20:50 PM - System Checkpoint
    RP300: 10/9/2011 1:33:21 AM - System Checkpoint
    RP301: 10/9/2011 2:21:08 PM - Configured Microsoft Office Home and Student 2007
    RP302: 10/10/2011 8:04:04 PM - System Checkpoint
    RP303: 10/11/2011 7:13:14 PM - Software Distribution Service 3.0
    RP304: 10/13/2011 8:13:58 PM - System Checkpoint
    RP305: 10/14/2011 5:23:40 AM - Installed Java(TM) 6 Update 26
    RP306: 10/15/2011 8:23:14 AM - System Checkpoint
    RP307: 10/16/2011 7:17:45 PM - Configured Microsoft Office Home and Student 2007
    RP308: 10/19/2011 9:39:19 PM - System Checkpoint
    RP309: 10/21/2011 7:23:15 AM - System Checkpoint
    RP310: 10/22/2011 11:14:46 AM - System Checkpoint
    RP311: 10/23/2011 1:14:25 PM - System Checkpoint
    RP312: 10/26/2011 7:48:05 PM - System Checkpoint
    RP313: 10/28/2011 1:04:51 PM - System Checkpoint
    RP314: 10/29/2011 2:02:49 PM - System Checkpoint
    RP315: 11/1/2011 6:56:12 PM - System Checkpoint
    RP316: 11/2/2011 11:29:57 PM - System Checkpoint
    RP317: 11/7/2011 9:14:59 AM - System Checkpoint
    RP318: 11/8/2011 5:49:12 PM - Software Distribution Service 3.0
    RP319: 11/11/2011 8:02:34 AM - Software Distribution Service 3.0
    RP320: 11/12/2011 7:59:20 PM - AVG restore point before healing of system file
    RP321: 11/12/2011 8:00:30 PM - AVG restore point before healing of system file
    RP322: 11/12/2011 8:02:45 PM - AVG restore point before healing of system file
    RP323: 11/12/2011 8:03:24 PM - AVG restore point before healing of system file
    RP324: 11/12/2011 8:14:23 PM - AVG restore point before healing of system file
    RP325: 11/12/2011 8:20:01 PM - Software Distribution Service 3.0
    RP326: 11/12/2011 8:28:50 PM - AVG restore point before healing of system file
    RP327: 11/12/2011 8:30:24 PM - AVG restore point before healing of system file
    RP328: 11/12/2011 8:34:56 PM - AVG restore point before healing of system file
    RP329: 11/12/2011 8:42:32 PM - AVG restore point before healing of system file
    RP330: 11/12/2011 8:46:00 PM - AVG restore point before healing of system file
    RP331: 11/12/2011 8:46:49 PM - AVG restore point before healing of system file
    RP332: 11/12/2011 8:47:13 PM - AVG restore point before healing of system file
    RP333: 11/12/2011 8:47:53 PM - AVG restore point before healing of system file
    RP334: 11/12/2011 8:53:45 PM - AVG restore point before healing of system file
    RP335: 11/12/2011 8:58:52 PM - Restore Operation
    RP336: 11/12/2011 8:59:56 PM - AVG restore point before healing of system file
    RP337: 11/12/2011 9:05:23 PM - Restore Operation
    RP338: 11/12/2011 9:06:27 PM - AVG restore point before healing of system file
    RP339: 11/13/2011 6:55:57 AM - AVG restore point before healing of system file
    RP340: 11/13/2011 6:56:07 AM - AVG restore point before healing of system file
    RP341: 11/13/2011 7:00:57 AM - AVG restore point before healing of system file
    RP342: 11/13/2011 7:06:55 AM - AVG restore point before healing of system file
    luddite, Nov 13, 2011
    #1

  2. Broni Malware Annihilator Posts: 39,313   +175

    Welcome aboard [IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    =====================================================================

    Attach.txt part of DDS is incomplete.
    Please repost it.

    Then...

    Download aswMBR to your desktop.
    Double click the aswMBR.exe to run it.
    If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
    Click the "Scan" button to start scan:
    [IMG]

    On completion of the scan click "Save log", save it to your desktop and post in your next reply:
    [IMG]

    NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

    =================================================================

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode (How to...)

    2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
    Broni, Nov 13, 2011
    #2

  3. luddite Newcomer, in training Posts: 82

    hello
    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume2
    Install Date: 5/4/2010 6:44:21 PM
    System Uptime: 11/13/2011 8:38:34 AM (2 hours ago)
    .
    Motherboard: Dell Inc. | |
    Processor: Intel(R) Core(TM)2 Duo CPU T9300 @ 2.50GHz | Microprocessor | 2468/200mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 453 GiB total, 314.183 GiB free.
    D: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID:
    Description:
    Device ID: ROOT\APRICORNDEVICES\SOFTWARE
    Manufacturer:
    Name:
    PNP Device ID: ROOT\APRICORNDEVICES\SOFTWARE
    Service:
    .
    ==== System Restore Points ===================
    .
    RP274: 8/13/2011 8:59:00 PM - System Checkpoint
    RP275: 8/15/2011 8:04:01 AM - System Checkpoint
    RP276: 8/15/2011 7:17:38 PM - Configured Microsoft Office Home and Student 2007
    RP277: 8/17/2011 7:48:00 PM - System Checkpoint
    RP278: 8/18/2011 1:38:09 PM - Installed HiJackThis
    RP279: 8/18/2011 1:40:18 PM - Configured Microsoft Office Home and Student 2007
    RP280: 8/19/2011 6:47:19 PM - System Checkpoint
    RP281: 8/21/2011 10:57:21 AM - System Checkpoint
    RP282: 8/21/2011 8:07:53 PM - Configured Microsoft Office Home and Student 2007
    RP283: 8/21/2011 8:09:14 PM - Configured Microsoft Office Home and Student 2007
    RP284: 8/22/2011 10:35:27 PM - System Checkpoint
    RP285: 8/27/2011 5:51:15 PM - Software Distribution Service 3.0
    RP286: 9/1/2011 3:24:23 PM - System Checkpoint
    RP287: 9/3/2011 7:56:11 PM - System Checkpoint
    RP288: 9/5/2011 1:35:08 AM - System Checkpoint
    RP289: 9/5/2011 12:56:31 PM - Configured Microsoft Office Home and Student 2007
    RP290: 9/8/2011 7:18:13 AM - System Checkpoint
    RP291: 9/8/2011 8:16:36 PM - Software Distribution Service 3.0
    RP292: 9/27/2011 11:59:46 PM - Installed Java(TM) 6 Update 26
    RP293: 9/29/2011 11:05:10 AM - System Checkpoint
    RP294: 10/1/2011 9:59:22 AM - Installed AVG 2012
    RP295: 10/1/2011 9:59:46 AM - Removed AVG 2011
    RP296: 10/1/2011 10:00:16 AM - Installed AVG 2012
    RP297: 10/1/2011 10:05:15 AM - Removed AVG 2011
    RP298: 10/3/2011 8:06:53 PM - System Checkpoint
    RP299: 10/4/2011 8:20:50 PM - System Checkpoint
    RP300: 10/9/2011 1:33:21 AM - System Checkpoint
    RP301: 10/9/2011 2:21:08 PM - Configured Microsoft Office Home and Student 2007
    RP302: 10/10/2011 8:04:04 PM - System Checkpoint
    RP303: 10/11/2011 7:13:14 PM - Software Distribution Service 3.0
    RP304: 10/13/2011 8:13:58 PM - System Checkpoint
    RP305: 10/14/2011 5:23:40 AM - Installed Java(TM) 6 Update 26
    RP306: 10/15/2011 8:23:14 AM - System Checkpoint
    RP307: 10/16/2011 7:17:45 PM - Configured Microsoft Office Home and Student 2007
    RP308: 10/19/2011 9:39:19 PM - System Checkpoint
    RP309: 10/21/2011 7:23:15 AM - System Checkpoint
    RP310: 10/22/2011 11:14:46 AM - System Checkpoint
    RP311: 10/23/2011 1:14:25 PM - System Checkpoint
    RP312: 10/26/2011 7:48:05 PM - System Checkpoint
    RP313: 10/28/2011 1:04:51 PM - System Checkpoint
    RP314: 10/29/2011 2:02:49 PM - System Checkpoint
    RP315: 11/1/2011 6:56:12 PM - System Checkpoint
    RP316: 11/2/2011 11:29:57 PM - System Checkpoint
    RP317: 11/7/2011 9:14:59 AM - System Checkpoint
    RP318: 11/8/2011 5:49:12 PM - Software Distribution Service 3.0
    RP319: 11/11/2011 8:02:34 AM - Software Distribution Service 3.0
    RP320: 11/12/2011 7:59:20 PM - AVG restore point before healing of system file
    RP321: 11/12/2011 8:00:30 PM - AVG restore point before healing of system file
    RP322: 11/12/2011 8:02:45 PM - AVG restore point before healing of system file
    RP323: 11/12/2011 8:03:24 PM - AVG restore point before healing of system file
    RP324: 11/12/2011 8:14:23 PM - AVG restore point before healing of system file
    RP325: 11/12/2011 8:20:01 PM - Software Distribution Service 3.0
    RP326: 11/12/2011 8:28:50 PM - AVG restore point before healing of system file
    RP327: 11/12/2011 8:30:24 PM - AVG restore point before healing of system file
    RP328: 11/12/2011 8:34:56 PM - AVG restore point before healing of system file
    RP329: 11/12/2011 8:42:32 PM - AVG restore point before healing of system file
    RP330: 11/12/2011 8:46:00 PM - AVG restore point before healing of system file
    RP331: 11/12/2011 8:46:49 PM - AVG restore point before healing of system file
    RP332: 11/12/2011 8:47:13 PM - AVG restore point before healing of system file
    RP333: 11/12/2011 8:47:53 PM - AVG restore point before healing of system file
    RP334: 11/12/2011 8:53:45 PM - AVG restore point before healing of system file
    RP335: 11/12/2011 8:58:52 PM - Restore Operation
    RP336: 11/12/2011 8:59:56 PM - AVG restore point before healing of system file
    RP337: 11/12/2011 9:05:23 PM - Restore Operation
    RP338: 11/12/2011 9:06:27 PM - AVG restore point before healing of system file
    RP339: 11/13/2011 6:55:57 AM - AVG restore point before healing of system file
    RP340: 11/13/2011 6:56:07 AM - AVG restore point before healing of system file
    RP341: 11/13/2011 7:00:57 AM - AVG restore point before healing of system file
    RP342: 11/13/2011 7:06:55 AM - AVG restore point before healing of system file
    RP343: 11/13/2011 7:15:37 AM - AVG restore point before healing of system file
    RP344: 11/13/2011 7:23:30 AM - AVG restore point before healing of system file
    RP345: 11/13/2011 7:44:11 AM - AVG restore point before healing of system file
    RP346: 11/13/2011 8:23:22 AM - AVG restore point before healing of system file
    RP347: 11/13/2011 8:30:08 AM - AVG restore point before healing of system file
    RP348: 11/13/2011 8:30:50 AM - AVG restore point before healing of system file
    RP349: 11/13/2011 8:31:13 AM - AVG restore point before healing of system file
    RP350: 11/13/2011 8:31:50 AM - AVG restore point before healing of system file
    RP351: 11/13/2011 8:45:46 AM - AVG restore point before healing of system file
    RP352: 11/13/2011 8:50:33 AM - AVG restore point before healing of system file
    RP353: 11/13/2011 8:58:10 AM - AVG restore point before healing of system file
    RP354: 11/13/2011 9:01:16 AM - AVG restore point before healing of system file
    .
    ==== Installed Programs ======================
    .
    Accidental Damage Services Agreement
    Adobe AIR
    Adobe Flash Player 11 ActiveX
    Adobe Reader X (10.1.1)
    Apple Application Support
    Apple Software Update
    Apricorn*EZ*Gig*II
    ArcSoft Panorama Maker 3
    ASIO4ALL
    Audacity 1.2.6
    AVG 2012
    Broadcom Management Programs
    CCleaner
    Comcast Desktop Software (v1.2.0.9)
    Compatibility Pack for the 2007 Office system
    Dell Touchpad
    Desktop Doctor
    Google Earth Plug-in
    Google Update Helper
    HiJackThis
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB2158563)
    Hotfix for Windows XP (KB2443685)
    Hotfix for Windows XP (KB2570791)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB953955)
    Hotfix for Windows XP (KB954434)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB958347)
    Hotfix for Windows XP (KB959252)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB968764)
    Hotfix for Windows XP (KB969084)
    Hotfix for Windows XP (KB976098-v2)
    Hotfix for Windows XP (KB979306)
    Hotfix for Windows XP (KB981793)
    Intel(R) PROSet/Wireless Software
    IntelliSonic Speech Enhancement
    Java Auto Updater
    Java(TM) 6 Update 20
    Java(TM) 6 Update 7
    KoRE 10-Bit Librarian
    LADSPA_plugins-win-0.4.15
    LAME v3.98.3 for Audacity
    Laptop Integrated Webcam Driver (1.03.02.0719)
    Logitech Gaming LCD Software 1.04
    Malwarebytes' Anti-Malware version 1.51.2.1300
    mCore
    mDrWiFi
    MediaDirect
    mHlpDell
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB2572067)
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Home and Student 2007
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office PowerPoint Viewer 2007 (English)
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Software Update for Web Folders (English) 12
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    mIWA
    mLogView
    mMHouse
    mPfMgr
    mPfWiz
    mProSafe
    mSCfg
    mSSO
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 4.0 SP3 Parser (KB973685)
    MSXML 6.0 Parser (KB927977)
    mWlsSafe
    mWMI
    mZConfig
    NCH Toolbox
    Nikon Message Center
    NVIDIA Drivers
    office Convert Pdf to Jpg Jpeg Tiff Free 6.4
    OutlookAddinSetup
    PictureProject
    QualxServ Service Agreement
    QuickSet
    QuickTime
    Sansa Updater
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Microsoft Windows (KB2564958)
    Security Update for Windows Internet Explorer 8 (KB2183461)
    Security Update for Windows Internet Explorer 8 (KB2360131)
    Security Update for Windows Internet Explorer 8 (KB2416400)
    Security Update for Windows Internet Explorer 8 (KB2482017)
    Security Update for Windows Internet Explorer 8 (KB2497640)
    Security Update for Windows Internet Explorer 8 (KB2510531)
    Security Update for Windows Internet Explorer 8 (KB2530548)
    Security Update for Windows Internet Explorer 8 (KB2544521)
    Security Update for Windows Internet Explorer 8 (KB2559049)
    Security Update for Windows Internet Explorer 8 (KB2586448)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB981332)
    Security Update for Windows Internet Explorer 8 (KB982381)
    Security Update for Windows Media Player (KB2378111)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player (KB975558)
    Security Update for Windows Media Player (KB978695)
    Security Update for Windows XP (KB2079403)
    Security Update for Windows XP (KB2115168)
    Security Update for Windows XP (KB2121546)
    Security Update for Windows XP (KB2160329)
    Security Update for Windows XP (KB2229593)
    Security Update for Windows XP (KB2259922)
    Security Update for Windows XP (KB2279986)
    Security Update for Windows XP (KB2286198)
    Security Update for Windows XP (KB2296011)
    Security Update for Windows XP (KB2296199)
    Security Update for Windows XP (KB2347290)
    Security Update for Windows XP (KB2360937)
    Security Update for Windows XP (KB2387149)
    Security Update for Windows XP (KB2393802)
    Security Update for Windows XP (KB2412687)
    Security Update for Windows XP (KB2419632)
    Security Update for Windows XP (KB2423089)
    Security Update for Windows XP (KB2436673)
    Security Update for Windows XP (KB2440591)
    Security Update for Windows XP (KB2443105)
    Security Update for Windows XP (KB2476490)
    Security Update for Windows XP (KB2476687)
    Security Update for Windows XP (KB2478960)
    Security Update for Windows XP (KB2478971)
    Security Update for Windows XP (KB2479628)
    Security Update for Windows XP (KB2479943)
    Security Update for Windows XP (KB2483185)
    Security Update for Windows XP (KB2483614)
    Security Update for Windows XP (KB2485376)
    Security Update for Windows XP (KB2485663)
    Security Update for Windows XP (KB2491683)
    Security Update for Windows XP (KB2503658)
    Security Update for Windows XP (KB2503665)
    Security Update for Windows XP (KB2506212)
    Security Update for Windows XP (KB2506223)
    Security Update for Windows XP (KB2507618)
    Security Update for Windows XP (KB2507938)
    Security Update for Windows XP (KB2508272)
    Security Update for Windows XP (KB2508429)
    Security Update for Windows XP (KB2509553)
    Security Update for Windows XP (KB2511455)
    Security Update for Windows XP (KB2524375)
    Security Update for Windows XP (KB2535512)
    Security Update for Windows XP (KB2536276-v2)
    Security Update for Windows XP (KB2536276)
    Security Update for Windows XP (KB2544893-v2)
    Security Update for Windows XP (KB2544893)
    Security Update for Windows XP (KB2555917)
    Security Update for Windows XP (KB2562937)
    Security Update for Windows XP (KB2566454)
    Security Update for Windows XP (KB2567053)
    Security Update for Windows XP (KB2567680)
    Security Update for Windows XP (KB2570222)
    Security Update for Windows XP (KB2570947)
    Security Update for Windows XP (KB2592799)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB938464-v2)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371-v2)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB963027)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969897)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB971961)
    Security Update for Windows XP (KB972260)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975562)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB977165)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978251)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978542)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979482)
    Security Update for Windows XP (KB979559)
    Security Update for Windows XP (KB979683)
    Security Update for Windows XP (KB979687)
    Security Update for Windows XP (KB980195)
    Security Update for Windows XP (KB980218)
    Security Update for Windows XP (KB980232)
    Security Update for Windows XP (KB980436)
    Security Update for Windows XP (KB981322)
    Security Update for Windows XP (KB981852)
    Security Update for Windows XP (KB981957)
    Security Update for Windows XP (KB981997)
    Security Update for Windows XP (KB982132)
    Security Update for Windows XP (KB982214)
    Security Update for Windows XP (KB982665)
    Security Update for Windows XP (KB982802)
    Stamp ID3 Tag Editor
    Switch Sound File Converter
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows Internet Explorer 8 (KB2598845)
    Update for Windows Internet Explorer 8 (KB976662)
    Update for Windows Internet Explorer 8 (KB980182)
    Update for Windows Internet Explorer 8 (KB980302)
    Update for Windows XP (KB2141007)
    Update for Windows XP (KB2345886)
    Update for Windows XP (KB2467659)
    Update for Windows XP (KB2541763)
    Update for Windows XP (KB2607712)
    Update for Windows XP (KB2616676-v2)
    Update for Windows XP (KB2641690)
    Update for Windows XP (KB898461)
    Update for Windows XP (KB951618-v2)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971029)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    WebFldrs XP
    WIDCOMM Bluetooth Software
    Windows Internet Explorer 8
    Windows Management Framework Core
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows Presentation Foundation
    XML Paper Specification Shared Components Pack 1.0
    .
    ==== Event Viewer Messages From Past Week ========
    .
    11/7/2011 8:31:26 AM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume2'. It has stopped monitoring the volume.
    11/13/2011 9:10:53 AM, error: atapi [9] - The device, \Device\Ide\IdePort1, did not respond within the timeout period.
    11/13/2011 8:44:02 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: iaStor
    11/12/2011 8:13:25 PM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The system cannot find the file specified.
    11/12/2011 8:13:25 PM, error: Service Control Manager [7000] - The Google Update Service (gupdate) service failed to start due to the following error: The system cannot find the file specified.
    11/12/2011 7:58:56 PM, error: Service Control Manager [7000] - The Telnet service failed to start due to the following error: Access is denied.
    11/12/2011 7:58:55 PM, error: Service Control Manager [7000] - The QoS RSVP service failed to start due to the following error: Access is denied.
    11/12/2011 7:58:54 PM, error: Service Control Manager [7000] - The Remote Desktop Help Session Manager service failed to start due to the following error: Access is denied.
    11/12/2011 7:58:54 PM, error: Service Control Manager [7000] - The Office Source Engine service failed to start due to the following error: Access is denied.
    11/12/2011 7:58:51 PM, error: Service Control Manager [7001] - The Network DDE service depends on the Network DDE DSDM service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    11/12/2011 7:58:48 PM, error: Service Control Manager [7000] - The NetMeeting Remote Desktop Sharing service failed to start due to the following error: Access is denied.
    11/12/2011 7:58:48 PM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: Access is denied.
    11/12/2011 7:58:47 PM, error: Service Control Manager [7000] - The Windows CardSpace service failed to start due to the following error: Access is denied.
    11/12/2011 7:58:46 PM, error: Service Control Manager [7000] - The Google Update Service (gupdate) service failed to start due to the following error: Access is denied.
    11/12/2011 7:58:45 PM, error: Service Control Manager [7000] - The Logical Disk Manager Administrative Service service failed to start due to the following error: Access is denied.
    11/12/2011 7:58:42 PM, error: Service Control Manager [7001] - The ClipBook service depends on the Network DDE service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    11/12/2011 7:58:42 PM, error: Service Control Manager [7000] - The Indexing Service service failed to start due to the following error: Access is denied.
    .
    ==== End Of File ===========================

    here is attach file again
    luddite, Nov 13, 2011
    #3

  4. luddite Newcomer, in training Posts: 82

    Hello
    Here is the aswMBR log file.
    I am having problems uninstalling AVG before running Combofix.
    Although I am still have the AVG desktop icons, I can't seem to uninstall.
    The link for appremover can't find AVG either.
    What next?

    aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
    Run date: 2011-11-13 12:41:01
    -----------------------------
    12:41:01.000 OS Version: Windows 5.1.2600 Service Pack 3
    12:41:01.000 Number of processors: 2 586 0x1706
    12:41:01.000 ComputerName: XPS UserName:
    12:41:02.656 Initialize success
    12:41:57.421 AVAST engine defs: 11111301
    12:42:41.125 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e
    12:42:41.125 Disk 0 Vendor: TOSHIBA_MK5056GSYF LJ001D Size: 476940MB BusType: 3
    12:42:43.265 Disk 0 MBR read successfully
    12:42:43.265 Disk 0 MBR scan
    12:42:43.312 Disk 0 unknown MBR code
    12:42:43.390 Disk 0 scanning sectors +976768065
    12:42:43.656 Disk 0 scanning C:\WINDOWS\system32\drivers
    12:43:27.296 Service scanning
    12:43:28.671 Modules scanning
    12:44:09.062 Disk 0 trace - called modules:
    12:44:09.093 ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
    12:44:09.093 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8af31ab8]
    12:44:09.093 3 CLASSPNP.SYS[ba0f8fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-e[0x8af34940]
    12:44:10.765 AVAST engine scan C:\WINDOWS
    12:45:07.453 AVAST engine scan C:\WINDOWS\system32
    12:45:48.921 File: C:\WINDOWS\system32\cmd.exe **INFECTED** Win32:Expiro-AC
    12:46:27.093 File: C:\WINDOWS\system32\dllhost.exe **INFECTED** Win32:Expiro-AC
    12:48:07.265 File: C:\WINDOWS\system32\magnify.exe **INFECTED** Win32:Expiro-AC
    12:49:34.000 File: C:\WINDOWS\system32\notepad.exe **INFECTED** Win32:Expiro-AC
    12:50:16.484 File: C:\WINDOWS\system32\osk.exe **INFECTED** Win32:Expiro-AC
    12:53:43.578 AVAST engine scan C:\WINDOWS\system32\drivers
    12:55:09.953 AVAST engine scan C:\Documents and Settings\Willy
    13:18:05.921 AVAST engine scan C:\Documents and Settings\All Users
    13:20:02.859 Scan finished successfully
    15:35:36.640 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Willy\Desktop\MBR.dat"
    15:35:36.656 The log file has been saved successfully to "C:\Documents and Settings\Willy\Desktop\aswMBR.txt"
    luddite, Nov 13, 2011
    #4

  5. Broni Malware Annihilator Posts: 39,313   +175

    Try running Combofix from Safe Mode.
    You can disregard any warnings there.
    Broni, Nov 13, 2011
    #5

  6. luddite Newcomer, in training Posts: 82

    Hello
    i had to run in safe mode. i don't have internet explorer in regular mode. Here is the combofix log and rkill log.
    ComboFix 11-11-13.03 - Willy 11/13/2011 16:13:39.1.2 - x86 NETWORK
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2749 [GMT -5:00]
    Running from: c:\documents and settings\Willy\Desktop\ComboFix.exe
    AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\documents and settings\All Users\Start Menu\Programs\Startup\NkbMonitor.exe.lnk
    c:\documents and settings\Willy\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
    c:\documents and settings\Willy\Local Settings\Application Data\dfl20z32.dll
    c:\documents and settings\Willy\Local Settings\Application Data\wsr20zt32.dll
    c:\windows\Help\compstui.hlp~0IHU3867
    c:\windows\Help\ieshared.chm~GP374098
    c:\windows\Help\nmchat.chm~0LM81171
    c:\windows\Help\sndvol32.chm~NRL68431
    c:\windows\system32\office.exe
    .
    Infected copy of c:\windows\system32\spoolsv.exe was found and disinfected
    Restored copy from - c:\windows\$hf_mig$\KB2347290\SP3QFE\spoolsv.exe
    .
    Infected copy of c:\windows\system32\alg.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0038968.exe
    .
    Infected copy of c:\windows\system32\cmd.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP319\A0037285.exe
    .
    Infected copy of c:\windows\system32\dllhost.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP319\A0037256.exe
    .
    Infected copy of c:\windows\system32\magnify.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP319\A0037280.exe
    .
    Infected copy of c:\windows\system32\notepad.exe was found and disinfected
    Restored copy from - c:\windows\NOTEPAD.EXE
    .
    Infected copy of c:\windows\system32\osk.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP319\A0037282.exe
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-10-13 to 2011-11-13 )))))))))))))))))))))))))))))))
    .
    .
    2011-11-13 21:21 . 2011-11-13 21:21 134 ----a-w- c:\documents and settings\Willy\Local Settings\Application Data\wsr20zt32.dll
    2011-11-13 13:28 . 2011-11-13 13:28 -------- d-----w- c:\documents and settings\Willy\Application Data\Malwarebytes
    2011-11-13 13:28 . 2011-11-13 13:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2011-11-13 13:28 . 2011-08-31 22:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-11-13 13:28 . 2011-11-13 13:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-11-13 01:48 . 2011-07-11 05:14 24272 ----a-w- c:\windows\system32\drivers\AVGIDSFilter.sys
    2011-11-13 01:48 . 2011-07-11 05:14 23120 ----a-w- c:\windows\system32\drivers\AVGIDSEH.sys
    2011-11-13 01:48 . 2011-07-11 05:14 134608 ----a-w- c:\windows\system32\drivers\AVGIDSDriver.sys
    2011-11-13 01:48 . 2011-10-04 11:21 16720 ----a-w- c:\windows\system32\drivers\AVGIDSShim.sys
    2011-11-13 01:48 . 2011-07-11 05:14 295248 ----a-w- c:\windows\system32\drivers\avgtdix.sys
    2011-11-13 01:48 . 2011-08-08 10:08 40016 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
    2011-11-13 01:48 . 2011-10-07 11:23 230608 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2011-11-13 01:48 . 2011-09-13 10:30 32592 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
    2011-11-13 01:38 . 2011-11-13 01:38 -------- d-----w- c:\program files\CCleaner
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-11-13 21:21 . 2008-04-25 16:16 216576 ----a-w- c:\windows\system32\notepad.exe
    2011-11-13 21:21 . 2008-04-25 16:16 536576 ----a-w- c:\windows\system32\cmd.exe
    2011-11-13 21:21 . 2008-04-25 16:16 363008 ----a-w- c:\windows\system32\osk.exe
    2011-11-13 21:21 . 2008-04-25 16:16 220160 ----a-w- c:\windows\system32\magnify.exe
    2011-11-13 21:20 . 2008-04-25 16:16 192000 ----a-w- c:\windows\system32\alg.exe
    2011-10-18 23:04 . 2011-08-10 14:27 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2011-10-10 14:22 . 2008-04-25 21:27 692736 ----a-w- c:\windows\system32\inetcomm.dll
    2011-09-28 07:06 . 2008-04-25 16:16 599040 ----a-w- c:\windows\system32\crypt32.dll
    2011-09-26 15:41 . 2008-07-30 07:59 611328 ----a-w- c:\windows\system32\uiautomationcore.dll
    2011-09-26 15:41 . 2008-04-25 16:16 220160 ----a-w- c:\windows\system32\oleacc.dll
    2011-09-26 15:41 . 2008-04-25 16:16 20480 ----a-w- c:\windows\system32\oleaccrc.dll
    2011-09-06 13:25 . 2008-04-25 16:16 1867904 ----a-w- c:\windows\system32\win32k.sys
    2011-08-22 23:48 . 2008-04-25 16:16 916480 ----a-w- c:\windows\system32\wininet.dll
    2011-08-22 23:48 . 2008-04-25 16:16 43520 ----a-w- c:\windows\system32\licmgr10.dll
    2011-08-22 23:48 . 2008-04-25 16:16 1469440 ------w- c:\windows\system32\inetcpl.cpl
    2011-08-22 11:56 . 2008-04-25 16:16 385024 ----a-w- c:\windows\system32\html.iec
    2011-08-18 17:38 . 2011-08-18 17:38 388096 ----a-r- c:\documents and settings\Willy\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2011-08-17 13:49 . 2008-04-25 16:16 138496 ----a-w- c:\windows\system32\drivers\afd.sys
    .
    .
    ------- Sigcheck -------
    Note: Unsigned files aren't necessarily malware.
    .
    [7] 2009-03-08 . B60DDDD2D63CE41CB8C487FCFBB6419E . 638816 . . [8.00.6001.18702] . . c:\windows\system32\dllcache\iexplore.exe
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Desktop Software"="c:\program files\Common Files\SupportSoft\bin\bcont.exe" [2009-04-24 1025320]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-27 1024000]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-05-05 8491008]
    "nwiz"="nwiz.exe" [2011-11-13 1773568]
    "NVHotkey"="nvHotkey.dll" [2007-11-06 81920]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-06 81920]
    "OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-08-28 36864]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
    "IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-07-25 823296]
    "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-07-25 974848]
    "Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2008-02-22 1245184]
    "Launch LCDMon"="c:\program files\Common Files\Logitech\LCD Manager\LCDMon.exe" [2007-07-18 775952]
    "KADxMain"="c:\windows\system32\KADxMain.exe" [2006-11-02 282624]
    "PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-12-21 184320]
    "EZGigMonitor.exe"="c:\program files\Apricorn\EZ Gig II\EZGigMonitor.exe" [2007-10-09 1169264]
    "AcronisTimounterMonitor"="c:\program files\Apricorn\EZ Gig II\TimounterMonitor.exe" [2007-10-09 1949480]
    "Apricorn Scheduler Service"="c:\program files\Common Files\Apricorn\Schedule2\schedhlp.exe" [2007-10-09 148712]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2011-11-13 569344]
    "AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2011-10-25 2415456]
    "ddoctorv2"="c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2008-04-24 202560]
    "SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2010-05-05 405504]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-11-13 1079808]
    "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
    .
    c:\windows\system32\config\systemprofile\Start Menu\Programs\Startup\
    desktop.ini~CL29UPQL [2010-5-4 84]
    .
    c:\documents and settings\Administrator\Start Menu\Programs\Startup\
    desktop.ini~29G9CGMH [2010-5-4 84]
    .
    c:\documents and settings\Willy\Start Menu\Programs\Startup\
    desktop.ini~NFDCDVNA [2010-5-4 84]
    OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2010-5-4 239104]
    .
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-5-17 568176]
    desktop.ini~QAQP9CP6 [2010-5-4 84]
    Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [N/A]
    .
    c:\documents and settings\Default User\Start Menu\Programs\Startup\
    desktop.ini~H762R46B [2010-5-4 84]
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
    "c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
    "c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=
    "c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=
    "c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"=
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
    .
    R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [11/12/2011 8:48 PM 23120]
    R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [11/12/2011 8:48 PM 32592]
    R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [11/12/2011 8:48 PM 230608]
    R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [11/12/2011 8:48 PM 295248]
    R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [11/13/2011 8:28 AM 366152]
    R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [11/12/2011 8:48 PM 134608]
    R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [11/12/2011 8:48 PM 24272]
    R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [11/12/2011 8:48 PM 16720]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11/13/2011 8:28 AM 22216]
    S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [10/12/2011 6:25 AM 4575232]
    S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [8/2/2011 5:09 AM 332288]
    S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [4/25/2008 11:16 AM 14336]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    WINRM REG_MULTI_SZ WINRM
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-11-07 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2010-05-04 23:40]
    .
    2011-11-13 c:\windows\Tasks\switchShakeIcon.job
    - c:\program files\NCH Swift Sound\Switch\switch.exe [2010-07-25 18:31]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    TCP: DhcpNameServer = 68.87.73.246 68.87.71.230
    .
    .
    ------- File Associations -------
    .
    txtfile=%windir%\NOTEPAD.EXE %1
    .
    - - - - ORPHANS REMOVED - - - -
    .
    HKCU-Run-SansaDispatch - c:\documents and settings\Willy\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-11-13 16:21
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    SansaDispatch = c:\documents and settings\Willy\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe?????????????????????????????????????????????????????????????????????????????????????????
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'lsass.exe'(1312)
    c:\windows\system32\relog_ap.dll
    .
    - - - - - - - > 'Explorer.EXE'(536)
    c:\windows\system32\WININET.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    c:\windows\system32\btmmhook.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\progra~1\AVG\AVG2012\avgrsx.exe
    c:\program files\AVG\AVG2012\avgcsrvx.exe
    c:\program files\Comcast\Desktop Doctor\bin\sprtsvc.exe
    c:\windows\system32\rundll32.exe
    c:\windows\system32\RUNDLL32.EXE
    c:\program files\Common Files\Logitech\LCD Manager\Applets\LCDClock.exe
    c:\program files\Common Files\Logitech\LCD Manager\Applets\LCDPOP3.exe
    c:\program files\Common Files\Logitech\LCD Manager\Applets\LCDMedia.exe~PGRH68QI
    .
    **************************************************************************
    .
    Completion time: 2011-11-13 17:11:50 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-11-13 22:11
    .
    Pre-Run: 340,358,004,736 bytes free
    Post-Run: 336,532,680,704 bytes free
    .
    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
    [spybotsd]
    timeout.old=30
    .
    - - End Of File - - FCED34FDAB300A04D134B929CDE15CE8

    This log file is located at C:\rkill.log.
    Please post this only if requested to by the person helping you.
    Otherwise you can close this log when you wish.

    Rkill was run on 11/13/2011 at 21:14:41.
    Operating System: Microsoft Windows XP


    Processes terminated by Rkill or while it was running:



    Rkill completed on 11/13/2011 at 21:14:56.
    luddite, Nov 13, 2011
    #6
     

  7. Broni Malware Annihilator Posts: 39,313   +175

    1. Please open Notepad
    • Click Start , then Run
    • Type notepad .exe in the Run Box
    • Click OK
    Windows Vista/7 users: click Start, in "Start search" type notepad and press Enter.

    2. Now copy/paste the entire content of the codebox below into the Notepad window:

    Code:
    File::
c:\documents and settings\Willy\Local Settings\Application Data\wsr20zt32.dll

    3. Save the above as CFScript.txt

    4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

    5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

    [IMG]


    6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    • Combofix.txt
    Broni, Nov 13, 2011
    #7

  8. luddite Newcomer, in training Posts: 82

    hello
    Here is the latest combofix log. I still had to run from safe mode to get intertnet explorer to open.

    ComboFix 11-11-13.03 - Willy 11/13/2011 21:44:27.2.2 - x86 NETWORK
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2729 [GMT -5:00]
    Running from: c:\documents and settings\Willy\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Willy\Desktop\CFScript.txt
    AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    .
    FILE ::
    "c:\documents and settings\Willy\Local Settings\Application Data\wsr20zt32.dll"
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\documents and settings\Willy\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
    c:\documents and settings\Willy\Local Settings\Application Data\wsr20zt32.dll
    .
    Infected copy of c:\windows\system32\userinit.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040463.exe
    .
    Infected copy of c:\windows\system32\spoolsv.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP361\A0040597.exe
    .
    Infected copy of c:\windows\explorer.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040563.exe
    .
    Infected copy of c:\windows\hh.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039935.exe
    .
    Infected copy of c:\windows\NOTEPAD.EXE was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040002.EXE
    .
    Infected copy of c:\windows\regedit.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040012.exe
    .
    Infected copy of c:\windows\twunk_32.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040501.exe
    .
    Infected copy of c:\windows\winhlp32.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040503.exe
    .
    Infected copy of c:\windows\inf\unregmp2.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039971.exe
    .
    Infected copy of c:\windows\msagent\agentsvr.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039999.exe
    .
    Infected copy of c:\windows\mui\muisetup.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040000.exe
    .
    Infected copy of c:\windows\pchealth\helpctr\binaries\HelpCtr.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040004.exe
    .
    Infected copy of c:\windows\pchealth\helpctr\binaries\HelpHost.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040005.exe
    .
    Infected copy of c:\windows\pchealth\helpctr\binaries\helpsvc.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040006.exe
    .
    Infected copy of c:\windows\pchealth\helpctr\binaries\HscUpd.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040007.exe
    .
    Infected copy of c:\windows\pchealth\helpctr\binaries\msconfig.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040008.exe
    .
    Infected copy of c:\windows\pchealth\helpctr\binaries\notiflag.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040009.exe
    .
    Infected copy of c:\windows\pchealth\UploadLB\Binaries\UploadM.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040010.exe
    .
    Infected copy of c:\windows\system32\accwiz.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039040.exe
    .
    Infected copy of c:\windows\system32\actmovie.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040017.exe
    .
    Infected copy of c:\windows\system32\ahui.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040019.exe
    .
    Infected copy of c:\windows\system32\alg.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0038968.exe
    .
    Infected copy of c:\windows\system32\arp.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040020.exe
    .
    Infected copy of c:\windows\system32\asr_fmt.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040021.exe
    .
    Infected copy of c:\windows\system32\asr_pfu.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040022.exe
    .
    Infected copy of c:\windows\system32\at.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040023.exe
    .
    Infected copy of c:\windows\system32\blastcln.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040024.exe
    .
    Infected copy of c:\windows\system32\bootcfg.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040025.exe
    .
    Infected copy of c:\windows\system32\cacls.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040026.exe
    .
    Infected copy of c:\windows\system32\cidaemon.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040027.exe
    .
    Infected copy of c:\windows\system32\cipher.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040028.exe
    .
    Infected copy of c:\windows\system32\ckcnv.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040029.exe
    .
    Infected copy of c:\windows\system32\clipbrd.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040031.exe
    .
    Infected copy of c:\windows\system32\cmd.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039030.exe
    .
    Infected copy of c:\windows\system32\cmdl32.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040032.exe
    .
    Infected copy of c:\windows\system32\cmmon32.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040033.exe
    .
    Infected copy of c:\windows\system32\cmstp.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040034.exe
    .
    Infected copy of c:\windows\system32\compact.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040036.exe
    .
    Infected copy of c:\windows\system32\cscript.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040037.exe
    .
    Infected copy of c:\windows\system32\ctfmon.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040038.exe
    .
    Infected copy of c:\windows\system32\ddeshare.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040039.exe
    .
    Infected copy of c:\windows\system32\defrag.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040040.exe
    .
    Infected copy of c:\windows\system32\dfrgfat.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040041.exe
    .
    Infected copy of c:\windows\system32\dfrgntfs.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040042.exe
    .
    Infected copy of c:\windows\system32\diantz.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040043.exe
    .
    Infected copy of c:\windows\system32\diskpart.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040044.exe
    .
    Infected copy of c:\windows\system32\dllhost.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039025.exe
    .
    Infected copy of c:\windows\system32\dplaysvr.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040313.exe
    .
    Infected copy of c:\windows\system32\dpnsvr.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040314.exe
    .
    Infected copy of c:\windows\system32\dpvsetup.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040315.exe
    .
    Infected copy of c:\windows\system32\driverquery.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040316.exe
    .
    Infected copy of c:\windows\system32\drwtsn32.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040318.exe
    .
    Infected copy of c:\windows\system32\dumprep.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040320.exe
    .
    Infected copy of c:\windows\system32\dvdupgrd.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040321.exe
    .
    Infected copy of c:\windows\system32\dwwin.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040322.exe
    .
    Infected copy of c:\windows\system32\dxdiag.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040323.exe
    .
    Infected copy of c:\windows\system32\esentutl.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040324.exe
    .
    Infected copy of c:\windows\system32\eudcedit.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040325.exe
    .
    Infected copy of c:\windows\system32\eventcreate.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040326.exe
    .
    Infected copy of c:\windows\system32\eventtriggers.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040327.exe
    .
    Infected copy of c:\windows\system32\expand.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040328.exe
    .
    Infected copy of c:\windows\system32\extrac32.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040329.exe
    .
    Infected copy of c:\windows\system32\find.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040330.exe
    .
    Infected copy of c:\windows\system32\findstr.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040331.exe
    .
    Infected copy of c:\windows\system32\finger.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040332.exe
    .
    Infected copy of c:\windows\system32\fltMc.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040333.exe
    .
    Infected copy of c:\windows\system32\fontview.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040334.exe
    .
    Infected copy of c:\windows\system32\freecell.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039050.exe
    .
    Infected copy of c:\windows\system32\fsquirt.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040335.exe
    .
    Infected copy of c:\windows\system32\fsutil.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040336.exe
    .
    Infected copy of c:\windows\system32\ftp.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040337.exe
    .
    Infected copy of c:\windows\system32\fxsclnt.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039041.exe
    .
    Infected copy of c:\windows\system32\fxscover.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039042.exe
    .
    Infected copy of c:\windows\system32\fxssend.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039043.exe
    .
    Infected copy of c:\windows\system32\getmac.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040338.exe
    .
    Infected copy of c:\windows\system32\gpresult.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040339.exe
    .
    Infected copy of c:\windows\system32\gpupdate.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040340.exe
    .
    Infected copy of c:\windows\system32\grpconv.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040341.exe
    .
    Infected copy of c:\windows\system32\hostname.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040342.exe
    .
    Infected copy of c:\windows\system32\ie4uinit.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040344.exe
    .
    Infected copy of c:\windows\system32\iexpress.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040346.exe
    .
    Infected copy of c:\windows\system32\ipconfig.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040347.exe
    .
    luddite, Nov 13, 2011
    #8

  9. luddite Newcomer, in training Posts: 82

    Hello
    Here is the rest of the file

    Infected copy of c:\windows\system32\ipsec6.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040348.exe
    .
    Infected copy of c:\windows\system32\ipv6.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040349.exe
    .
    Infected copy of c:\windows\system32\ipxroute.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040350.exe
    .
    Infected copy of c:\windows\system32\lnkstub.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040355.exe
    .
    Infected copy of c:\windows\system32\logagent.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040356.exe
    .
    Infected copy of c:\windows\system32\logman.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040357.exe
    .
    Infected copy of c:\windows\system32\lpq.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040359.exe
    .
    Infected copy of c:\windows\system32\lpr.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040360.exe
    .
    Infected copy of c:\windows\system32\magnify.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039028.exe
    .
    Infected copy of c:\windows\system32\makecab.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040362.exe
    .
    Infected copy of c:\windows\system32\mmcperf.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040364.exe
    .
    Infected copy of c:\windows\system32\mplay32.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040365.exe
    .
    Infected copy of c:\windows\system32\mpnotify.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040366.exe
    .
    Infected copy of c:\windows\system32\mqbkup.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040367.exe
    .
    Infected copy of c:\windows\system32\mqtgsvc.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040368.exe
    .
    Infected copy of c:\windows\system32\msg.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040371.exe
    .
    Infected copy of c:\windows\system32\mshearts.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039051.exe
    .
    Infected copy of c:\windows\system32\mshta.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040372.exe
    .
    Infected copy of c:\windows\system32\napstat.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040373.exe
    .
    Infected copy of c:\windows\system32\nbtstat.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040374.exe
    .
    Infected copy of c:\windows\system32\nddeapir.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040375.exe
    .
    Infected copy of c:\windows\system32\net.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040376.exe
    .
    Infected copy of c:\windows\system32\net1.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040377.exe
    .
    Infected copy of c:\windows\system32\netsetup.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040378.exe
    .
    Infected copy of c:\windows\system32\netsh.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040379.exe
    .
    Infected copy of c:\windows\system32\netstat.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040380.exe
    .
    Infected copy of c:\windows\system32\nslookup.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040382.exe
    .
    Infected copy of c:\windows\system32\ntbackup.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039046.exe
    .
    Infected copy of c:\windows\system32\ntsd.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040383.exe
    .
    Infected copy of c:\windows\system32\ntvdm.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040384.exe
    .
    Infected copy of c:\windows\system32\nwscript.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040390.exe
    .
    Infected copy of c:\windows\system32\odbcconf.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040391.exe
    .
    Infected copy of c:\windows\system32\openfiles.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040394.exe
    .
    Infected copy of c:\windows\system32\osk.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039029.exe
    .
    Infected copy of c:\windows\system32\packager.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040395.exe
    .
    Infected copy of c:\windows\system32\pathping.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040396.exe
    .
    Infected copy of c:\windows\system32\perfmon.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040397.exe
    .
    Infected copy of c:\windows\system32\ping6.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040398.exe
    .
    Infected copy of c:\windows\system32\powercfg.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040399.exe
    .
    Infected copy of c:\windows\system32\proquota.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040401.exe
    .
    Infected copy of c:\windows\system32\proxycfg.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040402.exe
    .
    Infected copy of c:\windows\system32\rasautou.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040404.exe
    .
    Infected copy of c:\windows\system32\rasphone.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040405.exe
    .
    Infected copy of c:\windows\system32\rcp.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040406.exe
    .
    Infected copy of c:\windows\system32\rdpclip.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040407.exe
    .
    Infected copy of c:\windows\system32\rdsaddin.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040408.exe
    .
    Infected copy of c:\windows\system32\rdshost.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040409.exe
    .
    Infected copy of c:\windows\system32\regini.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040410.exe
    .
    Infected copy of c:\windows\system32\regsvr32.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040411.exe
    .
    Infected copy of c:\windows\system32\relog.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040412.exe
    .
    Infected copy of c:\windows\system32\rexec.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040414.exe
    .
    Infected copy of c:\windows\system32\route.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040415.exe
    .
    Infected copy of c:\windows\system32\routemon.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040416.exe
    .
    Infected copy of c:\windows\system32\rsh.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040417.exe
    .
    Infected copy of c:\windows\system32\rsm.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040418.exe
    .
    Infected copy of c:\windows\system32\rsmsink.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040419.exe
    .
    Infected copy of c:\windows\system32\rsmui.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040420.exe
    .
    Infected copy of c:\windows\system32\rsnotify.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040421.exe
    .
    Infected copy of c:\windows\system32\rsopprov.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040422.exe
    .
    Infected copy of c:\windows\system32\rtcshare.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040423.exe
    .
    Infected copy of c:\windows\system32\runas.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040424.exe
    .
    Infected copy of c:\windows\system32\runonce.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040425.exe
    .
    Infected copy of c:\windows\system32\savedump.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040426.exe
    .
    Infected copy of c:\windows\system32\schtasks.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040427.exe
    .
    Infected copy of c:\windows\system32\sdbinst.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040428.exe
    .
    Infected copy of c:\windows\system32\secedit.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040432.exe
    .
    Infected copy of c:\windows\system32\sethc.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040433.exe
    .
    Infected copy of c:\windows\system32\setup.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040434.exe
    .
    Infected copy of c:\windows\system32\setupn.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040435.exe
    .
    Infected copy of c:\windows\system32\sfc.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040436.exe
    .
    Infected copy of c:\windows\system32\shmgrate.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040437.exe
    .
    Infected copy of c:\windows\system32\shrpubw.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040438.exe
    .
    Infected copy of c:\windows\system32\sigverif.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040439.exe
    .
    Infected copy of c:\windows\system32\skeys.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040440.exe
    .
    Infected copy of c:\windows\system32\sndrec32.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039044.exe
    .
    Infected copy of c:\windows\system32\sndvol32.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039045.exe
    .
    Infected copy of c:\windows\system32\sol.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039054.exe
    .
    Infected copy of c:\windows\system32\sort.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040441.exe
    .
    Infected copy of c:\windows\system32\spider.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039055.exe
    .
    Infected copy of c:\windows\system32\spiisupd.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040442.exe
    .
    Infected copy of c:\windows\system32\stimon.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040444.exe
    .
    Infected copy of c:\windows\system32\syncapp.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040445.exe
    .
    Infected copy of c:\windows\system32\syskey.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040446.exe
    .
    Infected copy of c:\windows\system32\sysocmgr.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040447.exe
    .
    Infected copy of c:\windows\system32\systeminfo.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040448.exe
    .
    Infected copy of c:\windows\system32\taskkill.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040449.exe
    .
    Infected copy of c:\windows\system32\tasklist.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040450.exe
    .
    Infected copy of c:\windows\system32\taskmgr.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040451.exe
    .
    Infected copy of c:\windows\system32\tcpsvcs.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040452.exe
    .
    Infected copy of c:\windows\system32\telnet.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040453.exe
    .
    Infected copy of c:\windows\system32\tftp.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040454.exe
    .
    Infected copy of c:\windows\system32\tlntadmn.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040455.exe
    .
    Infected copy of c:\windows\system32\tlntsess.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040456.exe
    .
    Infected copy of c:\windows\system32\tracerpt.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040457.exe
    .
    Infected copy of c:\windows\system32\tracert6.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040458.exe
    .
    Infected copy of c:\windows\system32\typeperf.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040460.exe
    .
    Infected copy of c:\windows\system32\upnpcont.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040461.exe
    .
    Infected copy of c:\windows\system32\usrmlnka.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040466.exe
    .
    Infected copy of c:\windows\system32\usrprbda.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040467.exe
    .
    Infected copy of c:\windows\system32\usrshuta.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040468.exe
    .
    Infected copy of c:\windows\system32\verifier.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040471.exe
    .
    Infected copy of c:\windows\system32\vssadmin.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040472.exe
    .
    Infected copy of c:\windows\system32\w32tm.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040473.exe
    .
    Infected copy of c:\windows\system32\wextract.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040482.exe
    .
    Infected copy of c:\windows\system32\winchat.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040483.exe
    .
    Infected copy of c:\windows\system32\winmine.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039052.exe
    .
    Infected copy of c:\windows\system32\winmsd.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040485.exe
    .
    luddite, Nov 13, 2011
    #9

  10. luddite Newcomer, in training Posts: 82

    Still more...

    Infected copy of c:\windows\system32\wpabaln.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040490.exe
    .
    Infected copy of c:\windows\system32\wpnpinst.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040492.exe
    .
    Infected copy of c:\windows\system32\wscntfy.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040493.exe
    .
    Infected copy of c:\windows\system32\wscript.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040494.exe
    .
    Infected copy of c:\windows\system32\wuauclt1.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040497.exe
    .
    Infected copy of c:\windows\system32\xcopy.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040499.exe
    .
    Infected copy of c:\windows\system32\Com\comrepl.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040035.exe
    .
    Infected copy of c:\windows\system32\npp\nppagent.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040381.exe
    .
    Infected copy of c:\windows\system32\oobe\oobebaln.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040393.exe
    .
    Infected copy of c:\windows\system32\Restore\rstrui.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039049.exe
    .
    Infected copy of c:\windows\system32\Restore\srdiag.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040413.exe
    .
    Infected copy of c:\windows\system32\usmt\migload.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040464.exe
    .
    Infected copy of c:\windows\system32\usmt\migwiz.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039047.exe
    .
    Infected copy of c:\windows\system32\usmt\migwiza.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040465.exe
    .
    Infected copy of c:\windows\system32\wbem\mofcomp.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040474.exe
    .
    Infected copy of c:\windows\system32\wbem\scrcons.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040475.exe
    .
    Infected copy of c:\windows\system32\wbem\unsecapp.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040476.exe
    .
    Infected copy of c:\windows\system32\wbem\wbemtest.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040477.exe
    .
    Infected copy of c:\windows\system32\wbem\winmgmt.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040478.exe
    .
    Infected copy of c:\windows\system32\wbem\wmiadap.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040479.exe
    .
    Infected copy of c:\windows\system32\wbem\wmic.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040480.exe
    .
    Infected copy of c:\windows\system32\userinit.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040463.exe
    Infected copy of c:\windows\system32\spoolsv.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP361\A0040597.exe
    Infected copy of c:\windows\explorer.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040563.exe
    Infected copy of c:\windows\hh.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039935.exe
    Infected copy of c:\windows\NOTEPAD.EXE was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040002.EXE
    Infected copy of c:\windows\regedit.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040012.exe
    Infected copy of c:\windows\twunk_32.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040501.exe
    Infected copy of c:\windows\winhlp32.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040503.exe
    Infected copy of c:\windows\inf\unregmp2.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039971.exe
    Infected copy of c:\windows\msagent\agentsvr.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039999.exe
    Infected copy of c:\windows\mui\muisetup.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040000.exe
    Infected copy of c:\windows\pchealth\helpctr\binaries\HelpCtr.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040004.exe
    Infected copy of c:\windows\pchealth\helpctr\binaries\HelpHost.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040005.exe
    Infected copy of c:\windows\pchealth\helpctr\binaries\helpsvc.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040006.exe
    Infected copy of c:\windows\pchealth\helpctr\binaries\HscUpd.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040007.exe
    Infected copy of c:\windows\pchealth\helpctr\binaries\msconfig.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040008.exe
    Infected copy of c:\windows\pchealth\helpctr\binaries\notiflag.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040009.exe
    Infected copy of c:\windows\pchealth\UploadLB\Binaries\UploadM.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040010.exe
    Infected copy of c:\windows\system32\accwiz.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039040.exe
    Infected copy of c:\windows\system32\actmovie.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040017.exe
    Infected copy of c:\windows\system32\ahui.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040019.exe
    Infected copy of c:\windows\system32\alg.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0038968.exe
    Infected copy of c:\windows\system32\arp.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040020.exe
    Infected copy of c:\windows\system32\asr_fmt.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040021.exe
    Infected copy of c:\windows\system32\asr_pfu.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040022.exe
    Infected copy of c:\windows\system32\at.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040023.exe
    Infected copy of c:\windows\system32\blastcln.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040024.exe
    Infected copy of c:\windows\system32\bootcfg.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040025.exe
    Infected copy of c:\windows\system32\cacls.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040026.exe
    Infected copy of c:\windows\system32\cidaemon.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040027.exe
    Infected copy of c:\windows\system32\cipher.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040028.exe
    Infected copy of c:\windows\system32\ckcnv.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040029.exe
    Infected copy of c:\windows\system32\clipbrd.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040031.exe
    Infected copy of c:\windows\system32\cmd.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039030.exe
    Infected copy of c:\windows\system32\cmdl32.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040032.exe
    Infected copy of c:\windows\system32\cmmon32.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040033.exe
    Infected copy of c:\windows\system32\cmstp.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040034.exe
    Infected copy of c:\windows\system32\compact.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040036.exe
    Infected copy of c:\windows\system32\cscript.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040037.exe
    Infected copy of c:\windows\system32\ctfmon.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040038.exe
    Infected copy of c:\windows\system32\ddeshare.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040039.exe
    Infected copy of c:\windows\system32\defrag.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040040.exe
    Infected copy of c:\windows\system32\dfrgfat.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040041.exe
    Infected copy of c:\windows\system32\dfrgntfs.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040042.exe
    Infected copy of c:\windows\system32\diantz.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040043.exe
    Infected copy of c:\windows\system32\diskpart.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040044.exe
    Infected copy of c:\windows\system32\dplaysvr.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040313.exe
    Infected copy of c:\windows\system32\dpnsvr.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040314.exe
    Infected copy of c:\windows\system32\dpvsetup.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040315.exe
    Infected copy of c:\windows\system32\driverquery.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040316.exe
    Infected copy of c:\windows\system32\drwtsn32.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040318.exe
    Infected copy of c:\windows\system32\dumprep.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040320.exe
    Infected copy of c:\windows\system32\dvdupgrd.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040321.exe
    Infected copy of c:\windows\system32\dwwin.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040322.exe
    Infected copy of c:\windows\system32\dxdiag.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040323.exe
    Infected copy of c:\windows\system32\esentutl.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040324.exe
    Infected copy of c:\windows\system32\eudcedit.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040325.exe
    Infected copy of c:\windows\system32\eventcreate.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040326.exe
    Infected copy of c:\windows\system32\eventtriggers.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040327.exe
    Infected copy of c:\windows\system32\expand.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040328.exe
    Infected copy of c:\windows\system32\extrac32.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040329.exe
    Infected copy of c:\windows\system32\find.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040330.exe
    Infected copy of c:\windows\system32\findstr.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040331.exe
    Infected copy of c:\windows\system32\finger.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040332.exe
    Infected copy of c:\windows\system32\fltMc.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040333.exe
    Infected copy of c:\windows\system32\fontview.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040334.exe
    Infected copy of c:\windows\system32\freecell.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039050.exe
    Infected copy of c:\windows\system32\fsquirt.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040335.exe
    Infected copy of c:\windows\system32\fsutil.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040336.exe
    Infected copy of c:\windows\system32\ftp.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040337.exe
    Infected copy of c:\windows\system32\fxsclnt.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039041.exe
    Infected copy of c:\windows\system32\fxscover.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039042.exe
    Infected copy of c:\windows\system32\fxssend.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039043.exe
    Infected copy of c:\windows\system32\getmac.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040338.exe
    Infected copy of c:\windows\system32\gpresult.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040339.exe
    Infected copy of c:\windows\system32\gpupdate.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040340.exe
    Infected copy of c:\windows\system32\grpconv.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040341.exe
    Infected copy of c:\windows\system32\hostname.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040342.exe
    Infected copy of c:\windows\system32\ie4uinit.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040344.exe
    Infected copy of c:\windows\system32\iexpress.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040346.exe
    Infected copy of c:\windows\system32\ipconfig.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040347.exe
    Infected copy of c:\windows\system32\ipsec6.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040348.exe
    Infected copy of c:\windows\system32\ipv6.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040349.exe
    Infected copy of c:\windows\system32\ipxroute.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040350.exe
    Infected copy of c:\windows\system32\lnkstub.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040355.exe
    Infected copy of c:\windows\system32\logagent.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040356.exe
    Infected copy of c:\windows\system32\logman.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040357.exe
    Infected copy of c:\windows\system32\lpq.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040359.exe
    Infected copy of c:\windows\system32\lpr.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040360.exe
    Infected copy of c:\windows\system32\magnify.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039028.exe
    Infected copy of c:\windows\system32\makecab.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040362.exe
    Infected copy of c:\windows\system32\mmcperf.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040364.exe
    Infected copy of c:\windows\system32\mplay32.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040365.exe
    Infected copy of c:\windows\system32\mpnotify.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040366.exe
    Infected copy of c:\windows\system32\mqbkup.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040367.exe
    Infected copy of c:\windows\system32\mqtgsvc.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040368.exe
    Infected copy of c:\windows\system32\msg.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040371.exe
    Infected copy of c:\windows\system32\mshearts.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039051.exe
    Infected copy of c:\windows\system32\mshta.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040372.exe
    Infected copy of c:\windows\system32\napstat.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040373.exe
    Infected copy of c:\windows\system32\nbtstat.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040374.exe
    Infected copy of c:\windows\system32\nddeapir.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040375.exe
    Infected copy of c:\windows\system32\net.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040376.exe
    Infected copy of c:\windows\system32\net1.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040377.exe
    Infected copy of c:\windows\system32\netsetup.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040378.exe
    Infected copy of c:\windows\system32\netsh.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040379.exe
    Infected copy of c:\windows\system32\netstat.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040380.exe
    Infected copy of c:\windows\system32\nslookup.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040382.exe
    Infected copy of c:\windows\system32\ntbackup.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039046.exe
    Infected copy of c:\windows\system32\ntsd.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040383.exe
    Infected copy of c:\windows\system32\ntvdm.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040384.exe
    Infected copy of c:\windows\system32\nwscript.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040390.exe
    Infected copy of c:\windows\system32\odbcconf.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040391.exe
    Infected copy of c:\windows\system32\openfiles.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040394.exe
    Infected copy of c:\windows\system32\osk.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039029.exe
    Infected copy of c:\windows\system32\packager.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040395.exe
    Infected copy of c:\windows\system32\pathping.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040396.exe
    Infected copy of c:\windows\system32\perfmon.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040397.exe
    Infected copy of c:\windows\system32\ping6.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040398.exe
    Infected copy of c:\windows\system32\powercfg.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040399.exe
    Infected copy of c:\windows\system32\proquota.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040401.exe
    Infected copy of c:\windows\system32\proxycfg.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040402.exe
    Infected copy of c:\windows\system32\rasautou.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040404.exe
    Infected copy of c:\windows\system32\rasphone.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040405.exe
    Infected copy of c:\windows\system32\rcp.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040406.exe
    Infected copy of c:\windows\system32\rdpclip.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040407.exe
    Infected copy of c:\windows\system32\rdsaddin.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040408.exe
    Infected copy of c:\windows\system32\rdshost.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040409.exe
    Infected copy of c:\windows\system32\regini.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040410.exe
    Infected copy of c:\windows\system32\regsvr32.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040411.exe
    Infected copy of c:\windows\system32\relog.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040412.exe
    Infected copy of c:\windows\system32\rexec.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040414.exe
    Infected copy of c:\windows\system32\route.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040415.exe
    Infected copy of c:\windows\system32\routemon.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040416.exe
    Infected copy of c:\windows\system32\rsh.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0040417.exe
    Infected copy of c:\windows\system32\sndrec32.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039044.exe
    Infected copy of c:\windows\system32\sndvol32.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039045.exe
    Infected copy of c:\windows\system32\sol.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039054.exe
    Infected copy of c:\windows\system32\spider.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039055.exe
    Infected copy of c:\windows\system32\winmine.exe was found and disinfected
    Restored copy from - c:\system volume information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP360\A0039052.exe
    .
    ((((((((((((((((((((((((( Files Created from 2011-10-14 to 2011-11-14 )))))))))))))))))))))))))))))))
    .
    .
    2011-11-14 01:17 . 2011-11-14 02:11 -------- d-----w- C:\ff73cd1785e82edb873a9ba1864eec01
    2011-11-13 13:28 . 2011-11-13 13:28 -------- d-----w- c:\documents and settings\Willy\Application Data\Malwarebytes
    2011-11-13 13:28 . 2011-11-13 13:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2011-11-13 13:28 . 2011-08-31 22:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-11-13 13:28 . 2011-11-13 13:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-11-13 01:48 . 2011-07-11 05:14 24272 ----a-w- c:\windows\system32\drivers\AVGIDSFilter.sys
    2011-11-13 01:48 . 2011-07-11 05:14 23120 ----a-w- c:\windows\system32\drivers\AVGIDSEH.sys
    2011-11-13 01:48 . 2011-07-11 05:14 134608 ----a-w- c:\windows\system32\drivers\AVGIDSDriver.sys
    2011-11-13 01:48 . 2011-10-04 11:21 16720 ----a-w- c:\windows\system32\drivers\AVGIDSShim.sys
    2011-11-13 01:48 . 2011-07-11 05:14 295248 ----a-w- c:\windows\system32\drivers\avgtdix.sys
    2011-11-13 01:48 . 2011-08-08 10:08 40016 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
    2011-11-13 01:48 . 2011-10-07 11:23 230608 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2011-11-13 01:48 . 2011-09-13 10:30 32592 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
    2011-11-13 01:38 . 2011-11-13 21:24 -------- d-----w- c:\program files\CCleaner
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-11-14 03:01 . 2008-04-25 16:16 662016 ----a-w- c:\windows\system32\logonui.exe
    2011-11-13 22:10 . 2010-05-05 02:38 293888 ----a-w- c:\windows\system32\WudfHost.exe
    2011-11-13 22:09 . 2010-05-05 02:38 164864 ----a-w- c:\windows\system32\wpdshextautoplay.exe
    2011-11-13 22:09 . 2009-10-09 21:22 217088 ----a-w- c:\windows\system32\winrs.exe
    2011-11-13 22:09 . 2010-05-05 02:38 587264 ----a-w- c:\windows\system32\searchindexer.exe
    2011-11-13 22:09 . 2010-05-05 02:38 332288 ----a-w- c:\windows\system32\searchprotocolhost.exe
    2011-11-13 22:08 . 2010-03-31 04:10 436736 ----a-w- c:\windows\system32\PresentationHost.exe
    2011-11-13 21:21 . 2008-04-25 16:16 216576 ----a-w- c:\windows\system32\notepad.exe
    2011-10-18 23:04 . 2011-08-10 14:27 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2011-10-10 14:22 . 2008-04-25 21:27 692736 ----a-w- c:\windows\system32\inetcomm.dll
    2011-09-28 07:06 . 2008-04-25 16:16 599040 ----a-w- c:\windows\system32\crypt32.dll
    2011-09-26 15:41 . 2008-07-30 07:59 611328 ----a-w- c:\windows\system32\uiautomationcore.dll
    2011-09-26 15:41 . 2008-04-25 16:16 220160 ----a-w- c:\windows\system32\oleacc.dll
    2011-09-26 15:41 . 2008-04-25 16:16 20480 ----a-w- c:\windows\system32\oleaccrc.dll
    2011-09-06 13:25 . 2008-04-25 16:16 1867904 ----a-w- c:\windows\system32\win32k.sys
    2011-08-22 23:48 . 2008-04-25 16:16 916480 ----a-w- c:\windows\system32\wininet.dll
    2011-08-22 23:48 . 2008-04-25 16:16 43520 ----a-w- c:\windows\system32\licmgr10.dll
    2011-08-22 23:48 . 2008-04-25 16:16 1469440 ------w- c:\windows\system32\inetcpl.cpl
    2011-08-22 11:56 . 2008-04-25 16:16 385024 ----a-w- c:\windows\system32\html.iec
    2011-08-18 17:38 . 2011-08-18 17:38 388096 ----a-r- c:\documents and settings\Willy\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2011-08-17 13:49 . 2008-04-25 16:16 138496 ----a-w- c:\windows\system32\drivers\afd.sys
    .
    .
    ------- Sigcheck -------
    Note: Unsigned files aren't necessarily malware.
    .
    [-] 2011-11-14 03:03 . !HASH: COULD NOT OPEN FILE !!!!! . 194560 . . [------] . . c:\windows\system32\wuauclt.exe
    [-] 2011-11-13 22:07 . !HASH: COULD NOT OPEN FILE !!!!! . 194560 . . [------] . . c:\windows\system32\dllcache\wuauclt.exe
    [-] 2011-11-13 21:59 . !HASH: COULD NOT OPEN FILE !!!!! . 194560 . . [------] . . c:\windows\ERDNT\cache\wuauclt.exe
    .
    [-] 2011-11-13 22:05 . !HASH: COULD NOT OPEN FILE !!!!! . 780288 . . [------] . . c:\windows\system32\dllcache\iexplore.exe
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SansaDispatch"="c:\documents and settings\Willy\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe" [BU]
    "Desktop Software"="c:\program files\Common Files\SupportSoft\bin\bcont.exe" [2011-11-14 1175552]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2011-11-14 1171456]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-05-05 8491008]
    "nwiz"="nwiz.exe" [2011-11-13 1773568]
    "NVHotkey"="nvHotkey.dll" [2007-11-06 81920]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-06 81920]
    "OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2011-11-14 184320]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-11-14 389632]
    "IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2011-11-14 970752]
    "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2011-11-14 1122304]
    "Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2011-11-14 1392640]
    "Launch LCDMon"="c:\program files\Common Files\Logitech\LCD Manager\LCDMon.exe" [2011-11-14 918016]
    "KADxMain"="c:\windows\system32\KADxMain.exe" [2011-11-14 430080]
    "PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2011-11-14 331776]
    "EZGigMonitor.exe"="c:\program files\Apricorn\EZ Gig II\EZGigMonitor.exe" [2007-10-09 1169264]
    "AcronisTimounterMonitor"="c:\program files\Apricorn\EZ Gig II\TimounterMonitor.exe" [2007-10-09 1949480]
    "Apricorn Scheduler Service"="c:\program files\Common Files\Apricorn\Schedule2\schedhlp.exe" [2011-11-14 290816]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2011-11-13 569344]
    "AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2011-11-14 2557440]
    "ddoctorv2"="c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2011-11-14 352256]
    "SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2011-11-14 552960]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-11-13 1079808]
    "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
    .
    c:\windows\system32\config\systemprofile\Start Menu\Programs\Startup\
    desktop.ini~CL29UPQL [2010-5-4 84]
    .
    c:\documents and settings\Administrator\Start Menu\Programs\Startup\
    desktop.ini~29G9CGMH [2010-5-4 84]
    .
    c:\documents and settings\Willy\Start Menu\Programs\Startup\
    desktop.ini~NFDCDVNA [2010-5-4 84]
    OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2010-5-4 239104]
    .
    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-5-17 716800]
    desktop.ini~QAQP9CP6 [2010-5-4 84]
    Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [N/A]
    .
    c:\documents and settings\Default User\Start Menu\Programs\Startup\
    desktop.ini~H762R46B [2010-5-4 84]
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
    "c:\\Program Files\\Google\\Google Earth\\plugin\\geplugin.exe"=
    "c:\\Program Files\\AVG\\AVG2012\\avgnsx.exe"=
    "c:\\Program Files\\AVG\\AVG2012\\avgdiagex.exe"=
    "c:\\Program Files\\AVG\\AVG2012\\avgemcx.exe"=
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
    .
    R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\AVGIDSAgent.exe [2011-11-13 4575232]
    R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [2011-11-13 332288]
    R3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe [2008-04-14 14336]
    S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [2011-07-11 23120]
    S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [2011-09-13 32592]
    S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [2011-10-07 230608]
    S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [2011-07-11 295248]
    S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
    S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [2011-07-11 134608]
    S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [2011-07-11 24272]
    S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys [2011-10-04 16720]
    S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216]
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    WINRM REG_MULTI_SZ WINRM
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-11-07 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2010-05-04 23:40]
    .
    2011-11-13 c:\windows\Tasks\switchShakeIcon.job
    - c:\program files\NCH Swift Sound\Switch\switch.exe [2010-07-25 18:31]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    TCP: DhcpNameServer = 68.87.73.246 68.87.71.230
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-11-13 22:13
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    SansaDispatch = c:\documents and settings\Willy\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe?????????????????????????????????????????????????????????????????????????????????????????
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'lsass.exe'(1328)
    c:\windows\system32\relog_ap.dll
    .
    - - - - - - - > 'Explorer.EXE'(848)
    c:\windows\system32\WININET.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\progra~1\AVG\AVG2012\avgrsx.exe
    c:\program files\AVG\AVG2012\avgcsrvx.exe
    c:\program files\Comcast\Desktop Doctor\bin\sprtsvc.exe
    c:\windows\system32\rundll32.exe
    c:\windows\system32\RUNDLL32.EXE
    .
    **************************************************************************
    .
    Completion time: 2011-11-13 22:26:34 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-11-14 03:26
    ComboFix2.txt 2011-11-13 22:11
    .
    Pre-Run: 339,763,580,928 bytes free
    Post-Run: 336,368,312,320 bytes free
    .
    - - End Of File - - DA16D0211348F6CA944D5D28B4F966DE
    luddite, Nov 13, 2011
    #10

  11. Broni Malware Annihilator Posts: 39,313   +175

    I'm not sure if I like what I see.
    There are too many infected files.

    Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • IMPORTANT! UN-check Remove found threats
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    Broni, Nov 13, 2011
    #11

  12. luddite Newcomer, in training Posts: 82

    here we go with the eset scan.
    C:\Documents and Settings\Willy\Local Settings\Application Data\Adobe\Reader 9.1\Setup Files\Setup.exe Win32/Expiro.X virus
    C:\drivers\audio\R181712\stacsv.exe Win32/Expiro.X virus
    C:\drivers\audio\R181712\stsystra.exe Win32/Expiro.X virus
    C:\drivers\audio\R181712\suhlp.exe Win32/Expiro.X virus
    C:\drivers\input\R165116\CtDrvIns.exe Win32/Expiro.X virus
    C:\drivers\input\R165116\CtDrvStp.exe Win32/Expiro.X virus
    C:\drivers\input\R165116\CtRunApp.exe Win32/Expiro.X virus
    C:\drivers\input\R165116\OEM02Cfg.exe Win32/Expiro.X virus
    C:\drivers\input\R165116\OEM02Mon.exe Win32/Expiro.X virus
    C:\drivers\input\R165116\OEM02Srv.exe Win32/Expiro.X virus
    C:\drivers\input\R175658\DellTpad.exe Win32/Expiro.X virus
    C:\drivers\input\R175658\InstNT.exe Win32/Expiro.X virus
    C:\drivers\input\R175658\setup.exe Win32/Expiro.X virus
    C:\drivers\input\R175658\SynMood.exe Win32/Expiro.X virus
    C:\drivers\input\R175658\SynTPEnh.exe Win32/Expiro.X virus
    C:\drivers\input\R175658\SynZMetr.exe Win32/Expiro.X virus
    C:\drivers\input\R175658\Tutorial.exe Win32/Expiro.X virus
    C:\drivers\video\R167604\nvudisp.exe Win32/Expiro.X virus
    C:\ff73cd1785e82edb873a9ba1864eec01\extexport.exe Win32/Expiro.X virus
    C:\ff73cd1785e82edb873a9ba1864eec01\ie4uinit.exe Win32/Expiro.X virus
    C:\ff73cd1785e82edb873a9ba1864eec01\ieudinit.exe Win32/Expiro.X virus
    C:\ff73cd1785e82edb873a9ba1864eec01\iexplore.exe Win32/Expiro.X virus
    C:\ff73cd1785e82edb873a9ba1864eec01\msfeedssync.exe Win32/Expiro.X virus
    C:\ff73cd1785e82edb873a9ba1864eec01\mshta.exe Win32/Expiro.X virus
    C:\ff73cd1785e82edb873a9ba1864eec01\spuninst.exe Win32/Expiro.X virus
    C:\ff73cd1785e82edb873a9ba1864eec01\winfxdocobj.exe Win32/Expiro.X virus
    C:\ff73cd1785e82edb873a9ba1864eec01\update\iesetup.exe Win32/Expiro.X virus
    C:\ff73cd1785e82edb873a9ba1864eec01\update\update.exe Win32/Expiro.X virus
    C:\I386\EXPAND.EXE Win32/Expiro.X virus
    C:\I386\FAXPATCH.EXE Win32/Expiro.X virus
    C:\I386\kb938464.exe Win32/Expiro.X virus
    C:\I386\kb940157.exe Win32/Expiro.X virus
    C:\I386\kb941569.exe Win32/Expiro.X virus
    C:\I386\kb946648.exe Win32/Expiro.X virus
    C:\I386\kb950762.exe Win32/Expiro.X virus
    C:\I386\kb950974.exe Win32/Expiro.X virus
    C:\I386\kb951066.exe Win32/Expiro.X virus
    C:\I386\kb951376.exe Win32/Expiro.X virus
    C:\I386\kb951618.exe Win32/Expiro.X virus
    C:\I386\kb951698.exe Win32/Expiro.X virus
    C:\I386\kb951748.exe Win32/Expiro.X virus
    C:\I386\kb951978.exe Win32/Expiro.X virus
    C:\I386\kb952004.exe Win32/Expiro.X virus
    C:\I386\kb952069.exe Win32/Expiro.X virus
    C:\I386\kb952287.exe Win32/Expiro.X virus
    C:\I386\kb952954.exe Win32/Expiro.X virus
    C:\I386\KB953297.EXE Win32/Expiro.X virus
    C:\I386\kb953955.exe Win32/Expiro.X virus
    C:\I386\KB954155sp2.EXE Win32/Expiro.X virus
    C:\I386\KB954155sp3.EXE Win32/Expiro.X virus
    C:\I386\kb954211.exe Win32/Expiro.X virus
    C:\I386\KB954430.EXE Win32/Expiro.X virus
    C:\I386\kb954434.exe Win32/Expiro.X virus
    C:\I386\kb954459.exe Win32/Expiro.X virus
    C:\I386\kb954600.exe Win32/Expiro.X virus
    C:\I386\kb955069.exe Win32/Expiro.X virus
    C:\I386\kb955759.exe Win32/Expiro.X virus
    C:\I386\kb955839.exe Win32/Expiro.X virus
    C:\I386\kb956572.exe Win32/Expiro.X virus
    C:\I386\kb956802.exe Win32/Expiro.X virus
    C:\I386\kb956803.exe Win32/Expiro.X virus
    C:\I386\kb956841.exe Win32/Expiro.X virus
    C:\I386\kb956844.exe Win32/Expiro.X virus
    C:\I386\kb957095.exe Win32/Expiro.X virus
    C:\I386\kb957097.exe Win32/Expiro.X virus
    C:\I386\kb958347.exe Win32/Expiro.X virus
    C:\I386\kb958644.exe Win32/Expiro.X virus
    C:\I386\kb958687.exe Win32/Expiro.X virus
    C:\I386\kb958690.exe Win32/Expiro.X virus
    C:\I386\kb958869.exe Win32/Expiro.X virus
    C:\I386\kb959252.exe Win32/Expiro.X virus
    C:\I386\kb959426.exe Win32/Expiro.X virus
    C:\I386\kb960225.exe Win32/Expiro.X virus
    C:\I386\kb960715.exe Win32/Expiro.X virus
    C:\I386\kb960803.exe Win32/Expiro.X virus
    C:\I386\kb961373.exe Win32/Expiro.X virus
    C:\I386\kb961501.exe Win32/Expiro.X virus
    C:\I386\kb963027.exe Win32/Expiro.X virus
    C:\I386\kb967715.exe Win32/Expiro.X virus
    C:\I386\kb968537.exe Win32/Expiro.X virus
    C:\I386\KB968816sp2.EXE Win32/Expiro.X virus
    C:\I386\KB968816sp3.EXE Win32/Expiro.X virus
    C:\I386\KB968930.EXE Win32/Expiro.X virus
    C:\I386\kb969059.exe Win32/Expiro.X virus
    C:\I386\kb969084.exe Win32/Expiro.X virus
    C:\I386\kb969897.exe Win32/Expiro.X virus
    C:\I386\kb969898.exe Win32/Expiro.X virus
    C:\I386\kb969947.exe Win32/Expiro.X virus
    C:\I386\kb970238.exe Win32/Expiro.X virus
    C:\I386\kb970430.exe Win32/Expiro.X virus
    C:\I386\kb971468.exe Win32/Expiro.X virus
    C:\I386\kb971737.exe Win32/Expiro.X virus
    C:\I386\KB971961sp2.EXE Win32/Expiro.X virus
    C:\I386\KB971961sp3.EXE Win32/Expiro.X virus
    C:\I386\kb972270.exe Win32/Expiro.X virus
    C:\I386\KB973685.EXE Win32/Expiro.X virus
    C:\I386\kb973687.exe Win32/Expiro.X virus
    C:\I386\KB973688.EXE Win32/Expiro.X virus
    C:\I386\kb973904.exe Win32/Expiro.X virus
    C:\I386\kb974112.exe Win32/Expiro.X virus
    C:\I386\kb974318.exe Win32/Expiro.X virus
    C:\I386\KB974417.EXE Win32/Expiro.X virus
    C:\I386\kb974571.exe Win32/Expiro.X virus
    C:\I386\kb975025.exe Win32/Expiro.X virus
    C:\I386\kb975467.exe Win32/Expiro.X virus
    C:\I386\kb975560.exe Win32/Expiro.X virus
    C:\I386\kb975713.exe Win32/Expiro.X virus
    C:\I386\kb976098.exe Win32/Expiro.X virus
    C:\I386\kb977165.exe Win32/Expiro.X virus
    C:\I386\kb977914.exe Win32/Expiro.X virus
    C:\I386\kb978037.exe Win32/Expiro.X virus
    C:\I386\kb978251.exe Win32/Expiro.X virus
    C:\I386\kb978262.exe Win32/Expiro.X virus
    C:\I386\kb978706.exe Win32/Expiro.X virus
    C:\I386\NETSETUP.EXE Win32/Expiro.X virus
    C:\I386\NTSD.EXE Win32/Expiro.X virus
    C:\I386\REGEDIT.EXE Win32/Expiro.X virus
    C:\I386\SYSPARSE.EXE Win32/Expiro.X virus
    C:\I386\TELNET.EXE Win32/Expiro.X virus
    C:\I386\WINNT32.EXE Win32/Expiro.X virus
    C:\I386\DRW\DWWIN.EXE Win32/Expiro.X virus
    C:\I386\svcpack\KB958644.exe Win32/Expiro.X virus
    C:\I386\WIN9XMIG\FAX\AWDVSTUB.EXE Win32/Expiro.X virus
    C:\I386\WIN9XMIG\MAPI\DLL\MKNTFRMCACHE.EXE Win32/Expiro.X virus
    C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE Win32/Expiro.X virus
    C:\MSOCache\All Users\{90120000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe Win32/Expiro.X virus
    C:\MSOCache\All Users\{91120000-002F-0000-0000-0000000FF1CE}-C\ose.exe Win32/Expiro.X virus
    C:\MSOCache\All Users\{91120000-002F-0000-0000-0000000FF1CE}-C\setup.exe Win32/Expiro.X virus
    C:\Program Files\Adobe\Reader 10.0\Reader\AcroBroker.exe Win32/Expiro.X virus
    C:\Program Files\Adobe\Reader 10.0\Reader\AcroRd32Info.exe Win32/Expiro.X virus
    C:\Program Files\Adobe\Reader 10.0\Reader\AcroTextExtractor.exe Win32/Expiro.X virus
    C:\Program Files\Adobe\Reader 10.0\Reader\AdobeCollabSync.exe Win32/Expiro.X virus
    C:\Program Files\Adobe\Reader 10.0\Reader\Eula.exe Win32/Expiro.X virus
    C:\Program Files\Adobe\Reader 10.0\Reader\PDFPrevHndlrShim.exe Win32/Expiro.X virus
    C:\Program Files\Adobe\Reader 10.0\Reader\reader_sl.exe Win32/Expiro.X virus
    C:\Program Files\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A91000000001}\Setup.exe Win32/Expiro.X virus
    C:\Program Files\Apricorn\EZ Gig II\spawn.exe Win32/Expiro.X virus
    C:\Program Files\ArcSoft\Panorama Maker 3\ArcRegister.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG2012\avgcfgex.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG2012\avgcmgr.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG2012\avgdiagex.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG2012\avgdumpx.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG2012\avgemcx.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG2012\avglscanx.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG2012\avgnsx.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG2012\avgscanx.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG2012\avgsrmax.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG2012\AVGTBInstall.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG2012\avgtray.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG2012\avgui.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG2012\avgwdsvc.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG2012\avgwsc.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG2012\fixcfg.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG8\avgcfgex.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG8\avgcmgr.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG8\avgcsrvx.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG8\avgdumpx.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG8\avgemc.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG8\avgfrw.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG8\avgiproxy.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG8\avgnsx.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG8\avgrsx.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG8\avgscanx.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG8\avgsrmax.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG8\avgtray.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG8\avgui.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG8\avgupd.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG8\avgwdsvc.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG8\fixcfg.exe Win32/Expiro.X virus
    C:\Program Files\AVG\AVG8\setup.exe Win32/Expiro.X virus
    C:\Program Files\CCleaner\CCleaner.exe Win32/Expiro.X virus
    C:\Program Files\Christie Digital\KoRELib\UNWISE.EXE Win32/Expiro.X virus
    C:\Program Files\Comcast\Desktop Doctor\agent\bin\bcont.exe Win32/Expiro.X virus
    C:\Program Files\Comcast\Desktop Doctor\agent\bin\bcont_nm.exe Win32/Expiro.X virus
    C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe Win32/Expiro.X virus
    C:\Program Files\Comcast\Desktop Doctor\bin\tgshell.exe Win32/Expiro.X virus
    C:\Program Files\ComcastUI\Desktop Software\bin\kui.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Adobe\ARM\1.0\AcrobatUpdater.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Adobe\ARM\1.0\ReaderUpdater.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\template.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Apple\Apple Application Support\defaults.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Apricorn\Schedule2\schedhlp.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Apricorn\Schedule2\schedul2.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Java\Java Update\jaucheck.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Java\Java Update\jaureg.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Java\Java Update\jucheck.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Java\Java Update\jusched.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Java\Update\Base Images\jre1.6.0.b105\patch-jre1.6.0_07.b06\launcher.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Java\Update\Base Images\jre1.6.0.b105\patch-jre1.6.0_07.b06\zipper.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Logitech\LCD Manager\LCDMon.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDMedia.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDPOP3.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE Win32/Expiro.X virus
    C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE Win32/Expiro.X virus
    C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Microsoft Shared\MSInfo\OINFOP12.EXE Win32/Expiro.X virus
    C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLED.EXE Win32/Expiro.X virus
    C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE Win32/Expiro.X virus
    C:\Program Files\Common Files\Microsoft Shared\OFFICE12\OFFDIAG.EXE Win32/Expiro.X virus
    C:\Program Files\Common Files\Microsoft Shared\OFFICE12\OFFLB.EXE Win32/Expiro.X virus
    C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\ODEPLOY.EXE Win32/Expiro.X virus
    C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\SETUP.EXE Win32/Expiro.X virus
    C:\Program Files\Common Files\Microsoft Shared\Smart Tag\SmartTagInstall.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Microsoft Shared\Speech\sapisvr.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Nikon\Message Center\NkMC.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Nikon\Services\NkvBurnIM.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Nikon\Utilities\NEFLauncher.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Nikon\Utilities\SearchApp2.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\Nikon\Utilities\StupAssist.exe Win32/Expiro.X virus
    C:\Program Files\Common Files\SupportSoft\bin\bcont.exe Win32/Expiro.X virus
    C:\Program Files\Dell\MediaDirect\BGDismount.exe Win32/Expiro.X virus
    C:\Program Files\Dell\MediaDirect\CLLauncher.exe Win32/Expiro.X virus
    C:\Program Files\Dell\MediaDirect\MD2Fixer.exe Win32/Expiro.X virus
    C:\Program Files\Dell\MediaDirect\PCMService.exe Win32/Expiro.X virus
    C:\Program Files\Dell\MediaDirect\Kernel\Office\PPTView\PPTVIEW.EXE Win32/Expiro.X virus
    C:\Program Files\Dell\MediaDirect\Koan\TouchStone.exe Win32/Expiro.X virus
    C:\Program Files\Dell\MediaDirect\OLAddin\OLAddin.Exe Win32/Expiro.X virus
    C:\Program Files\Dell\MediaDirect\PPTView\msiexec.exe Win32/Expiro.X virus
    C:\Program Files\Dell\QuickSet\battery.exe Win32/Expiro.X virus
    C:\Program Files\Dell\QuickSet\DisplayPlus.exe Win32/Expiro.X virus
    C:\Program Files\Dell\QuickSet\Gaming.exe Win32/Expiro.X virus
    C:\Program Files\Dell\QuickSet\HotKeys.exe Win32/Expiro.X virus
    C:\Program Files\Dell\QuickSet\installXPSLFX.exe Win32/Expiro.X virus
    C:\Program Files\Dell\QuickSet\NicConfigSvc.exe Win32/Expiro.X virus
    C:\Program Files\Dell\QuickSet\powerset.exe Win32/Expiro.X virus
    C:\Program Files\Dell\QuickSet\QSUI.exe Win32/Expiro.X virus
    C:\Program Files\Dell\QuickSet\quickset.exe Win32/Expiro.X virus
    C:\Program Files\Dell\QuickSet\SVCLauncher.exe Win32/Expiro.X virus
    C:\Program Files\Dell\QuickSet\WiFiLocator.exe Win32/Expiro.X virus
    C:\Program Files\ESET\ESET Online Scanner\ESETSmartInstaller.exe Win32/Expiro.X virus
    C:\Program Files\ESET\ESET Online Scanner\OnlineCmdLineScannerA.exe Win32/Expiro.X virus
    C:\Program Files\ESET\ESET Online Scanner\OnlineScannerApp.exe Win32/Expiro.X virus
    C:\Program Files\ESET\ESET Online Scanner\OnlineScannerUninstaller.exe Win32/Expiro.X virus
    C:\Program Files\Google\Google Earth\plugin\geplugin.exe Win32/Expiro.X virus
    C:\Program Files\Google\Update\1.3.21.79\GoogleCrashHandler.exe Win32/Expiro.X virus
    C:\Program Files\Google\Update\1.3.21.79\GoogleUpdate.exe Win32/Expiro.X virus
    C:\Program Files\Google\Update\1.3.21.79\GoogleUpdateBroker.exe Win32/Expiro.X virus
    C:\Program Files\Google\Update\1.3.21.79\GoogleUpdateOnDemand.exe Win32/Expiro.X virus
    C:\Program Files\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.21.79\GoogleUpdateSetup.exe Win32/Expiro.X virus
    C:\Program Files\Google\Update\Download\{77FCCC43-B894-49C5-A184-5470D398DAF9}\GoogleUpdateSetup.exe Win32/Expiro.X virus
    C:\Program Files\InstallShield Installation Information\{A5F68DC8-0278-4AD8-B413-861509B5F25B}\Setup.exe Win32/Expiro.X virus
    C:\Program Files\Intel\Wireless\Bin\AegisI5.exe Win32/Expiro.X virus
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe Win32/Expiro.X virus
    C:\Program Files\Intel\Wireless\Bin\DrWiFi.exe Win32/Expiro.X virus
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe Win32/Expiro.X virus
    C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe Win32/Expiro.X virus
    C:\Program Files\Intel\Wireless\Bin\iWrap.exe Win32/Expiro.X virus
    C:\Program Files\Intel\Wireless\Bin\PfWizard.exe Win32/Expiro.X virus
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe Win32/Expiro.X virus
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe Win32/Expiro.X virus
    C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe Win32/Expiro.X virus
    C:\Program Files\Intel\Wireless\Bin\WSCWIZ.exe Win32/Expiro.X virus
    C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe Win32/Expiro.X virus
    C:\Program Files\Internet Explorer\ExtExport.exe Win32/Expiro.X virus
    C:\Program Files\Internet Explorer\iedw.exe Win32/Expiro.X virus
    C:\Program Files\Internet Explorer\iexplore.exe Win32/Expiro.X virus
    C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe Win32/Expiro.X virus
    C:\Program Files\Internet Explorer\Connection Wizard\icwconn2.exe Win32/Expiro.X virus
    C:\Program Files\Internet Explorer\Connection Wizard\icwrmind.exe Win32/Expiro.X virus
    C:\Program Files\Internet Explorer\Connection Wizard\icwtutor.exe Win32/Expiro.X virus
    C:\Program Files\Internet Explorer\Connection Wizard\inetwiz.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre1.6.0_07\bin\java-rmi.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre1.6.0_07\bin\java.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre1.6.0_07\bin\javacpl.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre1.6.0_07\bin\javaw.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre1.6.0_07\bin\javaws.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre1.6.0_07\bin\jureg.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre1.6.0_07\bin\keytool.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre1.6.0_07\bin\kinit.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre1.6.0_07\bin\klist.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre1.6.0_07\bin\ktab.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre1.6.0_07\bin\orbd.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre1.6.0_07\bin\pack200.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre1.6.0_07\bin\policytool.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre1.6.0_07\bin\rmid.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre1.6.0_07\bin\rmiregistry.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre1.6.0_07\bin\servertool.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre1.6.0_07\bin\ssvagent.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre1.6.0_07\bin\tnameserv.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre1.6.0_07\bin\unpack200.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\java-rmi.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\java.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\javacpl.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\javaw.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\javaws.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\jbroker.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\jp2launcher.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\jqs.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\jqsnotify.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\jucheck.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\jureg.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\jusched.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\keytool.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\kinit.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\klist.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\ktab.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\orbd.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\pack200.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\policytool.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\rmid.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\rmiregistry.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\servertool.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\ssvagent.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\tnameserv.exe Win32/Expiro.X virus
    C:\Program Files\Java\jre6\bin\unpack200.exe Win32/Expiro.X virus
    C:\Program Files\Lame for Audacity\lame.exe Win32/Expiro.X virus
    C:\Program Files\Messenger\msmsgs.exe Win32/Expiro.X virus
    C:\Program Files\Microsoft Office\Office12\CLVIEW.EXE Win32/Expiro.X virus
    C:\Program Files\Microsoft Office\Office12\DSSM.EXE Win32/Expiro.X virus
    C:\Program Files\Microsoft Office\Office12\EXCEL.EXE Win32/Expiro.X virus
    C:\Program Files\Microsoft Office\Office12\excelcnv.exe Win32/Expiro.X virus
    C:\Program Files\Microsoft Office\Office12\GRAPH.EXE Win32/Expiro.X virus
    C:\Program Files\Microsoft Office\Office12\Moc.exe Win32/Expiro.X virus
    C:\Program Files\Microsoft Office\Office12\MSOHTMED.EXE Win32/Expiro.X virus
    C:\Program Files\Microsoft Office\Office12\MSQRY32.EXE Win32/Expiro.X virus
    C:\Program Files\Microsoft Office\Office12\MSTORDB.EXE Win32/Expiro.X virus
    C:\Program Files\Microsoft Office\Office12\MSTORE.EXE Win32/Expiro.X virus
    C:\Program Files\Microsoft Office\Office12\Oice.exe Win32/Expiro.X virus
    C:\Program Files\Microsoft Office\Office12\OIS.EXE Win32/Expiro.X virus
    C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE Win32/Expiro.X virus
    C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE Win32/Expiro.X virus
    C:\Program Files\Microsoft Office\Office12\POWERPNT.EXE Win32/Expiro.X virus
    C:\Program Files\Microsoft Office\Office12\PPCNVCOM.EXE Win32/Expiro.X virus
    C:\Program Files\Microsoft Office\Office12\PPTVIEW.EXE Win32/Expiro.X virus
    C:\Program Files\Microsoft Office\Office12\SELFCERT.EXE Win32/Expiro.X virus
    C:\Program Files\Microsoft Office\Office12\SETLANG.EXE Win32/Expiro.X virus
    C:\Program Files\Microsoft Office\Office12\VPREVIEW.EXE Win32/Expiro.X virus
    C:\Program Files\Microsoft Office\Office12\WINWORD.EXE Win32/Expiro.X virus
    C:\Program Files\Microsoft Office\Office12\Wordconv.exe Win32/Expiro.X virus
    C:\Program Files\Microsoft Office\Office12\1033\ONELEV.EXE Win32/Expiro.X virus
    C:\Program Files\Movie Maker\moviemk.exe Win32/Expiro.X virus
    C:\Program Files\MSN\MSNCoreFiles\Install\MSN9Components\Digcore.exe Win32/Expiro.X virus
    C:\Program Files\MSN\MSNCoreFiles\Install\MSN9Components\Msncli.exe Win32/Expiro.X virus
    C:\Program Files\NetMeeting\conf.exe Win32/Expiro.X virus
    C:\Program Files\Nikon\PictureProject\NkbImport.exe Win32/Expiro.X virus
    C:\Program Files\Nikon\PictureProject\NkbMonitor.exe Win32/Expiro.X virus
    C:\Program Files\Nikon\PictureProject\NkbTransfer.exe Win32/Expiro.X virus
    C:\Program Files\office Convert Pdf to Jpg Jpeg Tiff Free\office.exe Win32/Expiro.X virus
    C:\Program Files\Outlook Express\oemig50.exe Win32/Expiro.X virus
    C:\Program Files\Outlook Express\setup50.exe Win32/Expiro.X virus
    C:\Program Files\Outlook Express\wabmig.exe Win32/Expiro.X virus
    C:\Program Files\QuickTime\PictureViewer.exe Win32/Expiro.X virus
    C:\Program Files\QuickTime\QTInfo.exe Win32/Expiro.X virus
    C:\Program Files\QuickTime\QTTask.exe Win32/Expiro.X virus
    C:\Program Files\QuickTime\QTSystem\ExportController.exe Win32/Expiro.X virus
    C:\Program Files\QuickTime\QTSystem\QuickTimeUpdateHelper.exe Win32/Expiro.X virus
    C:\Program Files\Sigmatel\C-Major Audio\WDM\stacsv.exe Win32/Expiro.X virus
    C:\Program Files\Sigmatel\C-Major Audio\WDM\stsystra.exe Win32/Expiro.X virus
    C:\Program Files\Sigmatel\C-Major Audio\WDM\suhlp.exe Win32/Expiro.X virus
    C:\Program Files\Spybot - Search & Destroy\SDFiles.exe Win32/Expiro.X virus
    C:\Program Files\Synaptics\SynTP\DellTpad.exe Win32/Expiro.X virus
    C:\Program Files\Synaptics\SynTP\InstNT.exe Win32/Expiro.X virus
    C:\Program Files\Synaptics\SynTP\SynMood.exe Win32/Expiro.X virus
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe Win32/Expiro.X virus
    C:\Program Files\Synaptics\SynTP\SynZMetr.exe Win32/Expiro.X virus
    C:\Program Files\Synaptics\SynTP\Tutorial.exe Win32/Expiro.X virus
    C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe Win32/Expiro.X virus
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe Win32/Expiro.X virus
    C:\Program Files\WIDCOMM\Bluetooth Software\gzip.exe Win32/Expiro.X virus
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe Win32/Expiro.X virus
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\DPInst.exe Win32/Expiro.X virus
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\KB818801_1033.exe Win32/Expiro.X virus
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\Q816650_1033.exe Win32/Expiro.X virus
    C:\Program Files\Windows Media Connect 2\wmccds.exe Win32/Expiro.X virus
    C:\Program Files\Windows Media Connect 2\WMCCFG.exe Win32/Expiro.X virus
    C:\Program Files\Windows Media Player\migrate.exe Win32/Expiro.X virus
    C:\Program Files\Windows Media Player\setup_wm.exe Win32/Expiro.X virus
    C:\Program Files\Windows Media Player\wmdbexport.exe Win32/Expiro.X virus
    C:\Program Files\Windows Media Player\wmlaunch.exe Win32/Expiro.X virus
    C:\Program Files\Windows Media Player\wmpenc.exe Win32/Expiro.X virus
    C:\Program Files\Windows Media Player\wmpnscfg.exe Win32/Expiro.X virus
    C:\Program Files\Windows Media Player\wmpshare.exe Win32/Expiro.X virus
    C:\Program Files\Windows Media Player\wmsetsdk.exe Win32/Expiro.X virus
    C:\Program Files\Windows NT\dialer.exe Win32/Expiro.X virus
    C:\Program Files\Windows NT\Pinball\pinball.exe Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\explorer.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\hh.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\NOTEPAD.EXE.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\regedit.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\twunk_32.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\winhlp32.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\inf\unregmp2.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\msagent\agentsvr.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\mui\muisetup.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\pchealth\helpctr\binaries\HelpHost.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\pchealth\helpctr\binaries\helpsvc.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\pchealth\helpctr\binaries\HscUpd.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\pchealth\helpctr\binaries\notiflag.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\pchealth\UploadLB\Binaries\UploadM.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\accwiz.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\actmovie.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ahui.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\alg.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\arp.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\asr_fmt.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\asr_pfu.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\at.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\blastcln.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\bootcfg.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\cacls.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\cidaemon.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\cipher.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ckcnv.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\clipbrd.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\cmd.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\cmdl32.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\cmmon32.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\cmstp.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\compact.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\cscript.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ctfmon.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ddeshare.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\defrag.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\dfrgfat.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\dfrgntfs.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\diantz.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\diskpart.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\dllhost.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\dplaysvr.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\dpnsvr.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\dpvsetup.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\driverquery.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\drwtsn32.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\dumprep.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\dvdupgrd.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\dwwin.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\dxdiag.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\esentutl.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\eudcedit.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\eventcreate.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\eventtriggers.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\expand.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\extrac32.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\find.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\findstr.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\finger.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\fltMc.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\fontview.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\freecell.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\fsquirt.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\fsutil.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ftp.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\fxsclnt.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\fxscover.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\fxssend.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\getmac.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\gpresult.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\gpupdate.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\grpconv.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\hostname.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ie4uinit.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\iexpress.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ipconfig.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ipsec6.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ipv6.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ipxroute.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\lnkstub.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\logagent.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\logman.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\lpq.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\lpr.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\magnify.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\makecab.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\mmcperf.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\mplay32.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\mpnotify.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\mqbkup.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\mqtgsvc.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\msg.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\mshearts.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\mshta.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\napstat.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\nbtstat.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\nddeapir.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\net.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\net1.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\netsetup.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\netsh.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\netstat.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\notepad.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\nslookup.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ntbackup.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ntsd.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ntvdm.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\nwscript.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\odbcconf.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\openfiles.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\osk.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\packager.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\pathping.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\perfmon.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ping6.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\powercfg.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\proquota.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\proxycfg.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\rasautou.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\rasphone.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\rcp.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\rdpclip.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\rdsaddin.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\rdshost.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\regini.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\regsvr32.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\relog.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\rexec.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\route.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\routemon.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\rsh.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\rsm.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\rsmsink.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\rsmui.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\rsnotify.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\rsopprov.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\rtcshare.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\runas.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\runonce.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\savedump.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\schtasks.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\sdbinst.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\secedit.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\sethc.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\setup.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\setupn.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\sfc.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\shmgrate.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\shrpubw.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\sigverif.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\skeys.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\sndrec32.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\sndvol32.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\sol.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\sort.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\spider.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\spiisupd.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\spoolsv.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\stimon.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\syncapp.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\syskey.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\sysocmgr.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\systeminfo.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\taskkill.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\tasklist.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\taskmgr.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\tcpsvcs.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\telnet.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\tftp.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\tlntadmn.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\tlntsess.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\tracerpt.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\tracert6.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\typeperf.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\upnpcont.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\userinit.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\usrmlnka.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\usrprbda.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\usrshuta.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\verifier.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\vssadmin.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\w32tm.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\wextract.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\winchat.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\winmine.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\winmsd.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\wpabaln.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\wpnpinst.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\wscntfy.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\wscript.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\wuauclt1.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\xcopy.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\Com\comrepl.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\npp\nppagent.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\oobe\oobebaln.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\Restore\rstrui.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\Restore\srdiag.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\usmt\migload.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\usmt\migwiz.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\usmt\migwiza.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\wbem\mofcomp.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\wbem\scrcons.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\wbem\unsecapp.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\wbem\wbemtest.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\wbem\winmgmt.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\wbem\wmiadap.exe.vir Win32/Expiro.X virus
    C:\Qoobox\Quarantine\C\WINDOWS\system32\wbem\wmic.exe.vir Win32/Expiro.X virus
    C:\WINDOWS\CtDrvIns.exe Win32/Expiro.X virus
    C:\WINDOWS\explorer.exe Win32/Expiro.X virus
    C:\WINDOWS\hh.exe Win32/Expiro.X virus
    C:\WINDOWS\OEM02Cfg.exe Win32/Expiro.X virus
    C:\WINDOWS\OEM02Mon.exe Win32/Expiro.X virus
    C:\WINDOWS\PEV.exe Win32/Expiro.X virus
    C:\WINDOWS\regedit.exe Win32/Expiro.X virus
    C:\WINDOWS\sed.exe Win32/Expiro.X virus
    C:\WINDOWS\setpwr32.exe Win32/Expiro.X virus
    C:\WINDOWS\stsystra.exe Win32/Expiro.X virus
    C:\WINDOWS\twunk_32.exe Win32/Expiro.X virus
    C:\WINDOWS\unvise32qt.exe Win32/Expiro.X virus
    C:\WINDOWS\winhlp32.exe Win32/Expiro.X virus
    C:\WINDOWS\zip.exe Win32/Expiro.X virus
    C:\WINDOWS\$968930Uinstall_KB968930$\PSSetupNativeUtils.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2079403\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2079403\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2115168\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2115168\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2121546\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2121546\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2141007\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2141007\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2183461-IE8\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2183461-IE8\SP3QFE\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2183461-IE8\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2229593\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2229593\SP3QFE\helpsvc.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2229593\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2259922\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2259922\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2279986\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2279986\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2286198\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2286198\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2296199\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2296199\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2345886\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2345886\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2347290\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2347290\SP3QFE\spoolsv.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2347290\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2360131-IE8\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2360131-IE8\SP3QFE\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2360131-IE8\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2360937\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2360937\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2387149\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2387149\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2393802\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2393802\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2416400-IE8\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2416400-IE8\SP3QFE\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2416400-IE8\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2419632\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2419632\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2423089\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2423089\SP3QFE\wab.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2423089\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2440591\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2440591\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2443105\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2443105\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2467659\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2467659\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2476490\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2476490\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2476687\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2476687\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2478960\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2478960\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2478971\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2478971\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2479943\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2479943\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2482017-IE8\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2482017-IE8\SP3QFE\ie4uinit.exe Win32/Expiro.X virus
    luddite, Nov 14, 2011
    #12

  13. luddite Newcomer, in training Posts: 82

    mC:\WINDOWS\$hf_mig$\KB2482017-IE8\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2483185\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2483185\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2483614\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2483614\SP3QFE\mstsc.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2483614\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2485376\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2485376\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2485663\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2485663\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2491683\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2491683\SP3QFE\fxscover.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2491683\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2497640-IE8\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2497640-IE8\SP3QFE\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2497640-IE8\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2503658\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2503658\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2503665\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2503665\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2506212\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2506212\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2507618\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2507618\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2507938\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2507938\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2508272\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2508272\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2508429\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2508429\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2509553\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2509553\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2510531-IE8\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2510531-IE8\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2511455\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2511455\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2524375\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2524375\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2530548-IE8\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2530548-IE8\SP3QFE\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2530548-IE8\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2535512\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2535512\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2536276\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2536276\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2536276-v2\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2536276-v2\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2541763\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2541763\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2544521-IE8\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2544521-IE8\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2544893\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2544893\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2544893-v2\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2544893-v2\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2559049-IE8\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2559049-IE8\SP3QFE\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2559049-IE8\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2562937\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2562937\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2566454\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2566454\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2567680\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2567680\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2570222\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2570222\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2570947\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2570947\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2586448-IE8\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2586448-IE8\SP3QFE\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2586448-IE8\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2592799\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2592799\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2598845-IE8\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2598845-IE8\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2607712\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2607712\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2616676-v2\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2616676-v2\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2641690\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB2641690\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB898461\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB898461\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB923561\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB923561\SP3QFE\wordpad.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB923561\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB946648\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB946648\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB950762\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB950762\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB950974\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB950974\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB951066\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB951066\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB951376-v2\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB951376-v2\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB951618-v2\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB951618-v2\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB951698\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB951698\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB951748\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB951748\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB951978\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB951978\SP3QFE\cscript.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB951978\SP3QFE\wscript.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB951978\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB952004\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB952004\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB952287\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB952287\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB952954\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB952954\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB954211\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB954211\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB954434\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB954434\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB954459\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB954459\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB954600\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB954600\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB955069\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB955069\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB955759\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB955759\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB955839\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB955839\SP3QFE\tzchange.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB955839\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB956572\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\wmiprvse.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB956572\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB956744\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB956744\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB956802\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB956802\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB956803\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB956803\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB956841\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB956841\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB956844\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB956844\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB957095\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB957095\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB957097\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB957097\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB958644\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB958644\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB958687\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB958687\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB958690\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB958690\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB959426\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB959426\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB960225\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB960225\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB960715\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB960715\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB960803\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB960803\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB960859\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB960859\SP3QFE\telnet.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB960859\SP3QFE\tlntsess.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB960859\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB961371-v2\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB961371-v2\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB961373\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB961373\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB961501\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB961501\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB963027\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB963027\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB967715\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB967715\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB968389\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB968389\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB968537\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB968537\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB969059\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB969059\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB969897\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB969897\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB969898\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB969898\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB970238\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB970238\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB970430\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB970430\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB971029\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB971029\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB971468\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB971468\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB971486\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB971486\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB971557\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB971557\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB971633\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB971633\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB971657\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB971657\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB971737\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB971737\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB971961\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB971961\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB971961-IE8\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB971961-IE8\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB972260\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB972260\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB972260-IE8\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB972260-IE8\SP3QFE\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB972260-IE8\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB972270\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB972270\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB973346\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB973346\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB973354\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB973354\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB973507\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB973507\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB973525\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB973525\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB973687\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB973687\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB973815\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB973815\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB973869\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB973869\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB973874-IE8\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB973874-IE8\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB973904\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB973904\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB974112\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB974112\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB974318\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB974318\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB974392\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB974392\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB974455-IE8\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB974455-IE8\SP3QFE\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB974455-IE8\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB974571\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB974571\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB975025\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB975025\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB975467\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB975467\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB975560\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB975560\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB975561\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB975561\SP3QFE\moviemk.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB975561\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB975562\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB975562\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB975713\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB975713\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB976662-IE8\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB976662-IE8\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB977165\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB977165\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB977816\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB977816\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB977914\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB977914\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB978037\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB978037\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB978251\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB978251\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB978262\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB978262\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB978338\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB978338\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB978542\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB978542\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB978601\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB978601\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB978706\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB978706\SP3QFE\mspaint.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB978706\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB979309\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB979309\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB979482\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB979482\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB979683\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB979683\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB979687\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB979687\SP3QFE\wordpad.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB979687\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB980182-IE8\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB980182-IE8\SP3QFE\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB980182-IE8\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB980195\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB980195\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB980218\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB980218\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB980232\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB980232\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB980302-IE8\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB980302-IE8\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB980436\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB980436\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB981322\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB981322\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB981332-IE8\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB981332-IE8\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB981852\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB981852\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB981997\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB981997\SP3QFE\moviemk.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB981997\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB982132\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB982132\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB982214\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB982214\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB982381-IE8\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB982381-IE8\SP3QFE\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB982381-IE8\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB982665\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB982665\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB982802\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$hf_mig$\KB982802\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2079403$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2115168$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2121546$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2141007$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2158563$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2160329$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2229593$\helpsvc.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2229593$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2259922$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2279986$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2286198$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2296011$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2296199$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2345886$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2347290$\spoolsv.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2347290$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2360937$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2378111_WM9$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2387149$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2393802$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2412687$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2419632$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2423089$\wab.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2423089$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2436673$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2440591$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2443105$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2443685$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2467659$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2476490$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2476687$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2478960$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2478971$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2479628$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2479943$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2483185$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2483614$\mstsc.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2483614$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2485376$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2485663$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2491683$\fxscover.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2491683$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2503658$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2503665$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2506212$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2506223$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2507618$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2507938$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2508272$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2508429$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2509553$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2511455$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2524375$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2535512$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2536276$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2536276-v2$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2541763$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2544893$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2544893-v2$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2555917$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2562937$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2564958$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2566454$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2567053$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2567680$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2570222$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2570791$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2570947$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2592799$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2607712$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2616676-v2$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB2641690$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB898461$\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB898461$\update.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB915800-v4$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB923561$\wordpad.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB939683$\unregmp2.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB940157$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB960859$\telnet.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB960859$\tlntsess.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB961371-v2$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB963093$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB970653-v3$\tzchange.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB971029$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB972260$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB974392$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB975558_WM8$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB975561$\moviemk.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB975561$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB975562$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB977816$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB978338$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB978542$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB978601$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB978695_WM9$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB979306$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB979309$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB979482$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB979559$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB979683$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB979687$\wordpad.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB979687$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB980195$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB980218$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB980232$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB980436$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB981322$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB981793$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB981852$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB981957$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB981997$\moviemk.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB981997$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB982132$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB982214$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB982665$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallKB982802$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallwmp11$\setup_wm.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallwmp11$\unregmp2.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallwmp11$\wmplayer.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\ERDNT\cache\ctfmon.exe Win32/Expiro.X virus
    C:\WINDOWS\ERDNT\cache\explorer.exe Win32/Expiro.X virus
    C:\WINDOWS\ERDNT\cache\lsass.exe Win32/Expiro.X virus
    C:\WINDOWS\ERDNT\cache\regedit.exe Win32/Expiro.X virus
    C:\WINDOWS\ERDNT\cache\services.exe Win32/Expiro.X virus
    C:\WINDOWS\ERDNT\cache\spoolsv.exe Win32/Expiro.X virus
    C:\WINDOWS\ERDNT\cache\svchost.exe Win32/Expiro.X virus
    C:\WINDOWS\ERDNT\cache\userinit.exe Win32/Expiro.X virus
    C:\WINDOWS\ERDNT\cache\wscntfy.exe Win32/Expiro.X virus
    C:\WINDOWS\ERDNT\cache\wuauclt.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB2183461-IE8\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB2183461-IE8\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB2360131-IE8\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB2360131-IE8\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB2416400-IE8\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB2416400-IE8\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB2482017-IE8\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB2482017-IE8\spuninst\spuninst.exe Win32/Expiro.X virus
    luddite, Nov 14, 2011
    #13

  14. luddite Newcomer, in training Posts: 82

    C:\WINDOWS\ie8updates\KB2497640-IE8\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB2497640-IE8\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB2510531-IE8\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB2530548-IE8\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB2530548-IE8\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB2544521-IE8\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB2559049-IE8\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB2559049-IE8\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB2586448-IE8\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB2586448-IE8\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB2598845-IE8\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB971961-IE8\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB971961-IE8\update.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB971961-IE8\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB972260-IE8\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB972260-IE8\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB973874-IE8\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB974455-IE8\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB974455-IE8\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB976662-IE8\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB980182-IE8\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB980182-IE8\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB980302-IE8\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB981332-IE8\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB982381-IE8\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\ie8updates\KB982381-IE8\spuninst\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\inf\unregmp2.exe Win32/Expiro.X virus
    C:\WINDOWS\Installer\iProData\iconvrtr.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\NETFXSBS10.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\csc.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\cvtres.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\gacutil.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ilasm.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ngen.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\vbc.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\csc.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cvtres.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ilasm.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ngen.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v3.5\csc.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v3.5\vbc.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v3.5\WFServicesReg.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\DeleteTemp.exe Win32/Expiro.X virus
    C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe Win32/Expiro.X virus
    C:\WINDOWS\msagent\agentsvr.exe Win32/Expiro.X virus
    C:\WINDOWS\mui\muisetup.exe Win32/Expiro.X virus
    C:\WINDOWS\Network Diagnostic\xpnetdiag.exe Win32/Expiro.X virus
    C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe Win32/Expiro.X virus
    C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.exe Win32/Expiro.X virus
    C:\WINDOWS\pchealth\helpctr\binaries\helpsvc.exe Win32/Expiro.X virus
    C:\WINDOWS\pchealth\helpctr\binaries\HscUpd.exe Win32/Expiro.X virus
    C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe Win32/Expiro.X virus
    C:\WINDOWS\pchealth\helpctr\binaries\notiflag.exe Win32/Expiro.X virus
    C:\WINDOWS\pchealth\UploadLB\Binaries\UploadM.exe Win32/Expiro.X virus
    C:\WINDOWS\ServicePackFiles\ServicePackCache\i386\fxscover.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\0034610052cb298a78a7ba8a4f6282e6\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\0034610052cb298a78a7ba8a4f6282e6\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\0fa2ac15b3f3d16ecfc880648002b82e\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\0fa2ac15b3f3d16ecfc880648002b82e\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\36a2296f631a54daefcc3b56e3d990e2\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\53d91b4cb515ff831fd50b1300c41863\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\53d91b4cb515ff831fd50b1300c41863\SP3GDR\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\53d91b4cb515ff831fd50b1300c41863\SP3QFE\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\53d91b4cb515ff831fd50b1300c41863\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\555558d2c7916b118ad5baef62b18136\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\555558d2c7916b118ad5baef62b18136\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\5721b309e042b0a08775c2542421fa18\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\5721b309e042b0a08775c2542421fa18\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\587e71988a47a1a232e60cce9dc80e66\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\587e71988a47a1a232e60cce9dc80e66\SP3GDR\moviemk.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\587e71988a47a1a232e60cce9dc80e66\SP3QFE\moviemk.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\587e71988a47a1a232e60cce9dc80e66\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\5cfa09586faf6d9470f0c817d855bb6b\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\5cfa09586faf6d9470f0c817d855bb6b\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\62849f4f3a9b96392e2325ba7d1edc2b\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\62849f4f3a9b96392e2325ba7d1edc2b\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\71668abe67b6d77ebac6750f25908a6e\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\71668abe67b6d77ebac6750f25908a6e\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\74ed95624bb17ca049c77eb3a7669cc3\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\74ed95624bb17ca049c77eb3a7669cc3\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\85947e1a809663c7f480717673587a59\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\8fa1ad7968e63408057364ad07aa482c\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\8fa1ad7968e63408057364ad07aa482c\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\9868363812bbe4a0a4d814b7943ba906\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\9868363812bbe4a0a4d814b7943ba906\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\9e56f14e7203556d1448d8e8d058de0f\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\9e56f14e7203556d1448d8e8d058de0f\SP3GDR\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\9e56f14e7203556d1448d8e8d058de0f\SP3QFE\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\9e56f14e7203556d1448d8e8d058de0f\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\a49d784415582d2f98c84ceb0a75d898\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\a4c07d9275eb613d842cb1e140d8a426\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\a6311a8aaa709f294df621f1ff00a15b\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\a6311a8aaa709f294df621f1ff00a15b\SP3GDR\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\a6311a8aaa709f294df621f1ff00a15b\SP3QFE\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\a6311a8aaa709f294df621f1ff00a15b\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\b966082e6e248a4942b4768a4e4700f7\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\b966082e6e248a4942b4768a4e4700f7\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\d3767eab8f4479a8d252b47e8ec225c8\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\d3767eab8f4479a8d252b47e8ec225c8\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\d78980f289ff5cbd790156e5d1e92d28\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\d78980f289ff5cbd790156e5d1e92d28\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\dacaa269b99f2225391948b21cc85d90\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\dacaa269b99f2225391948b21cc85d90\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\dc679cd47b4fc0ba518ddf01400df59a\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\dc679cd47b4fc0ba518ddf01400df59a\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\e15760431e46367ca5a3dfd40a9d03e3\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\e15760431e46367ca5a3dfd40a9d03e3\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\e9e3bc7b49018c1f53cc0d1bd73cad37\ie8-windowsxp-kb982381-x86-enu.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\e9e3bc7b49018c1f53cc0d1bd73cad37\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\e9e3bc7b49018c1f53cc0d1bd73cad37\SP3GDR\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\e9e3bc7b49018c1f53cc0d1bd73cad37\SP3QFE\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\e9e3bc7b49018c1f53cc0d1bd73cad37\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\fbdd9f75315c1cf9ff63f37aaca267d3\spuninst.exe Win32/Expiro.X virus
    C:\WINDOWS\SoftwareDistribution\Download\fbdd9f75315c1cf9ff63f37aaca267d3\update\update.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\accwiz.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\actmovie.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\AegisI5Installer.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\ahui.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\alg.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\arp.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\asr_fmt.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\asr_pfu.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\at.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\blastcln.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\bootcfg.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\cacls.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\cidaemon.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\cipher.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\ckcnv.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\cliconfg.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\clipbrd.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\cmd.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\cmdl32.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\cmmon32.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\cmstp.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\compact.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\cscript.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\ddeshare.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\defrag.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dfrgfat.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dfrgntfs.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\diantz.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\diskpart.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllhost.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dplaysvr.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dpnsvr.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dpvsetup.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\driverquery.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\drmupgds.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\drwtsn32.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\DSRIRREM.EXE Win32/Expiro.X virus
    C:\WINDOWS\system32\dumprep.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dvdupgrd.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dwwin.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dxdiag.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\esentutl.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\eudcedit.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\eventcreate.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\eventtriggers.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\expand.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\extrac32.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\find.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\findstr.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\finger.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\fltMc.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\fontview.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\freecell.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\fsquirt.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\fsutil.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\ftp.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\fxsclnt.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\fxscover.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\fxssend.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\getmac.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\gpresult.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\gpupdate.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\grpconv.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\hostname.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\icardagt.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\ieudinit.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\iexpress.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\ipconfig.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\ipsec6.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\ipv6.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\ipxroute.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\java.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\javaw.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\javaws.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\KADxMain.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\keystone.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\lnkstub.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\logagent.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\logman.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\lpq.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\lpr.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\magnify.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\makecab.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\migpwd.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\mmcperf.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\mplay32.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\mpnotify.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\mqbkup.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\mqtgsvc.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\MRT.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\msfeedssync.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\msg.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\mshearts.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\mshta.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\napstat.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\nbtstat.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\nddeapir.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\net.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\net1.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\netsetup.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\netsh.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\netstat.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\notepad.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\nslookup.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\ntbackup.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\ntsd.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\ntvdm.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\nvappbar.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\nvcplui.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\nvdspsch.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\nvsvc32.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\nvudisp.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\nwiz.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\nwscript.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\odbcconf.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\OEM02Srv.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\openfiles.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\osk.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\packager.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\pathping.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\perfmon.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\ping6.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\powercfg.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\PresentationHost.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\proquota.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\proxycfg.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\ptj.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\rasautou.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\rasphone.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\rcp.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\rdpclip.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\rdsaddin.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\rdshost.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\regini.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\regsvr32.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\relog.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\rexec.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\route.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\routemon.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\rsh.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\rsm.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\rsmsink.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\rsmui.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\rsnotify.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\rsopprov.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\rtcshare.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\runas.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\runonce.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\savedump.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\schtasks.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\sdbinst.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\searchfilterhost.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\searchindexer.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\searchprotocolhost.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\secedit.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\sethc.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\setup.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\setupn.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\sfc.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\shmgrate.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\shrpubw.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\sigverif.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\skeys.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\sndrec32.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\sndvol32.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\sol.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\sort.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\spider.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\spiisupd.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\spoolsv.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\stacsv.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\stimon.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\syncapp.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\syskey.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\sysocmgr.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\systeminfo.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\taskkill.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\tasklist.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\taskmgr.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\tcpsvcs.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\telnet.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\tftp.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\tlntadmn.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\tlntsess.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\tracerpt.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\tracert6.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\TSWbPrxy.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\typeperf.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\upnpcont.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\userinit.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\usrmlnka.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\usrprbda.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\usrshuta.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\uwdf.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\verclsid.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\verifier.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\vssadmin.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\w32tm.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\wdfmgr.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\wextract.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\winchat.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\WinFXDocObj.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\winmine.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\winmsd.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\winrs.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\winrshost.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\WISPTIS.EXE Win32/Expiro.X virus
    C:\WINDOWS\system32\wksprt.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\wpabaln.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\wpdshextautoplay.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\wpnpinst.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\wscntfy.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\wscript.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\wsmanhttpconfig.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\wsmprovhost.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\wuauclt.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\wuauclt1.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\WudfHost.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\xcopy.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\Com\comrepl.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\accwiz.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\actmovie.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\agentsvr.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\ahui.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\alg.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\arp.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\asr_fmt.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\asr_pfu.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\at.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\blastcln.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\bootcfg.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\cacls.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\calc.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\charmap.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\cidaemon.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\cipher.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\cisvc.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\ckcnv.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\cleanmgr.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\clipbrd.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\clipsrv.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\cmd.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\cmdl32.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\cmmon32.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\cmstp.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\compact.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\comrepl.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\conf.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\cscript.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\ctfmon.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\ddeshare.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\defrag.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\dfrgfat.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\dfrgntfs.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\dialer.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\diantz.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\diskpart.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\dllhost.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\dmadmin.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\dplaysvr.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\dpnsvr.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\dpvsetup.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\drvqry.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\drwtsn32.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\dumprep.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\dvdupgrd.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\dwwin.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\dxdiag.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\esentutl.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\eudcedit.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\evcreate.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\evtrig.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\expand.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\explorer.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\extrac32.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\find.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\findstr.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\finger.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\fltmc.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\fontview.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\freecell.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\fsquirt.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\fsutil.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\ftp.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\fxsclnt.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\fxscover.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\fxssend.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\getmac.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\gprslt.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\gpupdate.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\grpconv.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\helpctr.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\helphost.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\helpsvc.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\hh.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\hostname.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\hscupd.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\icwconn1.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\icwconn2.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\icwrmind.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\icwtutor.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\ie4uinit.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\iedw.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\iexplore.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\iexpress.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\imapi.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\inetwiz.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\ipconfig.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\ipsec6.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\ipv6.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\ipxroute.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\lhmstsc.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\lnkstub.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\locator.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\logagent.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\logman.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\lpq.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\lpr.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\lsass.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\magnify.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\makecab.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\migload.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\migrate.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\migwiz.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\migwiza.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\mmcperf.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\mnmsrvc.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\mobsync.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\mofcomp.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\moviemk.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\mplay32.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\mpnotify.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\mqbkup.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\mqtgsvc.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\msconfig.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\msdtc.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\msg.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\mshearts.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\mshta.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\msiexec.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\msimn.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\msinfo32.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\mspaint.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\mstsc.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\muisetup.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\napstat.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\narrator.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\nbtstat.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\nddeapir.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\net.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\net1.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\netdde.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\netsetup.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\netsh.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\netstat.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\notepad.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\notiflag.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\nppagent.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\nslookup.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\ntbackup.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\ntsd.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\ntvdm.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\nwscript.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\odbcad32.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\odbcconf.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\oemig50.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\oobebaln.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\opnfiles.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\osk.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\packager.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\pathping.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\perfmon.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\pinball.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\ping6.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\powercfg.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\printfilterpipelinesvc.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\proquota.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\proxycfg.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\rasautou.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\rasphone.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\rcimlby.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\rcp.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\rdpclip.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\rdsaddin.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\rdshost.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\regedit.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\regini.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\regsvr32.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\relog.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\rexec.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\route.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\routemon.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\rsh.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\rsm.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\rsmsink.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\rsmui.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\rsnotify.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\rsopprov.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\rstrui.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\rsvp.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\rtcshare.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\runas.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\runonce.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\sapisvr.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\savedump.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\scardsvr.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\scrcons.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\sctasks.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\sdbinst.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\secedit.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\services.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\sessmgr.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\sethc.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\setup.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\setup50.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\setupn.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\sfc.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\shmgrate.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\shrpubw.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\sigverif.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\skeys.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\smlogsvc.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\sndrec32.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\sndvol32.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\sol.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\sort.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\spider.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\spiisupd.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\spoolsv.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\srdiag.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\stimon.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\svchost.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\syncapp.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\sysinfo.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\syskey.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\sysocmgr.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\taskkill.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\tasklist.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\taskmgr.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\tcpsvcs.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\telnet.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\tftp.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\tlntadmn.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\tlntsess.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\tlntsvr.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\tourstrt.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\tracerpt.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\tracert6.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\TSWbPrxy.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\twunk_32.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\typeperf.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\unsecapp.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\uploadm.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\upnpcont.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\userinit.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\usrmlnka.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\usrprbda.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\usrshuta.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\utilman.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\verifier.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\vssadmin.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\vssvc.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\w32tm.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\wab.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\wabmig.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\wbemtest.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\wextract.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\wiaacmgr.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\winchat.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\winhlp32.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\winmgmt.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\winmine.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\winmsd.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\wksprt.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\wmiadap.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\wmiapsrv.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\wmic.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\wmiprvse.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\wordpad.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\wpabaln.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\wpnpinst.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\wscntfy.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\wscript.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\wuauclt.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\wuauclt1.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\wupdmgr.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\dllcache\xcopy.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\Macromed\Flash\FlashUtil11c_ActiveX.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\npp\nppagent.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\oobe\oobebaln.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\Restore\rstrui.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\Restore\srdiag.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\URTTemp\regtlib.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\usmt\migload.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\usmt\migwiz.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\usmt\migwiza.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\wbem\mofcomp.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\wbem\scrcons.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\wbem\unsecapp.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\wbem\wbemtest.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\wbem\winmgmt.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\wbem\wmiadap.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\wbem\wmic.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\wbem\wmiprvse.exe Win32/Expiro.X virus
    C:\WINDOWS\system32\XPSViewer\XPSViewer.exe Win32/Expiro.X virus
    Operating memory Win32/Expiro.X virusore file
    luddite, Nov 14, 2011
    #14

  15. Broni Malware Annihilator Posts: 39,313   +175

    Please click HERE to download Kaspersky Virus Removal Tool.

    • Double click on the file you just downloaded and let it install.
    • It will install to your desktop (be patient; it may take a while).
    • Accept license agreement and click "Start" button.
    • Click on Settings button [IMG]
      • In Scan scope leave pre-checked items as they're and also checkmark My Computer
      • In Actions checkmark Select action: (disinfect; delete if disinfection fails) instead of preselected Prompt on detection
    • Click on Automatic Scan tab and then click on Start scanning button.
    • Before it is done it may prompt for action regardless of the setting so choose delete if prompted.
    • When the scan is done NO log will be produced.
    • Click on Report button [IMG] then on Automatic Scan report tab.
    • Right click anywhere within right pane, click Select All then right click again and click Copy.
    • This will copy the items that it found to the clipboard you can then open notepad (go to start then run then type in notepad) and choose paste to paste the contents into Notepad.
    • You can save this on the desktop.
    • Post the contents of the document in your next reply.
    Broni, Nov 14, 2011
    #15

  16. luddite Newcomer, in training Posts: 82

    Hello
    This K log file is huge! here it begins...
    Automatic Scan: completed 8 minutes ago (events: 227754, objects: 206350, time: 01:39:11)
    11/15/2011 8:02:24 AM Task completed
    11/15/2011 8:02:22 AM OK C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll Object was not changed (iSwift 3)
    11/15/2011 8:02:22 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc0\rtcres.dll
    11/15/2011 8:02:22 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc0\rtcres.dll~TBSMPVUS
    11/15/2011 8:02:22 AM OK C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll Object was not changed (iSwift 3)
    11/15/2011 8:02:21 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\rtcdll.dll~B28TRLOI
    11/15/2011 8:02:21 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\rtcdll.dll
    11/15/2011 8:02:21 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7\dxmrtp.dll~1KF1LTT6
    11/15/2011 8:02:21 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7\dxmrtp.dll
    11/15/2011 8:02:20 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\GdiPlus.dll~Q1J1EBD4
    11/15/2011 8:02:19 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\GdiPlus.dll~O75C97MQ
    11/15/2011 8:02:19 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\GdiPlus.dll~CAE3L5K0
    11/15/2011 8:02:19 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\GdiPlus.dll Object was not changed (iChecker)
    11/15/2011 8:02:19 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6002.22509_x-ww_c7dad023\GdiPlus.dll Object was not changed (iSwift 3)
    11/15/2011 8:02:19 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.5581_x-ww_dfbc4fc4\GdiPlus.dll~J6GB182T
    11/15/2011 8:02:19 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.5581_x-ww_dfbc4fc4\GdiPlus.dll
    11/15/2011 8:02:19 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.5512_x-ww_dfb54e0c\GdiPlus.dll~MMQH3R0K
    11/15/2011 8:02:18 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.5512_x-ww_dfb54e0c\GdiPlus.dll Object was not changed (iChecker)
    11/15/2011 8:02:18 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13\GdiPlus.dll~AGU3N8GQ
    11/15/2011 8:02:17 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13\GdiPlus.dll Object was not changed (iChecker)
    11/15/2011 8:02:17 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll~GS5VGD1P
    11/15/2011 8:02:17 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll
    11/15/2011 8:02:17 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcirt.dll~KHJBCSUH
    11/15/2011 8:02:17 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcirt.dll
    11/15/2011 8:02:16 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll~8N2U8NIL
    11/15/2011 8:02:16 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll Object was not changed (iChecker)
    11/15/2011 8:02:16 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcirt.dll~FVU5TBD8
    11/15/2011 8:02:16 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcirt.dll Object was not changed (iChecker)
    11/15/2011 8:02:15 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll~VB1FNA6J
    11/15/2011 8:02:15 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll~4IOEHP7P
    11/15/2011 8:02:15 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll~G52B2B62
    11/15/2011 8:02:15 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
    11/15/2011 8:02:15 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Object was not changed (iSwift 3)
    11/15/2011 8:02:15 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll~UJ5MHS9G
    11/15/2011 8:02:15 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll Object was not changed (iChecker)
    11/15/2011 8:02:14 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
    11/15/2011 8:02:13 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll
    11/15/2011 8:02:13 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll
    11/15/2011 8:02:13 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll
    11/15/2011 8:02:13 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll
    11/15/2011 8:02:12 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll
    11/15/2011 8:02:11 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll
    11/15/2011 8:02:11 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll
    11/15/2011 8:02:11 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll
    11/15/2011 8:02:11 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll
    11/15/2011 8:02:11 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll
    11/15/2011 8:02:11 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll
    11/15/2011 8:02:11 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll
    11/15/2011 8:02:11 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll
    11/15/2011 8:02:11 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll
    11/15/2011 8:02:10 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll
    11/15/2011 8:02:10 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcm90.dll
    11/15/2011 8:02:10 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcr90.dll
    11/15/2011 8:02:10 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcr90.dll Object was not changed (iSwift 3)
    11/15/2011 8:02:10 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e\msvcp90.dll Object was not changed (iSwift 3)
    11/15/2011 8:02:10 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcp90.dll
    11/15/2011 8:02:09 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcm90.dll
    11/15/2011 8:02:09 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
    11/15/2011 8:02:09 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
    11/15/2011 8:02:09 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e79c4723\vcomp.dll
    11/15/2011 8:02:08 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
    11/15/2011 8:02:08 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
    11/15/2011 8:02:08 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
    11/15/2011 8:02:07 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
    11/15/2011 8:02:07 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfcm80u.dll~9C5ELA8V
    11/15/2011 8:02:06 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfcm80u.dll
    11/15/2011 8:02:06 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfcm80.dll
    11/15/2011 8:02:06 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfc80u.dll~7KNC2SP7
    11/15/2011 8:02:06 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfcm80.dll~N891VIAO
    11/15/2011 8:02:06 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfc80u.dll
    11/15/2011 8:02:06 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfc80.dll~78JJB9A9
    11/15/2011 8:02:06 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfc80.dll
    11/15/2011 8:02:05 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e\mfcm80u.dll
    11/15/2011 8:02:03 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e\mfcm80.dll
    11/15/2011 8:02:03 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e\mfc80u.dll
    11/15/2011 8:02:03 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e\mfc80.dll
    11/15/2011 8:02:03 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
    11/15/2011 8:02:01 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
    11/15/2011 8:02:01 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
    11/15/2011 8:02:01 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
    11/15/2011 8:02:01 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
    11/15/2011 8:02:01 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
    11/15/2011 8:02:01 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
    11/15/2011 8:02:01 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
    11/15/2011 8:02:01 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
    11/15/2011 8:02:01 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80KOR.dll~T78UJSFO
    11/15/2011 8:02:00 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80KOR.dll
    11/15/2011 8:02:00 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80JPN.dll~6K1C60V0
    11/15/2011 8:02:00 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80JPN.dll
    11/15/2011 8:02:00 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80ITA.dll~2O4USI96
    11/15/2011 8:02:00 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80ITA.dll
    11/15/2011 8:02:00 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80FRA.dll~KPV78HSL
    11/15/2011 8:02:00 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80FRA.dll
    11/15/2011 8:02:00 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80ESP.dll~QML7DK09
    11/15/2011 8:02:00 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80ESP.dll
    11/15/2011 8:02:00 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80ENU.dll~LKKPUB7C
    11/15/2011 8:02:00 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80ENU.dll
    11/15/2011 8:02:00 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80DEU.dll~CFE3AQSK
    11/15/2011 8:02:00 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80DEU.dll
    11/15/2011 8:02:00 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80CHT.dll~G0BK9FQ9
    11/15/2011 8:02:00 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80CHT.dll
    11/15/2011 8:02:00 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80CHS.dll~59LHVUFI
    11/15/2011 8:02:00 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80CHS.dll
    11/15/2011 8:02:00 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80KOR.dll
    11/15/2011 8:01:59 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80JPN.dll
    11/15/2011 8:01:59 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80ITA.dll
    11/15/2011 8:01:59 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80FRA.dll
    11/15/2011 8:01:59 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80ESP.dll
    11/15/2011 8:01:59 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80ENU.dll
    11/15/2011 8:01:59 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80DEU.dll
    11/15/2011 8:01:59 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80CHT.dll
    11/15/2011 8:01:59 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c\mfc80CHS.dll
    11/15/2011 8:01:59 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
    11/15/2011 8:01:58 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
    11/15/2011 8:01:58 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
    11/15/2011 8:01:58 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcr80.dll~KS21N03D
    11/15/2011 8:01:58 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcr80.dll Object was not changed (iChecker)
    11/15/2011 8:01:58 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcp80.dll~81BVG09U
    11/15/2011 8:01:58 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcp80.dll
    11/15/2011 8:01:58 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcm80.dll~6DHN30BQ
    11/15/2011 8:01:58 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcm80.dll
    11/15/2011 8:01:58 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcm80.dll
    11/15/2011 8:01:57 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcr80.dll
    11/15/2011 8:01:57 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll Object was not changed (iSwift 3)
    11/15/2011 8:01:57 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcp80.dll Object was not changed (iSwift 3)
    11/15/2011 8:01:57 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcp80.dll
    11/15/2011 8:01:57 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcm80.dll
    11/15/2011 8:01:57 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
    11/15/2011 8:01:56 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841\ATL80.dll~MNP8JRQT
    11/15/2011 8:01:56 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841\ATL80.dll
    11/15/2011 8:01:56 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd\ATL80.dll
    11/15/2011 8:01:56 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7\msvcp60.dll~KK3L7D30
    11/15/2011 8:01:56 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7\msvcp60.dll Object was not changed (iChecker)
    11/15/2011 8:01:55 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7\mfc42u.dll~A4NRUE0N
    11/15/2011 8:01:55 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7\mfc42u.dll Object was not changed (iChecker)
    11/15/2011 8:01:55 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7\mfc42.dll~PB860H1V
    11/15/2011 8:01:55 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7\mfc42.dll Object was not changed (iChecker)
    11/15/2011 8:01:55 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7\atl.dll~Q38E7A99
    11/15/2011 8:01:55 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7\atl.dll Object was not changed (iChecker)
    11/15/2011 8:01:55 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.30.2107.0_x-ww_bd5ca85e\msxml4.dll Object was not changed (iChecker)
    11/15/2011 8:01:55 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9876.0_x-ww_a621d1d5\msxml4.dll
    11/15/2011 8:01:54 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9870.0_x-ww_a32d74cf\msxml4.dll
    11/15/2011 8:01:53 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.30.2100.0_x-ww_30941067\msxml4r.dll Object was not changed (iChecker)
    11/15/2011 8:01:53 AM OK C:\WINDOWS\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.1.0_x-ww_2a41bceb\msxml4r.dll
    11/15/2011 8:01:52 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_x-ww_6ad67377\9.0.30729.4148.policy
    11/15/2011 8:01:52 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_x-ww_6ad67377\9.0.30729.4148.cat
    11/15/2011 8:01:52 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_x-ww_4ee8bb30\9.0.30729.4148.policy
    11/15/2011 8:01:52 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_x-ww_4ee8bb30\9.0.30729.4148.cat
    11/15/2011 8:01:52 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_x-ww_b8438ace\9.0.30729.4148.policy
    11/15/2011 8:01:52 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_x-ww_b8438ace\9.0.30729.4148.cat
    11/15/2011 8:01:52 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\9.0.30729.4148.policy
    11/15/2011 8:01:52 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\9.0.30729.4148.cat
    11/15/2011 8:01:51 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\9.0.21022.8.policy
    11/15/2011 8:01:51 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_x-ww_b7353f75\9.0.21022.8.cat
    11/15/2011 8:01:51 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_x-ww_9e7eb501\9.0.30729.4148.policy
    11/15/2011 8:01:51 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.9.0.Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_x-ww_9e7eb501\9.0.30729.4148.cat
    11/15/2011 8:01:51 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_7d81c9f9\8.0.50727.762.policy
    11/15/2011 8:01:51 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_7d81c9f9\8.0.50727.762.cat
    11/15/2011 8:01:51 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_7d81c9f9\8.0.50727.4053.policy
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_x-ww_7d81c9f9\8.0.50727.4053.cat
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\8.0.50727.762.policy~H68ERC8I
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\8.0.50727.762.policy
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\8.0.50727.762.cat~SO6RIBG0
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\8.0.50727.762.cat
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\8.0.50727.42.policy~ATFLNA41
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\8.0.50727.42.cat~6B4D83RE
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\8.0.50727.42.policy
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\8.0.50727.42.cat
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\8.0.50727.4053.policy
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_x-ww_0f75c32e\8.0.50727.4053.cat
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\8.0.50727.762.policy
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\8.0.50727.762.cat~JGHV7KQ8
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\8.0.50727.762.policy~6BS027K1
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\8.0.50727.762.cat
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\8.0.50727.42.policy~M5SRFCA5
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\8.0.50727.42.cat~C3H1U0SS
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\8.0.50727.42.cat
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\8.0.50727.42.policy
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\8.0.50727.4053.policy
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_x-ww_caeee150\8.0.50727.4053.cat
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.762.policy~H8RTGMI7
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.762.policy
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.762.cat~KR5OOUTO
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.762.cat
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.42.policy~553NAOKE
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.42.policy
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.42.cat~JMGV5EUC
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.42.cat
    11/15/2011 8:01:50 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.4053.policy
    11/15/2011 8:01:49 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.4053.cat
    11/15/2011 8:01:49 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.3053.policy
    11/15/2011 8:01:49 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_x-ww_5f0bbcff\8.0.50727.762.policy~JI3NN3JC
    11/15/2011 8:01:49 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_x-ww_5f0bbcff\8.0.50727.762.policy
    11/15/2011 8:01:49 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_x-ww_77c24773\8.0.50727.3053.cat
    11/15/2011 8:01:49 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_x-ww_5f0bbcff\8.0.50727.762.cat~T7TG6LTG
    11/15/2011 8:01:49 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_x-ww_5f0bbcff\8.0.50727.762.cat
    11/15/2011 8:01:49 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_x-ww_5f0bbcff\8.0.50727.42.policy~4U4O77B6
    11/15/2011 8:01:49 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_x-ww_5f0bbcff\8.0.50727.42.policy
    11/15/2011 8:01:49 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_x-ww_5f0bbcff\8.0.50727.42.cat~URSPLAFB
    11/15/2011 8:01:49 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_x-ww_5f0bbcff\8.0.50727.42.cat
    11/15/2011 8:01:49 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_x-ww_5f0bbcff\8.0.50727.4053.policy
    11/15/2011 8:01:49 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.8.0.Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_x-ww_5f0bbcff\8.0.50727.4053.cat
    11/15/2011 8:01:49 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.7.0.Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_x-ww_a317e4b3\7.0.2600.5512.Policy~07LRG876
    11/15/2011 8:01:49 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.7.0.Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_x-ww_a317e4b3\7.0.2600.5512.Policy
    11/15/2011 8:01:49 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.7.0.Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_x-ww_a317e4b3\7.0.2600.5512.cat~OFEBCT77
    11/15/2011 8:01:49 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.7.0.Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_x-ww_a317e4b3\7.0.2600.5512.cat
    11/15/2011 8:01:49 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775\6.0.2600.6028.Policy
    11/15/2011 8:01:49 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775\6.0.2600.6028.cat
    11/15/2011 8:01:49 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775\6.0.2600.5512.Policy~GBOTOPV1
    11/15/2011 8:01:48 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775\6.0.2600.5512.Policy
    11/15/2011 8:01:48 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775\6.0.2600.5512.cat~KD1TN3G3
    11/15/2011 8:01:48 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.6.0.Microsoft.Windows.Common-Controls_6595b64144ccf1df_x-ww_5ddad775\6.0.2600.5512.cat
    11/15/2011 8:01:48 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Rtcdll_6595b64144ccf1df_x-ww_c7b7206f\5.2.2.3.cat~JKAA1PP8
    11/15/2011 8:01:48 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Rtcdll_6595b64144ccf1df_x-ww_c7b7206f\5.2.2.3.Policy~E4NUQAF7
    11/15/2011 8:01:48 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Rtcdll_6595b64144ccf1df_x-ww_c7b7206f\5.2.2.3.Policy
    11/15/2011 8:01:48 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Rtcdll_6595b64144ccf1df_x-ww_c7b7206f\5.2.2.3.cat
    11/15/2011 8:01:48 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_x-ww_362e60dd\5.2.2.3.Policy~4F0IER97
    11/15/2011 8:01:48 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_x-ww_362e60dd\5.2.2.3.Policy
    11/15/2011 8:01:48 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_x-ww_362e60dd\5.2.2.3.cat~LNAN0AMQ
    11/15/2011 8:01:48 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.5.2.Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_x-ww_362e60dd\5.2.2.3.cat
    11/15/2011 8:01:48 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.5.1.Microsoft.Windows.SystemCompatible_6595b64144ccf1df_x-ww_a0111510\5.1.2600.2000.Policy~QIDGOAP0
    11/15/2011 8:01:48 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.5.1.Microsoft.Windows.SystemCompatible_6595b64144ccf1df_x-ww_a0111510\5.1.2600.2000.Policy
    11/15/2011 8:01:48 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.5.1.Microsoft.Windows.SystemCompatible_6595b64144ccf1df_x-ww_a0111510\5.1.2600.2000.cat~VDSVC1L9
    11/15/2011 8:01:47 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.5.1.Microsoft.Windows.SystemCompatible_6595b64144ccf1df_x-ww_a0111510\5.1.2600.2000.cat
    11/15/2011 8:01:47 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.4.30.Microsoft.MSXML2_6bd6b9abf345378f_x-ww_73b8cff7\4.30.2107.0.policy
    11/15/2011 8:01:47 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.4.30.Microsoft.MSXML2_6bd6b9abf345378f_x-ww_73b8cff7\4.30.2107.0.cat
    11/15/2011 8:01:47 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.4.20.Microsoft.MSXML2_6bd6b9abf345378f_x-ww_88e8eab8\4.20.9876.0.policy
    11/15/2011 8:01:47 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.4.20.Microsoft.MSXML2_6bd6b9abf345378f_x-ww_88e8eab8\4.20.9870.0.policy
    11/15/2011 8:01:47 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.4.20.Microsoft.MSXML2_6bd6b9abf345378f_x-ww_88e8eab8\4.20.9876.0.cat
    11/15/2011 8:01:47 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.4.20.Microsoft.MSXML2_6bd6b9abf345378f_x-ww_88e8eab8\4.20.9870.0.cat
    11/15/2011 8:01:46 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.4.1.Microsoft.MSXML2R_6bd6b9abf345378f_x-ww_679a1c95\4.1.1.0.policy
    11/15/2011 8:01:46 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.4.1.Microsoft.MSXML2R_6bd6b9abf345378f_x-ww_679a1c95\4.1.1.0.cat
    11/15/2011 8:01:46 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac\1.0.6002.22509.Policy
    11/15/2011 8:01:46 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac\1.0.6002.22509.cat
    11/15/2011 8:01:45 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac\1.0.6001.22319.Policy
    11/15/2011 8:01:45 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac\1.0.6001.22319.cat~DTA9EFVI
    11/15/2011 8:01:45 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac\1.0.2600.5581.cat
    11/15/2011 8:01:45 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac\1.0.2600.5581.Policy
    11/15/2011 8:01:45 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac\1.0.6001.22319.cat
    11/15/2011 8:01:45 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac\1.0.2600.5512.Policy~56SNED7C
    11/15/2011 8:01:45 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac\1.0.2600.5512.cat~A1SSU4PP
    11/15/2011 8:01:45 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac\1.0.2600.5512.Policy
    11/15/2011 8:01:45 AM OK C:\WINDOWS\WinSxS\Policies\x86_policy.1.0.Microsoft.Windows.GdiPlus_6595b64144ccf1df_x-ww_4e8510ac\1.0.2600.5512.cat
    luddite, Nov 17, 2011
    #16

  17. luddite Newcomer, in training Posts: 82

    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df.cat~U3QDVMJJ
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df.cat
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.5581_x-ww_dfbc4fc4.Manifest
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.5581_x-ww_dfbc4fc4.cat
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.5512_x-ww_dfb54e0c.cat~AF6TRKGM
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.5512_x-ww_dfb54e0c.Manifest~4FD1J6FE
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.5512_x-ww_dfb54e0c.Manifest
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.5512_x-ww_dfb54e0c.cat
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13.Manifest~9FTMGCM2
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13.cat~1LRCFOPP
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13.Manifest
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13.cat
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63.Manifest~2L18RAH3
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a.Manifest~FRUO9ETE
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63.Manifest
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63.cat~IHISNE4M
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63.cat
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a.Manifest
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a.cat
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a.cat~QVV4JNA9
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202.Manifest
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202.cat
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83.Manifest~NJP1CL9D
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83.Manifest
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83.cat
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83.cat~QSADJO28
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a.Manifest~LQ19U3IK
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a.Manifest
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a.cat~SJRQUOHP
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a.cat
    11/15/2011 8:01:44 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d495ac4e.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a.manifest~R06QQ6R9
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a.cat~ABFR366K
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e79c4723.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05.manifest~D76AENOD
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e79c4723.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05.cat~2MU3LESO
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2.manifest~9VQUV6MF
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2.cat~DT6446O3
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303.manifest~LNK9IQB5
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303.cat~HOC45R44
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0.manifest~1A7IS397
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0.cat~5LLC3H1F
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.manifest~253U8Q5K
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_0ccc058c.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700.cat~DEJUEKAT
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.manifest~BVJHFNSB
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.cat~66D1RT6I
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474.manifest~5D17OG7M
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474.cat~SARQMM2E
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841.manifest~O62H7EPQ
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841.cat~QLCTPCS4
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7.Manifest~U5VPRL20
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7.cat~46OM1247
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.30.2100.0_x-ww_30941067.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7.Manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.0.0_x-ww_ff9986d7.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.30.2107.0_x-ww_bd5ca85e.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.30.2107.0_x-ww_bd5ca85e.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9876.0_x-ww_a621d1d5.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9876.0_x-ww_a621d1d5.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9870.0_x-ww_a32d74cf.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.30.2100.0_x-ww_30941067.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9870.0_x-ww_a32d74cf.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.1.0_x-ww_2a41bceb.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.1.0_x-ww_2a41bceb.cat
    11/15/2011 8:01:43 AM OK C:\WINDOWS\WinSxS\Manifests\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e.manifest
    11/15/2011 8:01:43 AM OK C:\WINDOWS\Web\Wallpaper\Windows XP.jpg~HI75TVI4
    11/15/2011 8:01:42 AM OK C:\WINDOWS\Web\Wallpaper\Wind.jpg~OA5V045J
    11/15/2011 8:01:42 AM OK C:\WINDOWS\Web\Wallpaper\Windows XP.jpg
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Wind.jpg
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Vortec space.jpg~DONAG4FO
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Vortec space.jpg
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Tulips.jpg
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Tulips.jpg~73B27GBF
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Stonehenge.jpg~FJ2H42M2
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Stonehenge.jpg
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Ripple.jpg~V0HCUJ24
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Ripple.jpg
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Red moon desert.jpg
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Red moon desert.jpg~5URPJU7B
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Radiance.jpg~PAL6U1Q0
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Radiance.jpg
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Purple flower.jpg~9NGCJ806
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Purple flower.jpg
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Power.jpg
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Power.jpg~HVMCBTF3
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Peace.jpg~GPH7364Q
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Peace.jpg
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Moon flower.jpg
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Moon flower.jpg~UPIAL9GO
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Home.jpg~41MDLEQ1
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Home.jpg
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Friend.jpg~MRQP3CRB
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Friend.jpg
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Follow.jpg
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Follow.jpg~G4PCFOC5
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Crystal.jpg~9T5MLMGT
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Crystal.jpg
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Bliss.bmp~CO8DDQ2I
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Bliss.bmp
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Azul.jpg~8S9P9TME
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Azul.jpg
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Autumn.jpg
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Autumn.jpg~BNFP6NMN
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Ascent.jpg~3ED7VO74
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\Wallpaper\Ascent.jpg
    11/15/2011 8:01:41 AM OK C:\WINDOWS\Web\printers\images\ipp_0015.gif~GDP0CQM7
    11/15/2011 8:01:40 AM OK C:\WINDOWS\Web\printers\images\ipp_0015.gif
    11/15/2011 8:01:40 AM OK C:\WINDOWS\Web\printers\images\ipp_0012.gif~BVFFRVFH
    11/15/2011 8:01:40 AM OK C:\WINDOWS\Web\printers\images\ipp_0012.gif
    11/15/2011 8:01:40 AM OK C:\WINDOWS\Web\printers\images\ipp_0005.gif~S91HD1TK
    11/15/2011 8:01:40 AM OK C:\WINDOWS\Web\printers\images\ipp_0005.gif
    11/15/2011 8:01:40 AM OK C:\WINDOWS\Web\printers\images\ipp_0004.gif~JR6A2BDJ
    11/15/2011 8:01:40 AM OK C:\WINDOWS\Web\printers\images\ipp_0002.gif~LAEL93IC
    11/15/2011 8:01:40 AM OK C:\WINDOWS\Web\printers\images\ipp_0004.gif
    11/15/2011 8:01:40 AM OK C:\WINDOWS\Web\printers\images\ipp_0003.gif~HC25SMK5
    11/15/2011 8:01:40 AM OK C:\WINDOWS\Web\printers\images\ipp_0003.gif
    11/15/2011 8:01:40 AM OK C:\WINDOWS\Web\printers\images\ipp_0002.gif
    11/15/2011 8:01:40 AM OK C:\WINDOWS\Web\printers\prtwebvw.css~3O0JN4S8
    11/15/2011 8:01:40 AM OK C:\WINDOWS\Web\printers\page1.asp~HAE2S3DM
    luddite, Nov 17, 2011
    #17

  18. luddite Newcomer, in training Posts: 82

    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\prtwebvw.css
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\page1.asp
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_util.inc~3QG48B42
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_util.inc
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_res.inc~CAQHL7FE
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_adsi.inc~3OFGHDDV
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_0015.asp~Q9A2VMPU
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_res.inc
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_adsi.inc
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_0015.asp
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_0014.asp~P6HOKN01
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_0014.asp
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_0013.asp~F2NL6NFK
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_0010.asp~27D2HG72
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_0013.asp
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_0010.asp
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_0007.asp~EBPILQEG
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_0007.asp
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_0006.asp~STPM2FKS
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_0005.asp~M56M3GVU
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_0006.asp
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_0005.asp
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_0004.asp~EHN7U1GG
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_0004.asp
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_0003.asp~C0FQF7SM
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_0003.asp
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_0002.asp~RLCM8EN3
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_0001.asp~6830VAIE
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_0002.asp
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_0001.asp
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_0000.inc~M6UBNBE1
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\printers\ipp_0000.inc
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\tips.gif~2JULP1JT
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\tips.gif
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\tip.htm~OF9AN0JK
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\tip.htm
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\safemode.htt~PH8VCTEL
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\safemode.htt
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\exclam.gif~3V75RH80
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\deskmovr.htt~KB0IUSK3
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\exclam.gif
    11/15/2011 8:01:39 AM OK C:\WINDOWS\twain_32\Creative\OEM002\HookWnd.dll~2RSTNPUR
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\deskmovr.htt
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\bullet.gif~HFNJD84K
    11/15/2011 8:01:39 AM OK C:\WINDOWS\Web\bullet.gif
    11/15/2011 8:01:39 AM OK C:\WINDOWS\WBEM\msfeeds.mof
    11/15/2011 8:01:39 AM OK C:\WINDOWS\WBEM\msfeedsbs.mof
    11/15/2011 8:01:39 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\BitsTransfer\en\microsoft.backgroundintelligenttransfer.management.dll-help.xml
    11/15/2011 8:01:38 AM OK C:\WINDOWS\twain_32\Creative\OEM002\HookWnd.dll Object was not changed (iChecker)
    11/15/2011 8:01:38 AM OK C:\WINDOWS\twain_32\wiatwain.ds~CQLD8SVT
    11/15/2011 8:01:38 AM OK C:\WINDOWS\twain_32\wiatwain.ds
    11/15/2011 8:01:38 AM OK C:\WINDOWS\temp\T30DebugLogFile.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\temp\Perflib_Perfdata_150.dat
    11/15/2011 8:01:38 AM OK C:\WINDOWS\Tasks\switchShakeIcon.job
    11/15/2011 8:01:38 AM OK C:\WINDOWS\Tasks\desktop.ini~8D8E0D70
    11/15/2011 8:01:38 AM OK C:\WINDOWS\Tasks\SA.DAT
    11/15/2011 8:01:38 AM OK C:\WINDOWS\Tasks\desktop.ini
    11/15/2011 8:01:38 AM OK C:\WINDOWS\Tasks\AppleSoftwareUpdate.job~S09TTUSO
    11/15/2011 8:01:38 AM OK C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\XPSViewer\en-US\XPSViewer.exe.mui
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\XPSViewer\XPSViewerManifest.xml
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\winrm\0409\winrm.ini
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\BitsTransfer\en\about_BITS_Cmdlets.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\BitsTransfer\BitsTransfer.psd1
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\BitsTransfer\microsoft.backgroundintelligenttransfer.management.interop.dll Object was not changed (iChecker)
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\WTRInstaller.ico
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\Examples\profile.ps1
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\BitsTransfer\BitsTransfer.format.ps1xml
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\types.ps1xml
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\System.Management.Automation.dll-Help.xml
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\WSMan.format.ps1xml
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\Registry.format.ps1xml
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\Microsoft.PowerShell.Commands.Utility.dll-Help.xml
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\pwrshsip.dll Object was not changed (iChecker)
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShellCore.format.ps1xml
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\pwrshmsg.dll Object was not changed (iChecker)
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\pspluginwkr.dll Object was not changed (iChecker)
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell_ise.resources.dll Object was not changed (iChecker)
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell_ise.exe Object was not changed (iChecker)
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShellTrace.format.ps1xml
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe.mui
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\Microsoft.wsman.management.dll-help.xml
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\Microsoft.PowerShell.Security.dll-Help.xml
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\Microsoft.PowerShell.Commands.Management.dll-Help.xml
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\Microsoft.PowerShell.ConsoleHost.dll-Help.xml
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\Help.format.ps1xml
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\Microsoft.powershell.commands.diagnostics.dll-help.xml
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\getevent.types.ps1xml
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\ImportAllModules.psd1
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\Diagnostics.format.ps1xml
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\Certificate.format.ps1xml
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\default.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\CompiledComposition.Microsoft.PowerShell.GPowerShell.dll Object was not changed (iChecker)
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_WS-Management_Cmdlets.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_WMI_Cmdlets.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_Windows_PowerShell_ise.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_Windows_PowerShell_2.0.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_type_operators.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_wildcards.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_while.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_variables.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_types.ps1xml.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_Try_Catch_Finally.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_Trap.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_Transactions.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_Throw.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_switch.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_split.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_special_characters.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_signing.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_Session_Configurations.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_script_internationalization.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_script_blocks.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_scripts.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_scopes.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_reserved_words.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_Return.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_remote_troubleshooting.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_requires.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_remote.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_remote_output.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_remote_requirements.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_remote_FAQ.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_remote_jobs.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_regular_expressions.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_ref.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_redirection.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_PSSession_details.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_quoting_rules.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_pssnapins.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_PSSessions.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_providers.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_properties.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_parameters.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\About_Preference_Variables.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_prompts.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_profiles.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_pipelines.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_path_syntax.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_operators.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_parsing.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_Modules.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_objects.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_methods.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_logical_operators.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_line_editing.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_locations.help.txt
    11/15/2011 8:01:38 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_Language_Keywords.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_job_details.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_join.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_jobs.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_if.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_history.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_hash_tables.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_functions_cmdletbindingattribute.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_functions_advanced_parameters.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_functions_advanced_methods.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_functions_advanced.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_functions.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_format.ps1xml.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_foreach.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_for.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_execution_policies.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_Eventlogs.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_escape_characters.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_environment_variables.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_do.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_debuggers.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_data_sections.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_core_commands.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_continue.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_comparison_operators.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_commonparameters.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_comment_based_help.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_command_syntax.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_Command_Precedence.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_break.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_automatic_variables.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_assignment_operators.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_arrays.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_arithmetic_operators.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\WindowsPowerShell\v1.0\about_aliases.help.txt
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\xml\wmi2xml.dll~6VHO8IQS
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\xml\wmi2xml.dll Object was not changed (iChecker)
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\xml\wmi20.dtd~TQNICG8V
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\xml\wmi20.dtd
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\xml\cim20.dtd~IRRLI8SU
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\xml\cim20.dtd
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\AutoRecover\E478A5DB75C9721E744C05D78DBACFD3.mof~6O3QRLR1
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\AutoRecover\E478A5DB75C9721E744C05D78DBACFD3.mof
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\Repository\$WinMgmt.CFG
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\Performance\WmiApRpl.ini
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\Performance\WmiApRpl.h
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\Logs\wmiprov.lo_
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\Logs\wmiprov.log
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\Logs\WinMgmt.log
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\Logs\wbemprox.log
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\Logs\wbemess.lo_
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\Logs\wbemess.log
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\Logs\wbemcore.lo_
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\Logs\wbemcore.log
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\Logs\mofcomp.log
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\Logs\FrameWork.log
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\AutoRecover\FAAD7D567E76CAB10704AFD7C0488F23.mof~0LDOR3BV
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\AutoRecover\FAAD7D567E76CAB10704AFD7C0488F23.mof
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\AutoRecover\EDBF963FB003D0670AA9C2219BD091FB.mof~1O3OMH45
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\AutoRecover\EDBF963FB003D0670AA9C2219BD091FB.mof
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\AutoRecover\E737DE61441445E1FDFCA45EF5E7D987.mof~1ADVLQU1
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\AutoRecover\E737DE61441445E1FDFCA45EF5E7D987.mof
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\AutoRecover\E441354B9FE5F63362A481C9B9195A73.mof~VHJQ6OB3
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\AutoRecover\E04DE4CDFEC284A342159BB920976701.mof~KVGLV02N
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\AutoRecover\DFD614E4D613EF4506AC8F525F5F514B.mof~TNGJIVBR
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\AutoRecover\E441354B9FE5F63362A481C9B9195A73.mof
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\AutoRecover\E04DE4CDFEC284A342159BB920976701.mof
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\AutoRecover\DC999686F8B85B326CEDFA199DD07F72.mof~9PFGIRHB
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\AutoRecover\DFD614E4D613EF4506AC8F525F5F514B.mof
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\AutoRecover\DFB9AD54AC2D3B8122567AAD3BF3EB7F.mof
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\AutoRecover\DC999686F8B85B326CEDFA199DD07F72.mof
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\AutoRecover\D724DF13E0B0DF051EB5D403DD8EF2FC.mof
    11/15/2011 8:01:37 AM OK C:\WINDOWS\system32\wbem\AutoRecover\D724DF13E0B0DF051EB5D403DD8EF2FC.mof~P0GAMDLJ
    11/15/2011 8:01:36 AM OK C:\WINDOWS\system32\wbem\AutoRecover\DBD781C2C031C708BCB490F228E7BEF9.mof~G94CLHKR
    11/15/2011 8:01:36 AM OK C:\WINDOWS\system32\wbem\AutoRecover\DBD781C2C031C708BCB490F228E7BEF9.mof
    11/15/2011 8:01:36 AM OK C:\WINDOWS\system32\wbem\AutoRecover\D92470B796B6B18F9EE52301857F0567.mof~R5P2M9G1
    11/15/2011 8:01:36 AM OK C:\WINDOWS\system32\wbem\AutoRecover\D92470B796B6B18F9EE52301857F0567.mof
    11/15/2011 8:01:36 AM OK C:\WINDOWS\system32\wbem\AutoRecover\CFC35B349D24A8495FD2CEAB15C32D88.mof~AG94SATT
    11/15/2011 8:01:36 AM OK C:\WINDOWS\system32\wbem\AutoRecover\CA0106054EB09C302ED3E0669F99D021.mof~15IU45KP
    11/15/2011 8:01:36 AM OK C:\WINDOWS\system32\wbem\AutoRecover\C92641594A6F2DA8A55FE4738AFDA539.mof~59OFA92Q
    11/15/2011 8:01:36 AM OK C:\WINDOWS\system32\wbem\AutoRecover\CFC35B349D24A8495FD2CEAB15C32D88.mof
    11/15/2011 8:01:36 AM Will be disinfected on system restart: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\wmiprvse.exe
    11/15/2011 8:01:36 AM OK C:\WINDOWS\system32\wbem\AutoRecover\CA0106054EB09C302ED3E0669F99D021.mof
    11/15/2011 8:01:35 AM OK C:\WINDOWS\system32\wbem\AutoRecover\C8463ECBE33BC240263A0B094E46D510.mof
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\C92641594A6F2DA8A55FE4738AFDA539.mof
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\C81ACF420917AA0F87487BC4D958BEB4.mof~8RQAM43N
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\C81ACF420917AA0F87487BC4D958BEB4.mof
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\C41519FF17C36D562B5BEE37ED395810.mof~BMHC28QA
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\C6300BFE37ADE6B52EC023F66124985F.mof~01ACSL5S
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\C6300BFE37ADE6B52EC023F66124985F.mof
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\C41519FF17C36D562B5BEE37ED395810.mof
    11/15/2011 8:01:34 AM Cleared of viruses: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\wmiprvse.exe
    11/15/2011 8:01:34 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\wmiprvse.exe
    11/15/2011 8:01:34 AM Will be disinfected on system restart: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\wmic.exe
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\C3A0BE17B37ACE48BE78B31580231AE9.mof~8SLN95C3
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\C3A0BE17B37ACE48BE78B31580231AE9.mof
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\BE81B2C0741907C1FC1C42B6223E59AD.mof~UDB2MF25
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\BE81B2C0741907C1FC1C42B6223E59AD.mof
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\B0F7571D09CBE0AE81CB8FC91B04A321.mof
    11/15/2011 8:01:34 AM Cleared of viruses: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\wmic.exe
    11/15/2011 8:01:34 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\wmic.exe
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\AEA50E449C23761CA4D9B7F9ED0D9C89.mof~5C3J93O3
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\AEA50E449C23761CA4D9B7F9ED0D9C89.mof
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\AE7023598F41510BF261111652046301.mof~S6OBLN96
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\AE7023598F41510BF261111652046301.mof
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\ABB70D53B97FC8002205F77E02C97304.mof~L41CCC2B
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\ABB70D53B97FC8002205F77E02C97304.mof
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\A99860BB696AE92ED001E48B014365CE.mof~KA6CBU2M
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\A99860BB696AE92ED001E48B014365CE.mof
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\A7575F8DE31A912FFE91A7A41B1E382A.mof~P3ROJFLO
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\A7575F8DE31A912FFE91A7A41B1E382A.mof
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\9AD3182A2F39A3E091E15109132EC6CC.mof~2I4TUSRL
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\9AD3182A2F39A3E091E15109132EC6CC.mof
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\958A50DFF8A9DF5FAEA042AC9F60815F.mof~UOJHFTPC
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\958A50DFF8A9DF5FAEA042AC9F60815F.mof
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\903E49C444C46FEF5F2C3A189C9CEF71.mof~HU3QEKJB
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\903E49C444C46FEF5F2C3A189C9CEF71.mof
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\88744D2A29102FC88ECF505DD2E984FC.mof
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\8636DC7F9479DACE6778109CB4FB4B01.mof~MCEH9V7J
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\8636DC7F9479DACE6778109CB4FB4B01.mof
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\852ECCDBABE77624586E4417FE66F857.mof~PSTHK2CC
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\852ECCDBABE77624586E4417FE66F857.mof
    11/15/2011 8:01:34 AM OK C:\WINDOWS\system32\wbem\AutoRecover\7F417E1A6D819A9B2FEB55DA6858EA0A.mof~VIRQEV85
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\7F417E1A6D819A9B2FEB55DA6858EA0A.mof
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\7E27EAAD25AA36FEADFF502991DFC5C1.mof
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\7BDE76979585395D59B5DA1D62E63C50.mof
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\7A62FA52E22CE751514BC93BE067BC80.mof~UB54DKB0
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\7A62FA52E22CE751514BC93BE067BC80.mof
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\79E817BC978E2D450EB9E3794DFDA6CF.mof~NCRDBNMF
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\79E817BC978E2D450EB9E3794DFDA6CF.mof
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\731AE1FC8C795979F40FAD645FFBAEB1.mof~9J9A3N4O
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\731AE1FC8C795979F40FAD645FFBAEB1.mof
    11/15/2011 8:01:33 AM Backed up C:\WINDOWS\system32\wbem\wmiprvse.exe
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\72F867EF62976CE9F70993FF3E68A4EB.mof~P7LBLOHC
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\72F867EF62976CE9F70993FF3E68A4EB.mof
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\701B705ED7DF100F88D5BC4A595E938D.mof~NING34E6
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\701B705ED7DF100F88D5BC4A595E938D.mof
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\6FFF7467A5B40765D5740A413CA8BB8A.mof~4AU7G3AE
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\6FFF7467A5B40765D5740A413CA8BB8A.mof
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\6B38F33147D0369D5038BBB61C7A31C8.mof~QFNGAUJN
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\6B38F33147D0369D5038BBB61C7A31C8.mof
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\60A06765DDFE47EF7240BD9C1EB29EFE.mof~G8D07084
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\60A06765DDFE47EF7240BD9C1EB29EFE.mof
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\608B41C6A2CD9460C2263E6CD80C335A.mof~N1IL4HJT
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\608B41C6A2CD9460C2263E6CD80C335A.mof
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\42C894EEACAD83A4E41154685841B3E1.mof~N8103AGV
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\42C894EEACAD83A4E41154685841B3E1.mof
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\42355E8E232EF8CADD187D531DEC55DD.mof~P9LJ2UQ4
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\42355E8E232EF8CADD187D531DEC55DD.mof
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\3EC317800FF508210BB945C81C0EACE7.mof~VAT1LD7I
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\3EC317800FF508210BB945C81C0EACE7.mof
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\37134956F76D3C30C9BE0C12571CAF43.mof~S3Q7IHTT
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\37134956F76D3C30C9BE0C12571CAF43.mof
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\2DA80135BA8EC175C9B1C1598F659434.mof~5N4DDSA5
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\2DA80135BA8EC175C9B1C1598F659434.mof
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\2CFB5B149FA396D1AEA5F89B1C5A8D81.mof~O8AL6HBI
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\2CFB5B149FA396D1AEA5F89B1C5A8D81.mof
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\2CE64FBD51953C097BB5470043A6DAF9.mof~VAI7FAKU
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\2CE64FBD51953C097BB5470043A6DAF9.mof
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\2C142C4C15E3B8D139B98154CD083071.mof~CDUPGS6J
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\2C142C4C15E3B8D139B98154CD083071.mof
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\2B8B1A8B0ACD3EE28B421D3918DC1F29.mof~TOE8PNRL
    11/15/2011 8:01:33 AM Backed up C:\WINDOWS\system32\wbem\wmic.exe
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\2B8B1A8B0ACD3EE28B421D3918DC1F29.mof
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\2AA23BB86A5EBD8BC2D820944E55B233.mof~LBCQOVQC
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\2AA23BB86A5EBD8BC2D820944E55B233.mof
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\2A61A823DC2C1C838EE71C4351BED0B4.mof~6I9PMA0G
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\2A61A823DC2C1C838EE71C4351BED0B4.mof
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\26D6C4EB696DD0C83F5D5BF2235000A7.mof~41ORBVIL
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\26D6C4EB696DD0C83F5D5BF2235000A7.mof
    11/15/2011 8:01:33 AM OK C:\WINDOWS\system32\wbem\AutoRecover\26C097A9392F8C541AD42E89B7909073.mof~QHO20PCO
    11/15/2011 8:01:33 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\wmiprvse.exe
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\AutoRecover\26C097A9392F8C541AD42E89B7909073.mof
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\AutoRecover\23BDE61F1F4FACE17E9B0C01F2A1FD9B.mof
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\AutoRecover\20D2C3B8CE10B96CE6B8A3C241EF4416.mof~Q9O6G1I7
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\AutoRecover\20D2C3B8CE10B96CE6B8A3C241EF4416.mof
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\AutoRecover\1EBE968EB7AF815A32641E6185350A9E.mof
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\AutoRecover\1E97A05DE566CF6EEAE29D0634E27392.mof~IR6VNT0T
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\AutoRecover\1E97A05DE566CF6EEAE29D0634E27392.mof
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\AutoRecover\0A9DBC92D554324656F61F9862679F27.mof~5U7I84V4
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\AutoRecover\0A9DBC92D554324656F61F9862679F27.mof
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\AutoRecover\092389D621F5A8834203DAAC74CCA279.mof~SV1PAM3Q
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\AutoRecover\092389D621F5A8834203DAAC74CCA279.mof
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\AutoRecover\02E78424AB18BDBFA706C08B7D7B9F1D.mof~96ESPEHB
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\AutoRecover\02E78424AB18BDBFA706C08B7D7B9F1D.mof
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\xsl-mappings.xml~GGLJDRDT
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\xsl-mappings.xml
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\xml.xsl~MQ3FQMO5
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\xml.xsl
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\wsmAuto.mof
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\wscenter.mof~7HLFBJT7
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\wscenter.mof
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\wmiutils.dll~R1HL4P33
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\wmiutils.dll~9T1TDDKS
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\wmiutils.dll~0L21QNRV
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\wmitimep.mof~E48K3GCD
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\wmitimep.mof
    11/15/2011 8:01:32 AM OK C:\WINDOWS\system32\wbem\wmitimep.mfl~UESJPEEU
    11/15/2011 8:01:31 AM OK C:\WINDOWS\system32\wbem\wmitimep.mfl
    11/15/2011 8:01:31 AM OK C:\WINDOWS\system32\wbem\wmitimep.dll~UH5CI0F5
    11/15/2011 8:01:31 AM OK C:\WINDOWS\system32\wbem\wmitimep.dll Object was not changed (iChecker)
    11/15/2011 8:01:31 AM OK C:\WINDOWS\system32\wbem\wmisvc.dll~CAEBU21E
    11/15/2011 8:01:31 AM OK C:\WINDOWS\system32\wbem\wmisvc.dll~C0MLRR28
    11/15/2011 8:01:31 AM OK C:\WINDOWS\system32\wbem\wmisvc.dll~BUISDJTN
    11/15/2011 8:01:31 AM OK C:\WINDOWS\system32\wbem\wmipsess.mof~0UJFJ1D6
    11/15/2011 8:01:31 AM OK C:\WINDOWS\system32\wbem\wmipsess.mof
    11/15/2011 8:01:30 AM OK C:\WINDOWS\system32\wbem\wmipsess.mfl~ED0MAULS
    11/15/2011 8:01:30 AM OK C:\WINDOWS\system32\wbem\wmipsess.mfl
    11/15/2011 8:01:30 AM OK C:\WINDOWS\system32\wbem\wmipsess.dll~DKMCA1HV
    11/15/2011 8:01:30 AM OK C:\WINDOWS\system32\wbem\wmipsess.dll Object was not changed (iChecker)
    11/15/2011 8:01:30 AM OK C:\WINDOWS\system32\wbem\wmiprvse.exe~KL96OFE7
    11/15/2011 8:01:30 AM OK C:\WINDOWS\system32\wbem\wmiprvse.exe~FOLHENIV
    11/15/2011 8:01:30 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\wmic.exe
    11/15/2011 8:01:30 AM OK C:\WINDOWS\system32\wbem\wmiprvse.exe~7R0HL7DC
    11/15/2011 8:01:29 AM OK C:\WINDOWS\system32\wbem\wmiprvsd.dll~MIFJF04N
    11/15/2011 8:01:29 AM OK C:\WINDOWS\system32\wbem\wmiprvsd.dll~PU3KH62C
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmiprvsd.dll~8B9REM8E
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmiprov.dll~RU59Q3SN
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmiprov.dll~5CE0VJTC
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmiprov.dll~0T1MBEKJ
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmiprov.dll Object was not changed (iChecker)
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipjobj.mof~PPR25TL8
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipjobj.mfl
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipjobj.mof
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipjobj.mfl~754B813V
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipjobj.dll~930B236N
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipiprt.mof~0F4S91E6
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipjobj.dll Object was not changed (iChecker)
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipiprt.mof
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipiprt.mfl~BJ3EEO6M
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipiprt.mfl
    11/15/2011 8:01:28 AM Will be disinfected on system restart: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\wmiadap.exe
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipiprt.dll~7CS9SUP0
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipiprt.dll Object was not changed (iChecker)
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipicmp.mof~P2QDS520
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipicmp.mof
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipicmp.mfl~PB5JR9SF
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipicmp.mfl
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipicmp.dll~1FE2KBF0
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipicmp.dll Object was not changed (iChecker)
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipdskq.mof~FT4986BA
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipdskq.mof
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipdskq.mfl~MD71BBVG
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipdskq.mfl
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipdskq.dll~F1203GB4
    11/15/2011 8:01:28 AM Cleared of viruses: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\wmiadap.exe
    11/15/2011 8:01:28 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\wmiadap.exe
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipdskq.dll Object was not changed (iChecker)
    11/15/2011 8:01:28 AM OK C:\WINDOWS\system32\wbem\wmipcima.mof~3L63M8MU
    11/15/2011 8:01:27 AM OK C:\WINDOWS\system32\wbem\wmipcima.mof
    11/15/2011 8:01:27 AM OK C:\WINDOWS\system32\wbem\wmipcima.mfl~I0SURDJ8
    11/15/2011 8:01:27 AM OK C:\WINDOWS\system32\wbem\wmipcima.mfl
    11/15/2011 8:01:27 AM OK C:\WINDOWS\system32\wbem\wmipcima.dll~GV78BD8N
    11/15/2011 8:01:27 AM OK C:\WINDOWS\system32\wbem\wmipcima.dll Object was not changed (iChecker)
    11/15/2011 8:01:27 AM OK C:\WINDOWS\system32\wbem\wmimsg.dll~FGJFMVII
    11/15/2011 8:01:27 AM OK C:\WINDOWS\system32\wbem\wmimsg.dll Object was not changed (iChecker)
    11/15/2011 8:01:27 AM OK C:\WINDOWS\system32\wbem\wmidcprv.dll~713FI49S
    11/15/2011 8:01:27 AM OK C:\WINDOWS\system32\wbem\wmidcprv.dll Object was not changed (iChecker)
    11/15/2011 8:01:27 AM OK C:\WINDOWS\system32\wbem\wmicookr.dll~1JMHD70I
    11/15/2011 8:01:27 AM OK C:\WINDOWS\system32\wbem\wmicookr.dll Object was not changed (iChecker)
    11/15/2011 8:01:27 AM OK C:\WINDOWS\system32\wbem\wmiclivalueformat.xsl~KDGEJPCT
    11/15/2011 8:01:27 AM OK C:\WINDOWS\system32\wbem\wmiclivalueformat.xsl
    11/15/2011 8:01:27 AM OK C:\WINDOWS\system32\wbem\wmiclitableformatnosys.xsl~3EEDSFTG
    11/15/2011 8:01:27 AM OK C:\WINDOWS\system32\wbem\wmiclitableformatnosys.xsl
    11/15/2011 8:01:27 AM OK C:\WINDOWS\system32\wbem\wmiclitableformat.xsl~HIQ95DS0
    11/15/2011 8:01:27 AM OK C:\WINDOWS\system32\wbem\wmiclitableformat.xsl
    11/15/2011 8:01:27 AM OK C:\WINDOWS\system32\wbem\wmiclimofformat.xsl~NH49NJ96
    11/15/2011 8:01:27 AM OK C:\WINDOWS\system32\wbem\wmiclimofformat.xsl
    11/15/2011 8:01:27 AM OK C:\WINDOWS\system32\wbem\wmic.exe~7C8H7VKM
    11/15/2011 8:01:26 AM OK C:\WINDOWS\system32\wbem\wmiapsrv.exe~H6H9J0F6
    11/15/2011 8:01:26 AM OK C:\WINDOWS\system32\wbem\wmiaprpl.dll~1STBECTN
    11/15/2011 8:01:26 AM Will be disinfected on system restart: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\winmgmt.exe
    11/15/2011 8:01:26 AM OK C:\WINDOWS\system32\wbem\wmiaprpl.dll Object was not changed (iChecker)
    11/15/2011 8:01:26 AM OK C:\WINDOWS\system32\wbem\wmiapres.dll~VP84AV8O
    11/15/2011 8:01:26 AM OK C:\WINDOWS\system32\wbem\wmiapres.dll Object was not changed (iChecker)
    11/15/2011 8:01:26 AM OK C:\WINDOWS\system32\wbem\wmiadap.exe~MTESJFAI
    11/15/2011 8:01:26 AM Cleared of viruses: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\winmgmt.exe
    11/15/2011 8:01:26 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\winmgmt.exe
    11/15/2011 8:01:26 AM Backed up C:\WINDOWS\system32\wbem\wmiadap.exe
    11/15/2011 8:01:25 AM Will be disinfected on system restart: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\wbemtest.exe
    11/15/2011 8:01:24 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\wmiadap.exe
    11/15/2011 8:01:24 AM Cleared of viruses: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\wbemtest.exe
    11/15/2011 8:01:24 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\wbemtest.exe
    11/15/2011 8:01:24 AM Backed up C:\WINDOWS\system32\wbem\winmgmt.exe
    11/15/2011 8:01:24 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\winmgmt.exe
    11/15/2011 8:01:24 AM Backed up C:\WINDOWS\system32\wbem\wbemtest.exe
    11/15/2011 8:01:23 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\wbemtest.exe
    11/15/2011 8:01:19 AM OK C:\WINDOWS\system32\wbem\wmi.mof~EH2DRTGK
    11/15/2011 8:01:19 AM OK C:\WINDOWS\system32\wbem\wmi.mof
    11/15/2011 8:01:19 AM OK C:\WINDOWS\system32\wbem\wmi.mfl~CSP4H1UR
    11/15/2011 8:01:19 AM OK C:\WINDOWS\system32\wbem\wmi.mfl
    11/15/2011 8:01:19 AM OK C:\WINDOWS\system32\wbem\winmgmtr.dll~RF1DQPQO
    11/15/2011 8:01:19 AM OK C:\WINDOWS\system32\wbem\winmgmtr.dll Object was not changed (iChecker)
    11/15/2011 8:01:19 AM OK C:\WINDOWS\system32\wbem\winmgmt.exe~OK0VANH0
    11/15/2011 8:01:18 AM OK C:\WINDOWS\system32\wbem\WindowsSearchEngine.mof~K7M8OIA2
    11/15/2011 8:01:18 AM OK C:\WINDOWS\system32\wbem\WindowsSearchEngine_Uninst.mof~0JANVU0E
    11/15/2011 8:01:18 AM OK C:\WINDOWS\system32\wbem\WindowsSearchEngine_Uninst.mof
    11/15/2011 8:01:18 AM OK C:\WINDOWS\system32\wbem\whqlprov.mof~SABP852Q
    11/15/2011 8:01:18 AM OK C:\WINDOWS\system32\wbem\WindowsSearchEngine.mof
    11/15/2011 8:01:17 AM OK C:\WINDOWS\system32\wbem\wbemupgd.dll~UT76JDL2
    11/15/2011 8:01:17 AM OK C:\WINDOWS\system32\wbem\whqlprov.mof
    11/15/2011 8:01:17 AM OK C:\WINDOWS\system32\wbem\wbemtest.exe~5IF2K3CP
    11/15/2011 8:01:17 AM OK C:\WINDOWS\system32\wbem\wbemupgd.dll Object was not changed (iChecker)
    11/15/2011 8:01:17 AM OK C:\WINDOWS\system32\wbem\wbemess.dll~K3HS87KG
    11/15/2011 8:01:17 AM OK C:\WINDOWS\system32\wbem\wbemess.dll~FUQE77M1
    11/15/2011 8:01:16 AM OK C:\WINDOWS\system32\wbem\wbemsvc.dll~MSOREM00
    11/15/2011 8:01:16 AM OK C:\WINDOWS\system32\wbem\wbemsvc.dll~FP3J7P5R
    11/15/2011 8:01:16 AM OK C:\WINDOWS\system32\wbem\wbemsvc.dll~7L2PJ6HB
    11/15/2011 8:01:16 AM OK C:\WINDOWS\system32\wbem\wbemprox.dll~V40FTRAK
    11/15/2011 8:01:16 AM OK C:\WINDOWS\system32\wbem\wbemprox.dll~P6G9P2PN
    11/15/2011 8:01:16 AM OK C:\WINDOWS\system32\wbem\wbemprox.dll~38CEUV4I
    11/15/2011 8:01:16 AM OK C:\WINDOWS\system32\wbem\wbemperf.dll~U7JE7UKL
    11/15/2011 8:01:16 AM OK C:\WINDOWS\system32\wbem\wbemperf.dll Object was not changed (iChecker)
    11/15/2011 8:01:16 AM Will be disinfected on system restart: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\unsecapp.exe
    11/15/2011 8:01:15 AM OK C:\WINDOWS\system32\wbem\wbemess.dll~93BMIPEV
    11/15/2011 8:01:15 AM OK C:\WINDOWS\system32\wbem\wbemcore.dll~HTLUC8BP
    11/15/2011 8:01:15 AM OK C:\WINDOWS\system32\wbem\wbemdisp.tlb~QE2NPTCI
    11/15/2011 8:01:15 AM OK C:\WINDOWS\system32\wbem\wbemdisp.tlb
    11/15/2011 8:01:15 AM OK C:\WINDOWS\system32\wbem\wbemdisp.dll~QE7LVVB7
    11/15/2011 8:01:15 AM OK C:\WINDOWS\system32\wbem\wbemcore.dll~2N7T41V0
    11/15/2011 8:01:15 AM OK C:\WINDOWS\system32\wbem\wbemcore.dll~7VGELKEI
    11/15/2011 8:01:14 AM Cleared of viruses: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\unsecapp.exe
    11/15/2011 8:01:14 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\unsecapp.exe
    11/15/2011 8:01:14 AM OK C:\WINDOWS\system32\wbem\wbemcons.mof~NE5545JT
    luddite, Nov 17, 2011
    #18

  19. luddite Newcomer, in training Posts: 82

    11/15/2011 8:01:14 AM OK C:\WINDOWS\system32\wbem\wbemcons.mof
    11/15/2011 8:01:14 AM OK C:\WINDOWS\system32\wbem\wbemcons.mfl~LP3RE8CS
    11/15/2011 8:01:14 AM OK C:\WINDOWS\system32\wbem\wbemcons.mfl
    11/15/2011 8:01:14 AM OK C:\WINDOWS\system32\wbem\wbemcons.dll~3TRH3KNE
    11/15/2011 8:01:14 AM OK C:\WINDOWS\system32\wbem\wbemcomn.dll~ETQQJCHK
    11/15/2011 8:01:14 AM OK C:\WINDOWS\system32\wbem\wbemcomn.dll~A7E4LVS4
    11/15/2011 8:01:14 AM OK C:\WINDOWS\system32\wbem\wbemcomn.dll~5H51M5J0
    11/15/2011 8:01:14 AM OK C:\WINDOWS\system32\wbem\wbemcntl.dll~SMPMFIO5
    11/15/2011 8:01:14 AM Will be disinfected on system restart: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\scrcons.exe
    11/15/2011 8:01:14 AM OK C:\WINDOWS\system32\wbem\wbemcntl.dll Object was not changed (iChecker)
    11/15/2011 8:01:14 AM OK C:\WINDOWS\system32\wbem\wbemads.tlb~421ALMGT
    11/15/2011 8:01:14 AM OK C:\WINDOWS\system32\wbem\wbemads.tlb
    11/15/2011 8:01:14 AM OK C:\WINDOWS\system32\wbem\wbemads.dll~105TSOV2
    11/15/2011 8:01:14 AM OK C:\WINDOWS\system32\wbem\wbemads.dll Object was not changed (iChecker)
    11/15/2011 8:01:14 AM OK C:\WINDOWS\system32\wbem\viewprov.dll~EPF9VI77
    11/15/2011 8:01:14 AM Cleared of viruses: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\scrcons.exe
    11/15/2011 8:01:14 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\scrcons.exe
    11/15/2011 8:01:14 AM OK C:\WINDOWS\system32\wbem\viewprov.dll Object was not changed (iChecker)
    11/15/2011 8:01:14 AM OK C:\WINDOWS\system32\wbem\updprov.mof~4N51H3KS
    11/15/2011 8:01:14 AM OK C:\WINDOWS\system32\wbem\updprov.mof
    11/15/2011 8:01:14 AM OK C:\WINDOWS\system32\wbem\updprov.mfl~GS6KKDTG
    11/15/2011 8:01:14 AM OK C:\WINDOWS\system32\wbem\updprov.mfl
    11/15/2011 8:01:14 AM OK C:\WINDOWS\system32\wbem\updprov.dll~66P60RI6
    11/15/2011 8:01:14 AM OK C:\WINDOWS\system32\wbem\updprov.dll Object was not changed (iChecker)
    11/15/2011 8:01:14 AM OK C:\WINDOWS\system32\wbem\unsecapp.exe~9EOEK5T6
    11/15/2011 8:01:14 AM Will be disinfected on system restart: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\mofcomp.exe
    11/15/2011 8:01:13 AM Backed up C:\WINDOWS\system32\wbem\unsecapp.exe
    11/15/2011 8:01:13 AM Cleared of viruses: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\mofcomp.exe
    11/15/2011 8:01:13 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\mofcomp.exe
    11/15/2011 8:01:12 AM Backed up C:\WINDOWS\system32\wbem\scrcons.exe
    11/15/2011 8:01:12 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\unsecapp.exe
    11/15/2011 8:01:12 AM Backed up C:\WINDOWS\system32\wbem\mofcomp.exe
    11/15/2011 8:01:12 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\scrcons.exe
    11/15/2011 8:01:12 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\wbem\mofcomp.exe
    11/15/2011 8:01:11 AM OK C:\WINDOWS\system32\wbem\tscfgwmi.mof~13H6PIAS
    11/15/2011 8:01:11 AM OK C:\WINDOWS\system32\wbem\tscfgwmi.mof
    11/15/2011 8:01:11 AM OK C:\WINDOWS\system32\wbem\tscfgwmi.mfl~CGBFN4DD
    11/15/2011 8:01:11 AM OK C:\WINDOWS\system32\wbem\tscfgwmi.mfl
    11/15/2011 8:01:11 AM OK C:\WINDOWS\system32\wbem\trnsprov.mof~Q4TFNKME
    11/15/2011 8:01:11 AM OK C:\WINDOWS\system32\wbem\trnsprov.mof
    11/15/2011 8:01:11 AM OK C:\WINDOWS\system32\wbem\trnsprov.mfl~KK3L60IM
    11/15/2011 8:01:11 AM OK C:\WINDOWS\system32\wbem\trnsprov.mfl
    11/15/2011 8:01:11 AM OK C:\WINDOWS\system32\wbem\trnsprov.dll~O0UDCK3N
    11/15/2011 8:01:11 AM OK C:\WINDOWS\system32\wbem\trnsprov.dll Object was not changed (iChecker)
    11/15/2011 8:01:11 AM OK C:\WINDOWS\system32\wbem\tmplprov.mof~BFA7QAVP
    11/15/2011 8:01:11 AM OK C:\WINDOWS\system32\wbem\tmplprov.mof
    11/15/2011 8:01:11 AM OK C:\WINDOWS\system32\wbem\tmplprov.mfl~L1C7HKHM
    11/15/2011 8:01:11 AM OK C:\WINDOWS\system32\wbem\tmplprov.mfl
    11/15/2011 8:01:11 AM OK C:\WINDOWS\system32\wbem\tmplprov.dll~MS721H5C
    11/15/2011 8:01:11 AM OK C:\WINDOWS\system32\wbem\tmplprov.dll Object was not changed (iChecker)
    11/15/2011 8:01:11 AM OK C:\WINDOWS\system32\wbem\textvaluelist.xsl~JLCA0NPB
    11/15/2011 8:01:11 AM OK C:\WINDOWS\system32\wbem\textvaluelist.xsl
    11/15/2011 8:01:11 AM OK C:\WINDOWS\system32\wbem\texttablewsys.xsl~REEGRM95
    11/15/2011 8:01:11 AM OK C:\WINDOWS\system32\wbem\texttablewsys.xsl
    11/15/2011 8:01:11 AM OK C:\WINDOWS\system32\wbem\texttable.xsl~SK6MTG0R
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\texttable.xsl
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\system.mof~JDMPFKGN
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\system.mof
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\subscrpt.mof~VE5U0F9K
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\subscrpt.mof
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\stdprov.dll~A67N00F9
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\stdprov.dll Object was not changed (iChecker)
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\sr.mof~TDTTSRCD
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\sr.mof
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\smtpcons.mof~QEESSTN5
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\smtpcons.mof
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\smtpcons.mfl~03748PS6
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\wmiutils.dll Object was not changed (iSwift 3)
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\smtpcons.mfl
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\smtpcons.dll~I8O89EKQ
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\smtpcons.dll Object was not changed (iChecker)
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\secrcw32.mof~5VPOBF1A
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\secrcw32.mof
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\secrcw32.mfl~A0NEB0T3
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\secrcw32.mfl
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\scrcons.mof~TJJBQU97
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\scrcons.mof
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\scrcons.mfl~QVD4OLOO
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\scrcons.mfl
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\scrcons.exe~UA53EOQ0
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\scm.mof~ILTS5QRN
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\wmisvc.dll Object was not changed (iSwift 3)
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\scm.mof
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\scersop.mof~JQ0T3SGM
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\rsop.mfl~LBB2SQO4
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\scersop.mof
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\rsop.mof~6IGMF2RR
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\rsop.mof
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\repdrvfs.dll~C6Q9KCBH
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\rsop.mfl
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\repdrvfs.dll~QS2VHU67
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\provthrd.dll~ME3NUN15
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\repdrvfs.dll~2JVFSIGC
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\regevent.mof~PMBERM79
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\regevent.mof
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\regevent.mfl~LBHFBVMK
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\regevent.mfl
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\rawxml.xsl~F0PTSAFE
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\rawxml.xsl
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\policman.mof~98700IO8
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\provthrd.dll Object was not changed (iChecker)
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\policman.mof
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\policman.dll~4P0RHCI5
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\policman.mfl~2H8IMLH7
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\policman.mfl
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\ntevt.mof~NT799L2A
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\policman.dll Object was not changed (iChecker)
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\ntevt.dll~8JRKMAII
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\ntevt.mof
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\ntevt.mfl~MPL86FS3
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\ntevt.mfl
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\ntevt.dll Object was not changed (iChecker)
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\ncprov.mof
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\ncprov.mof~A6U1S0ID
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\ncprov.mfl~664KIRNG
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\ncprov.dll~GLFVNLP1
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\ncprov.mfl
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\ncprov.dll~N64P42BN
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\napclientprov.mof~3EKT1HSI
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\ncprov.dll~30ONPVOP
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\napclientschema.mof~Q82PBD43
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\napclientschema.mof
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\msiprov.dll~UNUMLLUD
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\napclientprov.mof
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\msi.mof~GK7FUEEF
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\msiprov.dll Object was not changed (iChecker)
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\msi.mof
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\msi.mfl~RIDC3GJ3
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\mofd.dll~I23TDT7U
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\msi.mfl
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\mofd.dll Object was not changed (iChecker)
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\mofcomp.exe~RVQ8E7VE
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\licwmi.mof~47CMJ22A
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\mof.xsl~FJ5KQPC7
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\mof.xsl
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\licwmi.mfl~4I517MA0
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\licwmi.mof
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\krnlprov.mfl~0EP74V2D
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\licwmi.mfl
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\krnlprov.mof~JVKDDBS9
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\krnlprov.dll~I5FQ1F0V
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\krnlprov.mof
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\krnlprov.mfl
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\framedyn.dll~3VKFEPU0
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\ieinfo5.mof~ULQQ4O62
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\krnlprov.dll Object was not changed (iChecker)
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\ieinfo5.mof
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\htable.xsl~UBMNA31S
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\htable.xsl
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\htable-sortby.xsl~G6130HA8
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\hnetcfg.mof~SUD5I2DE
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\htable-sortby.xsl
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\fwdprov.dll~PE8TU1HQ
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\hnetcfg.mof
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\hform.xsl~FEHL0V3V
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\hform.xsl
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\fwdprov.dll Object was not changed (iChecker)
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\fevprov.mof~CS1QO424
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\framedyn.dll Object was not changed (iChecker)
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\fconprov.mfl~08VMABE6
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\fevprov.mof
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\fevprov.mfl~6NDIFJDF
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\fevprov.mfl
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\fconprov.mof~KNG85709
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\fconprov.mof
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\fastprox.dll~TET19512
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\fastprox.dll~RR033BDR
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\fconprov.mfl
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\fastprox.dll~DPO74HSH
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\esscli.dll~SIDSSVUV
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\evntrprv.mof~FO2O7NQE
    11/15/2011 8:01:09 AM OK C:\WINDOWS\system32\wbem\evntrprv.mof
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\esscli.dll~O9T78D2R
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\evntrprv.dll~HDBGLBD1
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\wmiprvsd.dll Object was not changed (iSwift 3)
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\evntrprv.dll Object was not changed (iChecker)
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\esscli.dll~7M6C9UG3
    11/15/2011 8:01:08 AM Will be disinfected on system restart: Virus.Win32.Expiro.w C:\WINDOWS\system32\usmt\migwiza.exe
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\dsprov.mof~8QTSR1VR
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\dsprov.dll~IMRQHN94
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\dsprov.mof
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\dsprov.mfl~T7C2F38A
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\dsprov.mfl
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\dsprov.dll Object was not changed (iChecker)
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\dgnet.mof~S25BVTSA
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\csv.xsl~PSK4AOJU
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\dgnet.mof
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\csv.xsl
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\CmdEvTgProv.mof~E3NN401E
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\CmdEvTgProv.dll~EP8FNCBQ
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\CmdEvTgProv.mof
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\CmdEvTgProv.dll
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\cliegaliases.mof~O3J6NBMJ
    11/15/2011 8:01:08 AM Will be disinfected on system restart: Virus.Win32.Expiro.w C:\WINDOWS\system32\usmt\migwiz.exe
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\cliegaliases.mof
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\cliegaliases.mfl~5I5G9V50
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\cliegaliases.mfl
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\cli.mof~TFUF48NA
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\cli.mof
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\cimwin32.mof~P5LNTH7R
    11/15/2011 8:01:08 AM Cleared of viruses: Virus.Win32.Expiro.w C:\WINDOWS\system32\usmt\migwiza.exe
    11/15/2011 8:01:08 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\usmt\migwiza.exe
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\cimwin32.mof
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\cimwin32.mfl~SPD7FOIB
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\cimwin32.mfl
    11/15/2011 8:01:08 AM Cleared of viruses: Virus.Win32.Expiro.w C:\WINDOWS\system32\usmt\migwiz.exe
    11/15/2011 8:01:08 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\usmt\migwiz.exe
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\cimwin32.dll~1UG2AQD4
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\wbem\cimwin32.dll Object was not changed (iChecker)
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\usmt\usmtdef.inf~I2E4CNGH
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\usmt\usmtdef.inf
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\usmt\sysmoda.dll~26DTMJ8J
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\usmt\sysmoda.dll Object was not changed (iChecker)
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\usmt\sysmod.dll~5QMP165J
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\usmt\sysmod.dll Object was not changed (iChecker)
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\usmt\sysfiles.inf~LJ8SULAI
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\usmt\sysfiles.inf
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\usmt\scripta.dll~3V6RPQ5U
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\usmt\scripta.dll Object was not changed (iChecker)
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\usmt\script.dll~PK4F37CF
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\usmt\script.dll Object was not changed (iChecker)
    11/15/2011 8:01:08 AM OK C:\WINDOWS\system32\usmt\migwiza.exe~43US08Q0
    11/15/2011 8:01:08 AM Will be disinfected on system restart: Virus.Win32.Expiro.w C:\WINDOWS\system32\usmt\migload.exe
    11/15/2011 8:01:08 AM Backed up C:\WINDOWS\system32\usmt\migwiza.exe
    11/15/2011 8:01:07 AM Cleared of viruses: Virus.Win32.Expiro.w C:\WINDOWS\system32\usmt\migload.exe
    11/15/2011 8:01:07 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\usmt\migload.exe
    11/15/2011 8:01:07 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\usmt\migwiza.exe
    11/15/2011 8:01:06 AM OK C:\WINDOWS\system32\wbem\wbemsvc.dll Object was not changed (iSwift 3)
    11/15/2011 8:01:06 AM OK C:\WINDOWS\system32\wbem\wbemprox.dll Object was not changed (iSwift 3)
    11/15/2011 8:01:06 AM OK C:\WINDOWS\system32\wbem\wbemess.dll Object was not changed (iSwift 3)
    11/15/2011 8:01:06 AM OK C:\WINDOWS\system32\wbem\wbemdisp.dll Object was not changed (iSwift 3)
    11/15/2011 8:01:06 AM OK C:\WINDOWS\system32\wbem\wbemcore.dll Object was not changed (iSwift 3)
    11/15/2011 8:01:06 AM OK C:\WINDOWS\system32\wbem\wbemcons.dll Object was not changed (iSwift 3)
    11/15/2011 8:01:06 AM OK C:\WINDOWS\system32\wbem\wbemcomn.dll Object was not changed (iSwift 3)
    11/15/2011 8:01:05 AM OK C:\WINDOWS\system32\wbem\repdrvfs.dll Object was not changed (iSwift 3)
    11/15/2011 8:01:05 AM OK C:\WINDOWS\system32\wbem\ncprov.dll Object was not changed (iSwift 3)
    11/15/2011 8:01:04 AM OK C:\WINDOWS\system32\wbem\fastprox.dll Object was not changed (iSwift 3)
    11/15/2011 8:01:04 AM Backed up C:\WINDOWS\system32\usmt\migwiz.exe
    11/15/2011 8:01:04 AM OK C:\WINDOWS\system32\wbem\esscli.dll Object was not changed (iSwift 3)
    11/15/2011 8:01:04 AM Backed up C:\WINDOWS\system32\usmt\migload.exe
    11/15/2011 8:01:04 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\usmt\migwiz.exe
    11/15/2011 8:01:02 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\usmt\migload.exe
    11/15/2011 8:01:01 AM OK C:\WINDOWS\system32\usmt\migwiz.inf~ROIMITJD
    11/15/2011 8:01:01 AM OK C:\WINDOWS\system32\usmt\migwiz.inf
    11/15/2011 8:01:01 AM OK C:\WINDOWS\system32\usmt\migwiz.exe~M1IFJ9JI
    11/15/2011 8:01:01 AM OK C:\WINDOWS\system32\usmt\migwiz.exe.manifest~ML94IS8A
    11/15/2011 8:01:01 AM OK C:\WINDOWS\system32\usmt\migwiz.exe.manifest
    11/15/2011 8:01:01 AM Will be disinfected on system restart: Virus.Win32.Expiro.w C:\WINDOWS\system32\URTTemp\regtlib.exe
    11/15/2011 8:01:01 AM Cleared of viruses: Virus.Win32.Expiro.w C:\WINDOWS\system32\URTTemp\regtlib.exe
    11/15/2011 8:01:01 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\URTTemp\regtlib.exe
    11/15/2011 8:01:01 AM OK C:\WINDOWS\system32\usmt\miguser.inf~1CBRVSGE
    11/15/2011 8:01:01 AM OK C:\WINDOWS\system32\usmt\miguser.inf
    11/15/2011 8:01:01 AM OK C:\WINDOWS\system32\usmt\migsys.inf~L8GSCLGH
    11/15/2011 8:01:01 AM OK C:\WINDOWS\system32\usmt\migsys.inf
    11/15/2011 8:01:01 AM OK C:\WINDOWS\system32\usmt\migload.exe~S0KBRGML
    11/15/2011 8:01:01 AM OK C:\WINDOWS\system32\usmt\migisma.dll~UE7KUO4S
    11/15/2011 8:01:01 AM OK C:\WINDOWS\system32\usmt\migisma.dll Object was not changed (iChecker)
    11/15/2011 8:01:01 AM OK C:\WINDOWS\system32\usmt\migism.inf
    11/15/2011 8:01:01 AM OK C:\WINDOWS\system32\usmt\migism.inf~IGBUD5R1
    11/15/2011 8:01:01 AM Backed up C:\WINDOWS\system32\URTTemp\regtlib.exe
    11/15/2011 8:01:01 AM OK C:\WINDOWS\system32\usmt\migism.dll~8LIBRBHO
    11/15/2011 8:01:01 AM OK C:\WINDOWS\system32\usmt\migapp.inf
    11/15/2011 8:01:01 AM OK C:\WINDOWS\system32\usmt\migism.dll Object was not changed (iChecker)
    11/15/2011 8:01:01 AM OK C:\WINDOWS\system32\usmt\migapp.inf~LG21VN15
    11/15/2011 8:01:01 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\URTTemp\regtlib.exe
    11/15/2011 8:01:00 AM OK C:\WINDOWS\system32\usmt\log.dll~R7CV11DL
    11/15/2011 8:01:00 AM OK C:\WINDOWS\system32\usmt\iconlib.dll~81AUBNU6
    11/15/2011 8:01:00 AM OK C:\WINDOWS\system32\usmt\log.dll Object was not changed (iChecker)
    11/15/2011 8:01:00 AM OK C:\WINDOWS\system32\usmt\guitrna.dll~JHATRNRS
    11/15/2011 8:01:00 AM OK C:\WINDOWS\system32\usmt\iconlib.dll
    11/15/2011 8:01:00 AM OK C:\WINDOWS\system32\usmt\guitrna.dll Object was not changed (iChecker)
    11/15/2011 8:01:00 AM OK C:\WINDOWS\system32\usmt\guitrn.dll~6FAB9GK8
    11/15/2011 8:01:00 AM OK C:\WINDOWS\system32\usmt\guitrn.dll Object was not changed (iChecker)
    11/15/2011 8:01:00 AM OK C:\WINDOWS\system32\usmt\cobramsg.dll~1B229NMI
    11/15/2011 8:01:00 AM OK C:\WINDOWS\system32\usmt\cobramsg.dll Object was not changed (iChecker)
    11/15/2011 8:01:00 AM OK C:\WINDOWS\system32\usmt\archvapp.inf~4D8VD89Q
    11/15/2011 8:01:00 AM OK C:\WINDOWS\system32\usmt\archvapp.inf
    11/15/2011 8:01:00 AM OK C:\WINDOWS\system32\URTTemp\regtlib.exe~CF8J6Q7B
    11/15/2011 8:01:00 AM OK C:\WINDOWS\system32\URTTemp\msvcr71.dll~VR910KPH
    11/15/2011 8:01:00 AM OK C:\WINDOWS\system32\URTTemp\msvcr71.dll Object was not changed (iChecker)
    11/15/2011 8:01:00 AM OK C:\WINDOWS\system32\URTTemp\mscorwks.dll~80D1TR24
    11/15/2011 8:01:00 AM OK C:\WINDOWS\system32\URTTemp\mscorwks.dll Object was not changed (iChecker)
    11/15/2011 8:01:00 AM OK C:\WINDOWS\system32\URTTemp\mscorsn.dll~G1RLIAEK
    11/15/2011 8:01:00 AM OK C:\WINDOWS\system32\URTTemp\mscorsn.dll Object was not changed (iChecker)
    luddite, Nov 17, 2011
    #19

  20. luddite Newcomer, in training Posts: 82

    11/15/2011 8:00:59 AM OK C:\WINDOWS\system32\URTTemp\mscoree.dll~A3ANABSF
    11/15/2011 8:00:59 AM OK C:\WINDOWS\system32\URTTemp\fusion.dll~QLAIGBI5
    11/15/2011 8:00:59 AM OK C:\WINDOWS\system32\URTTemp\mscoree.dll.local~CDF0JUIP
    11/15/2011 8:00:59 AM OK C:\WINDOWS\system32\URTTemp\mscoree.dll Object was not changed (iChecker)
    11/15/2011 8:00:59 AM OK C:\WINDOWS\system32\URTTemp\mscoree.dll.local
    11/15/2011 8:00:59 AM OK C:\WINDOWS\system32\URTTemp\fusion.dll Object was not changed (iChecker)
    11/15/2011 8:00:59 AM OK C:\WINDOWS\system32\tempdir\tinypdf2.dll Object was not changed (iChecker)
    11/15/2011 8:00:59 AM OK C:\WINDOWS\system32\tempdir\tinypdf1.dll Object was not changed (iChecker)
    11/15/2011 8:00:59 AM OK C:\WINDOWS\system32\spool\XPSEP\i386\i386\xpssvcs.dll~U9M9A6IG
    11/15/2011 8:00:59 AM OK C:\WINDOWS\system32\tempdir\tinypdf.dll
    11/15/2011 8:00:59 AM OK C:\WINDOWS\system32\tempdir\tinypdf.chm Object was not changed (iChecker)
    11/15/2011 8:00:59 AM OK C:\WINDOWS\system32\spool\XPSEP\i386\i386\xpssvcs.dll Object was not changed (iChecker)
    11/15/2011 8:00:58 AM OK C:\WINDOWS\system32\spool\XPSEP\i386\i386\mxdwdrv.dll~RMBT8OO2
    11/15/2011 8:00:58 AM OK C:\WINDOWS\system32\spool\XPSEP\i386\i386\mxdwdrv.dll Object was not changed (iChecker)
    11/15/2011 8:00:58 AM OK C:\WINDOWS\system32\spool\XPSEP\i386\xpssvcs.dll~50R92MA3
    11/15/2011 8:00:58 AM OK C:\WINDOWS\system32\spool\XPSEP\i386\xpssvcs.dll Object was not changed (iChecker)
    11/15/2011 8:00:56 AM OK C:\WINDOWS\system32\spool\XPSEP\i386\mxdwdrv.dll~DULG4A03
    11/15/2011 8:00:56 AM OK C:\WINDOWS\system32\spool\XPSEP\i386\mxdwdrv.dll Object was not changed (iChecker)
    11/15/2011 8:00:55 AM OK C:\WINDOWS\system32\spool\XPSEP\i386\msxpsinc.ppd~JPV223NE
    11/15/2011 8:00:55 AM Will be disinfected on system restart: Virus.Win32.Expiro.w C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
    11/15/2011 8:00:55 AM OK C:\WINDOWS\system32\spool\XPSEP\i386\msxpsinc.ppd
    11/15/2011 8:00:55 AM OK C:\WINDOWS\system32\spool\XPSEP\i386\msxpsdrv.inf~4245L4AA
    11/15/2011 8:00:55 AM OK C:\WINDOWS\system32\spool\XPSEP\i386\msxpsinc.gpd
    11/15/2011 8:00:55 AM OK C:\WINDOWS\system32\spool\XPSEP\i386\msxpsdrv.inf
    11/15/2011 8:00:55 AM Cleared of viruses: Virus.Win32.Expiro.w C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
    11/15/2011 8:00:55 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
    11/15/2011 8:00:55 AM OK C:\WINDOWS\system32\spool\XPSEP\i386\msxpsdrv.cat~6LBOUPN4
    11/15/2011 8:00:55 AM OK C:\WINDOWS\system32\spool\XPSEP\i386\msxpsdrv.cat
    11/15/2011 8:00:55 AM OK C:\WINDOWS\system32\spool\XPSEP\amd64\amd64\xpssvcs.dll Object was not changed (iChecker)
    11/15/2011 8:00:55 AM OK C:\WINDOWS\system32\spool\XPSEP\amd64\amd64\mxdwdrv.dll~3D3CD1F9
    11/15/2011 8:00:55 AM OK C:\WINDOWS\system32\spool\XPSEP\amd64\amd64\mxdwdrv.dll Object was not changed (iChecker)
    11/15/2011 8:00:55 AM OK C:\WINDOWS\system32\spool\XPSEP\amd64\xpssvcs.dll Object was not changed (iChecker)
    11/15/2011 8:00:54 AM Backed up C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
    11/15/2011 8:00:54 AM OK C:\WINDOWS\system32\spool\XPSEP\amd64\mxdwdrv.dll~5K2B3G6F
    11/15/2011 8:00:54 AM OK C:\WINDOWS\system32\spool\XPSEP\amd64\mxdwdrv.dll Object was not changed (iChecker)
    11/15/2011 8:00:54 AM OK C:\WINDOWS\system32\spool\XPSEP\amd64\msxpsinc.ppd~Q5MQS00K
    11/15/2011 8:00:54 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
    11/15/2011 8:00:54 AM OK C:\WINDOWS\system32\spool\XPSEP\amd64\msxpsinc.ppd
    11/15/2011 8:00:54 AM OK C:\WINDOWS\system32\spool\XPSEP\amd64\msxpsinc.gpd
    11/15/2011 8:00:54 AM OK C:\WINDOWS\system32\spool\XPSEP\amd64\msxpsdrv.inf~5DAET563
    11/15/2011 8:00:54 AM OK C:\WINDOWS\system32\spool\XPSEP\amd64\msxpsdrv.cat~U8MCOSGK
    11/15/2011 8:00:54 AM OK C:\WINDOWS\system32\spool\XPSEP\amd64\msxpsdrv.inf
    11/15/2011 8:00:54 AM OK C:\WINDOWS\system32\spool\XPSEP\amd64\msxpsdrv.cat
    11/15/2011 8:00:54 AM OK C:\WINDOWS\system32\spool\XPSEP\msxpsinc.ppd~96PUMGK3
    11/15/2011 8:00:54 AM OK C:\WINDOWS\system32\spool\XPSEP\msxpsinc.ppd
    11/15/2011 8:00:54 AM OK C:\WINDOWS\system32\spool\XPSEP\msxpsinc.gpd
    11/15/2011 8:00:54 AM OK C:\WINDOWS\system32\spool\XPSEP\msxpsdrv.inf~O1N3PPET
    11/15/2011 8:00:54 AM OK C:\WINDOWS\system32\spool\XPSEP\msxpsdrv.inf
    11/15/2011 8:00:54 AM OK C:\WINDOWS\system32\spool\XPSEP\msxpsdrv.cat
    11/15/2011 8:00:54 AM OK C:\WINDOWS\system32\spool\XPSEP\msxpsdrv.cat~QJKOC6TH
    11/15/2011 8:00:54 AM OK C:\WINDOWS\system32\spool\prtprocs\x64\filterpipelineprintproc.dll~QVJV793L
    11/15/2011 8:00:53 AM OK C:\WINDOWS\system32\spool\prtprocs\x64\filterpipelineprintproc.dll Object was not changed (iChecker)
    11/15/2011 8:00:53 AM OK C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe~8QF6ED90
    11/15/2011 8:00:53 AM OK C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll~DV1TTALO
    11/15/2011 8:00:53 AM OK C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll~HLVBHD0H
    11/15/2011 8:00:53 AM OK C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll~4FMF9UP5
    11/15/2011 8:00:53 AM OK C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll Object was not changed (iChecker)
    11/15/2011 8:00:53 AM OK C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll~K68V7OHV
    11/15/2011 8:00:53 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\XpsSvcs.dll~SH2CQJ5F
    11/15/2011 8:00:53 AM OK C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll Object was not changed (iChecker)
    11/15/2011 8:00:53 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\XpsSvcs.dll Object was not changed (iChecker)
    11/15/2011 8:00:52 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll~MMGRO3I8
    11/15/2011 8:00:52 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll Object was not changed (iChecker)
    11/15/2011 8:00:52 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrvui.dll~8KQ5H0AL
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrvui.dll Object was not changed (iChecker)
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrv.dll~1L4OUC57
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrv.hlp
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrv.dll Object was not changed (iChecker)
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\stdschmx.gdl~4V1BKG5S
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\stdschmx.gdl
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\stdnames.gpd~HTVJANH4
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\stdschem.gdl~BIHH6PCI
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\stdschem.gdl
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\stddtype.gdl~OG28V94N
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\stdnames.gpd
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll~G4418381
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\stddtype.gdl
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.gpd~3OA6HQLP
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.gpd
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Object was not changed (iChecker)
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdrv.dll~SUBR5JTE
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdrv.dll Object was not changed (iChecker)
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\msonpui.dll~8MRU4L2S
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\msonpdrv.dll~MM4I038R
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\msonpui.dll Object was not changed (iChecker)
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\msonpdrv.dll Object was not changed (iChecker)
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\FXSWZRD.DLL~J2BLT5SP
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\FXSUI.DLL~KVL9MRK9
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\FXSWZRD.DLL Object was not changed (iChecker)
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\FXSUI.DLL Object was not changed (iChecker)
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\FXSTIFF.DLL~8SLS2572
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\FXSTIFF.DLL Object was not changed (iChecker)
    11/15/2011 8:00:51 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\FXSRES.DLL~78E5BF53
    11/15/2011 8:00:50 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\FXSDRV.DLL~JK28V7TD
    11/15/2011 8:00:50 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\FXSRES.DLL Object was not changed (iChecker)
    11/15/2011 8:00:50 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\FXSAPI.DLL~BIJH9SAJ
    11/15/2011 8:00:50 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\FXSDRV.DLL Object was not changed (iChecker)
    11/15/2011 8:00:50 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\tinypdf2.dll
    11/15/2011 8:00:50 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\3\FXSAPI.DLL Object was not changed (iChecker)
    11/15/2011 8:00:50 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\tinypdf2.dll/PE_Patch
    11/15/2011 8:00:50 AM Packed: PE_Patch C:\WINDOWS\system32\spool\drivers\w32x86\tinypdf2.dll
    11/15/2011 8:00:50 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\tinypdf1.dll
    11/15/2011 8:00:50 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\msonpdrv.dll~UG0KSJV1
    11/15/2011 8:00:50 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\msonpui.dll~D2EO6QOT
    11/15/2011 8:00:50 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\tinypdf.chm Object was not changed (iChecker)
    11/15/2011 8:00:50 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\msonpui.dll Object was not changed (iChecker)
    11/15/2011 8:00:50 AM OK C:\WINDOWS\system32\spool\drivers\w32x86\msonpdrv.dll Object was not changed (iChecker)
    11/15/2011 8:00:50 AM OK C:\WINDOWS\system32\spool\drivers\color\sRGB Color Space Profile.icm~UBOD6P2T
    11/15/2011 8:00:50 AM OK C:\WINDOWS\system32\spool\drivers\color\sRGB Color Space Profile.icm
    11/15/2011 8:00:50 AM OK C:\WINDOWS\system32\spool\drivers\color\kodak_dc.icm~CJQB1R3R
    11/15/2011 8:00:49 AM OK C:\WINDOWS\system32\spool\drivers\color\kodak_dc.icm
    11/15/2011 8:00:49 AM OK C:\WINDOWS\system32\spool\drivers\color\NKMonitor_Win.icm~G4JANI2S
    11/15/2011 8:00:49 AM OK C:\WINDOWS\system32\spool\drivers\color\NKMonitor_Win.icm
    11/15/2011 8:00:49 AM OK C:\WINDOWS\system32\spool\drivers\color\is330.icm~RM64L5LN
    11/15/2011 8:00:49 AM OK C:\WINDOWS\system32\spool\drivers\color\is330.icm
    11/15/2011 8:00:49 AM OK C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.4.7600.226\wups2.dll Object was not changed (iChecker)
    11/15/2011 8:00:48 AM OK C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.4.7600.226\wups.dll Object was not changed (iChecker)
    11/15/2011 8:00:48 AM OK C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.2.6001.788\wups.dll
    11/15/2011 8:00:48 AM OK C:\WINDOWS\system32\Setup\zoneoc.dll~F3VHHDGP
    11/15/2011 8:00:47 AM OK C:\WINDOWS\system32\Setup\tsoc.dll~35V5OB8K
    11/15/2011 8:00:47 AM OK C:\WINDOWS\system32\Setup\tsoc.dll~35V5OB8K/#
    11/15/2011 8:00:47 AM OK C:\WINDOWS\system32\Setup\tsoc.dll Object was not changed (iChecker)
    11/15/2011 8:00:47 AM OK C:\WINDOWS\system32\Setup\zoneoc.dll Object was not changed (iChecker)
    11/15/2011 8:00:47 AM OK C:\WINDOWS\system32\Setup\tabletoc.dll Object was not changed (iChecker)
    11/15/2011 8:00:45 AM Will be disinfected on system restart: Virus.Win32.Expiro.w C:\WINDOWS\system32\Restore\srdiag.exe
    11/15/2011 8:00:45 AM OK C:\WINDOWS\system32\Setup\tabletoc.dll~0BHSUVT9
    11/15/2011 8:00:45 AM OK C:\WINDOWS\system32\Setup\tabletoc.dll~0BHSUVT9/#
    11/15/2011 8:00:45 AM OK C:\WINDOWS\system32\Setup\tabletoc.dll~0BHSUVT9/#
    11/15/2011 8:00:45 AM OK C:\WINDOWS\system32\Setup\setupqry.dll~R3UUCDU8
    11/15/2011 8:00:45 AM OK C:\WINDOWS\system32\Setup\ocmsn.dll~CIKJTN1O
    11/15/2011 8:00:45 AM OK C:\WINDOWS\system32\Setup\setupqry.dll Object was not changed (iChecker)
    11/15/2011 8:00:45 AM OK C:\WINDOWS\system32\Setup\msmqocm.dll~KNJHK3L6
    11/15/2011 8:00:45 AM OK C:\WINDOWS\system32\Setup\ocmsn.dll Object was not changed (iChecker)
    11/15/2011 8:00:45 AM OK C:\WINDOWS\system32\Setup\ocgen.dll~GACLCLD5
    11/15/2011 8:00:45 AM OK C:\WINDOWS\system32\Setup\ocgen.dll~GACLCLD5/#
    11/15/2011 8:00:45 AM OK C:\WINDOWS\system32\Setup\ocgen.dll Object was not changed (iChecker)
    11/15/2011 8:00:45 AM OK C:\WINDOWS\system32\Setup\ntoc.dll~LK5RPOEQ
    11/15/2011 8:00:45 AM OK C:\WINDOWS\system32\Setup\ntoc.dll Object was not changed (iChecker)
    11/15/2011 8:00:45 AM OK C:\WINDOWS\system32\Setup\netoc.dll~LG95E1BK
    11/15/2011 8:00:45 AM OK C:\WINDOWS\system32\Setup\netoc.dll Object was not changed (iChecker)
    11/15/2011 8:00:45 AM OK C:\WINDOWS\system32\Setup\netfxocm.dll~RD3HPVHU
    11/15/2011 8:00:45 AM OK C:\WINDOWS\system32\Setup\netfxocm.dll~RD3HPVHU/#
    11/15/2011 8:00:45 AM OK C:\WINDOWS\system32\Setup\netfxocm.dll~RD3HPVHU/#
    11/15/2011 8:00:45 AM Cleared of viruses: Virus.Win32.Expiro.w C:\WINDOWS\system32\Restore\srdiag.exe
    11/15/2011 8:00:45 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\Restore\srdiag.exe
    11/15/2011 8:00:45 AM OK C:\WINDOWS\system32\Setup\netfxocm.dll~RD3HPVHU/#
    11/15/2011 8:00:45 AM OK C:\WINDOWS\system32\Setup\netfxocm.dll~RD3HPVHU/#
    11/15/2011 8:00:45 AM OK C:\WINDOWS\system32\Setup\netfxocm.dll Object was not changed (iChecker)
    11/15/2011 8:00:45 AM Will be disinfected on system restart: Virus.Win32.Expiro.w C:\WINDOWS\system32\Restore\rstrui.exe
    11/15/2011 8:00:44 AM OK C:\WINDOWS\system32\Setup\msmqocm.dll Object was not changed (iChecker)
    11/15/2011 8:00:42 AM OK C:\WINDOWS\system32\Setup\msgrocm.dll~97S2D18G
    11/15/2011 8:00:42 AM OK C:\WINDOWS\system32\Setup\msgrocm.dll~97S2D18G/#
    11/15/2011 8:00:42 AM OK C:\WINDOWS\system32\Setup\msgrocm.dll Object was not changed (iChecker)
    11/15/2011 8:00:42 AM OK C:\WINDOWS\system32\Setup\msdtcstp.dll~7EFODATI
    11/15/2011 8:00:42 AM OK C:\WINDOWS\system32\Setup\msdtcstp.dll Object was not changed (iChecker)
    11/15/2011 8:00:42 AM OK C:\WINDOWS\system32\Setup\medctroc.dll~4PHI5R8G
    11/15/2011 8:00:42 AM OK C:\WINDOWS\system32\Setup\medctroc.dll~4PHI5R8G/#
    11/15/2011 8:00:42 AM OK C:\WINDOWS\system32\Setup\medctroc.dll Object was not changed (iChecker)
    11/15/2011 8:00:42 AM OK C:\WINDOWS\system32\Setup\koc.dll~5CRRQ5TA
    11/15/2011 8:00:42 AM Cleared of viruses: Virus.Win32.Expiro.w C:\WINDOWS\system32\Restore\rstrui.exe
    11/15/2011 8:00:42 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\Restore\rstrui.exe
    11/15/2011 8:00:42 AM OK C:\WINDOWS\system32\Setup\koc.dll
    11/15/2011 8:00:42 AM OK C:\WINDOWS\system32\Setup\imsinsnt.dll~GPDT334R
    11/15/2011 8:00:42 AM OK C:\WINDOWS\system32\Setup\imsinsnt.dll Object was not changed (iChecker)
    11/15/2011 8:00:42 AM OK C:\WINDOWS\system32\Setup\iis.dll~P1PKA6H1
    11/15/2011 8:00:42 AM OK C:\WINDOWS\system32\Setup\iis.dll Object was not changed (iChecker)
    11/15/2011 8:00:42 AM OK C:\WINDOWS\system32\Setup\fxsocm.dll~07K9T4PG
    11/15/2011 8:00:42 AM OK C:\WINDOWS\system32\Setup\fxsocm.dll Object was not changed (iChecker)
    11/15/2011 8:00:42 AM OK C:\WINDOWS\system32\Setup\fsconins.dll~6060S59C
    11/15/2011 8:00:42 AM OK C:\WINDOWS\system32\Setup\fsconins.dll Object was not changed (iChecker)
    11/15/2011 8:00:42 AM Backed up C:\WINDOWS\system32\Restore\srdiag.exe
    11/15/2011 8:00:42 AM OK C:\WINDOWS\system32\Setup\fp40ext.dll~BRPN0PIK
    11/15/2011 8:00:41 AM OK C:\WINDOWS\system32\Setup\fp40ext.dll Object was not changed (iChecker)
    11/15/2011 8:00:41 AM OK C:\WINDOWS\system32\Setup\comsetup.dll~OU2AB8ER
    11/15/2011 8:00:41 AM OK C:\WINDOWS\system32\Setup\comsetup.dll Object was not changed (iChecker)
    11/15/2011 8:00:41 AM OK C:\WINDOWS\system32\scripting\wshom.ocx.mui~RIMF0CT3
    11/15/2011 8:00:41 AM Backed up C:\WINDOWS\system32\Restore\rstrui.exe
    11/15/2011 8:00:41 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\Restore\srdiag.exe
    11/15/2011 8:00:41 AM OK C:\WINDOWS\system32\scripting\wshom.ocx.mui
    11/15/2011 8:00:41 AM OK C:\WINDOWS\system32\scripting\wshext.dll.mui~K181S4AT
    11/15/2011 8:00:41 AM OK C:\WINDOWS\system32\scripting\wshext.dll.mui
    11/15/2011 8:00:41 AM OK C:\WINDOWS\system32\scripting\wscript.exe.mui~FQDCQB92
    11/15/2011 8:00:41 AM OK C:\WINDOWS\system32\scripting\wscript.exe.mui
    11/15/2011 8:00:41 AM OK C:\WINDOWS\system32\scripting\vbscript.dll.mui~3E4J01FS
    11/15/2011 8:00:41 AM OK C:\WINDOWS\system32\scripting\vbscript.dll.mui
    11/15/2011 8:00:41 AM OK C:\WINDOWS\system32\scripting\scrrun.dll.mui~AP3C73PM
    11/15/2011 8:00:41 AM OK C:\WINDOWS\system32\scripting\scrrun.dll.mui
    11/15/2011 8:00:41 AM OK C:\WINDOWS\system32\scripting\scrobj.dll.mui~REEUSB77
    11/15/2011 8:00:41 AM OK C:\WINDOWS\system32\scripting\scrobj.dll.mui
    11/15/2011 8:00:41 AM OK C:\WINDOWS\system32\scripting\msscript.ocx.mui~VFS9PQ0P
    11/15/2011 8:00:41 AM OK C:\WINDOWS\system32\scripting\msscript.ocx.mui
    11/15/2011 8:00:41 AM OK C:\WINDOWS\system32\scripting\jscript.dll.mui~8A0N8QQ8
    11/15/2011 8:00:41 AM OK C:\WINDOWS\system32\scripting\jscript.dll.mui
    11/15/2011 8:00:41 AM OK C:\WINDOWS\system32\scripting\cscript.exe.mui~NIGK6CS2
    11/15/2011 8:00:41 AM OK C:\WINDOWS\system32\scripting\cscript.exe.mui
    11/15/2011 8:00:41 AM Detected: Virus.Win32.Expiro.w C:\WINDOWS\system32\Restore\rstrui.exe
    11/15/2011 8:00:41 AM OK C:\WINDOWS\system32\Restore\srframe.mmf~OMB6LEGK
    11/15/2011 8:00:40 AM OK C:\WINDOWS\system32\Restore\srframe.mmf
    11/15/2011 8:00:40 AM OK C:\WINDOWS\system32\Restore\srdiag.exe~107SSE51
    11/15/2011 8:00:40 AM OK C:\WINDOWS\system32\Restore\rstrui.exe~QQACL4R4
    11/15/2011 8:00:39 AM OK C:\WINDOWS\system32\Restore\rstrlog.dat
    11/15/2011 8:00:39 AM OK C:\WINDOWS\system32\ReinstallBackups\0020\DriverFiles\NETw4x32.sys
    11/15/2011 8:00:39 AM OK C:\WINDOWS\system32\Restore\filelist.xml~1MOGKF2C
    11/15/2011 8:00:39 AM OK C:\WINDOWS\system32\Restore\MachineGuid.txt
    11/15/2011 8:00:39 AM OK C:\WINDOWS\system32\Restore\filelist.xml
    11/15/2011 8:00:39 AM OK C:\WINDOWS\system32\ReinstallBackups\0020\DriverFiles\netw4x32.PNF
    11/15/2011 8:00:39 AM OK C:\WINDOWS\system32\ReinstallBackups\0020\DriverFiles\netw4x32.inf
    11/15/2011 8:00:39 AM OK C:\WINDOWS\system32\ReinstallBackups\0020\DriverFiles\NETw4x32.cat
    11/15/2011 8:00:39 AM OK C:\WINDOWS\system32\ReinstallBackups\0020\DriverFiles\NETw4r32.dll Object was not changed (iChecker)
    11/15/2011 8:00:39 AM OK C:\WINDOWS\system32\ReinstallBackups\0020\DriverFiles\NETw4c32.dll Object was not changed (iChecker)
    11/15/2011 8:00:38 AM OK C:\WINDOWS\system32\ReinstallBackups\0019\DriverFiles\btwusb.sys Object was not changed (iChecker)
    11/15/2011 8:00:38 AM OK C:\WINDOWS\system32\ReinstallBackups\0019\DriverFiles\btwusb.inf
    11/15/2011 8:00:38 AM OK C:\WINDOWS\system32\ReinstallBackups\0019\DriverFiles\btwusb.PNF
    11/15/2011 8:00:38 AM OK C:\WINDOWS\system32\ReinstallBackups\0019\DriverFiles\btwusb.cat
    11/15/2011 8:00:38 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\vidcap.ax~QU0SB47G
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\vfwwdm32.dll~4V3PI9TQ
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\vidcap.ax
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\usbvideo.sys~GLPUC8H6
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\usbvideo.sys~GLPUC8H6/PE_Patch
    11/15/2011 8:00:37 AM Packed: PE_Patch C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\usbvideo.sys~GLPUC8H6
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\vfwwdm32.dll Object was not changed (iChecker)
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\tsbyuv.dll~K8LE5UKM
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\usbvideo.sys Object was not changed (iChecker)
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\msyuv.dll~6S73H3C4
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\tsbyuv.dll Object was not changed (iChecker)
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\msyuv.dll Object was not changed (iChecker)
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\msh263.drv
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\msh263.drv~HKVC8DCI
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\ksxbar.ax~2T327CDC
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\kswdmcap.ax~CRO21RJT
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\kswdmcap.ax
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\ksxbar.ax
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\ksuser.dll~I0RHVL8O
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\kstvtune.ax
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\kstvtune.ax~DNCRV5F5
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\ksuser.dll Object was not changed (iChecker)
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\ks.sys~LFE1EN4K
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\ksproxy.ax~ELUVUHNH
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\ksproxy.ax
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\ks.sys Object was not changed (iChecker)
    11/15/2011 8:00:37 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\iyuv_32.dll~F8P94B4F
    11/15/2011 8:00:36 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\dshowext.ax~PD5ASD0J
    11/15/2011 8:00:36 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\iyuv_32.dll Object was not changed (iChecker)
    11/15/2011 8:00:36 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\dshowext.ax
    11/15/2011 8:00:36 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\usbvideo.PNF
    11/15/2011 8:00:36 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\usbvideo.inf~3518GJ6I
    11/15/2011 8:00:36 AM OK C:\WINDOWS\system32\ReinstallBackups\0017\DriverFiles\i386\pci.sys~19THBFJK
    11/15/2011 8:00:36 AM OK C:\WINDOWS\system32\ReinstallBackups\0017\DriverFiles\i386\pci.sys~19THBFJK/PE_Patch
    11/15/2011 8:00:36 AM Packed: PE_Patch C:\WINDOWS\system32\ReinstallBackups\0017\DriverFiles\i386\pci.sys~19THBFJK
    11/15/2011 8:00:36 AM OK C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\usbvideo.inf
    11/15/2011 8:00:35 AM OK C:\WINDOWS\system32\ReinstallBackups\0017\DriverFiles\machine.inf
    11/15/2011 8:00:35 AM OK C:\WINDOWS\system32\ReinstallBackups\0017\DriverFiles\i386\pci.sys Object was not changed (iChecker)
    11/15/2011 8:00:35 AM OK C:\WINDOWS\system32\ReinstallBackups\0017\DriverFiles\machine.inf~VF998JKF
    11/15/2011 8:00:35 AM OK C:\WINDOWS\system32\ReinstallBackups\0017\DriverFiles\machine.PNF
    11/15/2011 8:00:35 AM OK C:\WINDOWS\system32\ReinstallBackups\0016\DriverFiles\machine.PNF
    11/15/2011 8:00:35 AM OK C:\WINDOWS\system32\ReinstallBackups\0016\DriverFiles\machine.inf~96EETJNB
    11/15/2011 8:00:34 AM OK C:\WINDOWS\system32\ReinstallBackups\0016\DriverFiles\machine.inf
    11/15/2011 8:00:34 AM OK C:\WINDOWS\system32\ReinstallBackups\0015\DriverFiles\i386\pciidex.sys~I4QRQ3MF
    11/15/2011 8:00:34 AM OK C:\WINDOWS\system32\ReinstallBackups\0015\DriverFiles\i386\pciidex.sys~I4QRQ3MF/PE_Patch
    11/15/2011 8:00:34 AM Packed: PE_Patch C:\WINDOWS\system32\ReinstallBackups\0015\DriverFiles\i386\pciidex.sys~I4QRQ3MF
    11/15/2011 8:00:32 AM OK C:\WINDOWS\system32\ReinstallBackups\0015\DriverFiles\i386\atapi.sys~9ITG0JK2
    11/15/2011 8:00:32 AM OK C:\WINDOWS\system32\ReinstallBackups\0015\DriverFiles\i386\pciide.sys~ATG6T23L
    11/15/2011 8:00:32 AM OK C:\WINDOWS\system32\ReinstallBackups\0015\DriverFiles\i386\pciidex.sys Object was not changed (iChecker)
    11/15/2011 8:00:32 AM OK C:\WINDOWS\system32\ReinstallBackups\0015\DriverFiles\i386\atapi.sys~9ITG0JK2/PE_Patch
    11/15/2011 8:00:32 AM Packed: PE_Patch C:\WINDOWS\system32\ReinstallBackups\0015\DriverFiles\i386\atapi.sys~9ITG0JK2
    11/15/2011 8:00:32 AM OK C:\WINDOWS\system32\ReinstallBackups\0015\DriverFiles\i386\atapi.sys Object was not changed (iChecker)
    11/15/2011 8:00:32 AM OK C:\WINDOWS\system32\ReinstallBackups\0015\DriverFiles\i386\pciide.sys Object was not changed (iChecker)
    11/15/2011 8:00:32 AM OK C:\WINDOWS\system32\ReinstallBackups\0015\DriverFiles\mshdc.PNF
    11/15/2011 8:00:32 AM OK C:\WINDOWS\system32\ReinstallBackups\0015\DriverFiles\mshdc.inf~618PJQI6
    11/15/2011 8:00:32 AM OK C:\WINDOWS\system32\ReinstallBackups\0014\DriverFiles\i386\pci.sys~ALVFSR1G
    11/15/2011 8:00:32 AM OK C:\WINDOWS\system32\ReinstallBackups\0015\DriverFiles\mshdc.inf
    11/15/2011 8:00:32 AM OK C:\WINDOWS\system32\ReinstallBackups\0014\DriverFiles\i386\pci.sys~ALVFSR1G/PE_Patch
    11/15/2011 8:00:32 AM Packed: PE_Patch C:\WINDOWS\system32\ReinstallBackups\0014\DriverFiles\i386\pci.sys~ALVFSR1G
    11/15/2011 8:00:32 AM OK C:\WINDOWS\system32\ReinstallBackups\0014\DriverFiles\i386\pci.sys Object was not changed (iChecker)
    11/15/2011 8:00:31 AM OK C:\WINDOWS\system32\ReinstallBackups\0014\DriverFiles\machine.inf~7C0GLSNJ
    11/15/2011 8:00:31 AM OK C:\WINDOWS\system32\ReinstallBackups\0014\DriverFiles\machine.inf
    11/15/2011 8:00:31 AM OK C:\WINDOWS\system32\ReinstallBackups\0014\DriverFiles\machine.PNF
    11/15/2011 8:00:30 AM OK C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\i386\pci.sys~IHQ1BLVE
    11/15/2011 8:00:30 AM OK C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\i386\pci.sys~IHQ1BLVE/PE_Patch
    11/15/2011 8:00:30 AM Packed: PE_Patch C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\i386\pci.sys~IHQ1BLVE
    11/15/2011 8:00:30 AM OK C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\i386\pci.sys Object was not changed (iChecker)
    11/15/2011 8:00:30 AM OK C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\machine.PNF
    11/15/2011 8:00:29 AM OK C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\machine.inf~7J2HL9SQ
    11/15/2011 8:00:29 AM OK C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\machine.inf
    11/15/2011 8:00:29 AM OK C:\WINDOWS\system32\ReinstallBackups\0012\DriverFiles\i386\pci.sys~HBMJ3F4M
    11/15/2011 8:00:29 AM OK C:\WINDOWS\system32\ReinstallBackups\0012\DriverFiles\i386\pci.sys~HBMJ3F4M/PE_Patch
    11/15/2011 8:00:29 AM Packed: PE_Patch C:\WINDOWS\system32\ReinstallBackups\0012\DriverFiles\i386\pci.sys~HBMJ3F4M
    11/15/2011 8:00:29 AM OK C:\WINDOWS\system32\ReinstallBackups\0012\DriverFiles\i386\pci.sys Object was not changed (iChecker)
    11/15/2011 8:00:28 AM OK C:\WINDOWS\system32\ReinstallBackups\0012\DriverFiles\machine.inf~KSL222QQ
    11/15/2011 8:00:28 AM OK C:\WINDOWS\system32\ReinstallBackups\0012\DriverFiles\machine.PNF
    11/15/2011 8:00:28 AM OK C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\i386\pci.sys~I0HSHRH4
    11/15/2011 8:00:28 AM OK C:\WINDOWS\system32\ReinstallBackups\0012\DriverFiles\machine.inf
    11/15/2011 8:00:28 AM OK C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\i386\pci.sys~I0HSHRH4/PE_Patch
    11/15/2011 8:00:28 AM Packed: PE_Patch C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\i386\pci.sys~I0HSHRH4
    11/15/2011 8:00:28 AM OK C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\i386\pci.sys Object was not changed (iChecker)
    11/15/2011 8:00:27 AM OK C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\machine.PNF
    11/15/2011 8:00:27 AM OK C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\machine.inf~FEHHPVKT
    11/15/2011 8:00:27 AM OK C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\machine.inf
    11/15/2011 8:00:27 AM OK C:\WINDOWS\system32\ReinstallBackups\0010\DriverFiles\i386\usbui.dll Object was not changed (iChecker)
    11/15/2011 8:00:27 AM OK C:\WINDOWS\system32\ReinstallBackups\0010\DriverFiles\i386\usbui.dll~D33M7H29
    11/15/2011 8:00:26 AM OK C:\WINDOWS\system32\ReinstallBackups\0010\DriverFiles\i386\usbport.sys Object was not changed (iChecker)
    11/15/2011 8:00:26 AM OK C:\WINDOWS\system32\ReinstallBackups\0010\DriverFiles\i386\usbhub.sys~MU4MEE9I
    11/15/2011 8:00:26 AM OK C:\WINDOWS\system32\ReinstallBackups\0010\DriverFiles\i386\usbhub.sys~MU4MEE9I/PE_Patch
    11/15/2011 8:00:26 AM OK C:\WINDOWS\system32\ReinstallBackups\0010\DriverFiles\i386\usbhub.sys Object was not changed (iChecker)
    11/15/2011 8:00:26 AM Packed: PE_Patch C:\WINDOWS\system32\ReinstallBackups\0010\DriverFiles\i386\usbhub.sys~MU4MEE9I
    11/15/2011 8:00:26 AM OK C:\WINDOWS\system32\ReinstallBackups\0010\DriverFiles\i386\usbehci.sys Object was not changed (iChecker)
    11/15/2011 8:00:26 AM OK C:\WINDOWS\system32\ReinstallBackups\0010\DriverFiles\i386\hccoin.dll~G7QHCC10
    11/15/2011 8:00:26 AM OK C:\WINDOWS\system32\ReinstallBackups\0010\DriverFiles\usbport.inf~ANPKPE3L
    11/15/2011 8:00:26 AM OK C:\WINDOWS\system32\ReinstallBackups\0010\DriverFiles\i386\hccoin.dll Object was not changed (iChecker)
    11/15/2011 8:00:26 AM OK C:\WINDOWS\system32\ReinstallBackups\0010\DriverFiles\usbport.PNF
    11/15/2011 8:00:25 AM OK C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\usbui.dll~VFTJ3G7H
    11/15/2011 8:00:25 AM OK C:\WINDOWS\system32\ReinstallBackups\0010\DriverFiles\usbport.inf
    11/15/2011 8:00:25 AM OK C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\usbui.dll Object was not changed (iChecker)
    11/15/2011 8:00:24 AM OK C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\usbport.sys Object was not changed (iChecker)
    11/15/2011 8:00:24 AM OK C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\usbhub.sys~JMA976RG
    11/15/2011 8:00:24 AM OK C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\usbhub.sys~JMA976RG/PE_Patch
    11/15/2011 8:00:24 AM Packed: PE_Patch C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\usbhub.sys~JMA976RG
    11/15/2011 8:00:24 AM OK C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\usbhub.sys Object was not changed (iChecker)
    11/15/2011 8:00:24 AM OK C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\usbehci.sys Object was not changed (iChecker)
    11/15/2011 8:00:24 AM OK C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\hccoin.dll~T6QOSMLP
    11/15/2011 8:00:24 AM OK C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\hccoin.dll Object was not changed (iChecker)
    11/15/2011 8:00:24 AM OK C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\usbport.PNF
    11/15/2011 8:00:24 AM OK C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\usbport.inf~OF2UIGG7
    11/15/2011 8:00:24 AM OK C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\i386\usbui.dll~AG0HF223
    11/15/2011 8:00:24 AM OK C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\usbport.inf
    11/15/2011 8:00:23 AM OK C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\i386\usbuhci.sys~I06H9PNT
    11/15/2011 8:00:23 AM OK C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\i386\usbui.dll Object was not changed (iChecker)
    11/15/2011 8:00:23 AM OK C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\i386\usbuhci.sys~I06H9PNT/PE_Patch
    11/15/2011 8:00:23 AM Packed: PE_Patch C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\i386\usbuhci.sys~I06H9PNT
    11/15/2011 8:00:23 AM OK C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\i386\usbport.sys Object was not changed (iChecker)
    11/15/2011 8:00:23 AM OK C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\i386\usbuhci.sys Object was not changed (iChecker)
    11/15/2011 8:00:23 AM OK C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\i386\usbhub.sys~B3EGHP29
    11/15/2011 8:00:23 AM OK C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\i386\usbhub.sys~B3EGHP29/PE_Patch
    11/15/2011 8:00:23 AM Packed: PE_Patch C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\i386\usbhub.sys~B3EGHP29
    11/15/2011 8:00:23 AM OK C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\i386\usbhub.sys Object was not changed (iChecker)
    11/15/2011 8:00:23 AM OK C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\usbport.PNF
    11/15/2011 8:00:23 AM OK C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\usbport.inf~89KEF3ED
    11/15/2011 8:00:23 AM OK C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\usbport.inf
    11/15/2011 8:00:23 AM OK C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\usbui.dll~0VQKFD6T
    11/15/2011 8:00:23 AM OK C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\usbui.dll Object was not changed (iChecker)
    11/15/2011 8:00:22 AM OK C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\usbuhci.sys~Q0GN0U1B
    11/15/2011 8:00:22 AM OK C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\usbuhci.sys~Q0GN0U1B/PE_Patch
    11/15/2011 8:00:22 AM Packed: PE_Patch C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\usbuhci.sys~Q0GN0U1B
    11/15/2011 8:00:22 AM OK C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\usbhub.sys~MDOI9KDR
    11/15/2011 8:00:22 AM OK C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\usbhub.sys~MDOI9KDR/PE_Patch
    11/15/2011 8:00:22 AM OK C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\usbuhci.sys Object was not changed (iChecker)
    11/15/2011 8:00:22 AM OK C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\usbport.sys Object was not changed (iChecker)
    11/15/2011 8:00:22 AM Packed: PE_Patch C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\usbhub.sys~MDOI9KDR
    11/15/2011 8:00:22 AM OK C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\usbport.PNF
    11/15/2011 8:00:22 AM OK C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\usbhub.sys Object was not changed (iChecker)
    11/15/2011 8:00:22 AM OK C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\usbport.inf~PD9P81UA
    11/15/2011 8:00:22 AM OK C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\usbui.dll~G551OLEI
    11/15/2011 8:00:22 AM OK C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\usbport.inf
    11/15/2011 8:00:21 AM OK C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\usbui.dll Object was not changed (iChecker)
    11/15/2011 8:00:21 AM OK C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\usbuhci.sys~KDVRRFNE
    11/15/2011 8:00:21 AM OK C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\usbuhci.sys~KDVRRFNE/PE_Patch
    11/15/2011 8:00:21 AM Packed: PE_Patch C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\usbuhci.sys~KDVRRFNE
    11/15/2011 8:00:21 AM OK C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\usbhub.sys~1ATKT34H
    11/15/2011 8:00:21 AM OK C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\usbport.sys Object was not changed (iChecker)
    11/15/2011 8:00:21 AM OK C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\usbhub.sys~1ATKT34H/PE_Patch
    11/15/2011 8:00:21 AM OK C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\usbuhci.sys Object was not changed (iChecker)
    11/15/2011 8:00:21 AM Packed: PE_Patch C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\usbhub.sys~1ATKT34H
    11/15/2011 8:00:21 AM OK C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\usbhub.sys Object was not changed (iChecker)
    11/15/2011 8:00:21 AM OK C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\usbport.inf~QSKVRBNJ
    11/15/2011 8:00:21 AM OK C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\usbport.PNF
    11/15/2011 8:00:20 AM OK C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\usbui.dll~B5E4BRMG
    11/15/2011 8:00:20 AM OK C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\usbport.inf
    11/15/2011 8:00:20 AM OK C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\usbui.dll Object was not changed (iChecker)
    11/15/2011 8:00:19 AM OK C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\usbuhci.sys~IUFT2N45
    11/15/2011 8:00:19 AM OK C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\usbuhci.sys~IUFT2N45/PE_Patch
    11/15/2011 8:00:19 AM Packed: PE_Patch C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\usbuhci.sys~IUFT2N45
    11/15/2011 8:00:19 AM OK C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\usbhub.sys~954QFBA3
    11/15/2011 8:00:19 AM OK C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\usbhub.sys~954QFBA3/PE_Patch
    11/15/2011 8:00:19 AM OK C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\usbuhci.sys Object was not changed (iChecker)
    11/15/2011 8:00:19 AM OK C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\usbport.sys Object was not changed (iChecker)
    11/15/2011 8:00:19 AM Packed: PE_Patch C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\usbhub.sys~954QFBA3
    11/15/2011 8:00:19 AM OK C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\usbhub.sys Object was not changed (iChecker)
    11/15/2011 8:00:19 AM OK C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\usbport.inf~21S4VMOS
    11/15/2011 8:00:19 AM OK C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\usbport.PNF
    11/15/2011 8:00:19 AM OK C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\usbport.inf
    11/15/2011 8:00:19 AM OK C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\usbui.dll~NQF9PFGG
    11/15/2011 8:00:19 AM OK C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\usbui.dll Object was not changed (iChecker)
    11/15/2011 8:00:18 AM OK C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\usbuhci.sys~4GI5JC9N
    11/15/2011 8:00:18 AM OK C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\usbuhci.sys~4GI5JC9N/PE_Patch
    11/15/2011 8:00:18 AM Packed: PE_Patch C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\usbuhci.sys~4GI5JC9N
    11/15/2011 8:00:18 AM OK C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\usbhub.sys~MDPN0C5N
    11/15/2011 8:00:18 AM OK C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\usbuhci.sys Object was not changed (iChecker)
    11/15/2011 8:00:18 AM OK C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\usbport.sys Object was not changed (iChecker)
    11/15/2011 8:00:18 AM OK C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\usbhub.sys~MDPN0C5N/PE_Patch
    11/15/2011 8:00:18 AM Packed: PE_Patch C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\usbhub.sys~MDPN0C5N
    11/15/2011 8:00:18 AM OK C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\usbhub.sys Object was not changed (iChecker)
    11/15/2011 8:00:18 AM OK C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\usbport.PNF
    11/15/2011 8:00:18 AM OK C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\usbport.inf~AG77H7E6
    11/15/2011 8:00:17 AM OK C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\usbport.inf
    11/15/2011 8:00:17 AM OK C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\pciidex.sys~J4B0S3N8
    11/15/2011 8:00:17 AM OK C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\pciidex.sys~J4B0S3N8/PE_Patch
    11/15/2011 8:00:17 AM Packed: PE_Patch C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\pciidex.sys~J4B0S3N8
    11/15/2011 8:00:17 AM OK C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\pciide.sys~5LIO4A4S
    11/15/2011 8:00:17 AM OK C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\pciidex.sys Object was not changed (iChecker)
    11/15/2011 8:00:17 AM OK C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\atapi.sys~B752V8FC
    11/15/2011 8:00:17 AM OK C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\atapi.sys~B752V8FC/PE_Patch
    11/15/2011 8:00:17 AM OK C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\atapi.sys Object was not changed (iChecker)
    11/15/2011 8:00:17 AM OK C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\pciide.sys Object was not changed (iChecker)
    11/15/2011 8:00:17 AM Packed: PE_Patch C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\atapi.sys~B752V8FC
    11/15/2011 8:00:17 AM OK C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\mshdc.PNF
    11/15/2011 8:00:16 AM OK C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\mshdc.inf~G1M02QSB
    11/15/2011 8:00:16 AM OK C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\mshdc.inf
    11/15/2011 8:00:16 AM OK C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\isapnp.sys~J70NGUSO
    11/15/2011 8:00:16 AM OK C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\isapnp.sys~J70NGUSO/PE_Patch
    11/15/2011 8:00:16 AM Packed: PE_Patch C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\isapnp.sys~J70NGUSO
    11/15/2011 8:00:15 AM OK C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\isapnp.sys Object was not changed (iChecker)
    11/15/2011 8:00:15 AM OK C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\machine.PNF
    11/15/2011 8:00:15 AM OK C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\machine.inf~NNGRRNI8
    11/15/2011 8:00:15 AM OK C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\machine.inf
    11/15/2011 8:00:14 AM OK C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386\pci.sys~9I0AERM5
    11/15/2011 8:00:14 AM OK C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386\pci.sys~9I0AERM5/PE_Patch
    11/15/2011 8:00:14 AM Packed: PE_Patch C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386\pci.sys~9I0AERM5
    11/15/2011 8:00:14 AM OK C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386\pci.sys Object was not changed (iChecker)
    luddite, Nov 17, 2011
    #20
Page 1 of 6

Add New Comment

Social Login & Guest Posting

TechSpot Members
Login here or sign up for free,
it takes about a minute.
Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.