TechSpot

Follow-up from past Sirefef infection-

By Snazzy_C
Jun 25, 2012
  1. Some bad news. It seems that I have contracted the same issue, twice again now. You'd think that I'd have figured out what I did by now and not do it again, wouldn't you? Anyway. The first time broni helped me out and everything was fine for like a week or so, then it came back and I reformatted, and this time I feel like I should seek some advice and am not sure if you'd suggest reformatting again or not. I don't have the virus name, but it's acting the same way as it did before (Security essentials says that it's disabled and cannot enable again) What should I do next? everything is all backed up, so a reformat should be fairly quick and easy too... I just am sort of worried it's infected my recovery sector?
     
  2. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Is your computer bootable?
    What Windows version is it?
     
  3. Snazzy_C

    Snazzy_C TS Member Topic Starter Posts: 42

    Yes, perfectly bootable. As of right now the only symptom is SE being disabled/unable to be enabled. Windows 7, 64 bit
     
  4. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Before we run some scans...

    Did you try to reinstall MSE?
     
  5. Snazzy_C

    Snazzy_C TS Member Topic Starter Posts: 42

    I'm fairly certain that the second I re-install MSE the computer will no longer be bootable.
     
  6. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    I'm not sure....why would that be?
    Do you have a reason to suspect your computer is infected?
     
  7. Snazzy_C

    Snazzy_C TS Member Topic Starter Posts: 42

    none, other than this behavior is identical to the last two infections. MSE stopped working without any notification, and when I try to restart it, it has the same error message that it cannot find the files needed to start again. I'm hestant to re install because the last two times this has happened and I re-installed MSE it detected the sirefef virus and variants and shut down my computer with 60sec restart message on boot
     
  8. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    For x32 (x86) bit systems download Farbar Recovery Scan Tool 32-Bit and save it to a flash drive.
    For x64 bit systems download Farbar Recovery Scan Tool 64-Bit and save it to a flash drive.

    Plug the flashdrive into the infected PC.

    Enter System Recovery Options.

    To enter System Recovery Options from the Advanced Boot Options:
    • Restart the computer.
    • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
    • Use the arrow keys to select the Repair your computer menu item.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account an click Next.

    To enter System Recovery Options by using Windows installation disc:
    • Insert the installation disc.
    • Restart your computer.
    • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
    • Click Repair your computer.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account and click Next.

    On the System Recovery Options menu you will get the following options:

      • Startup Repair
        System Restore
        Windows Complete PC Restore
        Windows Memory Diagnostic Tool
        Command Prompt
    • Select Command Prompt
    • In the command window type in notepad and press Enter.
    • The notepad opens. Under File menu select Open.
    • Select "Computer" and find your flash drive letter and close the notepad.
    • In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
      Note: Replace letter e with the drive letter of your flash drive.
    • The tool will start to run.
    • When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.
     
  9. Snazzy_C

    Snazzy_C TS Member Topic Starter Posts: 42

    Scan result of Farbar Recovery Scan Tool Version: 25-06-2012
    Ran by SYSTEM at 25-06-2012 20:06:57
    Running from F:\
    Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
    The current controlset is ControlSet001

    ========================== Registry (Whitelisted) =============

    HKLM\...\Run: [] [x]
    HKLM\...\Run: [IgfxTray] C:\windows\system32\igfxtray.exe [167256 2011-04-07] (Intel Corporation)
    HKLM\...\Run: [HotKeysCmds] C:\windows\system32\hkcmd.exe [391000 2011-04-07] (Intel Corporation)
    HKLM\...\Run: [Persistence] C:\windows\system32\igfxpers.exe [418136 2011-04-07] (Intel Corporation)
    HKLM\...\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE [566696 2011-03-02] (TOSHIBA Corporation)
    HKLM\...\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe [296824 2010-09-25] (TOSHIBA Corporation)
    HKLM\...\Run: [TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe [973176 2010-12-15] (TOSHIBA Corporation)
    HKLM\...\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe /t [316032 2010-12-14] (Conexant systems, Inc.)
    HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2679592 2011-02-03] (Synaptics Incorporated)
    HKLM\...\Run: [Teco] "%ProgramFiles%\TOSHIBA\TECO\Teco.exe" /r [1520552 2011-03-02] (TOSHIBA Corporation)
    HKLM\...\Run: [TosWaitSrv] %ProgramFiles%\TOSHIBA\TPHM\TosWaitSrv.exe [711576 2010-12-20] (TOSHIBA Corporation)
    HKLM\...\Run: [TosVolRegulator] C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
    HKLM\...\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710040 2010-12-08] (TOSHIBA Corporation)
    HKLM\...\Run: [TosReelTimeMonitor] %ProgramFiles%\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [38304 2010-12-14] (TOSHIBA Corporation)
    HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1271168 2012-03-26] (Microsoft Corporation)
    HKLM\...\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices [112512 2010-03-13] (Microsoft Corporation)
    HKLM\...\Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [499608 2011-03-15] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [TSleepSrv] %ProgramFiles(x86)%\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe [x]
    HKLM-x32\...\Run: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60 [1294712 2010-11-29] (TOSHIBA Corporation)
    HKLM-x32\...\Run: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe" UNATTENDED [3218792 2010-08-17] (Toshiba)
    HKLM-x32\...\Run: [ToshibaAppPlace] "C:\Program Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe" [552960 2010-09-23] (Toshiba)
    HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2012-01-18] (Sun Microsystems, Inc.)
    HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-04-03] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2012-02-20] (Apple Inc.)
    HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-04-18] (Apple Inc.)
    HKLM-x32\...\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin [1523360 2011-01-12] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [] [x]
    HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [36760 2012-04-03] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [815512 2012-04-03] (Adobe Systems Inc.)
    Winlogon\Notify\igfxcui: igfxdev.dll (Intel Corporation)
    Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
    Startup: C:\Users\Chris\Start Menu\Programs\Startup\Dropbox.lnk
    ShortcutTarget: Dropbox.lnk -> (No File)

    ==================== Services (Whitelisted) ======

    2 Mcx2Svc; C:\Windows\SysWOW64\Mcx2Svc.dll [1888256 2012-06-21] ()
    3 ose64; "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" [174440 2010-01-09] (Microsoft Corporation)
    4 SharedAccess; C:\Windows\System32\svchost.exe -k netsvcs [27136 2009-07-13] (Microsoft Corporation)
    4 SharedAccess; C:\Windows\SysWow64\svchost.exe -k netsvcs [20992 2009-07-13] (Microsoft Corporation)
    2 UNS; "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe" [2656280 2010-12-20] (Intel Corporation)
    4 RemoteAccess; C:\Windows\SysWOW64\mpsdim.dll [x]

    ========================== Drivers (Whitelisted) =============

    3 QIOMem; C:\Windows\System32\Drivers\QIOMem.sys [12800 2009-06-15] (TOSHIBA)
    3 RSUSBVSTOR; C:\Windows\System32\Drivers\RTSUVSTOR.sys [307304 2010-11-30] (Realtek Semiconductor Corp.)
    3 RTL8192Ce; C:\Windows\System32\Drivers\RTL8192Ce.sys [1109096 2011-01-05] (Realtek Semiconductor Corporation )
    0 TVALZ; C:\Windows\System32\DRIVERS\TVALZ_O.SYS [26840 2009-07-14] (TOSHIBA Corporation)

    ========================== NetSvcs (Whitelisted) ===========

    NETSVCx32: Mcx2Svc -> C:\Windows\SysWOW64\Mcx2Svc.dll ()

    ============ One Month Created Files and Folders ==============


    2012-06-25 20:06 - 2012-06-25 20:07 - 00000000 ____D C:\FRST
    2012-06-25 15:57 - 2012-06-25 15:57 - 01425797 ____A C:\Users\Chris\Downloads\FRST64.exe
    2012-06-25 15:57 - 2012-06-25 15:57 - 00000794 ____A C:\Windows\setupact.log
    2012-06-25 15:57 - 2012-06-25 15:57 - 00000000 ____A C:\Windows\setuperr.log
    2012-06-25 15:24 - 2012-06-25 15:24 - 00000000 ____D C:\Users\Chris\AppData\Local\Apple Computer
    2012-06-25 14:57 - 2012-06-25 14:57 - 00000000 ___RD C:\Users\Chris\Documents\Notes
    2012-06-25 11:05 - 2012-06-25 11:05 - 00000000 __SHD C:\Windows\System32\%APPDATA%
    2012-06-25 10:35 - 2012-06-25 10:35 - 00137096 ____A (ESET) C:\Users\Chris\Downloads\ESETSirefefRemover.exe
    2012-06-24 20:23 - 2012-06-24 22:19 - 00000000 ____D C:\Users\Chris\Documents\Articles
    2012-06-24 20:01 - 2012-06-24 20:01 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Thunderbird
    2012-06-24 20:01 - 2012-06-24 20:01 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Mozilla
    2012-06-24 20:01 - 2012-06-24 20:01 - 00000000 ____D C:\Users\Chris\AppData\Local\Thunderbird
    2012-06-24 19:45 - 2012-06-24 19:45 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Tific
    2012-06-22 09:06 - 2012-06-03 19:28 - 58957832 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
    2012-06-22 09:04 - 2012-05-04 03:00 - 00366592 ____A (Microsoft Corporation) C:\Windows\System32\qdvd.dll
    2012-06-22 09:04 - 2012-05-04 01:59 - 00514560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
    2012-06-21 21:22 - 2012-06-25 10:20 - 00000000 ____D C:\Users\Chris\AppData\Roaming\foobar2000
    2012-06-21 21:04 - 2012-06-21 21:04 - 01888256 ____A C:\Windows\SysWOW64\Mcx2Svc.dll
    2012-06-21 21:04 - 2012-06-21 21:04 - 00000395 ____A C:\Windows\SysWOW64\Mcx2Svc.ocx
    2012-06-21 13:37 - 2011-04-27 19:55 - 00552960 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\bthport.sys
    2012-06-21 13:37 - 2011-04-27 19:54 - 00080384 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\BTHUSB.SYS
    2012-06-21 13:37 - 2011-03-24 19:29 - 00343040 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\usbhub.sys
    2012-06-21 13:37 - 2011-03-24 19:29 - 00325120 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\usbport.sys
    2012-06-21 13:37 - 2011-03-24 19:29 - 00098816 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\usbccgp.sys
    2012-06-21 13:37 - 2011-03-24 19:29 - 00052736 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\usbehci.sys
    2012-06-21 13:37 - 2011-03-24 19:29 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\usbuhci.sys
    2012-06-21 13:37 - 2011-03-24 19:29 - 00025600 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\usbohci.sys
    2012-06-21 13:37 - 2011-03-24 19:28 - 00007936 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\usbd.sys
    2012-06-21 13:37 - 2011-03-10 22:41 - 01659776 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys
    2012-06-21 13:37 - 2011-03-10 22:41 - 00410496 ____A (Intel Corporation) C:\Windows\System32\Drivers\iaStorV.sys
    2012-06-21 13:37 - 2011-03-10 22:41 - 00189824 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\storport.sys
    2012-06-21 13:37 - 2011-03-10 22:41 - 00166272 ____A (NVIDIA Corporation) C:\Windows\System32\Drivers\nvstor.sys
    2012-06-21 13:37 - 2011-03-10 22:41 - 00148352 ____A (NVIDIA Corporation) C:\Windows\System32\Drivers\nvraid.sys
    2012-06-21 13:37 - 2011-03-10 22:41 - 00107904 ____A (Advanced Micro Devices) C:\Windows\System32\Drivers\amdsata.sys
    2012-06-21 13:37 - 2011-03-10 22:41 - 00027008 ____A (Advanced Micro Devices) C:\Windows\System32\Drivers\amdxata.sys
    2012-06-21 13:37 - 2011-03-10 22:33 - 02565632 ____A (Microsoft Corporation) C:\Windows\System32\esent.dll
    2012-06-21 13:37 - 2011-03-10 22:30 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\fsutil.exe
    2012-06-21 13:37 - 2011-03-10 21:33 - 01699328 ____A (Microsoft Corporation) C:\Windows\SysWOW64\esent.dll
    2012-06-21 13:37 - 2011-03-10 21:31 - 00074240 ____A (Microsoft Corporation) C:\Windows\SysWOW64\fsutil.exe
    2012-06-21 13:37 - 2011-03-10 20:37 - 00091648 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\USBSTOR.SYS
    2012-06-21 13:33 - 2012-06-02 14:19 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
    2012-06-21 13:33 - 2012-06-02 14:19 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
    2012-06-21 13:33 - 2012-06-02 14:19 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
    2012-06-21 13:33 - 2012-06-02 14:19 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
    2012-06-21 13:33 - 2012-06-02 14:19 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
    2012-06-21 13:33 - 2012-06-02 14:15 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
    2012-06-21 13:33 - 2012-06-02 14:15 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
    2012-06-21 13:33 - 2012-06-02 11:19 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
    2012-06-21 13:33 - 2012-06-02 11:15 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 03695416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
    2012-06-21 00:44 - 2012-06-21 00:44 - 03695416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
    2012-06-21 00:44 - 2012-06-21 00:44 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2012-06-21 00:44 - 2012-06-21 00:44 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
    2012-06-21 00:44 - 2012-06-21 00:44 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
    2012-06-21 00:44 - 2012-06-21 00:44 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
    2012-06-21 00:44 - 2012-06-21 00:44 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00697344 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00603648 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00580608 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00534528 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00452608 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00448512 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
    2012-06-21 00:44 - 2012-06-21 00:44 - 00434176 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00403248 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00367104 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
    2012-06-21 00:44 - 2012-06-21 00:44 - 00353792 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00353584 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00282112 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00267776 ____A (Microsoft Corporation) C:\Windows\System32\ieaksie.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00249344 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00227840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieaksie.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00223232 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00222208 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00203776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00165888 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieakui.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00163840 ____A (Microsoft Corporation) C:\Windows\System32\ieakui.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00162304 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00161792 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00160256 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00160256 ____A (Microsoft Corporation) C:\Windows\System32\ieakeng.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00152064 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00145920 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00135168 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00130560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieakeng.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00123392 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00118784 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00114176 ____A (Microsoft Corporation) C:\Windows\System32\admparse.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00111616 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00101888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\admparse.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00091648 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00089088 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00089088 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00086528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00082432 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00078848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00076800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00076800 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
    2012-06-21 00:44 - 2012-06-21 00:44 - 00074752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00074752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00074240 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00066048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00063488 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
    2012-06-21 00:44 - 2012-06-21 00:44 - 00055296 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00054272 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00049664 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00041472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00035840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00031744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00023552 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00012288 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00010752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00010752 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
    2012-06-21 00:38 - 2012-02-29 22:46 - 00023408 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\fs_rec.sys
    2012-06-21 00:38 - 2012-02-29 22:38 - 00220672 ____A (Microsoft Corporation) C:\Windows\System32\wintrust.dll
    2012-06-21 00:38 - 2012-02-29 22:33 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\imagehlp.dll
    2012-06-21 00:38 - 2012-02-29 22:28 - 00005120 ____A (Microsoft Corporation) C:\Windows\System32\wmi.dll
    2012-06-21 00:38 - 2012-02-29 21:37 - 00172544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
    2012-06-21 00:38 - 2012-02-29 21:33 - 00159232 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
    2012-06-21 00:38 - 2012-02-29 21:29 - 00005120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wmi.dll
    2012-06-21 00:19 - 2012-06-21 00:30 - 00000000 ____D C:\Users\All Users\Brother
    2012-06-20 23:13 - 2012-03-02 22:35 - 01544704 ____A (Microsoft Corporation) C:\Windows\System32\DWrite.dll
    2012-06-20 23:13 - 2012-03-02 21:31 - 01077248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
    2012-06-20 23:13 - 2012-01-04 02:44 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
    2012-06-20 23:13 - 2012-01-04 02:44 - 00509952 ____A (Microsoft Corporation) C:\Windows\System32\ntshrui.dll
    2012-06-20 23:13 - 2012-01-04 00:59 - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
    2012-06-20 23:13 - 2012-01-04 00:58 - 00442880 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntshrui.dll
    2012-06-20 23:13 - 2011-10-25 21:25 - 01572864 ____A (Microsoft Corporation) C:\Windows\System32\quartz.dll
    2012-06-20 23:13 - 2011-10-25 20:32 - 01328128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
    2012-06-20 23:13 - 2011-06-15 21:49 - 00199680 ____A (Microsoft Corporation) C:\Windows\System32\xmllite.dll
    2012-06-20 23:13 - 2011-06-15 20:33 - 00180224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\xmllite.dll
    2012-06-20 23:13 - 2011-06-15 02:02 - 00212992 ____A (Microsoft Corporation) C:\Windows\System32\odbctrac.dll
    2012-06-20 23:13 - 2011-06-15 02:02 - 00163840 ____A (Microsoft Corporation) C:\Windows\System32\odbccp32.dll
    2012-06-20 23:13 - 2011-06-15 02:02 - 00106496 ____A (Microsoft Corporation) C:\Windows\System32\odbccu32.dll
    2012-06-20 23:13 - 2011-06-15 02:02 - 00106496 ____A (Microsoft Corporation) C:\Windows\System32\odbccr32.dll
    2012-06-20 23:13 - 2011-06-15 00:55 - 00319488 ____A (Microsoft Corporation) C:\Windows\SysWOW64\odbcjt32.dll
    2012-06-20 23:13 - 2011-06-15 00:55 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\odbctrac.dll
    2012-06-20 23:13 - 2011-06-15 00:55 - 00122880 ____A (Microsoft Corporation) C:\Windows\SysWOW64\odbccp32.dll
    2012-06-20 23:13 - 2011-06-15 00:55 - 00086016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\odbccu32.dll
    2012-06-20 23:13 - 2011-06-15 00:55 - 00081920 ____A (Microsoft Corporation) C:\Windows\SysWOW64\odbccr32.dll
    2012-06-20 23:13 - 2011-05-03 21:25 - 02315776 ____A (Microsoft Corporation) C:\Windows\System32\tquery.dll
    2012-06-20 23:13 - 2011-05-03 21:22 - 02223616 ____A (Microsoft Corporation) C:\Windows\System32\mssrch.dll
    2012-06-20 23:13 - 2011-05-03 21:22 - 00778752 ____A (Microsoft Corporation) C:\Windows\System32\mssvp.dll
    2012-06-20 23:13 - 2011-05-03 21:22 - 00491520 ____A (Microsoft Corporation) C:\Windows\System32\mssph.dll
    2012-06-20 23:13 - 2011-05-03 21:22 - 00288256 ____A (Microsoft Corporation) C:\Windows\System32\mssphtb.dll
    2012-06-20 23:13 - 2011-05-03 21:22 - 00075264 ____A (Microsoft Corporation) C:\Windows\System32\msscntrs.dll
    2012-06-20 23:13 - 2011-05-03 21:19 - 00591872 ____A (Microsoft Corporation) C:\Windows\System32\SearchIndexer.exe
    2012-06-20 23:13 - 2011-05-03 21:19 - 00249856 ____A (Microsoft Corporation) C:\Windows\System32\SearchProtocolHost.exe
    2012-06-20 23:13 - 2011-05-03 21:19 - 00113664 ____A (Microsoft Corporation) C:\Windows\System32\SearchFilterHost.exe
    2012-06-20 23:13 - 2011-05-03 20:34 - 01549312 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
    2012-06-20 23:13 - 2011-05-03 20:32 - 01401344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
    2012-06-20 23:13 - 2011-05-03 20:32 - 00666624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
    2012-06-20 23:13 - 2011-05-03 20:32 - 00337408 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
    2012-06-20 23:13 - 2011-05-03 20:32 - 00197120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mssphtb.dll
    2012-06-20 23:13 - 2011-05-03 20:32 - 00059392 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msscntrs.dll
    2012-06-20 23:13 - 2011-05-03 20:28 - 00427520 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
    2012-06-20 23:13 - 2011-05-03 20:28 - 00164352 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
    2012-06-20 23:13 - 2011-05-03 20:28 - 00086528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SearchFilterHost.exe
    2012-06-20 23:13 - 2011-04-08 22:58 - 00142336 ____A (Microsoft Corporation) C:\Windows\System32\poqexec.exe
    2012-06-20 23:13 - 2011-04-08 21:56 - 00123904 ____A (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
    2012-06-20 23:13 - 2011-02-24 22:19 - 02871808 ____A (Microsoft Corporation) C:\Windows\explorer.exe
    2012-06-20 23:13 - 2011-02-24 21:30 - 02616320 ____A (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
    2012-06-20 23:12 - 2012-05-04 03:06 - 05559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
    2012-06-20 23:12 - 2012-05-04 02:03 - 03968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
    2012-06-20 23:12 - 2012-05-04 02:03 - 03913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
    2012-06-20 23:12 - 2012-04-30 21:40 - 00209920 ____A (Microsoft Corporation) C:\Windows\System32\profsvc.dll
    2012-06-20 23:12 - 2012-04-25 21:41 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
    2012-06-20 23:12 - 2012-04-25 21:41 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
    2012-06-20 23:12 - 2012-04-25 21:34 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
    2012-06-20 23:12 - 2011-12-29 22:26 - 00515584 ____A (Microsoft Corporation) C:\Windows\System32\timedate.cpl
    2012-06-20 23:12 - 2011-12-29 21:27 - 00478720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\timedate.cpl
    2012-06-20 23:12 - 2011-11-16 22:49 - 00152432 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
    2012-06-20 23:12 - 2011-11-16 22:49 - 00095600 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
    2012-06-20 23:12 - 2011-11-16 22:44 - 00459232 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
    2012-06-20 23:12 - 2011-11-16 22:35 - 01447936 ____A (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
    2012-06-20 23:12 - 2011-11-16 22:35 - 00395776 ____A (Microsoft Corporation) C:\Windows\System32\webio.dll
    2012-06-20 23:12 - 2011-11-16 22:35 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll
    2012-06-20 23:12 - 2011-11-16 22:35 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\sspicli.dll
    2012-06-20 23:12 - 2011-11-16 22:35 - 00029184 ____A (Microsoft Corporation) C:\Windows\System32\sspisrv.dll
    2012-06-20 23:12 - 2011-11-16 22:35 - 00028160 ____A (Microsoft Corporation) C:\Windows\System32\secur32.dll
    2012-06-20 23:12 - 2011-11-16 22:33 - 00031232 ____A (Microsoft Corporation) C:\Windows\System32\lsass.exe
    2012-06-20 23:12 - 2011-11-16 21:35 - 00314880 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webio.dll
    2012-06-20 23:12 - 2011-11-16 21:34 - 00224768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
    2012-06-20 23:12 - 2011-11-16 21:34 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
    2012-06-20 23:12 - 2011-11-16 21:28 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
    2012-06-20 23:12 - 2011-10-25 21:21 - 00043520 ____A (Microsoft Corporation) C:\Windows\System32\csrsrv.dll
    2012-06-20 23:12 - 2011-07-08 18:46 - 00288768 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb10.sys
    2012-06-20 23:12 - 2011-04-26 18:40 - 00158208 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb.sys
    2012-06-20 23:12 - 2011-04-26 18:39 - 00128000 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\mrxsmb20.sys
    2012-06-20 23:12 - 2011-04-22 14:15 - 00027520 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\Diskdump.sys
    2012-06-20 23:12 - 2011-03-12 04:08 - 01465344 ____A (Microsoft Corporation) C:\Windows\System32\XpsPrint.dll
    2012-06-20 23:12 - 2011-03-12 03:23 - 00870912 ____A (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
    2012-06-20 23:12 - 2011-03-10 22:34 - 01395712 ____A (Microsoft Corporation) C:\Windows\System32\mfc42.dll
    2012-06-20 23:12 - 2011-03-10 22:34 - 01359872 ____A (Microsoft Corporation) C:\Windows\System32\mfc42u.dll
    2012-06-20 23:12 - 2011-03-10 21:33 - 01164288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc42u.dll
    2012-06-20 23:12 - 2011-03-10 21:33 - 01137664 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mfc42.dll
    2012-06-20 23:12 - 2011-03-02 22:24 - 00357888 ____A (Microsoft Corporation) C:\Windows\System32\dnsapi.dll
    2012-06-20 23:12 - 2011-03-02 22:24 - 00183296 ____A (Microsoft Corporation) C:\Windows\System32\dnsrslvr.dll
    2012-06-20 23:12 - 2011-03-02 22:21 - 00030208 ____A (Microsoft Corporation) C:\Windows\System32\dnscacheugc.exe
    2012-06-20 23:12 - 2011-03-02 21:38 - 00270336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dnsapi.dll
    2012-06-20 23:12 - 2011-03-02 21:36 - 00028672 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dnscacheugc.exe
    2012-06-20 23:12 - 2011-02-23 22:15 - 00476160 ____A (Microsoft Corporation) C:\Windows\System32\XpsGdiConverter.dll
    2012-06-20 23:12 - 2011-02-23 21:38 - 00288256 ____A (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
    2012-06-20 23:12 - 2011-02-19 04:03 - 00046080 ____A (Adobe Systems) C:\Windows\System32\atmlib.dll
    2012-06-20 23:12 - 2011-02-19 01:00 - 00367616 ____A (Adobe Systems Incorporated) C:\Windows\System32\atmfd.dll
    2012-06-20 23:12 - 2011-02-18 22:30 - 00034304 ____A (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
    2012-06-20 23:12 - 2011-02-18 20:34 - 00294912 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
    2012-06-20 23:11 - 2012-05-14 17:32 - 03146752 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
    2012-06-20 23:11 - 2012-04-27 19:55 - 00210944 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
    2012-06-20 23:11 - 2012-04-23 21:37 - 01462272 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
    2012-06-20 23:11 - 2012-04-23 21:37 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
    2012-06-20 23:11 - 2012-04-23 21:37 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
    2012-06-20 23:11 - 2012-04-23 20:36 - 01158656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
    2012-06-20 23:11 - 2012-04-23 20:36 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
    2012-06-20 23:11 - 2012-04-23 20:36 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
    2012-06-20 23:11 - 2012-04-07 04:31 - 03216384 ____A (Microsoft Corporation) C:\Windows\System32\msi.dll
    2012-06-20 23:11 - 2012-04-07 03:26 - 02342400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
    2012-06-20 23:11 - 2012-03-16 23:58 - 00075120 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\partmgr.sys
    2012-06-20 23:11 - 2011-12-27 19:59 - 00498688 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\afd.sys
    2012-06-20 23:11 - 2011-08-16 21:26 - 00613888 ____A (Microsoft Corporation) C:\Windows\System32\psisdecd.dll
    2012-06-20 23:11 - 2011-08-16 21:25 - 00108032 ____A (Microsoft Corporation) C:\Windows\System32\psisrndr.ax
    2012-06-20 23:11 - 2011-08-16 20:24 - 00465408 ____A (Microsoft Corporation) C:\Windows\SysWOW64\psisdecd.dll
    2012-06-20 23:11 - 2011-08-16 20:19 - 00075776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\psisrndr.ax
    2012-06-20 23:11 - 2011-07-15 21:41 - 00362496 ____A (Microsoft Corporation) C:\Windows\System32\wow64win.dll
    2012-06-20 23:11 - 2011-07-15 21:41 - 00243200 ____A (Microsoft Corporation) C:\Windows\System32\wow64.dll
    2012-06-20 23:11 - 2011-07-15 21:41 - 00013312 ____A (Microsoft Corporation) C:\Windows\System32\wow64cpu.dll
    2012-06-20 23:11 - 2011-07-15 21:39 - 00016384 ____A (Microsoft Corporation) C:\Windows\System32\ntvdm64.dll
    2012-06-20 23:11 - 2011-07-15 21:37 - 01162752 ____A (Microsoft Corporation) C:\Windows\System32\kernel32.dll
    2012-06-20 23:11 - 2011-07-15 21:37 - 00421888 ____A (Microsoft Corporation) C:\Windows\System32\KernelBase.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00006144 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00005120 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00004608 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00004608 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:29 - 00014336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
    2012-06-20 23:11 - 2011-07-15 20:25 - 00025600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
    2012-06-20 23:11 - 2011-07-15 20:24 - 01114112 ____A (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
    2012-06-20 23:11 - 2011-07-15 20:24 - 00272384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
    2012-06-20 23:11 - 2011-07-15 20:24 - 00005120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00005120 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00004608 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
     
  10. Snazzy_C

    Snazzy_C TS Member Topic Starter Posts: 42

    2012-06-20 23:11 - 2011-07-15 21:21 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 21:21 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:29 - 00014336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
    2012-06-20 23:11 - 2011-07-15 20:25 - 00025600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
    2012-06-20 23:11 - 2011-07-15 20:24 - 01114112 ____A (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
    2012-06-20 23:11 - 2011-07-15 20:24 - 00272384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
    2012-06-20 23:11 - 2011-07-15 20:24 - 00005120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00005120 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00004608 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 20:15 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 18:21 - 00007680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
    2012-06-20 23:11 - 2011-07-15 18:21 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
    2012-06-20 23:11 - 2011-07-15 18:17 - 00006144 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 18:17 - 00004608 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 18:17 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
    2012-06-20 23:11 - 2011-07-15 18:17 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
    2012-06-20 23:11 - 2011-06-23 21:34 - 00214528 ____A (Microsoft Corporation) C:\Windows\System32\winsrv.dll
    2012-06-20 23:11 - 2011-06-23 21:25 - 00338432 ____A (Microsoft Corporation) C:\Windows\System32\conhost.exe
    2012-06-20 23:11 - 2011-05-24 03:42 - 00404480 ____A (Microsoft Corporation) C:\Windows\System32\umpnpmgr.dll
    2012-06-20 23:11 - 2011-05-24 02:40 - 00064512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\devobj.dll
    2012-06-20 23:11 - 2011-05-24 02:40 - 00044544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\devrtl.dll
    2012-06-20 23:11 - 2011-05-24 02:39 - 00145920 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cfgmgr32.dll
    2012-06-20 23:11 - 2011-05-24 02:37 - 00252928 ____A (Microsoft Corporation) C:\Windows\SysWOW64\drvinst.exe
    2012-06-20 23:11 - 2011-04-28 19:06 - 00467456 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\srv.sys
    2012-06-20 23:11 - 2011-04-28 19:05 - 00410112 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\srv2.sys
    2012-06-20 23:11 - 2011-04-28 19:05 - 00168448 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\srvnet.sys
    2012-06-20 23:11 - 2011-02-18 02:51 - 00031232 ____A (Microsoft Corporation) C:\Windows\System32\prevhost.exe
    2012-06-20 23:11 - 2011-02-17 21:39 - 00031232 ____A (Microsoft Corporation) C:\Windows\SysWOW64\prevhost.exe
    2012-06-20 23:11 - 2011-02-05 09:10 - 00642944 ____A (Microsoft Corporation) C:\Windows\System32\winload.efi
    2012-06-20 23:11 - 2011-02-05 09:10 - 00020352 ____A (Microsoft Corporation) C:\Windows\System32\kdusb.dll
    2012-06-20 23:11 - 2011-02-05 09:10 - 00019328 ____A (Microsoft Corporation) C:\Windows\System32\kd1394.dll
    2012-06-20 23:11 - 2011-02-05 09:10 - 00017792 ____A (Microsoft Corporation) C:\Windows\System32\kdcom.dll
    2012-06-20 23:11 - 2011-02-05 09:06 - 00605552 ____A (Microsoft Corporation) C:\Windows\System32\winload.exe
    2012-06-20 23:11 - 2011-02-05 09:06 - 00566208 ____A (Microsoft Corporation) C:\Windows\System32\winresume.efi
    2012-06-20 23:11 - 2011-02-05 09:06 - 00518672 ____A (Microsoft Corporation) C:\Windows\System32\winresume.exe
    2012-06-20 23:10 - 2012-03-30 03:35 - 01918320 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
    2012-06-20 23:10 - 2011-12-16 00:46 - 00634880 ____A (Microsoft Corporation) C:\Windows\System32\msvcrt.dll
    2012-06-20 23:10 - 2011-12-15 23:52 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msvcrt.dll
    2012-06-20 23:10 - 2011-11-19 06:58 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\packager.dll
    2012-06-20 23:10 - 2011-11-19 06:01 - 00067072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
    2012-06-20 23:10 - 2011-11-16 22:41 - 01731920 ____A (Microsoft Corporation) C:\Windows\System32\ntdll.dll
    2012-06-20 23:10 - 2011-11-16 22:41 - 00000000 __SHD C:\Users\Chris\AppData\Local\{82b1ed88-8914-1ba4-e7ad-bdae9040b190}
    2012-06-20 23:10 - 2011-11-16 21:38 - 01292080 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
    2012-06-20 23:10 - 2011-11-04 21:32 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\tzres.dll
    2012-06-20 23:10 - 2011-11-04 20:26 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
    2012-06-20 23:10 - 2011-10-14 22:31 - 00723456 ____A (Microsoft Corporation) C:\Windows\System32\EncDec.dll
    2012-06-20 23:10 - 2011-10-14 21:38 - 00534528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\EncDec.dll
    2012-06-20 23:10 - 2011-08-26 21:37 - 00861696 ____A (Microsoft Corporation) C:\Windows\System32\oleaut32.dll
    2012-06-20 23:10 - 2011-08-26 21:37 - 00331776 ____A (Microsoft Corporation) C:\Windows\System32\oleacc.dll
    2012-06-20 23:10 - 2011-08-26 20:26 - 00571904 ____A (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
    2012-06-20 23:10 - 2011-08-26 20:26 - 00233472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\oleacc.dll
    2012-06-20 23:10 - 2011-05-02 21:29 - 00976896 ____A (Microsoft Corporation) C:\Windows\System32\inetcomm.dll
    2012-06-20 23:10 - 2011-05-02 20:30 - 00741376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
    2012-06-20 23:10 - 2011-02-22 20:55 - 00090624 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\bowser.sys
    2012-06-20 23:10 - 2011-02-12 03:34 - 00267776 ____A (Microsoft Corporation) C:\Windows\System32\FXSCOVER.exe
    2012-06-20 21:27 - 2012-06-20 21:27 - 00000000 ____D C:\Users\All Users\regid.1986-12.com.adobe
    2012-06-20 19:35 - 2012-06-20 19:35 - 00955840 ____A (Oracle Corporation) C:\Windows\System32\npDeployJava1.dll
    2012-06-20 19:35 - 2012-06-20 19:35 - 00839096 ____A (Oracle Corporation) C:\Windows\System32\deployJava1.dll
    2012-06-20 19:35 - 2012-06-20 19:35 - 00268720 ____A (Oracle Corporation) C:\Windows\System32\javaws.exe
    2012-06-20 19:35 - 2012-06-20 19:35 - 00189360 ____A (Oracle Corporation) C:\Windows\System32\javaw.exe
    2012-06-20 19:35 - 2012-06-20 19:35 - 00188840 ____A (Oracle Corporation) C:\Windows\System32\java.exe
    2012-06-20 19:35 - 2012-06-20 19:35 - 00000000 ____D C:\Program Files\Java
    2012-06-20 17:32 - 2012-06-20 17:32 - 00000000 ____D C:\Program Files\CCleaner
    2012-06-20 17:21 - 2012-06-25 14:59 - 00000000 ____D C:\Users\Chris\Documents\School
    2012-06-20 17:20 - 2012-06-24 22:23 - 00000000 ____D C:\Users\Chris\Documents\FSU
    2012-06-20 17:20 - 2012-06-20 17:20 - 00000000 ____D C:\Users\Chris\Documents\Rainmeter
    2012-06-20 17:20 - 2011-10-13 22:35 - 00000277 ____A C:\Users\Chris\Documents\book.txt
    2012-06-20 17:01 - 2012-06-24 22:10 - 00000000 ____D C:\Users\Chris\Documents\Billing
    2012-06-20 17:01 - 2012-06-24 20:46 - 00000000 ____D C:\Users\Chris\Documents\Books
    2012-06-20 17:01 - 2012-06-20 17:01 - 00000000 ____D C:\Users\Chris\Documents\Car
    2012-06-20 16:53 - 2012-06-20 16:53 - 00000000 ____D C:\Users\Chris\Documents\DVDFab
    2012-06-20 16:52 - 2012-06-20 16:57 - 00000000 ____D C:\Program Files (x86)\DVDFab 8
    2012-06-20 16:51 - 2012-06-20 16:51 - 00726016 ____A (Igor Pavlov) C:\Windows\SysWOW64\7z.dll
    2012-06-20 16:51 - 2012-06-20 16:51 - 00000000 ____D C:\Users\All Users\Xilisoft
    2012-06-20 16:51 - 2012-06-20 16:51 - 00000000 ____D C:\Program Files (x86)\Xilisoft
    2012-06-20 16:50 - 2012-06-20 16:50 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Malwarebytes
    2012-06-20 16:37 - 2012-06-24 18:28 - 00000000 ____D C:\Fraps
    2012-06-20 16:33 - 2012-06-20 16:34 - 00000000 ____D C:\Program Files\Common Files\Adobe
    2012-06-20 16:33 - 2012-06-20 16:34 - 00000000 ____D C:\Program Files\Adobe
    2012-06-20 16:25 - 2012-06-25 09:53 - 00151552 ____A C:\Windows\KMSEmulator.exe
    2012-06-20 16:01 - 2012-06-25 15:26 - 00000000 ____D C:\Users\Chris\AppData\Roaming\vlc
    2012-06-20 15:51 - 2012-06-25 09:53 - 00000292 ____A C:\Windows\Tasks\AutoKMS.job
    2012-06-20 15:51 - 2012-06-20 16:25 - 00000000 ____D C:\Windows\AutoKMS
    2012-06-20 15:41 - 2012-06-20 15:41 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
    2012-06-20 15:40 - 2012-06-20 15:40 - 00000000 ____D C:\Program Files\Microsoft Synchronization Services
    2012-06-20 15:39 - 2012-06-20 15:39 - 00000000 ____D C:\Program Files\Microsoft Sync Framework
    2012-06-20 15:39 - 2012-06-20 15:39 - 00000000 ____D C:\Program Files\Microsoft SQL Server Compact Edition
    2012-06-20 15:37 - 2012-06-20 15:37 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 8
    2012-06-20 15:35 - 2012-06-20 15:35 - 00000000 ____D C:\Program Files\Microsoft Analysis Services
    2012-06-20 15:35 - 2012-06-20 15:35 - 00000000 ____D C:\Program Files (x86)\Microsoft Analysis Services
    2012-06-20 15:34 - 2012-06-21 00:59 - 00000000 ____D C:\Users\All Users\Microsoft Help
    2012-06-20 15:34 - 2012-06-20 15:39 - 00000000 ____D C:\Program Files\Microsoft Office
    2012-06-20 15:34 - 2012-06-20 15:34 - 00000000 __RHD C:\MSOCache
    2012-06-20 15:34 - 2012-06-20 15:34 - 00000000 ____D C:\Users\Chris\AppData\Local\Microsoft Help
    2012-06-20 14:42 - 2012-06-25 15:52 - 00000912 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2012-06-20 14:42 - 2012-06-24 18:05 - 00000908 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2012-06-20 14:42 - 2012-06-20 17:50 - 00000000 ____D C:\Program Files\Google
    2012-06-20 14:42 - 2012-06-20 17:50 - 00000000 ____D C:\Program Files (x86)\Google
    2012-06-20 14:41 - 2012-06-20 14:41 - 00000000 ___HD C:\Windows\msdownld.tmp
    2012-06-20 14:41 - 2012-06-20 14:41 - 00000000 ____D C:\Program Files (x86)\Corel
    2012-06-20 14:41 - 2007-10-22 02:40 - 00411656 ____A (Microsoft Corporation) C:\Windows\System32\xactengine2_10.dll
    2012-06-20 14:41 - 2007-10-22 02:39 - 00267272 ____A (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
    2012-06-20 14:41 - 2007-10-22 02:37 - 00021000 ____A (Microsoft Corporation) C:\Windows\System32\X3DAudio1_2.dll
    2012-06-20 14:41 - 2007-10-22 02:37 - 00017928 ____A (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll
    2012-06-20 14:41 - 2007-10-12 14:14 - 05081608 ____A (Microsoft Corporation) C:\Windows\System32\d3dx9_36.dll
    2012-06-20 14:41 - 2007-10-12 14:14 - 03734536 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll
    2012-06-20 14:41 - 2007-10-12 14:14 - 02006552 ____A (Microsoft Corporation) C:\Windows\System32\D3DCompiler_36.dll
    2012-06-20 14:41 - 2007-10-12 14:14 - 01374232 ____A (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll
    2012-06-20 14:41 - 2007-10-02 08:56 - 00508264 ____A (Microsoft Corporation) C:\Windows\System32\d3dx10_36.dll
    2012-06-20 14:41 - 2007-10-02 08:56 - 00444776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll
    2012-06-20 14:41 - 2007-07-19 23:57 - 00411496 ____A (Microsoft Corporation) C:\Windows\System32\xactengine2_9.dll
    2012-06-20 14:41 - 2007-07-19 23:57 - 00267112 ____A (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll
    2012-06-20 14:41 - 2007-07-19 17:14 - 05073256 ____A (Microsoft Corporation) C:\Windows\System32\d3dx9_35.dll
    2012-06-20 14:41 - 2007-07-19 17:14 - 03727720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_35.dll
    2012-06-20 14:41 - 2007-07-19 17:14 - 01985904 ____A (Microsoft Corporation) C:\Windows\System32\D3DCompiler_35.dll
    2012-06-20 14:41 - 2007-07-19 17:14 - 01358192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
    2012-06-20 14:41 - 2007-07-19 17:14 - 00508264 ____A (Microsoft Corporation) C:\Windows\System32\d3dx10_35.dll
    2012-06-20 14:41 - 2007-07-19 17:14 - 00444776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
    2012-06-20 14:41 - 2007-06-20 19:49 - 00409960 ____A (Microsoft Corporation) C:\Windows\System32\xactengine2_8.dll
    2012-06-20 14:41 - 2007-06-20 19:46 - 00266088 ____A (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
    2012-06-20 14:41 - 2007-05-16 15:45 - 04496232 ____A (Microsoft Corporation) C:\Windows\System32\d3dx9_34.dll
    2012-06-20 14:41 - 2007-05-16 15:45 - 03497832 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
    2012-06-20 14:41 - 2007-05-16 15:45 - 01401200 ____A (Microsoft Corporation) C:\Windows\System32\D3DCompiler_34.dll
    2012-06-20 14:41 - 2007-05-16 15:45 - 01124720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
    2012-06-20 14:41 - 2007-05-16 15:45 - 00506728 ____A (Microsoft Corporation) C:\Windows\System32\d3dx10_34.dll
    2012-06-20 14:41 - 2007-05-16 15:45 - 00443752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
    2012-06-20 14:41 - 2007-04-04 17:55 - 00403304 ____A (Microsoft Corporation) C:\Windows\System32\xactengine2_7.dll
    2012-06-20 14:41 - 2007-04-04 17:55 - 00261480 ____A (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
    2012-06-20 14:41 - 2007-04-04 17:54 - 00107368 ____A (Microsoft Corporation) C:\Windows\System32\xinput1_3.dll
    2012-06-20 14:41 - 2007-04-04 17:53 - 00081768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
    2012-06-20 14:41 - 2007-03-15 15:57 - 00506728 ____A (Microsoft Corporation) C:\Windows\System32\d3dx10_33.dll
    2012-06-20 14:41 - 2007-03-15 15:57 - 00443752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
    2012-06-20 14:41 - 2007-03-12 15:42 - 04494184 ____A (Microsoft Corporation) C:\Windows\System32\d3dx9_33.dll
    2012-06-20 14:41 - 2007-03-12 15:42 - 03495784 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
    2012-06-20 14:41 - 2007-03-12 15:42 - 01400176 ____A (Microsoft Corporation) C:\Windows\System32\D3DCompiler_33.dll
    2012-06-20 14:41 - 2007-03-12 15:42 - 01123696 ____A (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
    2012-06-20 14:41 - 2007-03-05 11:42 - 00017688 ____A (Microsoft Corporation) C:\Windows\System32\x3daudio1_1.dll
    2012-06-20 14:41 - 2007-03-05 11:42 - 00015128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
    2012-06-20 14:41 - 2007-01-24 14:27 - 00393576 ____A (Microsoft Corporation) C:\Windows\System32\xactengine2_6.dll
    2012-06-20 14:41 - 2007-01-24 14:27 - 00255848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
    2012-06-20 14:41 - 2006-12-08 11:02 - 00251672 ____A (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
    2012-06-20 14:41 - 2006-12-08 11:00 - 00390424 ____A (Microsoft Corporation) C:\Windows\System32\xactengine2_5.dll
    2012-06-20 14:41 - 2006-11-29 12:06 - 00469264 ____A (Microsoft Corporation) C:\Windows\System32\d3dx10.dll
    2012-06-20 14:41 - 2006-11-29 12:06 - 00440080 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
    2012-06-20 14:41 - 2006-09-28 15:05 - 03977496 ____A (Microsoft Corporation) C:\Windows\System32\d3dx9_31.dll
    2012-06-20 14:41 - 2006-09-28 15:05 - 02414360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
    2012-06-20 14:41 - 2006-09-28 15:05 - 00237848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
    2012-06-20 14:41 - 2006-09-28 15:04 - 00364824 ____A (Microsoft Corporation) C:\Windows\System32\xactengine2_4.dll
    2012-06-20 14:41 - 2006-07-28 08:31 - 00083736 ____A (Microsoft Corporation) C:\Windows\System32\xinput1_2.dll
    2012-06-20 14:41 - 2006-07-28 08:30 - 00363288 ____A (Microsoft Corporation) C:\Windows\System32\xactengine2_3.dll
    2012-06-20 14:41 - 2006-07-28 08:30 - 00236824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
    2012-06-20 14:41 - 2006-07-28 08:30 - 00062744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
    2012-06-20 14:41 - 2006-05-31 06:24 - 00230168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
    2012-06-20 14:41 - 2006-05-31 06:22 - 00354072 ____A (Microsoft Corporation) C:\Windows\System32\xactengine2_2.dll
    2012-06-20 14:41 - 2006-03-31 11:41 - 03927248 ____A (Microsoft Corporation) C:\Windows\System32\d3dx9_30.dll
    2012-06-20 14:41 - 2006-03-31 11:40 - 02388176 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll
    2012-06-20 14:41 - 2006-03-31 11:40 - 00352464 ____A (Microsoft Corporation) C:\Windows\System32\xactengine2_1.dll
    2012-06-20 14:41 - 2006-03-31 11:39 - 00229584 ____A (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
    2012-06-20 14:41 - 2006-03-31 11:39 - 00083664 ____A (Microsoft Corporation) C:\Windows\System32\xinput1_1.dll
    2012-06-20 14:41 - 2006-03-31 11:39 - 00062672 ____A (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
    2012-06-20 14:41 - 2006-02-03 07:43 - 03830992 ____A (Microsoft Corporation) C:\Windows\System32\d3dx9_29.dll
    2012-06-20 14:41 - 2006-02-03 07:43 - 02332368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
    2012-06-20 14:41 - 2006-02-03 07:42 - 00355536 ____A (Microsoft Corporation) C:\Windows\System32\xactengine2_0.dll
    2012-06-20 14:41 - 2006-02-03 07:42 - 00230096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
    2012-06-20 14:41 - 2006-02-03 07:41 - 00016592 ____A (Microsoft Corporation) C:\Windows\System32\x3daudio1_0.dll
    2012-06-20 14:41 - 2006-02-03 07:41 - 00014032 ____A (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
    2012-06-20 14:41 - 2005-12-05 17:09 - 03815120 ____A (Microsoft Corporation) C:\Windows\System32\d3dx9_28.dll
    2012-06-20 14:41 - 2005-12-05 17:09 - 02323664 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
    2012-06-20 14:41 - 2005-07-22 18:59 - 03807440 ____A (Microsoft Corporation) C:\Windows\System32\d3dx9_27.dll
    2012-06-20 14:41 - 2005-07-22 18:59 - 02319568 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
    2012-06-20 14:41 - 2005-05-26 14:34 - 03767504 ____A (Microsoft Corporation) C:\Windows\System32\d3dx9_26.dll
    2012-06-20 14:41 - 2005-05-26 14:34 - 02297552 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
    2012-06-20 14:41 - 2005-03-18 16:19 - 03823312 ____A (Microsoft Corporation) C:\Windows\System32\d3dx9_25.dll
    2012-06-20 14:41 - 2005-03-18 16:19 - 02337488 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
    2012-06-20 14:41 - 2005-02-05 18:45 - 03544272 ____A (Microsoft Corporation) C:\Windows\System32\d3dx9_24.dll
    2012-06-20 14:41 - 2005-02-05 18:45 - 02222800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
    2012-06-20 14:40 - 2012-06-20 17:39 - 00000000 ____D C:\Program Files (x86)\TOSHIBA Corporation
    2012-06-20 14:36 - 2012-06-24 19:49 - 00000000 ____D C:\Users\All Users\Norton
    2012-06-20 14:36 - 2012-06-20 14:36 - 00000000 ____D C:\Program Files (x86)\Toshiba Online Backup
    2012-06-20 14:35 - 2012-06-20 17:39 - 00000000 ____D C:\Users\All Users\Google
    2012-06-20 14:33 - 2012-06-20 17:44 - 00000000 ____D C:\Program Files (x86)\TOSHIBA Games
    2012-06-20 14:33 - 2012-06-20 17:43 - 00000000 ____D C:\Users\All Users\WildTangent
    2012-06-20 14:26 - 2009-07-30 19:22 - 00027784 ____A (TOSHIBA Corporation.) C:\Windows\System32\Drivers\tdcmdpst.sys
    2012-06-20 14:24 - 2011-02-08 18:07 - 00038096 ____A (TOSHIBA Corporation) C:\Windows\System32\Drivers\PGEffect.sys
    2012-06-20 14:23 - 2012-06-20 14:23 - 00000000 ____D C:\Windows\SysWOW64\sda
    2012-06-20 14:23 - 2012-06-20 14:23 - 00000000 ____D C:\Program Files (x86)\Realtek
    2012-06-20 14:23 - 2010-12-01 15:12 - 09888360 ____A (Realtek Semiconductor Corp.) C:\Windows\SysWOW64\RtsUStoricon.dll
    2012-06-20 14:23 - 2010-12-01 15:12 - 00422504 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\RtsUStor.dll
    2012-06-20 14:23 - 2010-12-01 15:12 - 00250984 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\Drivers\RtsUStor.sys
    2012-06-20 14:23 - 2010-11-30 13:40 - 00307304 ____A (Realtek Semiconductor Corp.) C:\Windows\System32\Drivers\rtsuvstor.sys
    2012-06-20 14:22 - 2012-06-20 14:22 - 00000000 ____D C:\Windows\SysWOW64\Atheros_L1e
    2012-06-20 14:21 - 2012-06-20 14:21 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_SynTP_01009.Wdf
    2012-06-20 14:21 - 2012-06-20 14:21 - 00000000 ____D C:\Program Files\Synaptics
    2012-06-20 14:21 - 2012-06-20 14:21 - 00000000 ____D C:\Program Files (x86)\Cisco
    2012-06-20 14:21 - 2011-02-17 15:42 - 00099320 ____A (TOSHIBA CORPORATION) C:\Windows\System32\tosWirelessLANIndicatorCP.dll
    2012-06-20 14:21 - 2010-03-18 08:36 - 00827728 ____A (Microsoft Corporation) C:\Windows\System32\msvcr100.dll
    2012-06-20 14:21 - 2010-03-18 08:36 - 00607568 ____A (Microsoft Corporation) C:\Windows\System32\msvcp100.dll
    2012-06-20 14:20 - 2012-06-20 14:21 - 00000000 ____D C:\Program Files (x86)\Realtek WLAN Driver
    2012-06-20 14:20 - 2011-01-05 00:08 - 01109096 ____A (Realtek Semiconductor Corporation ) C:\Windows\System32\Drivers\rtl8192ce.sys
    2012-06-20 14:20 - 2010-12-22 15:24 - 00626792 ____A (Realtek Semiconductor Corporation ) C:\Windows\System32\Drivers\rtl819xp.sys
    2012-06-20 14:20 - 2010-12-17 15:04 - 01221224 ____A (Realtek Semiconductor Corporation ) C:\Windows\System32\Drivers\rtl8192se.sys
    2012-06-20 14:20 - 2010-04-01 13:01 - 00442368 ____A (Realtek Semiconductor Corporation ) C:\Windows\System32\Drivers\rtl8187Se.sys
    2012-06-20 14:20 - 2010-03-31 10:10 - 00450048 ____A (Realtek Semiconductor Corporation ) C:\Windows\System32\Drivers\rtl8187B.sys
    2012-06-20 14:20 - 2009-02-05 01:49 - 00451072 ____N C:\Windows\SysWOW64\ISSRemoveSP.exe
    2012-06-20 14:18 - 2012-06-20 14:18 - 00000000 ____D C:\Program Files\CONEXANT
    2012-06-20 14:15 - 1999-10-12 17:47 - 00024576 ____A (Toshiba) C:\Windows\SysWOW64\TSCI.dll
    2012-06-20 14:15 - 1999-10-12 17:45 - 00024576 ____A (Toshiba) C:\Windows\SysWOW64\THCI.dll
    2012-06-20 14:13 - 2012-06-20 14:13 - 00015828 ____A C:\Windows\System32\results.xml
    2012-06-20 14:13 - 2011-01-12 16:51 - 00439320 ____A (Intel Corporation) C:\Windows\System32\Drivers\iaStor.sys
    2012-06-20 14:11 - 2012-06-25 16:04 - 01599021 ____A C:\Windows\WindowsUpdate.log
    2012-06-20 14:11 - 2012-06-20 14:11 - 00000000 ____D C:\Program Files\Common Files\Intel
    2012-06-20 14:11 - 2012-06-20 14:11 - 00000000 ____D C:\Intel
    2012-06-20 14:10 - 2010-12-20 17:08 - 00008192 ____A C:\Windows\System32\Drivers\IntelMEFWVer.dll
    2012-06-20 13:31 - 2012-06-20 13:31 - 00000000 ____D C:\Program Files (x86)\FileHippo.com
    2012-06-20 13:27 - 2012-06-24 19:00 - 00000000 ___RD C:\Users\Chris\Dropbox
    2012-06-20 13:26 - 2012-06-25 16:03 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Skype
    2012-06-20 13:26 - 2012-06-20 13:26 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Apple Computer
    2012-06-20 13:17 - 2012-06-20 13:17 - 00731106 ____A C:\Windows\SysWOW64\PerfStringBackup.INI
    2012-06-20 13:17 - 2012-06-20 13:17 - 00001945 ____A C:\Windows\epplauncher.mif
    2012-06-20 13:17 - 2012-06-20 13:17 - 00000000 ____D C:\Program Files\Microsoft Security Client
    2012-06-20 13:17 - 2012-06-20 13:17 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
    2012-06-20 13:16 - 2012-06-20 13:16 - 00000000 ____D C:\Users\All Users\Malwarebytes
    2012-06-20 13:16 - 2012-06-20 13:16 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2012-06-20 13:16 - 2012-04-04 11:56 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
    2012-06-20 13:15 - 2012-06-20 13:15 - 00000000 ____D C:\Users\Chris\AppData\Local\Paint.NET
    2012-06-20 13:15 - 2012-06-20 13:15 - 00000000 ____D C:\Program Files\Paint.NET
    2012-06-20 13:14 - 2012-06-20 13:14 - 00000000 ____D C:\Users\Chris\AppData\Local\Apple
    2012-06-20 13:14 - 2012-06-20 13:14 - 00000000 ____D C:\Users\All Users\Apple Computer
    2012-06-20 13:14 - 2012-06-20 13:14 - 00000000 ____D C:\Users\All Users\Apple
    2012-06-20 13:14 - 2012-06-20 13:14 - 00000000 ____D C:\Program Files (x86)\QuickTime
    2012-06-20 13:14 - 2012-06-20 13:14 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
    2012-06-20 13:10 - 2012-06-20 13:10 - 00000000 ___RD C:\Program Files (x86)\Skype
    2012-06-20 13:10 - 2012-06-20 13:10 - 00000000 ____D C:\Program Files (x86)\VideoLAN
    2012-06-20 13:09 - 2012-06-20 13:10 - 00000000 ____D C:\Users\All Users\Skype
    2012-06-20 13:09 - 2012-06-20 13:09 - 00000000 ____D C:\Program Files (x86)\Audacity
    2012-06-20 13:08 - 2012-06-25 13:13 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Dropbox
    2012-06-20 13:08 - 2012-06-20 13:08 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
    2012-06-20 13:08 - 2012-06-20 13:08 - 00000000 ____D C:\Program Files (x86)\ImgBurn
    2012-06-20 13:08 - 2012-06-20 13:08 - 00000000 ____D C:\Program Files (x86)\Auslogics
    2012-06-20 13:07 - 2012-06-21 21:29 - 00000000 ____D C:\Program Files (x86)\foobar2000
    2012-06-20 13:07 - 2012-06-20 18:02 - 00000000 ____D C:\Users\Chris\AppData\Roaming\uTorrent
    2012-06-20 13:07 - 2012-06-20 16:31 - 00000000 ____D C:\Program Files\WinRAR
    2012-06-20 13:07 - 2012-06-20 15:29 - 00000000 ____D C:\Users\Chris\AppData\Roaming\WinRAR
    2012-06-20 13:07 - 2012-06-20 13:07 - 00000000 ____D C:\Program Files (x86)\uTorrent
    2012-06-20 13:03 - 2012-06-20 13:03 - 00000000 ____D C:\Windows\SysWOW64\Adobe
    2012-06-20 13:02 - 2012-06-24 10:25 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
    2012-06-20 13:02 - 2012-06-24 10:25 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
    2012-06-20 13:02 - 2012-06-20 21:27 - 00000000 ____D C:\Users\Chris\AppData\Local\Adobe
    2012-06-20 13:02 - 2012-06-20 13:02 - 00476936 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\npdeployJava1.dll
    2012-06-20 13:02 - 2012-06-20 13:02 - 00157448 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaws.exe
    2012-06-20 13:02 - 2012-06-20 13:02 - 00149256 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaw.exe
    2012-06-20 13:02 - 2012-06-20 13:02 - 00149256 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\java.exe
    2012-06-20 13:02 - 2012-06-20 13:02 - 00000000 ____D C:\Program Files (x86)\Java
    2012-06-20 13:01 - 2012-06-20 13:01 - 00000000 ____D C:\Windows\System32\Macromed
    2012-06-20 12:56 - 2012-06-21 21:34 - 00109624 ____A C:\Users\Chris\AppData\Local\GDIPFONTCACHEV1.DAT
    2012-06-20 12:56 - 2012-06-20 12:56 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Toshiba
    2012-06-20 12:55 - 2012-06-21 21:54 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Adobe
    2012-06-20 12:55 - 2012-06-20 13:16 - 00000000 ____D C:\Users\Chris\AppData\Local\Google
    2012-06-20 12:55 - 2012-06-20 13:06 - 00000000 ____D C:\Users\Chris\AppData\Local\TOSHIBA
    2012-06-20 12:53 - 2012-06-20 15:29 - 00000000 ____D C:\Users\Chris\AppData\Local\VirtualStore
    2012-06-20 12:53 - 2012-06-20 12:53 - 00000013 __RSH C:\Windows\System32\Drivers\fbd.sys
    2012-06-20 12:53 - 2012-02-16 22:38 - 01031680 ____A (Microsoft Corporation) C:\Windows\System32\rdpcore.dll
    2012-06-20 12:53 - 2012-02-16 21:34 - 00826880 ____A (Microsoft Corporation) C:\Windows\SysWOW64\rdpcore.dll
    2012-06-20 12:53 - 2012-02-16 20:57 - 00023552 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tdtcp.sys
    2012-06-20 12:52 - 2012-06-20 12:52 - 00000000 ____D C:\Users\Chris\AppData\Roaming\WinBatch
    2012-06-20 12:51 - 2012-06-20 13:27 - 00000000 ____D C:\users\Chris
    2012-06-20 12:51 - 2012-06-20 12:51 - 00000020 ___SH C:\Users\Chris\ntuser.ini
    2012-06-20 12:51 - 2011-03-23 18:30 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Macromedia
    2012-06-11 10:17 - 2012-06-11 10:17 - 00071680 ____A (Beepa P/L) C:\Windows\System32\frapsv64.dll
    2012-06-11 10:17 - 2012-06-11 10:17 - 00065536 ____A (Beepa P/L) C:\Windows\SysWOW64\frapsvid.dll

    ============ 3 Months Modified Files and Folders =============

    2012-06-25 20:07 - 2012-06-25 20:06 - 00000000 ____D C:\FRST
    2012-06-25 16:04 - 2012-06-20 14:11 - 01599021 ____A C:\Windows\WindowsUpdate.log
    2012-06-25 16:03 - 2012-06-20 13:26 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Skype
    2012-06-25 16:00 - 2009-07-13 21:13 - 00729752 ____A C:\Windows\System32\PerfStringBackup.INI
    2012-06-25 15:57 - 2012-06-25 15:57 - 01425797 ____A C:\Users\Chris\Downloads\FRST64.exe
    2012-06-25 15:57 - 2012-06-25 15:57 - 00000794 ____A C:\Windows\setupact.log
    2012-06-25 15:57 - 2012-06-25 15:57 - 00000000 ____A C:\Windows\setuperr.log
    2012-06-25 15:52 - 2012-06-20 14:42 - 00000912 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2012-06-25 15:26 - 2012-06-20 16:01 - 00000000 ____D C:\Users\Chris\AppData\Roaming\vlc
    2012-06-25 15:24 - 2012-06-25 15:24 - 00000000 ____D C:\Users\Chris\AppData\Local\Apple Computer
    2012-06-25 14:59 - 2012-06-20 17:21 - 00000000 ____D C:\Users\Chris\Documents\School
    2012-06-25 14:57 - 2012-06-25 14:57 - 00000000 ___RD C:\Users\Chris\Documents\Notes
    2012-06-25 13:54 - 2011-03-24 10:59 - 00000000 ____D C:\Windows\Panther
    2012-06-25 13:13 - 2012-06-20 13:08 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Dropbox
    2012-06-25 11:05 - 2012-06-25 11:05 - 00000000 __SHD C:\Windows\System32\%APPDATA%
    2012-06-25 10:35 - 2012-06-25 10:35 - 00137096 ____A (ESET) C:\Users\Chris\Downloads\ESETSirefefRemover.exe
    2012-06-25 10:20 - 2012-06-21 21:22 - 00000000 ____D C:\Users\Chris\AppData\Roaming\foobar2000
    2012-06-25 09:53 - 2012-06-20 16:25 - 00151552 ____A C:\Windows\KMSEmulator.exe
    2012-06-25 09:53 - 2012-06-20 15:51 - 00000292 ____A C:\Windows\Tasks\AutoKMS.job
    2012-06-24 22:23 - 2012-06-20 17:20 - 00000000 ____D C:\Users\Chris\Documents\FSU
    2012-06-24 22:19 - 2012-06-24 20:23 - 00000000 ____D C:\Users\Chris\Documents\Articles
    2012-06-24 22:10 - 2012-06-20 17:01 - 00000000 ____D C:\Users\Chris\Documents\Billing
    2012-06-24 20:46 - 2012-06-20 17:01 - 00000000 ____D C:\Users\Chris\Documents\Books
    2012-06-24 20:01 - 2012-06-24 20:01 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Thunderbird
    2012-06-24 20:01 - 2012-06-24 20:01 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Mozilla
    2012-06-24 20:01 - 2012-06-24 20:01 - 00000000 ____D C:\Users\Chris\AppData\Local\Thunderbird
    2012-06-24 19:49 - 2012-06-20 14:36 - 00000000 ____D C:\Users\All Users\Norton
    2012-06-24 19:45 - 2012-06-24 19:45 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Tific
    2012-06-24 19:06 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\NDF
    2012-06-24 19:00 - 2012-06-20 13:27 - 00000000 ___RD C:\Users\Chris\Dropbox
    2012-06-24 18:28 - 2012-06-20 16:37 - 00000000 ____D C:\Fraps
    2012-06-24 18:05 - 2012-06-20 14:42 - 00000908 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2012-06-24 10:25 - 2012-06-20 13:02 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
    2012-06-24 10:25 - 2012-06-20 13:02 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
    2012-06-23 16:50 - 2009-07-13 20:45 - 00024400 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2012-06-23 16:50 - 2009-07-13 20:45 - 00024400 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2012-06-22 07:34 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
    2012-06-22 03:11 - 2009-07-13 20:45 - 04968664 ____A C:\Windows\System32\FNTCACHE.DAT
    2012-06-21 21:54 - 2012-06-20 12:55 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Adobe
    2012-06-21 21:34 - 2012-06-20 12:56 - 00109624 ____A C:\Users\Chris\AppData\Local\GDIPFONTCACHEV1.DAT
    2012-06-21 21:29 - 2012-06-20 13:07 - 00000000 ____D C:\Program Files (x86)\foobar2000
    2012-06-21 21:04 - 2012-06-21 21:04 - 01888256 ____A C:\Windows\SysWOW64\Mcx2Svc.dll
    2012-06-21 21:04 - 2012-06-21 21:04 - 00000395 ____A C:\Windows\SysWOW64\Mcx2Svc.ocx
    2012-06-21 04:19 - 2009-07-13 19:20 - 00000000 ____D C:\Program Files\Common Files\System
    2012-06-21 04:18 - 2010-11-20 23:17 - 00000000 ____D C:\Program Files\Windows Journal
    2012-06-21 04:18 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\PolicyDefinitions
    2012-06-21 00:59 - 2012-06-20 15:34 - 00000000 ____D C:\Users\All Users\Microsoft Help
    2012-06-21 00:51 - 2009-07-13 19:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
    2012-06-21 00:48 - 2009-07-13 18:34 - 00000478 ____A C:\Windows\win.ini
    2012-06-21 00:44 - 2012-06-21 00:44 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 03695416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
    2012-06-21 00:44 - 2012-06-21 00:44 - 03695416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
    2012-06-21 00:44 - 2012-06-21 00:44 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2012-06-21 00:44 - 2012-06-21 00:44 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
    2012-06-21 00:44 - 2012-06-21 00:44 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
    2012-06-21 00:44 - 2012-06-21 00:44 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
    2012-06-21 00:44 - 2012-06-21 00:44 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00697344 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00603648 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00580608 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00534528 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00452608 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00448512 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
    2012-06-21 00:44 - 2012-06-21 00:44 - 00434176 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00403248 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00367104 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
    2012-06-21 00:44 - 2012-06-21 00:44 - 00353792 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00353584 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00282112 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00267776 ____A (Microsoft Corporation) C:\Windows\System32\ieaksie.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00249344 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00227840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieaksie.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00223232 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00222208 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00203776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00165888 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieakui.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00163840 ____A (Microsoft Corporation) C:\Windows\System32\ieakui.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00162304 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00161792 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00160256 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00160256 ____A (Microsoft Corporation) C:\Windows\System32\ieakeng.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00152064 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00145920 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00135168 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00130560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieakeng.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00123392 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00118784 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00114176 ____A (Microsoft Corporation) C:\Windows\System32\admparse.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00111616 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00101888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\admparse.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00091648 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00089088 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00089088 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00086528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
     
  11. Snazzy_C

    Snazzy_C TS Member Topic Starter Posts: 42

    2012-06-21 00:44 - 2012-06-21 00:44 - 00082432 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00078848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00076800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00076800 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
    2012-06-21 00:44 - 2012-06-21 00:44 - 00074752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00074752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00074240 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00066048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00063488 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
    2012-06-21 00:44 - 2012-06-21 00:44 - 00055296 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00054272 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00049664 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00041472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00035840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00031744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00023552 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
    2012-06-21 00:44 - 2012-06-21 00:44 - 00012288 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00010752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
    2012-06-21 00:44 - 2012-06-21 00:44 - 00010752 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
    2012-06-21 00:37 - 2011-03-23 18:30 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
    2012-06-21 00:30 - 2012-06-21 00:19 - 00000000 ____D C:\Users\All Users\Brother
    2012-06-20 21:27 - 2012-06-20 21:27 - 00000000 ____D C:\Users\All Users\regid.1986-12.com.adobe
    2012-06-20 21:27 - 2012-06-20 13:02 - 00000000 ____D C:\Users\Chris\AppData\Local\Adobe
    2012-06-20 21:27 - 2011-03-23 18:29 - 00000000 ____D C:\Users\All Users\Adobe
    2012-06-20 19:35 - 2012-06-20 19:35 - 00955840 ____A (Oracle Corporation) C:\Windows\System32\npDeployJava1.dll
    2012-06-20 19:35 - 2012-06-20 19:35 - 00839096 ____A (Oracle Corporation) C:\Windows\System32\deployJava1.dll
    2012-06-20 19:35 - 2012-06-20 19:35 - 00268720 ____A (Oracle Corporation) C:\Windows\System32\javaws.exe
    2012-06-20 19:35 - 2012-06-20 19:35 - 00189360 ____A (Oracle Corporation) C:\Windows\System32\javaw.exe
    2012-06-20 19:35 - 2012-06-20 19:35 - 00188840 ____A (Oracle Corporation) C:\Windows\System32\java.exe
    2012-06-20 19:35 - 2012-06-20 19:35 - 00000000 ____D C:\Program Files\Java
    2012-06-20 18:02 - 2012-06-20 13:07 - 00000000 ____D C:\Users\Chris\AppData\Roaming\uTorrent
    2012-06-20 17:50 - 2012-06-20 14:42 - 00000000 ____D C:\Program Files\Google
    2012-06-20 17:50 - 2012-06-20 14:42 - 00000000 ____D C:\Program Files (x86)\Google
    2012-06-20 17:44 - 2012-06-20 14:33 - 00000000 ____D C:\Program Files (x86)\TOSHIBA Games
    2012-06-20 17:43 - 2012-06-20 14:33 - 00000000 ____D C:\Users\All Users\WildTangent
    2012-06-20 17:42 - 2011-03-23 18:27 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
    2012-06-20 17:42 - 2011-03-23 18:27 - 00000000 ____D C:\Program Files\Toshiba
    2012-06-20 17:40 - 2011-03-23 18:28 - 00000000 ____D C:\Program Files (x86)\TOSHIBA
    2012-06-20 17:39 - 2012-06-20 14:40 - 00000000 ____D C:\Program Files (x86)\TOSHIBA Corporation
    2012-06-20 17:39 - 2012-06-20 14:35 - 00000000 ____D C:\Users\All Users\Google
    2012-06-20 17:32 - 2012-06-20 17:32 - 00000000 ____D C:\Program Files\CCleaner
    2012-06-20 17:20 - 2012-06-20 17:20 - 00000000 ____D C:\Users\Chris\Documents\Rainmeter
    2012-06-20 17:01 - 2012-06-20 17:01 - 00000000 ____D C:\Users\Chris\Documents\Car
    2012-06-20 16:57 - 2012-06-20 16:52 - 00000000 ____D C:\Program Files (x86)\DVDFab 8
    2012-06-20 16:53 - 2012-06-20 16:53 - 00000000 ____D C:\Users\Chris\Documents\DVDFab
    2012-06-20 16:51 - 2012-06-20 16:51 - 00726016 ____A (Igor Pavlov) C:\Windows\SysWOW64\7z.dll
    2012-06-20 16:51 - 2012-06-20 16:51 - 00000000 ____D C:\Users\All Users\Xilisoft
    2012-06-20 16:51 - 2012-06-20 16:51 - 00000000 ____D C:\Program Files (x86)\Xilisoft
    2012-06-20 16:50 - 2012-06-20 16:50 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Malwarebytes
    2012-06-20 16:45 - 2011-03-23 18:29 - 00000000 ____D C:\Program Files (x86)\Adobe
    2012-06-20 16:34 - 2012-06-20 16:33 - 00000000 ____D C:\Program Files\Common Files\Adobe
    2012-06-20 16:34 - 2012-06-20 16:33 - 00000000 ____D C:\Program Files\Adobe
    2012-06-20 16:31 - 2012-06-20 13:07 - 00000000 ____D C:\Program Files\WinRAR
    2012-06-20 16:25 - 2012-06-20 15:51 - 00000000 ____D C:\Windows\AutoKMS
    2012-06-20 15:50 - 2009-07-13 21:01 - 00108227 ____A C:\Windows\SysWOW64\license.rtf
    2012-06-20 15:50 - 2009-07-13 21:01 - 00108227 ____A C:\Windows\System32\license.rtf
    2012-06-20 15:49 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache
    2012-06-20 15:41 - 2012-06-20 15:41 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
    2012-06-20 15:41 - 2010-11-20 23:16 - 00000000 ____D C:\Windows\ShellNew
    2012-06-20 15:40 - 2012-06-20 15:40 - 00000000 ____D C:\Program Files\Microsoft Synchronization Services
    2012-06-20 15:40 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files (x86)\MSBuild
    2012-06-20 15:39 - 2012-06-20 15:39 - 00000000 ____D C:\Program Files\Microsoft Sync Framework
    2012-06-20 15:39 - 2012-06-20 15:39 - 00000000 ____D C:\Program Files\Microsoft SQL Server Compact Edition
    2012-06-20 15:39 - 2012-06-20 15:34 - 00000000 ____D C:\Program Files\Microsoft Office
    2012-06-20 15:37 - 2012-06-20 15:37 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 8
    2012-06-20 15:35 - 2012-06-20 15:35 - 00000000 ____D C:\Program Files\Microsoft Analysis Services
    2012-06-20 15:35 - 2012-06-20 15:35 - 00000000 ____D C:\Program Files (x86)\Microsoft Analysis Services
    2012-06-20 15:34 - 2012-06-20 15:34 - 00000000 __RHD C:\MSOCache
    2012-06-20 15:34 - 2012-06-20 15:34 - 00000000 ____D C:\Users\Chris\AppData\Local\Microsoft Help
    2012-06-20 15:34 - 2011-03-23 18:40 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
    2012-06-20 15:29 - 2012-06-20 13:07 - 00000000 ____D C:\Users\Chris\AppData\Roaming\WinRAR
    2012-06-20 15:29 - 2012-06-20 12:53 - 00000000 ____D C:\Users\Chris\AppData\Local\VirtualStore
    2012-06-20 15:05 - 2009-07-13 21:38 - 00025600 __ASH C:\Windows\System32\config\BCD-Template.LOG
    2012-06-20 15:05 - 2009-07-13 21:32 - 00028672 ____A C:\Windows\System32\config\BCD-Template
    2012-06-20 14:42 - 2011-03-23 18:30 - 00000000 ____D C:\Users\All Users\Toshiba
    2012-06-20 14:41 - 2012-06-20 14:41 - 00000000 ___HD C:\Windows\msdownld.tmp
    2012-06-20 14:41 - 2012-06-20 14:41 - 00000000 ____D C:\Program Files (x86)\Corel
    2012-06-20 14:36 - 2012-06-20 14:36 - 00000000 ____D C:\Program Files (x86)\Toshiba Online Backup
    2012-06-20 14:26 - 2011-03-23 18:28 - 00000000 ____D C:\Windows\Downloaded Installations
    2012-06-20 14:23 - 2012-06-20 14:23 - 00000000 ____D C:\Windows\SysWOW64\sda
    2012-06-20 14:23 - 2012-06-20 14:23 - 00000000 ____D C:\Program Files (x86)\Realtek
    2012-06-20 14:22 - 2012-06-20 14:22 - 00000000 ____D C:\Windows\SysWOW64\Atheros_L1e
    2012-06-20 14:21 - 2012-06-20 14:21 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_SynTP_01009.Wdf
    2012-06-20 14:21 - 2012-06-20 14:21 - 00000000 ____D C:\Program Files\Synaptics
    2012-06-20 14:21 - 2012-06-20 14:21 - 00000000 ____D C:\Program Files (x86)\Cisco
    2012-06-20 14:21 - 2012-06-20 14:20 - 00000000 ____D C:\Program Files (x86)\Realtek WLAN Driver
    2012-06-20 14:18 - 2012-06-20 14:18 - 00000000 ____D C:\Program Files\CONEXANT
    2012-06-20 14:13 - 2012-06-20 14:13 - 00015828 ____A C:\Windows\System32\results.xml
    2012-06-20 14:13 - 2011-03-23 18:41 - 00000000 ____D C:\Program Files (x86)\Intel
    2012-06-20 14:11 - 2012-06-20 14:11 - 00000000 ____D C:\Program Files\Common Files\Intel
    2012-06-20 14:11 - 2012-06-20 14:11 - 00000000 ____D C:\Intel
    2012-06-20 13:31 - 2012-06-20 13:31 - 00000000 ____D C:\Program Files (x86)\FileHippo.com
    2012-06-20 13:27 - 2012-06-20 12:51 - 00000000 ____D C:\users\Chris
    2012-06-20 13:26 - 2012-06-20 13:26 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Apple Computer
    2012-06-20 13:17 - 2012-06-20 13:17 - 00731106 ____A C:\Windows\SysWOW64\PerfStringBackup.INI
    2012-06-20 13:17 - 2012-06-20 13:17 - 00001945 ____A C:\Windows\epplauncher.mif
    2012-06-20 13:17 - 2012-06-20 13:17 - 00000000 ____D C:\Program Files\Microsoft Security Client
    2012-06-20 13:17 - 2012-06-20 13:17 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
    2012-06-20 13:16 - 2012-06-20 13:16 - 00000000 ____D C:\Users\All Users\Malwarebytes
    2012-06-20 13:16 - 2012-06-20 13:16 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2012-06-20 13:16 - 2012-06-20 12:55 - 00000000 ____D C:\Users\Chris\AppData\Local\Google
    2012-06-20 13:15 - 2012-06-20 13:15 - 00000000 ____D C:\Users\Chris\AppData\Local\Paint.NET
    2012-06-20 13:15 - 2012-06-20 13:15 - 00000000 ____D C:\Program Files\Paint.NET
    2012-06-20 13:14 - 2012-06-20 13:14 - 00000000 ____D C:\Users\Chris\AppData\Local\Apple
    2012-06-20 13:14 - 2012-06-20 13:14 - 00000000 ____D C:\Users\All Users\Apple Computer
    2012-06-20 13:14 - 2012-06-20 13:14 - 00000000 ____D C:\Users\All Users\Apple
    2012-06-20 13:14 - 2012-06-20 13:14 - 00000000 ____D C:\Program Files (x86)\QuickTime
    2012-06-20 13:14 - 2012-06-20 13:14 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
    2012-06-20 13:10 - 2012-06-20 13:10 - 00000000 ___RD C:\Program Files (x86)\Skype
    2012-06-20 13:10 - 2012-06-20 13:10 - 00000000 ____D C:\Program Files (x86)\VideoLAN
    2012-06-20 13:10 - 2012-06-20 13:09 - 00000000 ____D C:\Users\All Users\Skype
    2012-06-20 13:09 - 2012-06-20 13:09 - 00000000 ____D C:\Program Files (x86)\Audacity
    2012-06-20 13:08 - 2012-06-20 13:08 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
    2012-06-20 13:08 - 2012-06-20 13:08 - 00000000 ____D C:\Program Files (x86)\ImgBurn
    2012-06-20 13:08 - 2012-06-20 13:08 - 00000000 ____D C:\Program Files (x86)\Auslogics
    2012-06-20 13:07 - 2012-06-20 13:07 - 00000000 ____D C:\Program Files (x86)\uTorrent
    2012-06-20 13:06 - 2012-06-20 12:55 - 00000000 ____D C:\Users\Chris\AppData\Local\TOSHIBA
    2012-06-20 13:03 - 2012-06-20 13:03 - 00000000 ____D C:\Windows\SysWOW64\Adobe
    2012-06-20 13:02 - 2012-06-20 13:02 - 00476936 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\npdeployJava1.dll
    2012-06-20 13:02 - 2012-06-20 13:02 - 00157448 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaws.exe
    2012-06-20 13:02 - 2012-06-20 13:02 - 00149256 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaw.exe
    2012-06-20 13:02 - 2012-06-20 13:02 - 00149256 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\java.exe
    2012-06-20 13:02 - 2012-06-20 13:02 - 00000000 ____D C:\Program Files (x86)\Java
    2012-06-20 13:02 - 2011-03-23 18:26 - 00472840 ____A (Sun Microsystems, Inc.) C:\Windows\SysWOW64\deployJava1.dll
    2012-06-20 13:01 - 2012-06-20 13:01 - 00000000 ____D C:\Windows\System32\Macromed
    2012-06-20 12:56 - 2012-06-20 12:56 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Toshiba
    2012-06-20 12:53 - 2012-06-20 12:53 - 00000013 __RSH C:\Windows\System32\Drivers\fbd.sys
    2012-06-20 12:53 - 2010-11-20 23:06 - 00000000 ____D C:\Windows\SysWOW64\sysprep
    2012-06-20 12:53 - 2009-07-13 19:20 - 00000000 ___AD C:\Windows\System32\sysprep
    2012-06-20 12:52 - 2012-06-20 12:52 - 00000000 ____D C:\Users\Chris\AppData\Roaming\WinBatch
    2012-06-20 12:51 - 2012-06-20 12:51 - 00000020 ___SH C:\Users\Chris\ntuser.ini
    2012-06-20 12:51 - 2009-07-13 21:32 - 00000000 ____D C:\Windows\System32\restore
    2012-06-20 12:51 - 2009-07-13 19:20 - 00000000 __RHD C:\Users\Public\Libraries
    2012-06-11 10:17 - 2012-06-11 10:17 - 00071680 ____A (Beepa P/L) C:\Windows\System32\frapsv64.dll
    2012-06-11 10:17 - 2012-06-11 10:17 - 00065536 ____A (Beepa P/L) C:\Windows\SysWOW64\frapsvid.dll
    2012-06-03 19:28 - 2012-06-22 09:06 - 58957832 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
    2012-06-02 14:19 - 2012-06-21 13:33 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
    2012-06-02 14:19 - 2012-06-21 13:33 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
    2012-06-02 14:19 - 2012-06-21 13:33 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
    2012-06-02 14:19 - 2012-06-21 13:33 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
    2012-06-02 14:19 - 2012-06-21 13:33 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
    2012-06-02 14:15 - 2012-06-21 13:33 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
    2012-06-02 14:15 - 2012-06-21 13:33 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
    2012-06-02 11:19 - 2012-06-21 13:33 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
    2012-06-02 11:15 - 2012-06-21 13:33 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
    2012-05-14 17:32 - 2012-06-20 23:11 - 03146752 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
    2012-05-04 03:06 - 2012-06-20 23:12 - 05559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
    2012-05-04 03:00 - 2012-06-22 09:04 - 00366592 ____A (Microsoft Corporation) C:\Windows\System32\qdvd.dll
    2012-05-04 02:03 - 2012-06-20 23:12 - 03968368 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
    2012-05-04 02:03 - 2012-06-20 23:12 - 03913072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
    2012-05-04 01:59 - 2012-06-22 09:04 - 00514560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
    2012-04-30 21:40 - 2012-06-20 23:12 - 00209920 ____A (Microsoft Corporation) C:\Windows\System32\profsvc.dll
    2012-04-27 19:55 - 2012-06-20 23:11 - 00210944 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
    2012-04-25 21:41 - 2012-06-20 23:12 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
    2012-04-25 21:41 - 2012-06-20 23:12 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
    2012-04-25 21:34 - 2012-06-20 23:12 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
    2012-04-23 21:37 - 2012-06-20 23:11 - 01462272 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
    2012-04-23 21:37 - 2012-06-20 23:11 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
    2012-04-23 21:37 - 2012-06-20 23:11 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
    2012-04-23 20:36 - 2012-06-20 23:11 - 01158656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
    2012-04-23 20:36 - 2012-06-20 23:11 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
    2012-04-23 20:36 - 2012-06-20 23:11 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
    2012-04-18 16:56 - 2012-04-18 16:56 - 00094208 ____A (Apple Inc.) C:\Windows\SysWOW64\QuickTimeVR.qtx
    2012-04-18 16:56 - 2012-04-18 16:56 - 00069632 ____A (Apple Inc.) C:\Windows\SysWOW64\QuickTime.qts
    2012-04-07 04:31 - 2012-06-20 23:11 - 03216384 ____A (Microsoft Corporation) C:\Windows\System32\msi.dll
    2012-04-07 03:26 - 2012-06-20 23:11 - 02342400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
    2012-04-04 11:56 - 2012-06-20 13:16 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
    2012-04-03 21:53 - 2012-04-03 21:53 - 00053656 ____A (Adobe Systems Inc) C:\Windows\System32\AdobePDF.dll
    2012-04-03 21:53 - 2012-04-03 21:53 - 00024984 ____A (Adobe Systems Inc.) C:\Windows\System32\AdobePDFUI.dll
    2012-03-30 03:35 - 2012-06-20 23:10 - 01918320 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys

    ZeroAccess:
    C:\Windows\Installer\{82b1ed88-8914-1ba4-e7ad-bdae9040b190}
    C:\Windows\Installer\{82b1ed88-8914-1ba4-e7ad-bdae9040b190}\@
    C:\Windows\Installer\{82b1ed88-8914-1ba4-e7ad-bdae9040b190}\L
    C:\Windows\Installer\{82b1ed88-8914-1ba4-e7ad-bdae9040b190}\n
    C:\Windows\Installer\{82b1ed88-8914-1ba4-e7ad-bdae9040b190}\U
    C:\Windows\Installer\{82b1ed88-8914-1ba4-e7ad-bdae9040b190}\U\00000001.@
    C:\Windows\Installer\{82b1ed88-8914-1ba4-e7ad-bdae9040b190}\U\80000000.@
    C:\Windows\Installer\{82b1ed88-8914-1ba4-e7ad-bdae9040b190}\U\800000cb.@

    ZeroAccess:
    C:\Users\Chris\AppData\Local\{82b1ed88-8914-1ba4-e7ad-bdae9040b190}
    C:\Users\Chris\AppData\Local\{82b1ed88-8914-1ba4-e7ad-bdae9040b190}\@
    C:\Users\Chris\AppData\Local\{82b1ed88-8914-1ba4-e7ad-bdae9040b190}\L
    C:\Users\Chris\AppData\Local\{82b1ed88-8914-1ba4-e7ad-bdae9040b190}\n
    C:\Users\Chris\AppData\Local\{82b1ed88-8914-1ba4-e7ad-bdae9040b190}\U

    ========================= Known DLLs (Whitelisted) ============


    ========================= Bamital & volsnap Check ============

    C:\Windows\System32\winlogon.exe => MD5 is legit
    C:\Windows\System32\wininit.exe => MD5 is legit
    C:\Windows\SysWOW64\wininit.exe => MD5 is legit
    C:\Windows\explorer.exe => MD5 is legit
    C:\Windows\SysWOW64\explorer.exe => MD5 is legit
    C:\Windows\System32\svchost.exe => MD5 is legit
    C:\Windows\SysWOW64\svchost.exe => MD5 is legit
    C:\Windows\System32\services.exe 014A9CB92514E27C0107614DF764BC06 ZeroAccess <==== ATTENTION!.
    C:\Windows\System32\User32.dll => MD5 is legit
    C:\Windows\SysWOW64\User32.dll => MD5 is legit
    C:\Windows\System32\userinit.exe => MD5 is legit
    C:\Windows\SysWOW64\userinit.exe => MD5 is legit
    C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

    ==================== EXE ASSOCIATION =====================

    HKLM\...\.exe: exefile => OK
    HKLM\...\exefile\DefaultIcon: %1 => OK
    HKLM\...\exefile\open\command: "%1" %* => OK

    ========================= Memory info ======================

    Percentage of memory in use: 10%
    Total physical RAM: 6091.86 MB
    Available physical RAM: 5433.65 MB
    Total Pagefile: 6090.06 MB
    Available Pagefile: 5417.87 MB
    Total Virtual: 8192 MB
    Available Virtual: 8191.9 MB

    ======================= Partitions =========================

    1 Drive c: (TI106139W0E) (Fixed) (Total:580.98 GB) (Free:500.84 GB) NTFS ==>[System with boot components (obtained from reading drive)]
    2 Drive d: (System) (Fixed) (Total:1.46 GB) (Free:1.27 GB) NTFS ==>[System with boot components (obtained from reading drive)]
    4 Drive f: () (Removable) (Total:1.85 GB) (Free:1.85 GB) FAT
    5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

    Disk ### Status Size Free Dyn Gpt
    -------- ------------- ------- ------- --- ---
    Disk 0 Online 596 GB 0 B
    Disk 1 Online 1901 MB 0 B

    Partitions of Disk 0:
    ===============

    Partition ### Type Size Offset
    ------------- ---------------- ------- -------
    Partition 1 Recovery 1500 MB 1024 KB
    Partition 2 Primary 580 GB 1501 MB
    Partition 3 Primary 13 GB 582 GB

    ======================================================================================================

    Disk: 0
    Partition 1
    Type : 27
    Hidden: Yes
    Active: Yes

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 2 D System NTFS Partition 1500 MB Healthy Hidden

    ======================================================================================================

    Disk: 0
    Partition 2
    Type : 07
    Hidden: No
    Active: No

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 1 C TI106139W0E NTFS Partition 580 GB Healthy

    ======================================================================================================

    Disk: 0
    Partition 3
    Type : 17 (Suspicious Type)
    Hidden: Yes
    Active: No

    There is no volume associated with this partition.

    ======================================================================================================

    Partitions of Disk 1:
    ===============

    Partition ### Type Size Offset
    ------------- ---------------- ------- -------
    Partition 1 Primary 1899 MB 1280 KB

    ======================================================================================================

    Disk: 1
    Partition 1
    Type : 06
    Hidden: No
    Active: No

    Volume ### Ltr Label Fs Type Size Status Info
    ---------- --- ----------- ----- ---------- ------- --------- --------
    * Volume 3 F FAT Removable 1899 MB Healthy

    ======================================================================================================

    ==========================================================

    Last Boot: 2011-03-23 18:16

    ======================= End Of Log ==========================
     
  12. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Yep.
    You're infected with ZeroAccess rootkit again.
    How did you manage?....LOL

    In Vista or Windows 7: Boot to System Recovery Options and run FRST.
    In Windows XP: Please boot to UBCD and run FRST.
    Type the following in the edit box after "Search:".

    services.exe

    Click Search button and post the log (Search.txt) it makes to your reply.
     
  13. Snazzy_C

    Snazzy_C TS Member Topic Starter Posts: 42

    hahahaha I have no idea. Maybe it's on my backup drive? What should I use to scan that/ how should I go about it? anyway... one sec I'll post the log.
     
  14. Snazzy_C

    Snazzy_C TS Member Topic Starter Posts: 42

    Farbar Recovery Scan Tool Version: 25-06-2012
    Ran by SYSTEM at 2012-06-25 20:30:37
    Running from F:\

    ================== Search: "services.exe" ===================

    C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
    [2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

    C:\Windows\System32\services.exe
    [2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 014A9CB92514E27C0107614DF764BC06

    ====== End Of Search ======
     
  15. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    You definitely have to scan backup drive with your AV program.

    Download attached fixlist.txt file and save it to the very same USB flash drive you've been using. Plug the drive back in.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    On Vista or Windows 7: Now please enter System Recovery Options.
    On Windows XP: Now please boot into the UBCD.
    Run FRST64 and press the Fix button just once and wait.
    The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

    Next....

    Restart normally.

    Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
    There are 4 different versions. If one of them won't run then download and try to run the other one.
    Vista and Win7 users need to right click Rkill and choose Run as Administrator
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    * Rkill.com
    * Rkill.scr
    * Rkill.exe
    • Double-click on the Rkill icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.
    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     

    Attached Files:

  16. Snazzy_C

    Snazzy_C TS Member Topic Starter Posts: 42

    Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 25-06-2012
    Ran by SYSTEM at 2012-06-25 21:01:38 Run:1
    Running from G:\

    ==============================================

    HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Session Manager\SubSystems\\Windows Value was restored successfully .
    C:\Windows\System32\consrv.dll not found.
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ Default Value restored successfully.
    HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ Default Value restored successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\\netsvcs Mcx2Svc Deleted successfully.
    C:\Windows\Installer\{82b1ed88-8914-1ba4-e7ad-bdae9040b190} moved successfully.
    C:\Users\Chris\AppData\Local\{82b1ed88-8914-1ba4-e7ad-bdae9040b190} moved successfully.
    C:\Windows\System32\services.exe moved successfully.
    C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe copied successfully to C:\Windows\System32\services.exe

    ==== End of Fixlog ====
     
  17. Snazzy_C

    Snazzy_C TS Member Topic Starter Posts: 42

    ComboFix 12-06-25.04 - Chris 06/25/2012 21:10:16.1.4 - x64
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6092.4849 [GMT -4:00]
    Running from: c:\users\Chris\Desktop\ComboFix.exe
    AV: Microsoft Security Essentials *Enabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
    SP: Microsoft Security Essentials *Enabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    * Created a new restore point
    .
    .
    ((((((((((((((((((((((((( Files Created from 2012-05-26 to 2012-06-26 )))))))))))))))))))))))))))))))
    .
    .
    2012-06-26 04:06 . 2012-06-26 04:08 -------- d-----w- C:\FRST
    2012-06-25 19:05 . 2012-06-25 19:05 -------- d-sh--w- c:\windows\system32\%APPDATA%
    2012-06-24 21:09 . 2012-05-31 01:04 9013136 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9469672F-8B0A-40B4-BF74-4B1568DD1E66}\mpengine.dll
    2012-06-23 20:04 . 2012-05-31 01:04 9013136 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
    2012-06-22 17:04 . 2012-05-04 11:00 366592 ----a-w- c:\windows\system32\qdvd.dll
    2012-06-22 17:04 . 2012-05-04 09:59 514560 ----a-w- c:\windows\SysWow64\qdvd.dll
    2012-06-22 05:04 . 2012-06-22 05:04 1888256 ----a-w- c:\windows\SysWow64\Mcx2Svc.dll
    2012-06-21 21:33 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
    2012-06-21 21:33 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
    2012-06-21 21:33 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
    2012-06-21 21:33 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
    2012-06-21 21:33 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
    2012-06-21 21:33 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
    2012-06-21 21:33 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
    2012-06-21 21:33 . 2012-06-02 19:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
    2012-06-21 21:33 . 2012-06-02 19:15 36864 ----a-w- c:\windows\system32\wuapp.exe
    2012-06-21 12:18 . 2012-06-21 12:18 -------- d-----w- c:\windows\SysWow64\Wat
    2012-06-21 12:18 . 2012-06-21 12:18 -------- d-----w- c:\windows\system32\Wat
    2012-06-21 08:38 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys
    2012-06-21 08:38 . 2012-03-01 06:38 220672 ----a-w- c:\windows\system32\wintrust.dll
    2012-06-21 08:38 . 2012-03-01 06:33 81408 ----a-w- c:\windows\system32\imagehlp.dll
    2012-06-21 08:38 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll
    2012-06-21 08:38 . 2012-03-01 05:37 172544 ----a-w- c:\windows\SysWow64\wintrust.dll
    2012-06-21 08:38 . 2012-03-01 05:33 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
    2012-06-21 08:38 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll
    2012-06-21 08:19 . 2012-06-21 08:30 -------- d-----w- c:\programdata\Brother
    2012-06-21 07:12 . 2011-07-09 02:46 288768 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
    2012-06-21 07:11 . 2012-05-15 01:32 3146752 ----a-w- c:\windows\system32\win32k.sys
    2012-06-21 07:10 . 2011-05-03 05:29 976896 ----a-w- c:\windows\system32\inetcomm.dll
    2012-06-21 05:27 . 2012-06-21 05:27 -------- d-----w- c:\programdata\regid.1986-12.com.adobe
    2012-06-21 03:35 . 2012-06-21 03:35 955840 ----a-w- c:\windows\system32\npDeployJava1.dll
    2012-06-21 03:35 . 2012-06-21 03:35 839096 ----a-w- c:\windows\system32\deployJava1.dll
    2012-06-21 03:35 . 2012-06-21 03:35 -------- d-----w- c:\program files\Java
    2012-06-21 01:32 . 2012-06-21 01:32 -------- d-----w- c:\program files\CCleaner
    2012-06-21 01:21 . 2012-06-21 01:49 -------- d-----w- c:\program files (x86)\Common Files\Symantec Shared
    2012-06-21 00:52 . 2012-06-21 00:57 -------- d-----w- c:\program files (x86)\DVDFab 8
    2012-06-21 00:51 . 2012-06-21 00:51 726016 ----a-w- c:\windows\SysWow64\7z.dll
    2012-06-21 00:51 . 2012-06-21 00:51 -------- d-----w- c:\programdata\Xilisoft
    2012-06-21 00:51 . 2012-06-21 00:51 -------- d-----w- c:\program files (x86)\Xilisoft
    2012-06-21 00:37 . 2012-06-25 02:28 -------- d-----w- C:\Fraps
    2012-06-21 00:33 . 2012-06-21 00:34 -------- d-----w- c:\program files\Common Files\Adobe
    2012-06-21 00:25 . 2012-06-26 01:16 151552 ----a-w- c:\windows\KMSEmulator.exe
    2012-06-20 23:51 . 2012-06-21 00:25 -------- d-----w- c:\windows\AutoKMS
    2012-06-20 23:40 . 2012-06-20 23:40 -------- d-----w- c:\program files\Microsoft Synchronization Services
    2012-06-20 23:39 . 2012-06-23 12:16 -------- d-----w- c:\program files (x86)\Microsoft.NET
    2012-06-20 23:39 . 2012-06-20 23:39 -------- d-----w- c:\program files\Microsoft Sync Framework
    2012-06-20 23:39 . 2012-06-20 23:39 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
    2012-06-20 23:37 . 2012-06-20 23:37 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 8
    2012-06-20 23:35 . 2012-06-20 23:35 -------- d-----w- c:\program files\Microsoft Analysis Services
    2012-06-20 23:35 . 2012-06-20 23:35 -------- d-----w- c:\program files (x86)\Microsoft Analysis Services
    2012-06-20 23:34 . 2012-06-21 08:59 -------- d-----w- c:\programdata\Microsoft Help
    2012-06-20 23:34 . 2012-06-20 23:34 -------- d-----r- C:\MSOCache
    2012-06-20 22:43 . 2012-06-20 22:43 -------- d-----w- c:\program files (x86)\Common Files\Toshiba Shared
    2012-06-20 22:42 . 2012-06-21 01:50 -------- d-----w- c:\program files\Google
    2012-06-20 22:42 . 2012-06-21 01:50 -------- d-----w- c:\program files (x86)\Google
    2012-06-20 22:40 . 2012-06-21 01:39 -------- d-----w- c:\program files (x86)\TOSHIBA Corporation
    2012-06-20 22:36 . 2012-06-25 03:49 -------- d-----w- c:\programdata\Norton
    2012-06-20 22:36 . 2012-06-20 22:36 -------- d-----w- c:\program files (x86)\Toshiba Online Backup
    2012-06-20 22:33 . 2012-06-21 01:44 -------- d-----w- c:\program files (x86)\TOSHIBA Games
    2012-06-20 22:33 . 2012-06-21 01:43 -------- d-----w- c:\programdata\WildTangent
    2012-06-20 22:26 . 2009-07-31 03:22 27784 ----a-w- c:\windows\system32\drivers\tdcmdpst.sys
    2012-06-20 22:24 . 2011-02-09 02:07 38096 ----a-w- c:\windows\system32\drivers\PGEffect.sys
    2012-06-20 22:23 . 2012-06-20 22:23 -------- d-----w- c:\windows\SysWow64\sda
    2012-06-20 22:23 . 2012-06-20 22:23 -------- d-----w- c:\program files (x86)\Realtek
    2012-06-20 22:23 . 2010-12-01 23:12 9888360 ----a-w- c:\windows\SysWow64\RtsUStoricon.dll
    2012-06-20 22:23 . 2010-12-01 23:12 422504 ----a-w- c:\windows\system32\RtsUStor.dll
    2012-06-20 22:23 . 2010-12-01 23:12 250984 ----a-w- c:\windows\system32\drivers\RtsUStor.sys
    2012-06-20 22:23 . 2010-11-30 21:40 307304 ----a-w- c:\windows\system32\drivers\rtsuvstor.sys
    2012-06-20 22:22 . 2012-06-20 22:22 -------- d-----w- c:\windows\SysWow64\Atheros_L1e
    2012-06-20 22:21 . 2012-06-20 22:21 -------- d-----w- c:\program files\Synaptics
    2012-06-20 22:21 . 2011-02-17 23:42 99320 ----a-w- c:\windows\system32\tosWirelessLANIndicatorCP.dll
    2012-06-20 22:21 . 2010-03-18 16:36 827728 ----a-w- c:\windows\system32\msvcr100.dll
    2012-06-20 22:21 . 2010-03-18 16:36 607568 ----a-w- c:\windows\system32\msvcp100.dll
    2012-06-20 22:21 . 2012-06-20 22:21 -------- d-----w- c:\program files (x86)\Cisco
    2012-06-20 22:20 . 2012-06-20 22:21 -------- d-----w- c:\program files (x86)\Realtek WLAN Driver
    2012-06-20 22:20 . 2011-01-05 08:08 1109096 ----a-w- c:\windows\system32\drivers\rtl8192ce.sys
    2012-06-20 22:20 . 2010-12-22 23:24 626792 ----a-w- c:\windows\system32\drivers\rtl819xp.sys
    2012-06-20 22:20 . 2010-12-17 23:04 1221224 ----a-w- c:\windows\system32\drivers\rtl8192se.sys
    2012-06-20 22:20 . 2010-04-01 21:01 442368 ----a-w- c:\windows\system32\drivers\rtl8187Se.sys
    2012-06-20 22:20 . 2010-03-31 18:10 450048 ----a-w- c:\windows\system32\drivers\rtl8187B.sys
    2012-06-20 22:20 . 2009-02-05 09:49 451072 ------w- c:\windows\SysWow64\ISSRemoveSP.exe
    2012-06-20 22:18 . 2012-06-20 22:18 -------- d-----w- c:\program files\CONEXANT
    2012-06-20 22:15 . 1999-10-13 01:47 24576 ----a-w- c:\windows\SysWow64\TSCI.dll
    2012-06-20 22:15 . 1999-10-13 01:45 24576 ----a-w- c:\windows\SysWow64\THCI.dll
    2012-06-20 22:13 . 2011-01-13 00:51 439320 ----a-w- c:\windows\system32\drivers\iaStor.sys
    2012-06-20 22:11 . 2012-06-20 22:11 -------- d-----w- c:\program files\Common Files\Intel
    2012-06-20 22:11 . 2012-06-20 22:11 -------- d-----w- c:\program files (x86)\Common Files\Intel
    2012-06-20 22:11 . 2012-06-20 22:11 -------- d-----w- C:\Intel
    2012-06-20 22:10 . 2010-12-21 01:08 8192 ----a-w- c:\windows\system32\drivers\IntelMEFWVer.dll
    2012-06-20 22:10 . 2012-06-20 22:10 -------- d-----w- c:\program files (x86)\Common Files\postureAgent
    2012-06-20 21:31 . 2012-06-20 21:31 -------- d-----w- c:\program files (x86)\FileHippo.com
    2012-06-20 21:20 . 2012-06-20 21:20 927800 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6B8EB480-2EB0-47B2-8BBD-C7654B7A662A}\gapaengine.dll
    2012-06-20 21:17 . 2012-06-20 21:17 -------- d-----w- c:\program files (x86)\Microsoft Security Client
    2012-06-20 21:17 . 2012-06-20 21:17 -------- d-----w- c:\program files\Microsoft Security Client
    2012-06-20 21:16 . 2012-06-20 21:16 -------- d-----w- c:\programdata\Malwarebytes
    2012-06-20 21:16 . 2012-06-20 21:16 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
    2012-06-20 21:16 . 2012-04-04 19:56 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
    2012-06-20 21:15 . 2012-06-20 21:15 -------- d-----w- c:\program files\Paint.NET
    2012-06-20 21:14 . 2012-06-20 21:14 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
    2012-06-20 21:14 . 2012-06-20 21:14 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
    2012-06-20 21:14 . 2012-06-20 21:14 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
    2012-06-20 21:14 . 2012-06-20 21:14 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
    2012-06-20 21:14 . 2012-06-20 21:14 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
    2012-06-20 21:14 . 2012-06-20 21:14 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
    2012-06-20 21:14 . 2012-06-20 21:14 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
    2012-06-20 21:14 . 2012-06-20 21:14 -------- d-----w- c:\program files (x86)\QuickTime
    2012-06-20 21:14 . 2012-06-20 21:14 -------- d-----w- c:\programdata\Apple Computer
    2012-06-20 21:14 . 2012-06-20 21:14 -------- d-----w- c:\program files (x86)\Apple Software Update
    2012-06-20 21:14 . 2012-06-20 21:14 -------- d-----w- c:\programdata\Apple
    2012-06-20 21:14 . 2012-06-20 21:14 -------- d-----w- c:\program files (x86)\Common Files\Apple
    2012-06-20 21:13 . 2012-06-21 00:48 -------- d-----w- c:\program files (x86)\Common Files\Adobe
    2012-06-20 21:10 . 2012-06-20 21:10 -------- d-----w- c:\program files (x86)\VideoLAN
    2012-06-20 21:10 . 2012-06-20 21:10 -------- d-----w- c:\program files (x86)\Common Files\Skype
    2012-06-20 21:10 . 2012-06-20 21:10 -------- d-----r- c:\program files (x86)\Skype
    2012-06-20 21:09 . 2012-06-20 21:10 -------- d-----w- c:\programdata\Skype
    2012-06-20 21:09 . 2012-06-20 21:09 -------- d-----w- c:\program files (x86)\Audacity
    2012-06-20 21:08 . 2012-06-20 21:08 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird
    2012-06-20 21:08 . 2012-06-20 21:08 -------- d-----w- c:\program files (x86)\ImgBurn
    2012-06-20 21:08 . 2012-06-20 21:08 -------- d-----w- c:\program files (x86)\Auslogics
    2012-06-20 21:07 . 2012-06-22 05:29 -------- d-----w- c:\program files (x86)\foobar2000
    2012-06-20 21:07 . 2012-06-20 21:07 -------- d-----w- c:\program files (x86)\uTorrent
    2012-06-20 21:03 . 2012-06-20 21:03 -------- d-----w- c:\windows\SysWow64\Adobe
    2012-06-20 21:03 . 2012-06-20 21:03 -------- d-----w- c:\program files (x86)\Common Files\Java
    2012-06-20 21:02 . 2012-06-20 21:02 476936 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
    2012-06-20 21:02 . 2012-06-20 21:02 -------- d-----w- c:\program files (x86)\Java
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2012-06-20 21:02 . 2011-03-24 02:26 472840 ----a-w- c:\windows\SysWow64\deployJava1.dll
    2012-06-20 20:52 . 2010-06-24 18:33 19736 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
    2012-04-19 00:56 . 2012-04-19 00:56 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
    2012-04-19 00:56 . 2012-04-19 00:56 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
    2012-04-04 05:53 . 2012-04-04 05:53 53656 ----a-w- c:\windows\system32\AdobePDF.dll
    2012-04-04 05:53 . 2012-04-04 05:53 24984 ----a-w- c:\windows\system32\AdobePDFUI.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2012-02-15 00:32 94208 ----a-w- c:\users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2012-02-15 00:32 94208 ----a-w- c:\users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2012-02-15 00:32 94208 ----a-w- c:\users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
    @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
    2012-02-15 00:32 94208 ----a-w- c:\users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2010-11-29 1294712]
    "NortonOnlineBackupReminder"="c:\program files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe" [2010-08-17 3218792]
    "ToshibaAppPlace"="c:\program files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe" [2010-09-23 552960]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
    "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888]
    "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
    "AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
    "Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2012-04-04 36760]
    "Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2012-04-04 815512]
    .
    c:\users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Dropbox.lnk - c:\users\Chris\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-6-13 27595032]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
    "aux"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
    .
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
    R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-20 136176]
    R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-20 136176]
    R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 51740536]
    R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
    R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]
    R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-10 174440]
    R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
    R3 RSUSBVSTOR;RTSUVSTOR.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RTSUVSTOR.sys [x]
    R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
    R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
    R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
    R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
    R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2010-11-29 54136]
    R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-12-08 137632]
    R3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2010-12-21 822704]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
    R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
    R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
    S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [x]
    S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
    S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]
    S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe [2011-03-02 266680]
    S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [x]
    S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-12-21 2656280]
    S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
    S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]
    S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
    S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
    S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [x]
    S3 QIOMem;Generic IO & Memory Access;c:\windows\system32\DRIVERS\QIOMem.sys [x]
    S3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;c:\windows\system32\DRIVERS\rtl8192Ce.sys [x]
    S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
    .
    .
    --- Other Services/Drivers In Memory ---
    .
    *NewlyCreated* - WS2IFSL
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2012-06-26 c:\windows\Tasks\AutoKMS.job
    - c:\windows\AutoKMS\AutoKMS.exe [2012-06-20 23:51]
    .
    2012-06-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-20 22:42]
    .
    2012-06-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-20 22:42]
    .
    .
    --------- X64 Entries -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2012-02-15 00:32 97792 ----a-w- c:\users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2012-02-15 00:32 97792 ----a-w- c:\users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2012-02-15 00:32 97792 ----a-w- c:\users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
    @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
    2012-02-15 00:32 97792 ----a-w- c:\users\Chris\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-08 167256]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-08 391000]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-08 418136]
    "SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2010-12-14 316032]
    "TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
    "TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-12-08 710040]
    "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168]
    "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]
    "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "LoadAppInit_DLLs"=0x0
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    uStart Page = hxxp://start.toshiba.com/g/
    mLocal Page = c:\windows\SysWOW64\blank.htm
    uInternet Settings,ProxyOverride = <local>
    IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
    IE: Se&nd to OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
    TCP: DhcpNameServer = 192.168.1.1
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Toolbar-Locked - (no file)
    Wow6432Node-HKLM-Run-TSleepSrv - %ProgramFiles(x86)%\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe
    SafeBoot-MsMpSvc
    Toolbar-Locked - (no file)
    HKLM-Run-TPwrMain - c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE
    HKLM-Run-HSON - c:\program files (x86)\TOSHIBA\TBS\HSON.exe
    HKLM-Run-TCrdMain - c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe
    HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
    HKLM-Run-Teco - c:\program files (x86)\TOSHIBA\TECO\Teco.exe
    HKLM-Run-TosWaitSrv - c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe
    HKLM-Run-TosReelTimeMonitor - c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.11"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    .
    **************************************************************************
    .
    Completion time: 2012-06-25 21:21:32 - machine was rebooted
    ComboFix-quarantined-files.txt 2012-06-26 01:21
    .
    Pre-Run: 563,801,620,480 bytes free
    Post-Run: 563,260,801,024 bytes free
    .
    - - End Of File - - E3EEAF3233173E96C251C859165F7956
     
  18. Snazzy_C

    Snazzy_C TS Member Topic Starter Posts: 42

    Some things that happened:

    Combofix said MSE was still running. It was disabled as much as I could disable it without uninstalling, checked running processes etc, no sign of it running, so ran Combofix anyway.

    When combofix was done, I couldn't start any programs, everything said it relied on registry keys which were marked for deletion. Rebooted, can start programs (like chrome) now.
     
  19. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Looks good.

    Is MSE working now?
    If not, reinstall it.
    Let me know.
     
  20. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    We posted at the same time.
     
  21. Snazzy_C

    Snazzy_C TS Member Topic Starter Posts: 42

    Will reinstall MSE.

    As an aside, do you think Nod32 is worth the cash?
     
  22. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    I can't really say. Never used it.
     
  23. Snazzy_C

    Snazzy_C TS Member Topic Starter Posts: 42

    Re-installed MSE, updated
     
  24. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Good :)

    Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/products/malwarebytes_free to your desktop.

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform quick scan, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad.
    * Post the log back here.

    Be sure to restart the computer.

    The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
    Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

    ===================================================

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\tasks\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /I " " /c
    dir /b "%systemroot%\*.exe" | find /I " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
  25. Snazzy_C

    Snazzy_C TS Member Topic Starter Posts: 42

    Malwarebytes Anti-Malware 1.61.0.1400
    www.malwarebytes.org

    Database version: v2012.06.25.10

    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 9.0.8112.16421
    Chris :: CHRISPC [administrator]

    6/25/2012 9:44:57 PM
    mbam-log-2012-06-25 (21-44-57).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 212754
    Time elapsed: 2 minute(s), 50 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    (end)
    One Sec for OTL logs
     

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...