Solved Problem with AVG not removing unknown rootkit

Foxiffer · Sep 15, 2012

I just ran gmer again (only prescan) this was the log I got. is the virus gone?

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit quick scan 2012-09-15 16:56:21
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD800JD-60LSA5 rev.10.01E03
Running: wo2ryh1c.exe; Driver: C:\DOCUME~1\FOXELL~1\LOCALS~1\Temp\pwdyipog.sys

---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\Ntfs \Ntfs avgidsfilterx.sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
---- EOF - GMER 1.0.15 ----

Broni · Sep 15, 2012

Create new restore point before proceeding with the following....

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
Double click on combofix.exe & follow the prompts.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try the following...

Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

Restart computer in safe mode

Double-click on the Rkill desktop icon to run the tool.
If using Vista or Windows 7 right-click on it and choose Run As Administrator.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
Do not reboot until instructed.
If the tool does not run from any of the links provided, please let me know.

When the scan is done Notepad will open with rKill.txt log.
NOTE. rKill.txt log will also be present on your desktop.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.

Foxiffer · Sep 16, 2012

Combfix is not running. It starts but freezes when combofix says output C/ folder xxxxxxxxxxxx. And I tried changing the name of combofix to my name, that didn't work either. Also my computer won't start in safe mode. It goes to bios screen I push F8 and click start in safe mode, it goes to a screen that says that some drivers are starting and it freezes on that screen. Also as a second point my computer hasn't been able to successfully reboot (since the last three weeks) such when a program like antivirus says it needs to reboot to clean the virus fully, I allow it to and it turns off, then on the bios screen it freezes. So I have to push the power button on the tower to restart. What do I do now?

Broni · Sep 16, 2012

Let's try to boot your computer using the Ultimate Boot CD for Windows (UBCD4win).

Please print this guide for future reference!

You will need a blank CD, a clean computer and a flash drive.

Please follow the steps below and let me know if you were successful. If you were unable to create the UBCD4win, please tell me what error messages you got and/or what steps you got hung up on.

:step1:

1. Download and Run Ultimate Boot CD for Windows

Save it to your Desktop.
Double-Click on the UBCD4Win.EXE that you just downloaded to your desktop.
Follow all of the instructions/prompts that come up.
NOTES:
- Do not install to a folder with spaces in it's name.
- Your Anti-Virus may report viruses or trojans when you extract UBCD4Win, these are "False-Positives." Read HERE for information regarding the files that normally trigger AV software.

2. Insert your XP CD with SP1/SP2/SP3 into a CD Rom drive

Double-Click on UBCD4WinBuilder.exe located in your C:\ubcd4win folder.
Click "I agree" to the Builders License.
Click NO to Search for Windows Installation Files
Make the following selections from the Main Screen that pops up:
- Builder
  - Sourcepath to Windows installation files)
    - Enter the path to the drive where your XP CD is located.
    - You can click on the "..." button on the right to navigate to the path as well.
  - Custom: (include files and folders from this directory)
    - No information is necessary, leave blank.
  - Output: (C:\ubcd4win\BartPE)
    - Keep the default BartPE
- Media output
  - Choose Create ISO image
  - Do not choose Burn to CD/DVD
  Please note: If your XP install disc is SP1 then please .....
  1. Disable- DComLaunch Service
  2. Enable- LargeIDE Fix
    
    This can be done by pressing the "Plugin" button and checking or unchecking the appropriate selections
  Also note: If you have a Dell XP install disc you will need to follow the instructions here
  http://www.ubcd4win.com/faq.htm#dell
3. Click on the "Build" button
- You will see the Windows EULA message. Click on I Agree
- You will now see the Build Screen. Let it run it's course
- When the Build is finished you can click close, then exit
4. Burn your ISO file to CD
- Please see HERE on how to burn an ISO to CD.

==========

:step2:

Next, from your clean computer:

Download Farbar Recovery Scan Tool
and save it to your flash drive.

Now plug your flashdrive back into your sick computer and follow the next instructions:

==========

:step3:

1. Restart Your sick Computer Using the UBCD4Win Disc That You Have Created

Insert the UBCD4Win disc in to one of your CD/DVD drives.
Restart your computer.
- The computer should choose to boot from the UBCD4Win CD automatically. If it doesn't and you are asked if you want to boot from CD, then choose that option.
In the window that pops up select Launch The Ultimate Boot CD For Windows and press Enter.
- It may take a little longer for the Desktop to appear than it does when you start your computer normally. Just let the process run itself until the desktop appears.
Once the desktop appears, you will receive a message asking: Do you want to start Network support?
- Click on Yes if you want to use the PE environment to get online post your log and reply by way of an Ethernet connection.
You should now have a desktop that looks like this:

==========

:step4:

Single click My computer from your UBCD4W desktop to navigate to the Farbar Recovery Scan Tool you saved to your flash drive.
Double click on it to begin running the tool.
When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your next reply.

Foxiffer · Sep 17, 2012

I tried to start in safe mode again and it started. so here is the rkill log and then the combofix log.

Rkill 2.3.15 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html
Program started at: 09/17/2012 01:24:21 AM in x86 mode.
Windows Version: Microsoft Windows XP Service Pack 3
Checking for Windows services to stop:
* No malware services found to stop.
Checking for processes to terminate:
* No malware processes found to kill.
Possibly Patched Files.
* C:\WINDOWS\system32\services.exe
* C:\WINDOWS\system32\lsass.exe
* C:\WINDOWS\system32\svchost.exe
* C:\WINDOWS\system32\svchost.exe
* C:\WINDOWS\system32\svchost.exe
* C:\WINDOWS\system32\svchost.exe
* C:\WINDOWS\system32\userinit.exe
* C:\WINDOWS\system32\wbem\wmiprvse.exe
Checking Registry for malware related settings:
* No issues found in the Registry.
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
Performing miscellaneous checks:
* Windows Firewall Disabled
[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = dword:00000000
Checking Windows Service Integrity:
* DNS Client (Dnscache) is not Running.
Startup Type set to: Disabled
* COM+ Event System (EventSystem) is not Running.
Startup Type set to: Manual
* Security Center (wscsvc) is not Running.
Startup Type set to: Automatic
* Automatic Updates (wuauserv) is not Running.
Startup Type set to: Automatic
* RpcSs => %SystemRoot%\system32\svchost.exe -k rpcss [Incorrect ImagePath]
Searching for Missing Digital Signatures:
* C:\WINDOWS\System32\appmgmts.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\appmgmts.dll : 167,936 : 08/21/2008 00:00 AM : d8849f77c0b66226335a59d26cb4edc6 [Pos Repl]
* C:\WINDOWS\System32\browser.dll [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB2705219\SP3QFE\browser.dll : 78,336 : 07/06/2012 00:58 AM : fc6d1d80588d371f0321e15a75b2f8f2 [Pos Repl]
+-> C:\WINDOWS\$NtUninstallKB2705219$\browser.dll : 77,824 : 08/21/2008 00:00 AM : a06ce3399d16db864f55faeb1f1927a9 [Pos Repl]
+-> C:\WINDOWS\SoftwareDistribution\Download\4a0e4531b96faf560594eec84d879de6\sp3gdr\browser.dll : 78,336 : 07/06/2012 00:58 AM : cfd4e51402da9838b5a04ae680af54a0 [Pos Repl]
+-> C:\WINDOWS\SoftwareDistribution\Download\4a0e4531b96faf560594eec84d879de6\sp3qfe\browser.dll : 78,336 : 07/06/2012 00:58 AM : fc6d1d80588d371f0321e15a75b2f8f2 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\browser.dll : 78,336 : 07/06/2012 00:58 AM : cfd4e51402da9838b5a04ae680af54a0 [Pos Repl]
* C:\WINDOWS\System32\clipsrv.exe [NoSig]
+-> C:\WINDOWS\system32\dllcache\clipsrv.exe : 33,280 : 08/21/2008 00:00 AM : 34cbe729f38138217f9c80212a2a0c82 [Pos Repl]
* C:\WINDOWS\System32\comctl32.dll [NoSig]
+-> C:\WINDOWS\I386\ASMS\6000\MSFT\WINDOWS\COMMON\CONTROLS\COMCTL32.DLL : 921,088 : 08/21/2008 00:00 AM : aef3d788dbf40c7c4d204ea45eb0c505 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\comctl32.dll : 617,472 : 08/23/2010 00:12 AM : 93afb83fbc1f9443cac722fca63d73bf [Pos Repl]
+-> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll : 921,088 : 08/21/2008 00:00 AM : aef3d788dbf40c7c4d204ea45eb0c505 [Pos Repl]
+-> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll : 1,054,208 : 08/21/2008 00:00 AM : bd38d1ebe24a46bd3eda059560afba12 [Pos Repl]
+-> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll : 1,054,208 : 08/23/2010 00:12 AM : 736b12b725aeb2b07f0241a9f680cb10 [Pos Repl]
* C:\WINDOWS\System32\comres.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\comres.dll : 792,064 : 08/21/2008 00:00 AM : 1280a158c722fa95a80fb7aebe78fa7d [Pos Repl]
* C:\WINDOWS\System32\cryptsvc.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\cryptsvc.dll : 62,464 : 08/21/2008 00:00 AM : 3d4e199942e29207970e04315d02ad3b [Pos Repl]
* C:\WINDOWS\System32\csrss.exe [NoSig]
+-> C:\WINDOWS\system32\dllcache\csrss.exe : 6,144 : 08/21/2008 00:00 AM : 44f275c64738ea2056e3d9580c23b60f [Pos Repl]
* C:\WINDOWS\System32\ctfmon.exe [NoSig]
+-> C:\WINDOWS\system32\dllcache\ctfmon.exe : 15,360 : 08/21/2008 00:00 AM : 5f1d5f88303d4a4dbc8e5f97ba967cc3 [Pos Repl]
* C:\WINDOWS\System32\d3d8.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\d3d8.dll : 1,179,648 : 08/21/2008 00:00 AM : f099b129022170f2df9e1c0185c9bcfb [Pos Repl]
* C:\WINDOWS\System32\d3d8thk.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\d3d8thk.dll : 8,192 : 08/21/2008 00:00 AM : 31b067c412fa1a9bad3ca2a63d7da440 [Pos Repl]
* C:\WINDOWS\System32\d3d9.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\d3d9.dll : 1,689,088 : 08/21/2008 00:00 AM : 0607cbc6fa20114cb491efe4b2f9efad [Pos Repl]
* C:\WINDOWS\System32\ddraw.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\ddraw.dll : 279,552 : 08/21/2008 00:00 AM : a340cd71eb535a3dd751b5f28723e50c [Pos Repl]
* C:\WINDOWS\System32\dllhost.exe [NoSig]
+-> C:\WINDOWS\system32\dllcache\dllhost.exe : 5,120 : 08/21/2008 00:00 AM : 0a9ba6af531afe7fa5e4fb973852d863 [Pos Repl]
* C:\WINDOWS\System32\drivers\acpiec.sys [NoSig]
* C:\WINDOWS\System32\drivers\acpi.sys [NoSig]
* C:\WINDOWS\System32\drivers\aec.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\aec.sys : 142,592 : 04/13/2008 11:09 PM : 8bed39e3c35d6a489438b8141717a557 [Pos Repl]
* C:\WINDOWS\System32\drivers\afd.sys [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB2503665\SP3QFE\afd.sys : 138,496 : 02/16/2011 00:25 AM : 8d499b1276012eb907e7a9e0f4d8fda4 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2509553\SP3QFE\afd.sys : 138,496 : 10/16/2008 00:07 AM : 38d7b715504da4741df35e3594fe2099 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2592799\SP3QFE\afd.sys : 138,496 : 08/17/2011 00:41 AM : f6b7b1ecd7b41736bdb6ff4b092bcb79 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\afd.sys : 138,496 : 06/20/2008 00:48 AM : d6ee6014241d034e63c49a50cb2b442a [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB956803\SP3QFE\afd.sys : 138,496 : 08/14/2008 00:34 AM : 4d43e74f2a1239d53929b82600f1971c [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\afd.sys : 138,496 : 08/17/2011 11:49 AM : 1e44bc1e83d8fd2305f8d452db109cf9 [Pos Repl]
* C:\WINDOWS\System32\drivers\amdk6.sys [NoSig]
* C:\WINDOWS\System32\drivers\amdk7.sys [NoSig]
* C:\WINDOWS\System32\drivers\arp1394.sys [NoSig]
* C:\WINDOWS\System32\drivers\asyncmac.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\asyncmac.sys : 14,336 : 08/21/2008 11:00 AM : b153affac761e7f5fcfa822b9c4e97bc [Pos Repl]
* C:\WINDOWS\System32\drivers\atapi.sys [NoSig]
* C:\WINDOWS\System32\drivers\audstub.sys [NoSig]
* C:\WINDOWS\System32\drivers\beep.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\beep.sys : 4,224 : 08/21/2008 11:00 AM : da1f27d85e0d1525f6621372e7b685e9 [Pos Repl]
* C:\WINDOWS\System32\drivers\bridge.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\bridge.sys : 71,552 : 08/21/2008 11:00 AM : f934d1b230f84e1d19dd00ac5a7a83ed [Pos Repl]
* C:\WINDOWS\System32\drivers\bthport.sys [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB951376-v2\SP3QFE\bthport.sys : 272,128 : 06/13/2008 00:27 AM : 51d05d5a8a7d93ab0b1a8d6a38db3ca4 [Pos Repl]
+-> C:\WINDOWS\Driver Cache\i386\bthport.sys : 272,128 : 06/13/2008 11:05 AM : 662bfd909447dd9cc15b1a1c366583b4 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\bthport.sys : 272,128 : 06/13/2008 11:05 AM : 662bfd909447dd9cc15b1a1c366583b4 [Pos Repl]
* C:\WINDOWS\System32\drivers\cbidf2k.sys [NoSig]
* C:\WINDOWS\System32\drivers\cdaudio.sys [NoSig]
* C:\WINDOWS\System32\drivers\cdfs.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\cdfs.sys : 63,744 : 08/21/2008 11:00 AM : c885b02847f5d2fd45a24e219ed93b32 [Pos Repl]
* C:\WINDOWS\System32\drivers\cdrom.sys [NoSig]
* C:\WINDOWS\System32\drivers\classpnp.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\classpnp.sys : 49,536 : 08/21/2008 11:00 AM : fe47dd8fe6d7768ff94ebec6c74b2719 [Pos Repl]
* C:\WINDOWS\System32\drivers\cpqdap01.sys [NoSig]
* C:\WINDOWS\System32\drivers\crusoe.sys [NoSig]
* C:\WINDOWS\System32\drivers\diskdump.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\diskdump.sys : 14,208 : 08/21/2008 11:00 AM : e65e2353a5d74ea89971cb918eeeb2f6 [Pos Repl]
* C:\WINDOWS\System32\drivers\disk.sys [NoSig]
* C:\WINDOWS\System32\drivers\dmboot.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\dmboot.sys : 799,744 : 08/21/2008 11:00 AM : d992fe1274bde0f84ad826acae022a41 [Pos Repl]
* C:\WINDOWS\System32\drivers\dmio.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\dmio.sys : 153,344 : 08/21/2008 11:00 AM : 7c824cf7bbde77d95c08005717a95f6f [Pos Repl]
* C:\WINDOWS\System32\drivers\dmload.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\dmload.sys : 5,888 : 08/21/2008 11:00 AM : e9317282a63ca4d188c0df5e09c6ac5f [Pos Repl]
* C:\WINDOWS\System32\drivers\DMusic.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\dmusic.sys : 52,864 : 04/14/2008 11:15 AM : 8a208dfcf89792a484e76c40e5f50b45 [Pos Repl]
* C:\WINDOWS\System32\drivers\drmkaud.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\drmkaud.sys : 2,944 : 04/14/2008 11:15 AM : 8f5fcff8e8848afac920905fbd9d33c8 [Pos Repl]
* C:\WINDOWS\System32\drivers\drmk.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\drmk.sys : 60,160 : 04/14/2008 11:15 AM : 6cb08593487f5701d2d2254e693eafce [Pos Repl]
* C:\WINDOWS\System32\drivers\dxapi.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\dxapi.sys : 10,496 : 08/21/2008 11:00 AM : fe97d0343acfdebdd578fc67cc91fa87 [Pos Repl]
* C:\WINDOWS\System32\drivers\dxg.sys [NoSig]
* C:\WINDOWS\System32\drivers\dxgthk.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\dxgthk.sys : 3,328 : 08/21/2008 11:00 AM : a73f5d6705b1d820c19b18782e176efd [Pos Repl]
* C:\WINDOWS\System32\drivers\fastfat.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\fastfat.sys : 143,744 : 08/21/2008 11:00 AM : 38d332a6d56af32635675f132548343e [Pos Repl]
* C:\WINDOWS\System32\drivers\fdc.sys [NoSig]
* C:\WINDOWS\System32\drivers\fips.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\fips.sys : 44,544 : 08/21/2008 11:00 AM : d45926117eb9fa946a6af572fbe1caa3 [Pos Repl]
* C:\WINDOWS\System32\drivers\flpydisk.sys [NoSig]
* C:\WINDOWS\System32\drivers\fltMgr.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\fltmgr.sys : 129,792 : 08/21/2008 11:00 AM : b2cf4b0786f8212cb92ed2b50c6db6b0 [Pos Repl]
* C:\WINDOWS\System32\drivers\fs_rec.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\fs_rec.sys : 7,936 : 08/21/2008 11:00 AM : 3e1e2bd4f39b0e2b7dc4f4d2bcc2779a [Pos Repl]
* C:\WINDOWS\System32\drivers\fsvga.sys [NoSig]
* C:\WINDOWS\System32\drivers\ftdisk.sys [NoSig]
* C:\WINDOWS\System32\drivers\hidclass.sys [NoSig]
* C:\WINDOWS\System32\drivers\hidparse.sys [NoSig]
* C:\WINDOWS\System32\drivers\hidusb.sys [NoSig]
* C:\WINDOWS\System32\drivers\http.sys [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB970430\SP3QFE\http.sys : 265,728 : 10/20/2009 00:21 AM : 937031c085718c1c04a9c0864625ec6b [Pos Repl]
+-> C:\WINDOWS\Driver Cache\i386\http.sys : 265,728 : 10/20/2009 11:20 AM : f80a415ef82cd06ffaf0d971528ead38 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\http.sys : 265,728 : 10/20/2009 11:20 AM : f80a415ef82cd06ffaf0d971528ead38 [Pos Repl]
* C:\WINDOWS\System32\drivers\i8042prt.sys [NoSig]
* C:\WINDOWS\System32\drivers\imapi.sys [NoSig]
* C:\WINDOWS\System32\drivers\intelppm.sys [NoSig]
* C:\WINDOWS\System32\drivers\ip6fw.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\ip6fw.sys : 36,608 : 08/21/2008 11:00 AM : 3bb22519a194418d5fec05d800a19ad0 [Pos Repl]
* C:\WINDOWS\System32\drivers\ipfltdrv.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\ipfltdrv.sys : 32,896 : 08/21/2008 11:00 AM : 731f22ba402ee4b62748adaf6363c182 [Pos Repl]
* C:\WINDOWS\System32\drivers\ipinip.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\ipinip.sys : 20,864 : 08/21/2008 11:00 AM : b87ab476dcf76e72010632b5550955f5 [Pos Repl]
* C:\WINDOWS\System32\drivers\ipnat.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\ipnat.sys : 152,832 : 08/21/2008 11:00 AM : cc748ea12c6effde940ee98098bf96bb [Pos Repl]
* C:\WINDOWS\System32\drivers\ipsec.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\ipsec.sys : 75,264 : 08/21/2008 11:00 AM : 23c74d75e36e7158768dd63d92789a91 [Pos Repl]
* C:\WINDOWS\System32\drivers\irenum.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\irenum.sys : 11,264 : 08/21/2008 11:00 AM : c93c9ff7b04d772627a3646d89f7bf89 [Pos Repl]
* C:\WINDOWS\System32\drivers\isapnp.sys [NoSig]
* C:\WINDOWS\System32\drivers\kbdclass.sys [NoSig]
* C:\WINDOWS\System32\drivers\kmixer.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\kmixer.sys : 172,416 : 04/14/2008 11:15 AM : 692bcf44383d056aed41b045a323d378 [Pos Repl]
* C:\WINDOWS\System32\drivers\ksecdd.sys [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB968389\SP3QFE\ksecdd.sys : 92,928 : 06/24/2009 00:28 AM : c6ebf1d6ad71df30db49b8d3287e1368 [Pos Repl]
+-> C:\WINDOWS\I386\KSECDD.SYS : 92,288 : 08/21/2008 00:00 AM : 1705745d900dabf2d89f90ebaddc7517 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\ksecdd.sys : 92,928 : 06/24/2009 11:18 AM : b467646c54cc746128904e1654c750c1 [Pos Repl]
* C:\WINDOWS\System32\drivers\ks.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\ks.sys : 141,056 : 04/14/2008 11:46 AM : 0753515f78df7f271a5e61c20bcd36a1 [Pos Repl]
* C:\WINDOWS\System32\drivers\mcd.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\mcd.sys : 7,680 : 08/21/2008 11:00 AM : d1f8be91ed4ddb671d42e473e3fe71ab [Pos Repl]
* C:\WINDOWS\System32\drivers\mf.sys [NoSig]
* C:\WINDOWS\System32\drivers\mnmdd.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\mnmdd.sys : 4,224 : 08/21/2008 11:00 AM : 4ae068242760a1fb6e1a44bf4e16afa6 [Pos Repl]
* C:\WINDOWS\System32\drivers\modem.sys [NoSig]
* C:\WINDOWS\System32\drivers\mouclass.sys [NoSig]
* C:\WINDOWS\System32\drivers\mouhid.sys [NoSig]
* C:\WINDOWS\System32\drivers\mountmgr.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\mountmgr.sys : 42,368 : 08/21/2008 11:00 AM : a80b9a0bad1b73637dbcbba7df72d3fd [Pos Repl]
* C:\WINDOWS\System32\drivers\mqac.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\mqac.sys : 92,544 : 08/21/2008 11:00 AM : 70c14f5cca5cf73f8a645c73a01d8726 [Pos Repl]
* C:\WINDOWS\System32\drivers\mrxdav.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\mrxdav.sys : 180,608 : 08/21/2008 11:00 AM : 11d42bb6206f33fbb3ba0288d3ef81bd [Pos Repl]
* C:\WINDOWS\System32\drivers\mrxsmb.sys [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB2511455\SP3QFE\mrxsmb.sys : 457,472 : 02/17/2011 00:19 AM : fb7dfd15d760ad339837a470f0e780d3 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2536276\SP3QFE\mrxsmb.sys : 457,856 : 04/29/2011 00:47 AM : 8dd801e28eb76fda2a38907882a0036f [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2536276-v2\SP3QFE\mrxsmb.sys : 457,856 : 07/15/2011 00:29 AM : fb2fccc70f7174c7bf64f48e96d3adf4 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB980232\SP3QFE\mrxsmb.sys : 457,216 : 02/24/2010 00:57 AM : d09b9f0b9960dd41e73127b7814c115f [Pos Repl]
+-> C:\WINDOWS\Driver Cache\i386\mrxsmb.sys : 456,320 : 07/15/2011 11:29 AM : 7d304a5eb4344ebeeab53a2fe3ffb9f0 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\mrxsmb.sys : 456,320 : 07/15/2011 11:29 AM : 7d304a5eb4344ebeeab53a2fe3ffb9f0 [Pos Repl]
* C:\WINDOWS\System32\drivers\msfs.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\msfs.sys : 19,072 : 08/21/2008 11:00 AM : c941ea2454ba8350021d774daf0f1027 [Pos Repl]
* C:\WINDOWS\System32\drivers\msgpc.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\msgpc.sys : 35,072 : 08/21/2008 11:00 AM : 0a02c63c8b144bd8c86b103dee7c86a2 [Pos Repl]
* C:\WINDOWS\System32\drivers\MSKSSRV.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\mskssrv.sys : 7,552 : 04/14/2008 11:09 AM : d1575e71568f4d9e14ca56b7b0453bf1 [Pos Repl]
* C:\WINDOWS\System32\drivers\MSPCLOCK.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\mspclock.sys : 5,376 : 04/14/2008 11:09 AM : 325bb26842fc7ccc1fcce2c457317f3e [Pos Repl]
* C:\WINDOWS\System32\drivers\MSPQM.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\mspqm.sys : 4,992 : 04/14/2008 11:09 AM : bad59648ba099da4a17680b39730cb3d [Pos Repl]
* C:\WINDOWS\System32\drivers\mssmbios.sys [NoSig]
* C:\WINDOWS\System32\drivers\mup.sys [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB2535512\SP3QFE\mup.sys : 105,472 : 04/21/2011 00:52 AM : f7b1ad991491f02af6da70b00b8bf114 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\mup.sys : 105,472 : 04/21/2011 11:37 AM : de6a75f5c270e756c5508d94b6cf68f5 [Pos Repl]
* C:\WINDOWS\System32\drivers\ndis.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\ndis.sys : 182,656 : 08/21/2008 11:00 AM : 1df7f42665c94b825322fae71721130d [Pos Repl]
* C:\WINDOWS\System32\drivers\ndistapi.sys [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB2566454\SP3QFE\ndistapi.sys : 10,496 : 07/08/2011 00:51 AM : 091735a5f20acb1dc147383a905ae002 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\ndistapi.sys : 10,496 : 07/08/2011 11:02 AM : 0109c4f3850dfbab279542515386ae22 [Pos Repl]
* C:\WINDOWS\System32\drivers\ndisuio.sys [NoSig]
* C:\WINDOWS\System32\drivers\ndiswan.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\ndiswan.sys : 91,520 : 08/21/2008 11:00 AM : edc1531a49c80614b2cfda43ca8659ab [Pos Repl]
* C:\WINDOWS\System32\drivers\ndproxy.sys [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB2440591\SP3QFE\ndproxy.sys : 40,960 : 11/02/2010 10:55 PM : 816460bd4b4acd27937d1d0813e2e9e9 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\ndproxy.sys : 40,960 : 11/02/2010 11:17 AM : 9282bd12dfb069d3889eb3fcc1000a9b [Pos Repl]
* C:\WINDOWS\System32\drivers\netbios.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\netbios.sys : 34,688 : 08/21/2008 11:00 AM : 5d81cf9a2f1a3a756b66cf684911cdf0 [Pos Repl]
* C:\WINDOWS\System32\drivers\netbt.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\netbt.sys : 162,816 : 08/21/2008 11:00 AM : 74b2b2f5bea5e9a3dc021d685551bd3d [Pos Repl]
* C:\WINDOWS\System32\drivers\nic1394.sys [NoSig]
* C:\WINDOWS\System32\drivers\nikedrv.sys [NoSig]
* C:\WINDOWS\System32\drivers\nmnt.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\nmnt.sys : 40,320 : 08/21/2008 11:00 AM : 1e421a6bcf2203cc61b821ada9de878b [Pos Repl]
* C:\WINDOWS\System32\drivers\npfs.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\npfs.sys : 30,848 : 08/21/2008 11:00 AM : 3182d64ae053d6fb034f44b6def8034a [Pos Repl]
* C:\WINDOWS\System32\drivers\ntfs.sys [NoSig]
+-> C:\WINDOWS\I386\NTFS.SYS : 574,976 : 08/21/2008 00:00 AM : 78a08dd6a8d65e697c18e1db01c5cdca [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\ntfs.sys : 574,976 : 08/21/2008 11:00 AM : 78a08dd6a8d65e697c18e1db01c5cdca [Pos Repl]
* C:\WINDOWS\System32\drivers\null.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\null.sys : 2,944 : 08/21/2008 11:00 AM : 73c1e1f395918bc2c6dd67af7591a3ad [Pos Repl]
* C:\WINDOWS\System32\drivers\nwlnkflt.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\nwlnkflt.sys : 12,416 : 08/21/2008 11:00 AM : b305f3fad35083837ef46a0bbce2fc57 [Pos Repl]
* C:\WINDOWS\System32\drivers\nwlnkfwd.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\nwlnkfwd.sys : 32,512 : 08/21/2008 11:00 AM : c99b3415198d1aab7227f2c88fd664b9 [Pos Repl]
* C:\WINDOWS\System32\drivers\nwlnkipx.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\nwlnkipx.sys : 88,320 : 08/21/2008 11:00 AM : 8b8b1be2dba4025da6786c645f77f123 [Pos Repl]
* C:\WINDOWS\System32\drivers\nwlnknb.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\nwlnknb.sys : 63,232 : 08/21/2008 11:00 AM : 56d34a67c05e94e16377c60609741ff8 [Pos Repl]
* C:\WINDOWS\System32\drivers\nwlnkspx.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\nwlnkspx.sys : 55,936 : 08/21/2008 11:00 AM : c0bb7d1615e1acbdc99757f6ceaf8cf0 [Pos Repl]
* C:\WINDOWS\System32\drivers\nwrdr.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\nwrdr.sys : 163,584 : 08/21/2008 11:00 AM : 36b9b950e3d2e100970a48d8bad86740 [Pos Repl]
* C:\WINDOWS\System32\drivers\oprghdlr.sys [NoSig]
* C:\WINDOWS\System32\drivers\p3.sys [NoSig]
* C:\WINDOWS\System32\drivers\parport.sys [NoSig]
* C:\WINDOWS\System32\drivers\partmgr.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\partmgr.sys : 19,712 : 08/21/2008 11:00 AM : beb3ba25197665d82ec7065b724171c6 [Pos Repl]
* C:\WINDOWS\System32\drivers\parvdm.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\parvdm.sys : 6,784 : 08/21/2008 11:00 AM : 70e98b3fd8e963a6a46a2e6247e0bea1 [Pos Repl]
* C:\WINDOWS\System32\drivers\pciidex.sys [NoSig]
* C:\WINDOWS\System32\drivers\pci.sys [NoSig]
* C:\WINDOWS\System32\drivers\pcmcia.sys [NoSig]
* C:\WINDOWS\System32\drivers\portcls.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\portcls.sys : 146,048 : 04/14/2008 11:49 AM : e82a496c3961efc6828b508c310ce98f [Pos Repl]
* C:\WINDOWS\System32\drivers\processr.sys [NoSig]
* C:\WINDOWS\System32\drivers\psched.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\psched.sys : 69,120 : 08/21/2008 11:00 AM : 09298ec810b07e5d582cb3a3f9255424 [Pos Repl]
* C:\WINDOWS\System32\drivers\ptilink.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\ptilink.sys : 17,792 : 08/21/2008 11:00 AM : 80d317bd1c3dbc5d4fe7b1678c60cadd [Pos Repl]
* C:\WINDOWS\System32\drivers\rasacd.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\rasacd.sys : 8,832 : 08/21/2008 11:00 AM : fe0d99d6f31e4fad8159f690d68ded9c [Pos Repl]
* C:\WINDOWS\System32\drivers\rasl2tp.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\rasl2tp.sys : 51,328 : 08/21/2008 11:00 AM : 11b4a627bc9614b885c4969bfa5ff8a6 [Pos Repl]
* C:\WINDOWS\System32\drivers\raspppoe.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\raspppoe.sys : 41,472 : 08/21/2008 11:00 AM : 5bc962f2654137c9909c3d4603587dee [Pos Repl]
* C:\WINDOWS\System32\drivers\raspptp.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\raspptp.sys : 48,384 : 08/21/2008 11:00 AM : efeec01b1d3cf84f16ddd24d9d9d8f99 [Pos Repl]
* C:\WINDOWS\System32\drivers\raspti.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\raspti.sys : 16,512 : 08/21/2008 11:00 AM : fdbb1d60066fcfbb7452fd8f9829b242 [Pos Repl]
* C:\WINDOWS\System32\drivers\rawwan.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\rawwan.sys : 34,432 : 08/21/2008 11:00 AM : 01524cd237223b18adbb48f70083f101 [Pos Repl]
* C:\WINDOWS\System32\drivers\rdbss.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\rdbss.sys : 175,744 : 08/21/2008 11:00 AM : 7ad224ad1a1437fe28d89cf22b17780a [Pos Repl]
* C:\WINDOWS\System32\drivers\rdpcdd.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\rdpcdd.sys : 4,224 : 08/21/2008 11:00 AM : 4912d5b403614ce99c28420f75353332 [Pos Repl]
* C:\WINDOWS\System32\drivers\rdpdr.sys [NoSig]
* C:\WINDOWS\System32\drivers\rdpwd.sys [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB2570222\SP3QFE\rdpwd.sys : 139,656 : 06/24/2011 10:09 AM : 3348e61a78ba4f79c795aad6565d3b6f [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2621440\SP3QFE\rdpwd.sys : 139,784 : 01/09/2012 10:19 AM : 2d293b720c206473a05950ce007db12a [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2685939\SP3QFE\rdpwd.sys : 139,656 : 05/02/2012 10:45 AM : 997c59b9955f911ec460241dd9e01b04 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2723135\SP3QFE\rdpwd.sys : 139,784 : 07/04/2012 10:59 AM : c7d9bc54354b8c706abf172d48313f1b [Pos Repl]
+-> C:\WINDOWS\$NtUninstallKB2723135$\rdpwd.sys : 139,656 : 05/02/2012 00:46 AM : 6589db6e5969f8eee594cf71171c5028 [Pos Repl]
+-> C:\WINDOWS\SoftwareDistribution\Download\af1dca7ba584ed594c74473813ba498b\SP3GDR\rdpwd.sys : 139,784 : 07/04/2012 00:05 AM : 43af5212bd8fb5ba6eed9754358bd8f7 [Pos Repl]
+-> C:\WINDOWS\SoftwareDistribution\Download\af1dca7ba584ed594c74473813ba498b\SP3QFE\rdpwd.sys : 139,784 : 07/04/2012 00:59 AM : c7d9bc54354b8c706abf172d48313f1b [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\rdpwd.sys : 139,784 : 07/04/2012 11:05 AM : 43af5212bd8fb5ba6eed9754358bd8f7 [Pos Repl]
* C:\WINDOWS\System32\drivers\redbook.sys [NoSig]
* C:\WINDOWS\System32\drivers\rmcast.sys [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB950762\SP3QFE\rmcast.sys : 203,136 : 05/08/2008 10:58 AM : c711645c76b8ed87c021bf6165e52795 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\rmcast.sys : 203,136 : 05/08/2008 11:02 AM : 96f7a9a7bf0c9c0440a967440065d33c [Pos Repl]
* C:\WINDOWS\System32\drivers\rndismp.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\rndismp.sys : 30,592 : 08/21/2008 11:00 AM : 601844cbcf617ff8c868130ca5b2039d [Pos Repl]
* C:\WINDOWS\System32\drivers\rootmdm.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\rootmdm.sys : 5,888 : 08/21/2008 11:00 AM : d8b0b4ade32574b2d9c5cc34dc0dbbe7 [Pos Repl]
* C:\WINDOWS\System32\drivers\scsiport.sys [NoSig]
* C:\WINDOWS\System32\drivers\sdbus.sys [NoSig]
* C:\WINDOWS\System32\drivers\serenum.sys [NoSig]
* C:\WINDOWS\System32\drivers\serial.sys [NoSig]
* C:\WINDOWS\System32\drivers\sffdisk.sys [NoSig]
* C:\WINDOWS\System32\drivers\sffp_sd.sys [NoSig]
* C:\WINDOWS\System32\drivers\sfloppy.sys [NoSig]
* C:\WINDOWS\System32\drivers\smclib.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\smclib.sys : 14,592 : 08/21/2008 11:00 AM : 017daecf0ed3aa731313433601ec40fa [Pos Repl]
* C:\WINDOWS\System32\drivers\sonydcam.sys [NoSig]
* C:\WINDOWS\System32\drivers\splitter.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\splitter.sys : 6,272 : 04/14/2008 11:15 AM : ab8b92451ecb048a4d1de7c3ffcb4a9f [Pos Repl]
* C:\WINDOWS\System32\drivers\sr.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\sr.sys : 73,472 : 08/21/2008 11:00 AM : 76bb022c2fb6902fd5bdd4f78fc13a5d [Pos Repl]
* C:\WINDOWS\System32\drivers\srv.sys [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB2345886\SP3QFE\srv.sys : 357,248 : 08/26/2010 10:37 AM : 70cd8b8dd2a680b128617c19eb0ab94f [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2508429\SP3QFE\srv.sys : 357,888 : 02/17/2011 10:19 AM : 9b390283569ea58d43d2586032b892f5 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB982214\SP3QFE\srv.sys : 354,304 : 06/21/2010 10:18 AM : 422e4508508015c7d12f40bf9763f158 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\srv.sys : 357,888 : 02/17/2011 11:18 AM : 47ddfc2f003f7f9f0592c6874962a2e7 [Pos Repl]
* C:\WINDOWS\System32\drivers\stream.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\stream.sys : 49,408 : 04/14/2008 11:15 AM : 3e5d89099ded9e86e5639f411693218f [Pos Repl]
* C:\WINDOWS\System32\drivers\swenum.sys [NoSig]
* C:\WINDOWS\System32\drivers\swmidi.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\swmidi.sys : 56,576 : 04/14/2008 11:15 AM : 8ce882bcc6cf8a62f2b2323d95cb3d01 [Pos Repl]
* C:\WINDOWS\System32\drivers\sysaudio.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\sysaudio.sys : 60,800 : 04/14/2008 11:45 AM : 8b83f3ed0f1688b4958f77cd6d2bf290 [Pos Repl]
* C:\WINDOWS\System32\drivers\tape.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\tape.sys : 14,976 : 08/21/2008 11:00 AM : fd6093e3decd925f1cffc8a0dd539d72 [Pos Repl]
* C:\WINDOWS\System32\drivers\tcpip6.sys [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB2509553\SP3QFE\tcpip6.sys : 225,856 : 06/20/2008 10:16 AM : 026a94e4eb2960fdc96a447b5391d56a [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip6.sys : 225,856 : 06/20/2008 10:16 AM : 026a94e4eb2960fdc96a447b5391d56a [Pos Repl]

Foxiffer · Sep 17, 2012

+-> C:\WINDOWS\$hf_mig$\KB978338\SP3QFE\tcpip6.sys : 226,880 : 02/11/2010 10:36 AM : f4a3c6abe7818b1b53f58fa1adb605cd [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\tcpip6.sys : 226,880 : 02/11/2010 11:02 AM : 4e53bbcc4be37d7a4bd6ef1098c89ff7 [Pos Repl]
* C:\WINDOWS\System32\Drivers\tcpip.sys [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB2509553\SP3QFE\tcpip.sys : 361,600 : 06/20/2008 10:59 AM : ad978a1b783b5719720cff204b666c8e [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys : 361,600 : 06/20/2008 10:59 AM : ad978a1b783b5719720cff204b666c8e [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\tcpip.sys : 361,600 : 06/20/2008 11:51 AM : 9aefa14bd6b182d61e3119fa5f436d3d [Pos Repl]
* C:\WINDOWS\System32\drivers\tdi.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\tdi.sys : 19,072 : 08/21/2008 11:00 AM : 0539d5e53587f82d1b4fd74c5be205cf [Pos Repl]
* C:\WINDOWS\System32\drivers\tdpipe.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\tdpipe.sys : 12,040 : 08/21/2008 11:00 AM : 6471a66807f5e104e4885f5b67349397 [Pos Repl]
* C:\WINDOWS\System32\drivers\tdtcp.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\tdtcp.sys : 21,896 : 08/21/2008 11:00 AM : c56b6d0402371cf3700eb322ef3aaf61 [Pos Repl]
* C:\WINDOWS\System32\drivers\termdd.sys [NoSig]
* C:\WINDOWS\System32\drivers\tosdvd.sys [NoSig]
* C:\WINDOWS\System32\drivers\tunmp.sys [NoSig]
* C:\WINDOWS\System32\drivers\udfs.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\udfs.sys : 66,048 : 08/21/2008 11:00 AM : 5787b80c2e3c5e2f56c2a233d91fa2c9 [Pos Repl]
* C:\WINDOWS\System32\drivers\update.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\update.sys : 384,768 : 08/21/2008 11:00 AM : 402ddc88356b1bac0ee3dd1580c76a31 [Pos Repl]
* C:\WINDOWS\System32\drivers\usb8023.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\usb8023.sys : 12,800 : 08/21/2008 11:00 AM : bee793d4a059caea55d6ac20e19b3a8f [Pos Repl]
* C:\WINDOWS\System32\drivers\usbcamd2.sys [NoSig]
* C:\WINDOWS\System32\drivers\usbcamd.sys [NoSig]
* C:\WINDOWS\System32\drivers\usbccgp.sys [NoSig]
* C:\WINDOWS\System32\drivers\usbd.sys [NoSig]
* C:\WINDOWS\System32\drivers\usbehci.sys [NoSig]
* C:\WINDOWS\System32\drivers\usbhub.sys [NoSig]
* C:\WINDOWS\System32\drivers\usbintel.sys [NoSig]
* C:\WINDOWS\System32\drivers\usbport.sys [NoSig]
* C:\WINDOWS\System32\drivers\USBSTOR.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\usbstor.sys : 26,368 : 04/14/2008 11:15 AM : a32426d9b14a089eaa1d922e0c5801a9 [Pos Repl]
+-> C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\USBSTOR.SYS : 26,368 : 04/14/2008 00:15 AM : a32426d9b14a089eaa1d922e0c5801a9 [Pos Repl]
* C:\WINDOWS\System32\drivers\vga.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\vga.sys : 20,992 : 08/21/2008 11:00 AM : 0d3a8fafceacd8b7625cd549757a7df1 [Pos Repl]
* C:\WINDOWS\System32\drivers\videoprt.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\videoprt.sys : 81,664 : 08/21/2008 11:00 AM : e28726b72c46821a28830e077d39a55b [Pos Repl]
* C:\WINDOWS\System32\drivers\volsnap.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\volsnap.sys : 52,352 : 08/21/2008 11:00 AM : 4c8fcb5cc53aab716d810740fe59d025 [Pos Repl]
* C:\WINDOWS\System32\drivers\wanarp.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\wanarp.sys : 34,560 : 08/21/2008 11:00 AM : e20b95baedb550f32dd489265c1da1f6 [Pos Repl]
* C:\WINDOWS\System32\drivers\wdmaud.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\wdmaud.sys : 83,072 : 04/14/2008 11:47 AM : 6768acf64b18196494413695f0c3a00f [Pos Repl]
* C:\WINDOWS\System32\drivers\wmilib.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\wmilib.sys : 4,352 : 08/21/2008 11:00 AM : 2f31b7f954bed437f2c75026c65caf7b [Pos Repl]
* C:\WINDOWS\System32\drivers\ws2ifsl.sys [NoSig]
+-> C:\WINDOWS\system32\dllcache\ws2ifsl.sys : 12,032 : 08/21/2008 11:00 AM : 6abe6e225adb5a751622a9cc3bc19ce8 [Pos Repl]
* C:\WINDOWS\System32\dsound.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\dsound.dll : 367,616 : 08/21/2008 11:00 AM : 4d83ed8bddec431fc8ad907b47cfb6e3 [Pos Repl]
* C:\WINDOWS\System32\dssenh.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\dssenh.dll : 138,752 : 08/21/2008 11:00 AM : fede68bf80052bad393afd5c2e60dcb0 [Pos Repl]
* C:\WINDOWS\System32\es.dll [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB950974\SP3QFE\es.dll : 253,952 : 07/07/2008 01:23 PM : f17f6226bdc0cd5f0bef0daf84d29bec [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\es.dll : 253,952 : 07/07/2008 01:26 PM : d4991d98f2db73c60d042f1aef79efae [Pos Repl]
* C:\WINDOWS\System32\eventlog.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\eventlog.dll : 56,320 : 08/21/2008 01:00 AM : 6d4feb43ee538fc5428cc7f0565aa656 [Pos Repl]
* C:\WINDOWS\System32\hid.dll [NoSig]
* C:\WINDOWS\System32\hnetcfg.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\hnetcfg.dll : 344,064 : 08/21/2008 01:00 AM : 3cb32d3b8cbe79899d63280bb7a83cd9 [Pos Repl]
* C:\WINDOWS\System32\imm32.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\imm32.dll : 110,080 : 08/21/2008 01:00 AM : 0da85218e92526972a821587e6a8bf8f [Pos Repl]
* C:\WINDOWS\System32\ipsecsvc.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\ipsecsvc.dll : 183,808 : 08/21/2008 01:00 AM : 332760fba1655fcfd35bd6f4fd871300 [Pos Repl]
* C:\WINDOWS\System32\kernel32.dll [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB959426\SP3QFE\kernel32.dll : 991,744 : 03/21/2009 01:59 AM : da11d9d6ecbdf0f93436a4b7c13f7bec [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\kernel32.dll : 989,696 : 03/21/2009 01:06 AM : b921fb870c9ac0d509b2ccabbbbe95f3 [Pos Repl]
* C:\WINDOWS\System32\ksuser.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\ksuser.dll : 4,096 : 04/14/2008 01:41 AM : 9b9f1c38d559047b8ac0dba2d5febde9 [Pos Repl]
* C:\WINDOWS\System32\linkinfo.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\linkinfo.dll : 19,968 : 08/21/2008 01:00 AM : 2dc5a8019e2387987905f77c664e4be2 [Pos Repl]
* C:\WINDOWS\System32\lpk.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\lpk.dll : 22,016 : 08/21/2008 01:00 AM : 012df358cebaa23acb26d82077820817 [Pos Repl]
* C:\WINDOWS\System32\lsass.exe [NoSig]
+-> C:\WINDOWS\system32\dllcache\lsass.exe : 13,312 : 08/21/2008 01:00 AM : bf2466b3e18e970d8a976fb95fc1ca85 [Pos Repl]
* C:\WINDOWS\System32\mfc40u.dll [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB2387149\SP3QFE\mfc40u.dll : 953,856 : 09/18/2010 01:18 AM : 842900dedbc8e3e8dbcccb298fd88f65 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\mfc40u.dll : 953,856 : 09/17/2010 11:53 PM : e76a5c202e68af5a322d16b5a78f48b9 [Pos Repl]
* C:\WINDOWS\System32\midimap.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\midimap.dll : 18,944 : 08/21/2008 11:00 AM : 5c12660a97822f6e61576943b49aaad6 [Pos Repl]
* C:\WINDOWS\System32\msgsvc.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\msgsvc.dll : 33,792 : 08/21/2008 11:00 AM : 986b1ff5814366d71e0ac5755c88f2d3 [Pos Repl]
* C:\WINDOWS\System32\mshtml.dll [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB2360131\SP3QFE\mshtml.dll : 3,074,560 : 09/09/2010 01:25 AM : 575fbcb3e2c6e848f0386f38aaf0e4ed [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2360131-IE8\SP3QFE\mshtml.dll : 5,958,656 : 09/09/2010 10:57 PM : 8a03cc037e6b7d1796192815231b0c3f [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2416400-IE8\SP3QFE\mshtml.dll : 5,960,704 : 11/05/2010 05:27 PM : 864e69f32656a7121444ba0193d7b64b [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2482017-IE8\SP3QFE\mshtml.dll : 5,962,240 : 12/20/2010 03:58 PM : 2a2c070ec691ce410533a1da7aa3cd86 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2497640-IE8\SP3QFE\mshtml.dll : 5,964,800 : 02/22/2011 03:27 PM : 3422847aa07e37076a87d0b7d5044dc6 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2530548-IE8\SP3QFE\mshtml.dll : 5,967,360 : 05/30/2011 03:17 PM : d0b1db576941cb0b6669b8752ffac79a [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2559049-IE8\SP3QFE\mshtml.dll : 5,971,456 : 07/25/2011 03:15 AM : bce7ccebad6c8955d2b4c3b246bd0e57 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2586448-IE8\SP3QFE\mshtml.dll : 5,972,992 : 10/03/2011 03:34 AM : 1240a6b7b470bed0aa6c9fec7ab0ea26 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2618444-IE8\SP3QFE\mshtml.dll : 5,978,624 : 11/04/2011 03:19 AM : 699421e2e1313c18671a703953cae14b [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2647516-IE8\SP3QFE\mshtml.dll : 5,980,160 : 12/17/2011 03:45 AM : 49b88a833eca99efbffc5aae5cc998ed [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2675157-IE8\SP3QFE\mshtml.dll : 5,980,672 : 03/01/2012 03:58 AM : 5dbb0c997ad276bce9d30cd609bdbf67 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2699988-IE8\SP3QFE\mshtml.dll : 6,009,344 : 05/11/2012 03:41 AM : 55f148b94246a77fb4ac33346671cac8 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2722913-IE8\SP3QFE\mshtml.dll : 6,010,368 : 07/02/2012 03:48 AM : df599ac52b62de001e42d36f92b45e68 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB982381-IE8\SP3QFE\mshtml.dll : 5,953,024 : 05/06/2010 03:36 AM : 9be28f749a7fe7f8f177c6aa2e9da609 [Pos Repl]
+-> C:\WINDOWS\ie8\mshtml.dll : 3,066,880 : 08/21/2008 00:00 AM : a706e122b398fe1ab85cb9b75d044223 [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB2360131-IE8\mshtml.dll : 5,950,976 : 05/06/2010 11:41 AM : c7b7a88cc7d7aba5c395145bf92f46f7 [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB2416400-IE8\mshtml.dll : 5,957,120 : 09/09/2010 10:58 PM : de41132da8e5a3cd57201c6f2175ec05 [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB2482017-IE8\mshtml.dll : 5,959,168 : 11/05/2010 05:26 PM : d7cca87057901c87ed8cc40ddcc7fa1b [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB2497640-IE8\mshtml.dll : 5,961,216 : 12/20/2010 03:59 PM : 1edcec5d649dbac37ed9ffb5a14ceb0c [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB2530548-IE8\mshtml.dll : 5,962,240 : 02/22/2011 03:06 PM : c2ef2335f1b6c2be20a67d9098f6c9a1 [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB2559049-IE8\mshtml.dll : 5,964,800 : 05/30/2011 03:19 PM : 22ba5235ea846eda87f68a1dcc2bfcf9 [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB2586448-IE8\mshtml.dll : 5,969,920 : 07/25/2011 03:17 AM : 23b3c8e9f3f280180573569253ce98ab [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB2618444-IE8\mshtml.dll : 5,971,456 : 10/03/2011 03:35 AM : 4963cb503600fc3bcbdbfba51fba1fac [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB2647516-IE8\mshtml.dll : 5,978,112 : 11/04/2011 03:20 AM : dd8d655e1881b70a5259a23a6018a6c2 [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB2675157-IE8\mshtml.dll : 5,979,136 : 12/17/2011 03:46 AM : a9259cd226283cd4f798c00909754a94 [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB2699988-IE8\mshtml.dll : 5,978,624 : 03/01/2012 03:01 AM : dade53318d8e5335ee2e1745f1c3fc4d [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB2722913-IE8\mshtml.dll : 6,007,808 : 05/11/2012 03:42 AM : 886b62a906b3967cbbf0fd2c833a30bf [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB982381-IE8\mshtml.dll : 5,937,152 : 03/08/2009 03:41 AM : d469a0eba2ef5c6bee8065b7e3196e5e [Pos Repl]
+-> C:\WINDOWS\SoftwareDistribution\Download\06af2d630217aa32a4f6f6b9c5c1a3ba\SP3GDR\mshtml.dll : 6,008,320 : 07/02/2012 00:49 AM : 13d2e016b784730a98f24d6e5beed22f [Pos Repl]
+-> C:\WINDOWS\SoftwareDistribution\Download\06af2d630217aa32a4f6f6b9c5c1a3ba\SP3QFE\mshtml.dll : 6,010,368 : 07/02/2012 00:48 AM : df599ac52b62de001e42d36f92b45e68 [Pos Repl]
+-> C:\WINDOWS\SoftwareDistribution\Download\c0b2667570bfaadca71db300b030c7f4\SP3GDR\mshtml.dll : 5,957,120 : 09/09/2010 10:58 PM : de41132da8e5a3cd57201c6f2175ec05 [Pos Repl]
+-> C:\WINDOWS\SoftwareDistribution\Download\c0b2667570bfaadca71db300b030c7f4\SP3QFE\mshtml.dll : 5,958,656 : 09/09/2010 10:57 PM : 8a03cc037e6b7d1796192815231b0c3f [Pos Repl]
+-> C:\WINDOWS\SoftwareDistribution\Download\e9e3bc7b49018c1f53cc0d1bd73cad37\SP3GDR\mshtml.dll : 5,950,976 : 05/06/2010 10:41 AM : c7b7a88cc7d7aba5c395145bf92f46f7 [Pos Repl]
+-> C:\WINDOWS\SoftwareDistribution\Download\e9e3bc7b49018c1f53cc0d1bd73cad37\SP3QFE\mshtml.dll : 5,953,024 : 05/06/2010 10:36 AM : 9be28f749a7fe7f8f177c6aa2e9da609 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\mshtml.dll : 6,008,320 : 07/02/2012 03:49 AM : 13d2e016b784730a98f24d6e5beed22f [Pos Repl]
* C:\WINDOWS\System32\msimg32.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\msimg32.dll : 4,608 : 08/21/2008 03:00 AM : affc87e2501fce8f09d4c10ba6421ccf [Pos Repl]
* C:\WINDOWS\System32\mspmsnsv.dll [NoSig]
+-> C:\WINDOWS\$NtUninstallWMFDist11$\mspmsnsv.dll : 25,088 : 01/28/2005 01:44 PM : 140ef97b64f560fd78643cae2cdad838 [Pos Repl]
+-> C:\WINDOWS\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSNSv.dll : 25,088 : 01/28/2005 01:44 PM : 140ef97b64f560fd78643cae2cdad838 [Pos Repl]
+-> C:\WINDOWS\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MsPMSNSv.dll : 52,224 : 08/21/2008 03:00 AM : c7e39ea41233e9f5b86c8da3a9f1e4a8 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\mspmsnsv.dll : 27,136 : 10/18/2006 09:47 PM : c51b4a5c05a5475708e3c81c7765b71d [Pos Repl]
* C:\WINDOWS\System32\msprivs.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\msprivs.dll : 48,128 : 08/21/2008 09:00 AM : c6bb1d1500db4a0e224cb65e6c7e8a80 [Pos Repl]
* C:\WINDOWS\System32\msvcrt.dll [NoSig]
+-> C:\WINDOWS\I386\ASMS\7000\MSFT\WINDOWS\MSWINCRT\MSVCRT.DLL : 322,560 : 08/21/2008 00:00 AM : 4200be3808f6406dbe45a7b88dae5035 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\msvcrt.dll : 343,040 : 08/21/2008 09:00 AM : 355edbb4d412b01f1740c17e3f50fa00 [Pos Repl]
+-> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll : 322,560 : 08/21/2008 09:00 AM : 4200be3808f6406dbe45a7b88dae5035 [Pos Repl]
+-> C:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll : 343,040 : 08/21/2008 09:00 AM : d7075e95aa599ee77b7a89d39296bd3d [Pos Repl]
* C:\WINDOWS\System32\mswsock.dll [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB2509553\SP3QFE\mswsock.dll : 245,248 : 06/20/2008 03:43 AM : fcee5fcb99f7c724593365c706d28388 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\mswsock.dll : 245,248 : 06/20/2008 03:43 AM : fcee5fcb99f7c724593365c706d28388 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\mswsock.dll : 245,248 : 06/20/2008 09:02 AM : 943337d786a56729263071623bbb9de5 [Pos Repl]
* C:\WINDOWS\System32\netlogon.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\netlogon.dll : 407,040 : 08/21/2008 09:00 AM : 1b7f071c51b77c272875c3a23e1e4550 [Pos Repl]
* C:\WINDOWS\System32\netman.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\netman.dll : 198,144 : 08/21/2008 09:00 AM : 13e67b55b3abd7bf3fe7aae5a0f9a9de [Pos Repl]
* C:\WINDOWS\System32\ntkrnlpa.exe [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB2393802\SP3QFE\ntkrnlpa.exe : 2,069,376 : 12/09/2010 06:39 PM : f67cd97282e0abfaf91a9a1359b16f2d [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2633171\SP3QFE\ntkrnlpa.exe : 2,069,376 : 10/25/2011 06:52 AM : db19fff0c805664cb95062c027b11fe9 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2676562\SP3QFE\ntkrnlpa.exe : 2,069,120 : 04/11/2012 06:42 AM : 063a0f8a90d8e2b802e5243fe9aabcf3 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2707511\SP3QFE\ntkrnlpa.exe : 2,069,120 : 05/04/2012 06:41 AM : 8e99a0ce02c1beda6c0935a4dde9ceaa [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe : 2,066,176 : 02/06/2009 06:30 AM : 607352b9cb3d708c67f6039097801b5a [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB981852\SP3QFE\ntkrnlpa.exe : 2,066,944 : 04/28/2010 06:14 AM : 756362706de8bc92f11e197c98a73844 [Pos Repl]
+-> C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe : 2,069,120 : 05/04/2012 09:32 AM : 5dd80d56af1cefbff4f25951069b55bb [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\ntkrnlpa.exe : 2,069,120 : 05/04/2012 09:32 AM : 5dd80d56af1cefbff4f25951069b55bb [Pos Repl]
* C:\WINDOWS\System32\ntmssvc.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\ntmssvc.dll : 435,200 : 08/21/2008 09:00 AM : 156f64a3345bd23c600655fb4d10bc08 [Pos Repl]
* C:\WINDOWS\System32\ntoskrnl.exe [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB2393802\SP3QFE\ntoskrnl.exe : 2,192,768 : 12/09/2010 06:43 AM : a531bbd3de13121c1380ed7dc99082db [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2633171\SP3QFE\ntoskrnl.exe : 2,192,768 : 10/25/2011 06:34 AM : f512c662874d7545e5bd8005e6800a44 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2676562\SP3QFE\ntoskrnl.exe : 2,192,640 : 04/11/2012 06:22 AM : 8d061bb825bc606c2b1c6f7452d1baaa [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2707511\SP3QFE\ntoskrnl.exe : 2,192,640 : 05/04/2012 06:20 AM : 099a0f80a563ebe935f4a9750f96c219 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe : 2,189,184 : 02/07/2009 06:35 PM : efe8eace83eaad5849a7a548fb75b584 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB981852\SP3QFE\ntoskrnl.exe : 2,190,080 : 04/27/2010 06:50 AM : a2abbec40cdb57454645d06b7ebd22f5 [Pos Repl]
+-> C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe : 2,192,640 : 05/04/2012 09:12 AM : ddf0cb8cd3c6007cdf4ad8f0409ed930 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\ntoskrnl.exe : 2,192,640 : 05/04/2012 09:12 AM : ddf0cb8cd3c6007cdf4ad8f0409ed930 [Pos Repl]
* C:\WINDOWS\System32\oakley.dll [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB974392\SP3QFE\oakley.dll : 270,336 : 10/13/2009 06:38 AM : 7eadba6d371c60cca9e4db57c28c8045 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\oakley.dll : 270,336 : 10/13/2009 09:30 AM : c5ff8682eada5b3b27a865f1c3ef9270 [Pos Repl]
* C:\WINDOWS\System32\ole32.dll [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB2624667\SP3QFE\ole32.dll : 1,289,216 : 11/01/2011 06:05 AM : 7d9dde1ab4b00ddb173f5a16e9206517 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB979687\SP3QFE\ole32.dll : 1,289,216 : 07/16/2010 06:04 AM : 8d51fb47062f2a1a9efeccef338a4c46 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\ole32.dll : 1,288,704 : 11/01/2011 09:07 AM : 6bad1bed9872e62049e487fb91ae2f3a [Pos Repl]
* C:\WINDOWS\System32\olepro32.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\olepro32.dll : 84,992 : 08/21/2008 09:00 AM : 5652f6ce1d9e9d8068b9d29bc21b5409 [Pos Repl]
* C:\WINDOWS\System32\perfctrs.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\perfctrs.dll : 39,936 : 08/21/2008 09:00 AM : dbe2b62353660ecca0d75ea307a717e9 [Pos Repl]
* C:\WINDOWS\System32\powrprof.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\powrprof.dll : 17,408 : 08/21/2008 09:00 AM : 50a166237a0fa771261275a405646cc0 [Pos Repl]
* C:\WINDOWS\System32\psbase.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\psbase.dll : 96,768 : 08/21/2008 09:00 AM : 22d89d84e8e081cda529dbf8c0255a38 [Pos Repl]
* C:\WINDOWS\System32\pstorsvc.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\pstorsvc.dll : 34,304 : 08/21/2008 09:00 AM : 853d0d0c6f02d7bfdf1cf99dd7553732 [Pos Repl]
* C:\WINDOWS\System32\qmgr.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\qmgr.dll : 409,088 : 08/21/2008 09:00 AM : 574738f61fca2935f5265dc4e5691314 [Pos Repl]
* C:\WINDOWS\System32\rasadhlp.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\rasadhlp.dll : 7,680 : 08/21/2008 09:00 AM : 6f9bef24c578d5d6740e080bedd6a448 [Pos Repl]
* C:\WINDOWS\System32\regsvc.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\regsvc.dll : 59,904 : 08/21/2008 09:00 AM : 5b19b557b0c188210a56a6b699d90b8f [Pos Repl]
* C:\WINDOWS\System32\rpcss.dll [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\rpcss.dll : 401,408 : 02/09/2009 06:56 AM : 9222562d44021b988b9f9f62207fb6f2 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\rpcss.dll : 401,408 : 02/09/2009 09:10 AM : 6b27a5c03dfb94b4245739065431322c [Pos Repl]
* C:\WINDOWS\System32\scecli.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\scecli.dll : 181,248 : 08/21/2008 09:00 AM : a86bb5e61bf3e39b62ab4c7e7085a084 [Pos Repl]
* C:\WINDOWS\System32\schannel.dll [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB2541763\SP3QFE\schannel.dll : 151,552 : 04/29/2011 06:23 AM : 6fd5eec3703d7770c9029e774acc2294 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2585542\SP3QFE\schannel.dll : 152,064 : 11/16/2011 06:20 AM : d444009f7cd704c89f7f9e62396ed4f1 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2655992\SP3QFE\schannel.dll : 153,088 : 06/03/2012 09:31 PM : 26f1193092b9ac2586deb38dd1cbb25c [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB968389\SP3QFE\schannel.dll : 147,456 : 06/25/2009 09:41 AM : e513ba8bc33fd00f35d69659b478b1df [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB980436\SP3QFE\schannel.dll : 149,504 : 06/30/2010 09:23 AM : e04b6497b6407d2f444e86b30680dc5a [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\schannel.dll : 152,576 : 06/03/2012 09:32 PM : 0f64207b49390c8063c36ae7cbf9c2db [Pos Repl]
* C:\WINDOWS\System32\schedsvc.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\schedsvc.dll : 192,512 : 08/21/2008 09:00 AM : 0a9a7365a1ca4319aa7c1d6cd8e4eafa [Pos Repl]
* C:\WINDOWS\System32\services.exe [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe : 110,592 : 02/06/2009 09:06 AM : 020ceaaedc8eb655b6506b8c70d53bb6 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\services.exe : 110,592 : 02/06/2009 09:11 AM : 65df52f5b8b6e9bbd183505225c37315 [Pos Repl]
* C:\WINDOWS\System32\setupapi.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\setupapi.dll : 985,088 : 08/21/2008 09:00 AM : 24192246760e0e64435522e246b1d6c2 [Pos Repl]
* C:\WINDOWS\System32\sfc.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\sfc.dll : 5,120 : 08/21/2008 09:00 AM : 96e1c926f22ee1bfbae82901a35f6bf3 [Pos Repl]
* C:\WINDOWS\System32\sfcfiles.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\sfcfiles.dll : 1,614,848 : 08/21/2008 09:00 AM : 9dd07af82244867ca36681ea2d29ce79 [Pos Repl]
* C:\WINDOWS\System32\shsvcs.dll [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB971029\SP3QFE\shsvcs.dll : 135,168 : 07/27/2009 03:13 PM : 888cd7b39c37e13a2419becfaaf0a28c [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\shsvcs.dll : 135,168 : 07/27/2009 04:17 PM : 99bc0b50f511924348be19c7c7313bbf [Pos Repl]
* C:\WINDOWS\System32\smss.exe [NoSig]
+-> C:\WINDOWS\I386\SYSTEM32\SMSS.EXE : 470,016 : 08/21/2008 04:00 AM : 3c3393c92a73a3006c7b706dac54a812 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\smss.exe : 50,688 : 08/21/2008 04:00 AM : 5f816c1f539266d2d4c78694239da0b5 [Pos Repl]
* C:\WINDOWS\System32\srsvc.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\srsvc.dll : 171,008 : 08/21/2008 04:00 AM : 3805df0ac4296a34ba4bf93b346cc378 [Pos Repl]
* C:\WINDOWS\System32\ssdpsrv.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\ssdpsrv.dll : 71,680 : 08/21/2008 04:00 AM : 0a5679b3714edab99e357057ee88fca6 [Pos Repl]
* C:\WINDOWS\System32\svchost.exe [NoSig]
+-> C:\WINDOWS\system32\dllcache\svchost.exe : 14,336 : 08/21/2008 04:00 AM : 27c6d03bcdb8cfeb96b716f3d8be3e18 [Pos Repl]
* C:\WINDOWS\System32\tapisrv.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\tapisrv.dll : 249,856 : 08/21/2008 04:00 AM : 3cb78c17bb664637787c9a1c98f79c38 [Pos Repl]
* C:\WINDOWS\System32\termsrv.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\termsrv.dll : 295,424 : 08/21/2008 04:00 AM : ff3477c03be7201c294c35f684b3479f [Pos Repl]
* C:\WINDOWS\System32\upnphost.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\upnphost.dll : 185,856 : 08/21/2008 04:00 AM : 1ebafeb9a3fbdc41b8d9c7f0f687ad91 [Pos Repl]
* C:\WINDOWS\System32\user32.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\user32.dll : 578,560 : 08/21/2008 04:00 AM : b26b135ff1b9f60c9388b4a7d16f600b [Pos Repl]
* C:\WINDOWS\System32\userinit.exe [NoSig]
+-> C:\WINDOWS\system32\dllcache\userinit.exe : 26,112 : 08/21/2008 04:00 AM : a93aee1928a9d7ce3e16d24ec7380f89 [Pos Repl]
* C:\WINDOWS\System32\usp10.dll [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB981322\SP3QFE\usp10.dll : 406,016 : 04/16/2010 03:29 AM : f8894bcc961d461674002b4bae7aecc1 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\usp10.dll : 406,016 : 04/16/2010 04:36 AM : 9e03dc5ab51cfd0190541ce2038d819d [Pos Repl]
* C:\WINDOWS\System32\UxTheme.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\uxtheme.dll : 218,624 : 08/21/2008 04:00 AM : 7a2cc3719b255e6b5d74396183b7715b [Pos Repl]
* C:\WINDOWS\System32\version.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\version.dll : 18,944 : 08/21/2008 04:00 AM : c7ce131408739b0b3a318be2d0032719 [Pos Repl]
* C:\WINDOWS\System32\w32time.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\w32time.dll : 175,104 : 08/21/2008 04:00 AM : 54af4b1d5459500ef0937f6d33b1914f [Pos Repl]
* C:\WINDOWS\System32\wbem\wmiprvse.exe [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\wmiprvse.exe : 227,840 : 02/06/2009 03:15 AM : f520ab392d58c0a1070268032d809382 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\wmiprvse.exe : 227,840 : 02/06/2009 04:10 AM : 798a9e6828997eef4517ada8a2259831 [Pos Repl]
* C:\WINDOWS\System32\wdigest.dll [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB968389\SP3QFE\wdigest.dll : 54,272 : 06/25/2009 03:41 AM : d9dcec3fa1b27689fc56e34c38d3f148 [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\wdigest.dll : 54,272 : 06/25/2009 04:25 AM : 3aaf9b35939ff9e58ccd18d41655c2fc [Pos Repl]
* C:\WINDOWS\System32\wiaservc.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\wiaservc.dll : 333,824 : 08/21/2008 04:00 AM : 8bad69cbac032d4bbacfce0306174c30 [Pos Repl]
* C:\WINDOWS\System32\wininet.dll [NoSig]
+-> C:\WINDOWS\$hf_mig$\KB2360131\SP3QFE\wininet.dll : 668,672 : 09/09/2010 03:25 AM : d7275e6da8d1a8beb36468548899522c [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2360131-IE8\SP3QFE\wininet.dll : 919,552 : 09/09/2010 10:57 PM : 0555e190dcd06b8998e6ddca42daeb82 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2416400-IE8\SP3QFE\wininet.dll : 919,552 : 11/05/2010 05:27 PM : 9357c4249f4810fb0e49c13387a8a77c [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2482017-IE8\SP3QFE\wininet.dll : 919,552 : 12/20/2010 03:58 PM : 5504b4ecce892eb82cd2c5fa71940ac1 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2497640-IE8\SP3QFE\wininet.dll : 919,552 : 02/22/2011 03:27 PM : a9fa95f0d7f511959ac721e4843e5967 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2530548-IE8\SP3QFE\wininet.dll : 919,552 : 04/25/2011 03:09 AM : 7f4f1697001b9e9a7924d219dc215903 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2559049-IE8\SP3QFE\wininet.dll : 919,552 : 06/23/2011 03:33 AM : 509cf67ae762a38e23a5455a0053853c [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2586448-IE8\SP3QFE\wininet.dll : 919,552 : 08/22/2011 04:47 PM : 19630aebbfaeb06984cab91848270aaf [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2618444-IE8\SP3QFE\wininet.dll : 919,552 : 11/04/2011 04:19 AM : 4e4716caf514717814d07113ad0425b6 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2647516-IE8\SP3QFE\wininet.dll : 919,552 : 12/17/2011 04:45 AM : 84a48e9818e8440ddbfd8eec37c8a937 [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2675157-IE8\SP3QFE\wininet.dll : 919,552 : 03/01/2012 04:58 AM : 4ec67fab39f37626ad6d9895fc094abf [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2699988-IE8\SP3QFE\wininet.dll : 920,064 : 05/16/2012 04:06 AM : 553ad35768cd27959391dd5aa82cef6f [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB2722913-IE8\SP3QFE\wininet.dll : 920,064 : 07/02/2012 04:48 AM : efb2241de3aa6480521a16d0cb67b0ec [Pos Repl]
+-> C:\WINDOWS\$hf_mig$\KB982381-IE8\SP3QFE\wininet.dll : 919,040 : 05/06/2010 04:36 AM : c1490f68b44af8b781f52f12f564625d [Pos Repl]
+-> C:\WINDOWS\ie8\wininet.dll : 666,112 : 08/21/2008 01:00 AM : 7a4f775abb2f1c97def3e73afa2faedd [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB2360131-IE8\wininet.dll : 916,480 : 05/06/2010 04:41 AM : 2d9c7b010409372c34f725da5cced083 [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB2416400-IE8\wininet.dll : 916,480 : 09/09/2010 10:58 PM : 36fe8abc59aafbe20cbe54bc372f9429 [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB2482017-IE8\wininet.dll : 916,480 : 11/05/2010 05:26 PM : 306a2b05ea9846278113964dc6e2c940 [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB2497640-IE8\wininet.dll : 916,480 : 12/20/2010 03:59 PM : 88014d62b5e3cdb0ac67948d86c926c8 [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB2530548-IE8\wininet.dll : 916,480 : 02/22/2011 03:06 PM : f192d49eefe297fa858b2c774ba2291d [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB2559049-IE8\wininet.dll : 916,480 : 04/25/2011 03:11 AM : cc951c2212a200475a587a440e0aa804 [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB2586448-IE8\wininet.dll : 916,480 : 06/23/2011 03:36 AM : af4eddc6c0446fce5681b5ded52b8f0e [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB2618444-IE8\wininet.dll : 916,480 : 08/22/2011 04:48 PM : 1a377838b4b468e37c3eeb5baa24f925 [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB2647516-IE8\wininet.dll : 916,992 : 11/04/2011 04:20 AM : 552263502ea8c24d301a0c43ff90b3ed [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB2675157-IE8\wininet.dll : 916,992 : 12/17/2011 04:46 AM : f362d50fbdc6e34918df41bde1770e5c [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB2699988-IE8\wininet.dll : 916,992 : 03/01/2012 04:01 AM : 009e7b4c284f080608d7286484015ee5 [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB2722913-IE8\wininet.dll : 916,992 : 05/16/2012 04:08 AM : 6b1774334e2975aa60596e54f5ea1430 [Pos Repl]
+-> C:\WINDOWS\ie8updates\KB982381-IE8\wininet.dll : 914,944 : 03/08/2009 04:34 AM : 6ce32f7778061ccc5814d5e0f282d369 [Pos Repl]
+-> C:\WINDOWS\SoftwareDistribution\Download\06af2d630217aa32a4f6f6b9c5c1a3ba\SP3GDR\wininet.dll : 916,992 : 07/02/2012 10:49 AM : c4300cb4d20b1159dc77e01e8a2525ec [Pos Repl]
+-> C:\WINDOWS\SoftwareDistribution\Download\06af2d630217aa32a4f6f6b9c5c1a3ba\SP3QFE\wininet.dll : 920,064 : 07/02/2012 10:48 AM : efb2241de3aa6480521a16d0cb67b0ec [Pos Repl]
+-> C:\WINDOWS\SoftwareDistribution\Download\c0b2667570bfaadca71db300b030c7f4\SP3GDR\wininet.dll : 916,480 : 09/09/2010 10:58 PM : 36fe8abc59aafbe20cbe54bc372f9429 [Pos Repl]
+-> C:\WINDOWS\SoftwareDistribution\Download\c0b2667570bfaadca71db300b030c7f4\SP3QFE\wininet.dll : 919,552 : 09/09/2010 10:57 PM : 0555e190dcd06b8998e6ddca42daeb82 [Pos Repl]
+-> C:\WINDOWS\SoftwareDistribution\Download\e9e3bc7b49018c1f53cc0d1bd73cad37\SP3GDR\wininet.dll : 916,480 : 05/06/2010 10:41 AM : 2d9c7b010409372c34f725da5cced083 [Pos Repl]
+-> C:\WINDOWS\SoftwareDistribution\Download\e9e3bc7b49018c1f53cc0d1bd73cad37\SP3QFE\wininet.dll : 919,040 : 05/06/2010 10:36 AM : c1490f68b44af8b781f52f12f564625d [Pos Repl]
+-> C:\WINDOWS\system32\dllcache\wininet.dll : 916,992 : 07/02/2012 04:49 AM : c4300cb4d20b1159dc77e01e8a2525ec [Pos Repl]
* C:\WINDOWS\System32\winlogon.exe [NoSig]
+-> C:\WINDOWS\system32\dllcache\winlogon.exe : 507,904 : 08/21/2008 04:00 AM : ed0ef0a136dec83df69f04118870003e [Pos Repl]
* C:\WINDOWS\System32\ws2_32.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\ws2_32.dll : 82,432 : 08/21/2008 04:00 AM : 2ccc474eb85ceaa3e1fa1726580a3e5a [Pos Repl]
* C:\WINDOWS\System32\ws2help.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\ws2help.dll : 19,968 : 08/21/2008 04:00 AM : 9789e95e1d88eeb4b922bf3ea7779c28 [Pos Repl]
* C:\WINDOWS\System32\wscntfy.exe [NoSig]
+-> C:\WINDOWS\system32\dllcache\wscntfy.exe : 13,824 : 08/21/2008 04:00 AM : f92e1076c42fcd6db3d72d8cfe9816d5 [Pos Repl]
* C:\WINDOWS\System32\xmlprov.dll [NoSig]
+-> C:\WINDOWS\system32\dllcache\xmlprov.dll : 129,024 : 08/21/2008 04:00 AM : 295d21f14c335b53cb8154e5b1f892b9 [Pos Repl]
* C:\WINDOWS\explorer.exe [NoSig]
+-> C:\WINDOWS\system32\dllcache\explorer.exe : 1,033,728 : 08/21/2008 04:00 AM : 12896823fb95bfb3dc9b46bcaedc9923 [Pos Repl]
Program finished at: 09/17/2012 01:26:50 AM
Execution time: 0 hours(s), 2 minute(s), and 28 seconds(s)

Foxiffer · Sep 17, 2012

Here is combofix log.

ComboFix 12-09-16.01 - Fox Ellis 09/17/2012 1:31.1.1 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2942.2508 [GMT -7:00]
Running from: c:\documents and settings\Fox Ellis\Desktop\C0mb0Fix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\All Users\Application Data\TEMP\AVG\avgmfapx.exe
c:\documents and settings\All Users\Application Data\TEMP\AVG\avgmfarx.dll
c:\documents and settings\All Users\Application Data\TEMP\AVG\avgntdumpx.exe
c:\documents and settings\All Users\Application Data\TEMP\AVG\avgrunasx.exe
c:\documents and settings\All Users\Application Data\TEMP\AVG\avi7.avg
c:\documents and settings\All Users\Application Data\TEMP\AVG\compat.ini
c:\documents and settings\All Users\Application Data\TEMP\AVG\htmlayout.dll
c:\documents and settings\All Users\Application Data\TEMP\AVG\incavi.avm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_cz.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_da.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_es.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_fr.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_ge.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_hu.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_id.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_in.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_it.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_jp.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_ko.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_ms.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_nl.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_pb.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_pl.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_pt.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_ru.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_sc.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_sk.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_sp.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_tr.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_us.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_zh.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\license_zt.htm
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfaconf.txt
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfacz.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfada.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfaes.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfafr.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfage.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfahu.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfaid.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfain.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfait.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfajp.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfako.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfams.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfanl.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfapb.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfapl.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfapt.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfaru.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfasc.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfask.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfasp.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfatr.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfaus.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfavera.txt
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfaverx.txt
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfazh.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\mfazt.lns
c:\documents and settings\All Users\Application Data\TEMP\AVG\microavi.avg
c:\documents and settings\All Users\Application Data\TEMP\AVG\miniavi.avg
c:\documents and settings\All Users\Application Data\TEMP\AVG\setup.exe
c:\documents and settings\All Users\Application Data\TEMP\AVG\setup.ini
c:\documents and settings\Fox Ellis\Application Data\PriceGong
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\1.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\a.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\b.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\c.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\d.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\e.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\f.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\g.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\h.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\I.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\J.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\k.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\l.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\m.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\n.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\o.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\p.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\q.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\r.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\s.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\t.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\u.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\v.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\w.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\x.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\y.xml
c:\documents and settings\Fox Ellis\Application Data\PriceGong\Data\z.xml
c:\documents and settings\Fox Ellis\WINDOWS
c:\documents and settings\Guest\Application Data\PriceGong
c:\documents and settings\Guest\Application Data\PriceGong\Data\1.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\a.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\b.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\c.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\d.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\e.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\f.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\g.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\h.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\I.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\J.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\k.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\l.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\m.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\n.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\o.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\p.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\q.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\r.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\s.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\t.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\u.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\v.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\w.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\x.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\y.xml
c:\documents and settings\Guest\Application Data\PriceGong\Data\z.xml
c:\documents and settings\Lisa Narvaez\g2mdlhlpx.exe
c:\windows\desktop
c:\windows\system32\Cache
c:\windows\system32\Cache\272512937d9e61a4.fb
c:\windows\system32\Cache\287204568329e189.fb
c:\windows\system32\Cache\28bc8f716fd76a47.fb
c:\windows\system32\Cache\2c53092c95605355.fb
c:\windows\system32\Cache\31a0997e9a5b5eb3.fb
c:\windows\system32\Cache\32c84fe32bb74d60.fb
c:\windows\system32\Cache\3917078cb68ec657.fb
c:\windows\system32\Cache\5475d5126a4582aa.fb
c:\windows\system32\Cache\590ba23ce359fd0c.fb
c:\windows\system32\Cache\610289e025a3ee9a.fb
c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb
c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb
c:\windows\system32\Cache\6d03dad1035885d3.fb
c:\windows\system32\Cache\7aaea09008ece81b.fb
c:\windows\system32\Cache\7b3f97abcd713eee.fb
c:\windows\system32\Cache\a106d1cdc6e65be8.fb
c:\windows\system32\Cache\a8556537add6dfc5.fb
c:\windows\system32\Cache\ad10a52aff5e038d.fb
c:\windows\system32\Cache\c1fa887b03019701.fb
c:\windows\system32\Cache\c4d28dca2e7648be.fb
c:\windows\system32\Cache\d201ef9910cd39de.fb
c:\windows\system32\Cache\d2e94710a5708128.fb
c:\windows\system32\Cache\d79b9dfe81484ec4.fb
c:\windows\system32\Cache\e0de16f883bea794.fb
c:\windows\system32\Cache\e65e61ff8886045d.fb
c:\windows\system32\Cache\f998975c9cc711ee.fb
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32\encapi32.dll
c:\windows\system32\rnaph.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_MYWEBSEARCHSERVICE
.
.
((((((((((((((((((((((((( Files Created from 2012-08-17 to 2012-09-17 )))))))))))))))))))))))))))))))
.
.
2012-09-17 08:17 . 2012-09-17 08:21 -------- dc----w- C:\C0mb0Fix
2012-09-15 03:20 . 2012-09-15 03:20 -------- dc----w- C:\TDSSKiller_Quarantine
2012-09-15 00:33 . 2012-09-15 00:33 -------- d-----w- c:\documents and settings\Fox Ellis\Application Data\Malwarebytes
2012-09-15 00:32 . 2012-09-15 00:32 -------- dc----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2012-09-15 00:32 . 2012-09-08 00:04 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-09-14 03:47 . 2012-09-14 03:47 -------- dc----w- c:\documents and settings\Guest\Local Settings\Application Data\Mozilla
2012-09-10 01:15 . 2012-09-10 01:15 -------- d-----w- c:\program files\Common Files\Java
2012-09-10 01:14 . 2012-09-10 01:14 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-09-10 01:14 . 2012-09-10 01:14 -------- d-----w- c:\program files\Java
2012-09-10 01:13 . 2012-09-10 01:13 0 ----a-w- c:\windows\system32\REN8E.tmp
2012-09-10 01:13 . 2012-09-10 01:13 0 ----a-w- c:\windows\system32\REN8D.tmp
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-10 01:14 . 2012-05-09 03:27 821736 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-09-10 01:14 . 2011-03-08 23:54 143872 ----a-w- c:\windows\system32\javacpl.cpl
2012-09-10 01:14 . 2010-10-17 05:56 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-08-17 02:09 . 2012-08-17 02:09 0 ----a-w- c:\windows\system32\RENCA5.tmp
2012-08-17 02:09 . 2012-08-17 02:09 0 ----a-w- c:\windows\system32\RENCA4.tmp
2012-08-17 01:59 . 2012-08-17 01:59 263186 -c--a-w- C:\Minecraft.exe
2012-08-17 01:56 . 2012-08-17 01:56 0 ----a-w- c:\windows\system32\REN2C.tmp
2012-08-17 01:56 . 2012-08-17 01:56 0 ----a-w- c:\windows\system32\REN2B.tmp
2012-08-17 01:55 . 2012-08-17 01:55 0 ----a-w- c:\windows\system32\REN11.tmp
2012-08-17 01:55 . 2012-08-17 01:55 0 ----a-w- c:\windows\system32\REN10.tmp
2012-08-15 01:06 . 2012-08-09 03:33 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-15 01:06 . 2011-08-21 01:51 70344 -c--a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-08 21:37 . 2012-08-08 21:37 0 ----a-w- c:\windows\system32\REND45.tmp
2012-08-08 21:37 . 2012-08-08 21:37 0 ----a-w- c:\windows\system32\REND44.tmp
2012-08-08 21:27 . 2012-08-08 21:26 910128 -c--a-w- C:\jre-6u33-windows-i586-iftw.exe
2012-08-08 21:14 . 2012-08-08 21:14 0 ----a-w- c:\windows\system32\REND01.tmp
2012-08-08 21:14 . 2012-08-08 21:14 0 ----a-w- c:\windows\system32\REND00.tmp
2012-08-08 21:07 . 2012-08-08 21:06 88210392 -c--a-w- C:\jdk-7u3-windows-i586.exe
2012-08-08 20:44 . 2012-08-08 20:44 0 ----a-w- c:\windows\system32\RENCF3.tmp
2012-08-08 20:44 . 2012-08-08 20:44 0 ----a-w- c:\windows\system32\RENCF2.tmp
2012-08-08 20:44 . 2012-08-08 20:44 0 ----a-w- c:\windows\system32\RENCF1.tmp
2012-08-08 20:43 . 2012-08-08 20:43 16824096 -c--a-w- C:\jre-6u15-windows-i586-s.exe
2012-08-06 22:00 . 2012-08-06 22:00 0 ----a-w- c:\windows\system32\RENC27.tmp
2012-08-06 22:00 . 2012-08-06 22:00 0 ----a-w- c:\windows\system32\RENC26.tmp
2012-08-06 21:53 . 2012-08-06 21:53 893936 -c--a-w- C:\JavaSetup7u5.exe
2012-08-06 21:52 . 2012-08-06 21:52 0 ----a-w- c:\windows\system32\RENC05.tmp
2012-08-06 21:52 . 2012-08-06 21:52 0 ----a-w- c:\windows\system32\RENC04.tmp
2012-07-06 13:58 . 2010-03-11 15:45 78336 ----a-w- c:\windows\system32\browser.dll
2012-07-04 14:05 . 2010-03-11 16:57 139784 ------w- c:\windows\system32\drivers\rdpwd.sys
2012-07-03 13:40 . 2010-03-11 15:46 1866112 ------w- c:\windows\system32\win32k.sys
2012-07-02 17:49 . 2010-03-11 15:46 916992 ----a-w- c:\windows\system32\wininet.dll
2012-07-02 17:49 . 2010-03-11 15:45 43520 ------w- c:\windows\system32\licmgr10.dll
2012-07-02 17:49 . 2010-03-11 15:45 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-07-02 12:05 . 2010-03-11 15:45 385024 ------w- c:\windows\system32\html.iec
2012-06-22 23:32 . 2012-07-09 03:45 405144 ----a-w- c:\windows\system32\Newtonsoft.Json.Net20.dll
2011-11-21 04:04 . 2011-11-22 18:46 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-08-21 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\drivers\atapi.sys
.
[-] 2008-08-21 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\asyncmac.sys
[-] 2008-08-21 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\system32\drivers\asyncmac.sys
.
[-] 2008-08-21 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\dllcache\beep.sys
[-] 2008-08-21 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\drivers\beep.sys
.
[-] 2008-08-21 . 463C1EC80CD17420A542B7F36A36F128 . 24576 . . [5.1.2600.5512] . . c:\windows\system32\drivers\kbdclass.sys
.
[-] 2008-08-21 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ndis.sys
[-] 2008-08-21 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ndis.sys
.
[-] 2008-08-21 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\I386\NTFS.SYS
[-] 2008-08-21 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ntfs.sys
[-] 2008-08-21 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ntfs.sys
.
[-] 2008-08-21 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\dllcache\null.sys
[-] 2008-08-21 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys
.
[-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB2509553\SP3QFE\tcpip.sys
[-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
.
[-] 2012-07-06 . CFD4E51402DA9838B5A04AE680AF54A0 . 78336 . . [5.1.2600.6260] . . c:\windows\SoftwareDistribution\Download\4a0e4531b96faf560594eec84d879de6\sp3gdr\browser.dll
[-] 2012-07-06 . CFD4E51402DA9838B5A04AE680AF54A0 . 78336 . . [5.1.2600.6260] . . c:\windows\system32\browser.dll
[-] 2012-07-06 . CFD4E51402DA9838B5A04AE680AF54A0 . 78336 . . [5.1.2600.6260] . . c:\windows\system32\dllcache\browser.dll
[-] 2012-07-06 . FC6D1D80588D371F0321E15A75B2F8F2 . 78336 . . [5.1.2600.6260] . . c:\windows\$hf_mig$\KB2705219\SP3QFE\browser.dll
[-] 2012-07-06 . FC6D1D80588D371F0321E15A75B2F8F2 . 78336 . . [5.1.2600.6260] . . c:\windows\SoftwareDistribution\Download\4a0e4531b96faf560594eec84d879de6\sp3qfe\browser.dll
[-] 2008-08-21 . A06CE3399D16DB864F55FAEB1F1927A9 . 77824 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB2705219$\browser.dll
.
[-] 2008-08-21 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\system32\lsass.exe
[-] 2008-08-21 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\lsass.exe
.
[-] 2008-08-21 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\system32\netman.dll
[-] 2008-08-21 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\netman.dll
.
[-] 2008-08-21 12:00 . 1280A158C722FA95A80FB7AEBE78FA7D . 792064 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll
[-] 2008-08-21 12:00 . 1280A158C722FA95A80FB7AEBE78FA7D . 792064 . . [2001.12.4414.700] . . c:\windows\system32\dllcache\comres.dll
.
[-] 2008-08-21 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\qmgr.dll
[-] 2008-08-21 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\dllcache\qmgr.dll
.
[-] 2009-02-09 . 6B27A5C03DFB94B4245739065431322C . 401408 . . [5.1.2600.5755] . . c:\windows\system32\rpcss.dll
[-] 2009-02-09 . 6B27A5C03DFB94B4245739065431322C . 401408 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\rpcss.dll
[-] 2009-02-09 . 9222562D44021B988B9F9F62207FB6F2 . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\rpcss.dll
.
[-] 2009-02-06 . 65DF52F5B8B6E9BBD183505225C37315 . 110592 . . [5.1.2600.5755] . . c:\windows\system32\services.exe
[-] 2009-02-06 . 65DF52F5B8B6E9BBD183505225C37315 . 110592 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\services.exe
[-] 2009-02-06 . 020CEAAEDC8EB655B6506B8C70D53BB6 . 110592 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe
.
[-] 2010-08-17 . 258DD5D4283FD9F9A7166BE9AE45CE73 . 58880 . . [5.1.2600.6024] . . c:\windows\$hf_mig$\KB2347290\SP3QFE\spoolsv.exe
[-] 2010-08-17 . 60784F891563FB1B767F70117FC2428F . 58880 . . [5.1.2600.6024] . . c:\windows\system32\dllcache\spoolsv.exe
.
[-] 2008-08-21 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
[-] 2008-08-21 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\winlogon.exe
.
[-] 2008-08-21 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ipsec.sys
[-] 2008-08-21 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ipsec.sys
.
[-] 2010-08-23 . 93AFB83FBC1F9443CAC722FCA63D73BF . 617472 . . [5.82] . . c:\windows\system32\comctl32.dll
[-] 2010-08-23 . 93AFB83FBC1F9443CAC722FCA63D73BF . 617472 . . [5.82] . . c:\windows\system32\dllcache\comctl32.dll
[-] 2010-08-23 . 736B12B725AEB2B07F0241A9F680CB10 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
[-] 2008-08-21 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\I386\ASMS\6000\MSFT\WINDOWS\COMMON\CONTROLS\COMCTL32.DLL
[-] 2008-08-21 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
[-] 2008-08-21 . BD38D1EBE24A46BD3EDA059560AFBA12 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
.
[-] 2008-08-21 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\system32\cryptsvc.dll
[-] 2008-08-21 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\cryptsvc.dll
.
[-] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\system32\es.dll
[-] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\system32\dllcache\es.dll
[-] 2008-07-07 20:23 . F17F6226BDC0CD5F0BEF0DAF84D29BEC . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3QFE\es.dll
.
[-] 2008-08-21 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\system32\imm32.dll
[-] 2008-08-21 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\imm32.dll
.
[-] 2009-03-21 . B921FB870C9AC0D509B2CCABBBBE95F3 . 989696 . . [5.1.2600.5781] . . c:\windows\system32\kernel32.dll
[-] 2009-03-21 . B921FB870C9AC0D509B2CCABBBBE95F3 . 989696 . . [5.1.2600.5781] . . c:\windows\system32\dllcache\kernel32.dll
[-] 2009-03-21 . DA11D9D6ECBDF0F93436A4B7C13F7BEC . 991744 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll
.
[-] 2008-08-21 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\linkinfo.dll
[-] 2008-08-21 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\linkinfo.dll
.
[-] 2008-08-21 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\system32\lpk.dll
[-] 2008-08-21 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\lpk.dll
.
[-] 2012-07-02 . 13D2E016B784730A98F24D6E5BEED22F . 6008320 . . [8.00.6001.19298] . . c:\windows\SoftwareDistribution\Download\06af2d630217aa32a4f6f6b9c5c1a3ba\SP3GDR\mshtml.dll
[-] 2012-07-02 . 13D2E016B784730A98F24D6E5BEED22F . 6008320 . . [8.00.6001.19298] . . c:\windows\system32\mshtml.dll
[-] 2012-07-02 . 13D2E016B784730A98F24D6E5BEED22F . 6008320 . . [8.00.6001.19298] . . c:\windows\system32\dllcache\mshtml.dll
[-] 2012-07-02 . DF599AC52B62DE001E42D36F92B45E68 . 6010368 . . [8.00.6001.23385] . . c:\windows\$hf_mig$\KB2722913-IE8\SP3QFE\mshtml.dll
[-] 2012-07-02 . DF599AC52B62DE001E42D36F92B45E68 . 6010368 . . [8.00.6001.23385] . . c:\windows\SoftwareDistribution\Download\06af2d630217aa32a4f6f6b9c5c1a3ba\SP3QFE\mshtml.dll
[-] 2012-05-11 . 886B62A906B3967CBBF0FD2C833A30BF . 6007808 . . [8.00.6001.19258] . . c:\windows\ie8updates\KB2722913-IE8\mshtml.dll
[-] 2012-05-11 . 55F148B94246A77FB4AC33346671CAC8 . 6009344 . . [8.00.6001.23345] . . c:\windows\$hf_mig$\KB2699988-IE8\SP3QFE\mshtml.dll
[-] 2012-03-01 . DADE53318D8E5335EE2E1745F1C3FC4D . 5978624 . . [8.00.6001.19222] . . c:\windows\ie8updates\KB2699988-IE8\mshtml.dll
[-] 2012-03-01 . 5DBB0C997AD276BCE9D30CD609BDBF67 . 5980672 . . [8.00.6001.23318] . . c:\windows\$hf_mig$\KB2675157-IE8\SP3QFE\mshtml.dll
[-] 2011-12-17 . A9259CD226283CD4F798C00909754A94 . 5979136 . . [8.00.6001.19190] . . c:\windows\ie8updates\KB2675157-IE8\mshtml.dll
[-] 2011-12-17 . 49B88A833ECA99EFBFFC5AAE5CC998ED . 5980160 . . [8.00.6001.23286] . . c:\windows\$hf_mig$\KB2647516-IE8\SP3QFE\mshtml.dll
[-] 2011-11-04 . DD8D655E1881B70A5259A23A6018A6C2 . 5978112 . . [8.00.6001.19170] . . c:\windows\ie8updates\KB2647516-IE8\mshtml.dll
[-] 2011-11-04 . 699421E2E1313C18671A703953CAE14B . 5978624 . . [8.00.6001.23266] . . c:\windows\$hf_mig$\KB2618444-IE8\SP3QFE\mshtml.dll
[-] 2011-10-03 . 4963CB503600FC3BCBDBFBA51FBA1FAC . 5971456 . . [8.00.6001.19154] . . c:\windows\ie8updates\KB2618444-IE8\mshtml.dll
[-] 2011-10-03 . 1240A6B7B470BED0AA6C9FEC7AB0EA26 . 5972992 . . [8.00.6001.23250] . . c:\windows\$hf_mig$\KB2586448-IE8\SP3QFE\mshtml.dll
[-] 2011-07-25 . 23B3C8E9F3F280180573569253CE98AB . 5969920 . . [8.00.6001.19120] . . c:\windows\ie8updates\KB2586448-IE8\mshtml.dll
[-] 2011-07-25 . BCE7CCEBAD6C8955D2B4C3B246BD0E57 . 5971456 . . [8.00.6001.23216] . . c:\windows\$hf_mig$\KB2559049-IE8\SP3QFE\mshtml.dll
[-] 2011-05-30 . 22BA5235EA846EDA87F68A1DCC2BFCF9 . 5964800 . . [8.00.6001.19088] . . c:\windows\ie8updates\KB2559049-IE8\mshtml.dll
[-] 2011-05-30 . D0B1DB576941CB0B6669B8752FFAC79A . 5967360 . . [8.00.6001.23181] . . c:\windows\$hf_mig$\KB2530548-IE8\SP3QFE\mshtml.dll
[-] 2011-02-22 . 3422847AA07E37076A87D0B7D5044DC6 . 5964800 . . [8.00.6001.23141] . . c:\windows\$hf_mig$\KB2497640-IE8\SP3QFE\mshtml.dll
[-] 2011-02-22 . C2EF2335F1B6C2BE20A67D9098F6C9A1 . 5962240 . . [8.00.6001.19046] . . c:\windows\ie8updates\KB2530548-IE8\mshtml.dll
[-] 2010-12-20 . 1EDCEC5D649DBAC37ED9FFB5A14CEB0C . 5961216 . . [8.00.6001.19019] . . c:\windows\ie8updates\KB2497640-IE8\mshtml.dll
[-] 2010-12-20 . 2A2C070EC691CE410533A1DA7AA3CD86 . 5962240 . . [8.00.6001.23111] . . c:\windows\$hf_mig$\KB2482017-IE8\SP3QFE\mshtml.dll
[-] 2010-11-06 . 864E69F32656A7121444BA0193D7B64B . 5960704 . . [8.00.6001.23091] . . c:\windows\$hf_mig$\KB2416400-IE8\SP3QFE\mshtml.dll
[-] 2010-11-06 . D7CCA87057901C87ED8CC40DDCC7FA1B . 5959168 . . [8.00.6001.18999] . . c:\windows\ie8updates\KB2482017-IE8\mshtml.dll
[-] 2010-09-10 . DE41132DA8E5A3CD57201C6F2175EC05 . 5957120 . . [8.00.6001.18975] . . c:\windows\ie8updates\KB2416400-IE8\mshtml.dll
[-] 2010-09-10 . DE41132DA8E5A3CD57201C6F2175EC05 . 5957120 . . [8.00.6001.18975] . . c:\windows\SoftwareDistribution\Download\c0b2667570bfaadca71db300b030c7f4\SP3GDR\mshtml.dll
[-] 2010-09-10 . 8A03CC037E6B7D1796192815231B0C3F . 5958656 . . [8.00.6001.23067] . . c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\mshtml.dll
[-] 2010-09-10 . 8A03CC037E6B7D1796192815231B0C3F . 5958656 . . [8.00.6001.23067] . . c:\windows\SoftwareDistribution\Download\c0b2667570bfaadca71db300b030c7f4\SP3QFE\mshtml.dll
[-] 2010-09-09 . 575FBCB3E2C6E848F0386F38AAF0E4ED . 3074560 . . [6.00.2900.6036] . . c:\windows\$hf_mig$\KB2360131\SP3QFE\mshtml.dll
.
[-] 2008-08-21 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\I386\ASMS\7000\MSFT\WINDOWS\MSWINCRT\MSVCRT.DLL
[-] 2008-08-21 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\system32\msvcrt.dll
[-] 2008-08-21 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\system32\dllcache\msvcrt.dll
[-] 2008-08-21 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll
[-] 2008-08-21 . D7075E95AA599EE77B7A89D39296BD3D . 343040 . . [7.0.2600.5512] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll
.
[-] 2008-06-20 . FCEE5FCB99F7C724593365C706D28388 . 245248 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB2509553\SP3QFE\mswsock.dll
[-] 2008-06-20 . FCEE5FCB99F7C724593365C706D28388 . 245248 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\mswsock.dll
[-] 2008-06-20 . 943337D786A56729263071623BBB9DE5 . 245248 . . [5.1.2600.5625] . . c:\windows\system32\mswsock.dll
[-] 2008-06-20 . 943337D786A56729263071623BBB9DE5 . 245248 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\mswsock.dll
.
[-] 2008-08-21 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\system32\netlogon.dll
[-] 2008-08-21 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\netlogon.dll
.
[-] 2008-08-21 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\system32\powrprof.dll
[-] 2008-08-21 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\powrprof.dll
.
[-] 2008-08-21 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\system32\scecli.dll
[-] 2008-08-21 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\scecli.dll
.
[-] 2008-08-21 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\system32\sfc.dll
[-] 2008-08-21 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\sfc.dll
.
[-] 2008-08-21 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\system32\svchost.exe
[-] 2008-08-21 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\svchost.exe
.
[-] 2008-08-21 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\system32\tapisrv.dll
[-] 2008-08-21 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\tapisrv.dll
.
[-] 2008-08-21 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll
[-] 2008-08-21 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\user32.dll
.
[-] 2008-08-21 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\system32\userinit.exe
[-] 2008-08-21 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\userinit.exe
.
[-] 2012-07-02 . C4300CB4D20B1159DC77E01E8A2525EC . 916992 . . [8.00.6001.19298] . . c:\windows\SoftwareDistribution\Download\06af2d630217aa32a4f6f6b9c5c1a3ba\SP3GDR\wininet.dll
[-] 2012-07-02 . C4300CB4D20B1159DC77E01E8A2525EC . 916992 . . [8.00.6001.19298] . . c:\windows\system32\wininet.dll
[-] 2012-07-02 . C4300CB4D20B1159DC77E01E8A2525EC . 916992 . . [8.00.6001.19298] . . c:\windows\system32\dllcache\wininet.dll
[-] 2012-07-02 . EFB2241DE3AA6480521A16D0CB67B0EC . 920064 . . [8.00.6001.23385] . . c:\windows\$hf_mig$\KB2722913-IE8\SP3QFE\wininet.dll
[-] 2012-07-02 . EFB2241DE3AA6480521A16D0CB67B0EC . 920064 . . [8.00.6001.23385] . . c:\windows\SoftwareDistribution\Download\06af2d630217aa32a4f6f6b9c5c1a3ba\SP3QFE\wininet.dll
[-] 2012-05-16 . 6B1774334E2975AA60596E54F5EA1430 . 916992 . . [8.00.6001.19272] . . c:\windows\ie8updates\KB2722913-IE8\wininet.dll
[-] 2012-05-16 . 553AD35768CD27959391DD5AA82CEF6F . 920064 . . [8.00.6001.23359] . . c:\windows\$hf_mig$\KB2699988-IE8\SP3QFE\wininet.dll
[-] 2012-03-01 . 009E7B4C284F080608D7286484015EE5 . 916992 . . [8.00.6001.19222] . . c:\windows\ie8updates\KB2699988-IE8\wininet.dll
[-] 2012-03-01 . 4EC67FAB39F37626AD6D9895FC094ABF . 919552 . . [8.00.6001.23318] . . c:\windows\$hf_mig$\KB2675157-IE8\SP3QFE\wininet.dll
[-] 2011-12-17 . F362D50FBDC6E34918DF41BDE1770E5C . 916992 . . [8.00.6001.19190] . . c:\windows\ie8updates\KB2675157-IE8\wininet.dll
[-] 2011-12-17 . 84A48E9818E8440DDBFD8EEC37C8A937 . 919552 . . [8.00.6001.23286] . . c:\windows\$hf_mig$\KB2647516-IE8\SP3QFE\wininet.dll
[-] 2011-11-04 . 552263502EA8C24D301A0C43FF90B3ED . 916992 . . [8.00.6001.19165] . . c:\windows\ie8updates\KB2647516-IE8\wininet.dll
[-] 2011-11-04 . 4E4716CAF514717814D07113AD0425B6 . 919552 . . [8.00.6001.23261] . . c:\windows\$hf_mig$\KB2618444-IE8\SP3QFE\wininet.dll
[-] 2011-08-22 . 1A377838B4B468E37C3EEB5BAA24F925 . 916480 . . [8.00.6001.19131] . . c:\windows\ie8updates\KB2618444-IE8\wininet.dll
[-] 2011-08-22 . 19630AEBBFAEB06984CAB91848270AAF . 919552 . . [8.00.6001.23227] . . c:\windows\$hf_mig$\KB2586448-IE8\SP3QFE\wininet.dll
[-] 2011-06-23 . AF4EDDC6C0446FCE5681B5DED52B8F0E . 916480 . . [8.00.6001.19098] . . c:\windows\ie8updates\KB2586448-IE8\wininet.dll
[-] 2011-06-23 . 509CF67AE762A38E23A5455A0053853C . 919552 . . [8.00.6001.23192] . . c:\windows\$hf_mig$\KB2559049-IE8\SP3QFE\wininet.dll
[-] 2011-04-25 . CC951C2212A200475A587A440E0AA804 . 916480 . . [8.00.6001.19072] . . c:\windows\ie8updates\KB2559049-IE8\wininet.dll
[-] 2011-04-25 . 7F4F1697001B9E9A7924D219DC215903 . 919552 . . [8.00.6001.23165] . . c:\windows\$hf_mig$\KB2530548-IE8\SP3QFE\wininet.dll
[-] 2011-02-22 . A9FA95F0D7F511959AC721E4843E5967 . 919552 . . [8.00.6001.23139] . . c:\windows\$hf_mig$\KB2497640-IE8\SP3QFE\wininet.dll
[-] 2011-02-22 . F192D49EEFE297FA858B2C774BA2291D . 916480 . . [8.00.6001.19044] . . c:\windows\ie8updates\KB2530548-IE8\wininet.dll
[-] 2010-12-20 . 88014D62B5E3CDB0AC67948D86C926C8 . 916480 . . [8.00.6001.19019] . . c:\windows\ie8updates\KB2497640-IE8\wininet.dll
[-] 2010-12-20 . 5504B4ECCE892EB82CD2C5FA71940AC1 . 919552 . . [8.00.6001.23111] . . c:\windows\$hf_mig$\KB2482017-IE8\SP3QFE\wininet.dll
[-] 2010-11-06 . 9357C4249F4810FB0E49C13387A8A77C . 919552 . . [8.00.6001.23084] . . c:\windows\$hf_mig$\KB2416400-IE8\SP3QFE\wininet.dll
[-] 2010-11-06 . 306A2B05EA9846278113964DC6E2C940 . 916480 . . [8.00.6001.18992] . . c:\windows\ie8updates\KB2482017-IE8\wininet.dll
[-] 2010-09-10 . 36FE8ABC59AAFBE20CBE54BC372F9429 . 916480 . . [8.00.6001.18968] . . c:\windows\ie8updates\KB2416400-IE8\wininet.dll
[-] 2010-09-10 . 36FE8ABC59AAFBE20CBE54BC372F9429 . 916480 . . [8.00.6001.18968] . . c:\windows\SoftwareDistribution\Download\c0b2667570bfaadca71db300b030c7f4\SP3GDR\wininet.dll
[-] 2010-09-10 . 0555E190DCD06B8998E6DDCA42DAEB82 . 919552 . . [8.00.6001.23060] . . c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\wininet.dll
[-] 2010-09-10 . 0555E190DCD06B8998E6DDCA42DAEB82 . 919552 . . [8.00.6001.23060] . . c:\windows\SoftwareDistribution\Download\c0b2667570bfaadca71db300b030c7f4\SP3QFE\wininet.dll
[-] 2010-09-09 . D7275E6DA8D1A8BEB36468548899522C . 668672 . . [6.00.2900.6036] . . c:\windows\$hf_mig$\KB2360131\SP3QFE\wininet.dll
[-] 2010-05-06 . 2D9C7B010409372C34F725DA5CCED083 . 916480 . . [8.00.6001.18923] . . c:\windows\ie8updates\KB2360131-IE8\wininet.dll
[-] 2010-05-06 . 2D9C7B010409372C34F725DA5CCED083 . 916480 . . [8.00.6001.18923] . . c:\windows\SoftwareDistribution\Download\e9e3bc7b49018c1f53cc0d1bd73cad37\SP3GDR\wininet.dll
[-] 2010-05-06 . C1490F68B44AF8B781F52F12F564625D . 919040 . . [8.00.6001.23014] . . c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\wininet.dll
[-] 2010-05-06 . C1490F68B44AF8B781F52F12F564625D . 919040 . . [8.00.6001.23014] . . c:\windows\SoftwareDistribution\Download\e9e3bc7b49018c1f53cc0d1bd73cad37\SP3QFE\wininet.dll
[-] 2009-03-08 . 6CE32F7778061CCC5814D5E0F282D369 . 914944 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB982381-IE8\wininet.dll
[-] 2008-08-21 . 7A4F775ABB2F1C97DEF3E73AFA2FAEDD . 666112 . . [6.00.2900.5512] . . c:\windows\ie8\wininet.dll
.
[-] 2008-08-21 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\system32\ws2_32.dll
[-] 2008-08-21 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ws2_32.dll
.
[-] 2008-08-21 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\ws2help.dll
[-] 2008-08-21 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ws2help.dll
.

Foxiffer · Sep 17, 2012

[-] 2008-08-21 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-08-21 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\explorer.exe
.
[-] 2008-08-21 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\regedit.exe
[-] 2008-08-21 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\I386\REGEDIT.EXE
[-] 2008-08-21 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\regedit.exe
.
[-] 2011-11-01 . 6BAD1BED9872E62049E487FB91AE2F3A . 1288704 . . [5.1.2600.6168] . . c:\windows\system32\ole32.dll
[-] 2011-11-01 . 6BAD1BED9872E62049E487FB91AE2F3A . 1288704 . . [5.1.2600.6168] . . c:\windows\system32\dllcache\ole32.dll
[-] 2011-11-01 . 7D9DDE1AB4B00DDB173F5A16E9206517 . 1289216 . . [5.1.2600.6168] . . c:\windows\$hf_mig$\KB2624667\SP3QFE\ole32.dll
[-] 2010-07-16 . 8D51FB47062F2A1A9EFECCEF338A4C46 . 1289216 . . [5.1.2600.6010] . . c:\windows\$hf_mig$\KB979687\SP3QFE\ole32.dll
.
[-] 2010-04-16 . 9E03DC5AB51CFD0190541CE2038D819D . 406016 . . [1.0420.2600.5969] . . c:\windows\system32\usp10.dll
[-] 2010-04-16 . 9E03DC5AB51CFD0190541CE2038D819D . 406016 . . [1.0420.2600.5969] . . c:\windows\system32\dllcache\usp10.dll
[-] 2010-04-16 . F8894BCC961D461674002B4BAE7AECC1 . 406016 . . [1.0420.2600.5969] . . c:\windows\$hf_mig$\KB981322\SP3QFE\usp10.dll
.
[-] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\system32\ksuser.dll
[-] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\system32\dllcache\ksuser.dll
.
[-] 2008-08-21 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe
[-] 2008-08-21 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ctfmon.exe
.
[-] 2009-07-27 . 99BC0B50F511924348BE19C7C7313BBF . 135168 . . [6.00.2900.5853] . . c:\windows\system32\shsvcs.dll
[-] 2009-07-27 . 99BC0B50F511924348BE19C7C7313BBF . 135168 . . [6.00.2900.5853] . . c:\windows\system32\dllcache\shsvcs.dll
[-] 2009-07-27 . 888CD7B39C37E13A2419BECFAAF0A28C . 135168 . . [6.00.2900.5853] . . c:\windows\$hf_mig$\KB971029\SP3QFE\shsvcs.dll
.
[-] 2008-08-21 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll
[-] 2008-08-21 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\srsvc.dll
.
[-] 2008-08-21 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\system32\wscntfy.exe
[-] 2008-08-21 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\wscntfy.exe
.
[-] 2008-08-21 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\system32\xmlprov.dll
[-] 2008-08-21 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\xmlprov.dll
.
[-] 2010-12-09 . 15CE4DBC22FAB90B3CA5352AF1FFF81C . 718336 . . [5.1.2600.6055] . . c:\windows\$hf_mig$\KB2393802\SP3QFE\ntdll.dll
[-] 2010-12-09 . F8F0D25CA553E39DDE485D8FC7FCCE89 . 718336 . . [5.1.2600.6055] . . c:\windows\system32\ntdll.dll
[-] 2010-12-09 . F8F0D25CA553E39DDE485D8FC7FCCE89 . 718336 . . [5.1.2600.6055] . . c:\windows\system32\dllcache\ntdll.dll
[-] 2009-02-09 . B0913005EE3FC15D7F72472D0B8A30EB . 715264 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntdll.dll
[-] 2008-08-21 . 27D9ED8CB8B62D1E0A8E5ACE6CF52E2F . 706048 . . [5.1.2600.5512] . . c:\windows\I386\NTDLL.DLL
[-] 2008-08-21 . 27D9ED8CB8B62D1E0A8E5ACE6CF52E2F . 706048 . . [5.1.2600.5512] . . c:\windows\I386\SYSTEM32\NTDLL.DLL
.
[-] 2008-08-21 . 5733177BCF16EE78B99543C9B0AB81EA . 177152 . . [5.1.2600.5512] . . c:\windows\system32\MSCTFIME.IME
[-] 2008-08-21 . 5733177BCF16EE78B99543C9B0AB81EA . 177152 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\msctfime.ime
.
[-] 2008-08-21 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\system32\eventlog.dll
[-] 2008-08-21 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\eventlog.dll
.
[-] 2008-08-21 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
[-] 2008-08-21 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\sfcfiles.dll
.
[-] 2008-08-21 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ipsec.sys
[-] 2008-08-21 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ipsec.sys
.
[-] 2008-08-21 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\system32\regsvc.dll
[-] 2008-08-21 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\regsvc.dll
.
[-] 2008-08-21 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\system32\schedsvc.dll
[-] 2008-08-21 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\schedsvc.dll
.
[-] 2008-08-21 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\system32\ssdpsrv.dll
[-] 2008-08-21 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ssdpsrv.dll
.
[-] 2008-08-21 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\system32\termsrv.dll
[-] 2008-08-21 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\termsrv.dll
.
[-] 2008-08-21 . 3CB32D3B8CBE79899D63280BB7A83CD9 . 344064 . . [5.1.2600.5512] . . c:\windows\system32\hnetcfg.dll
[-] 2008-08-21 . 3CB32D3B8CBE79899D63280BB7A83CD9 . 344064 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\hnetcfg.dll
.
[-] 2008-08-21 . D8849F77C0B66226335A59D26CB4EDC6 . 167936 . . [5.1.2600.5512] . . c:\windows\system32\appmgmts.dll
[-] 2008-08-21 . D8849F77C0B66226335A59D26CB4EDC6 . 167936 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\appmgmts.dll
.
[-] 2008-08-21 . 9859C0F6936E723E4892D7141B1327D5 . 11648 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys
.
[-] 2008-04-14 06:09 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\system32\dllcache\aec.sys
[-] 2008-04-14 06:09 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\system32\drivers\aec.sys
.
[-] 2008-08-21 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ip6fw.sys
[-] 2008-08-21 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ip6fw.sys
.
[-] 2010-09-18 07:18 . 842900DEDBC8E3E8DBCCCB298FD88F65 . 953856 . . [4.1.6151] . . c:\windows\$hf_mig$\KB2387149\SP3QFE\mfc40u.dll
[-] 2010-09-18 06:53 . E76A5C202E68AF5A322D16B5A78F48B9 . 953856 . . [4.1.6151] . . c:\windows\system32\mfc40u.dll
[-] 2010-09-18 06:53 . E76A5C202E68AF5A322D16B5A78F48B9 . 953856 . . [4.1.6151] . . c:\windows\system32\dllcache\mfc40u.dll
.
[-] 2008-08-21 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\system32\msgsvc.dll
[-] 2008-08-21 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\msgsvc.dll
.
[-] 2008-08-21 12:00 . C7E39EA41233E9F5B86C8DA3A9F1E4A8 . 52224 . . [9.0.1.56] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MsPMSNSv.dll
[-] 2006-10-19 04:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll
[-] 2006-10-19 04:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\dllcache\mspmsnsv.dll
[-] 2005-01-28 21:44 . 140EF97B64F560FD78643CAE2CDAD838 . 25088 . . [10.0.3790.3802] . . c:\windows\$NtUninstallWMFDist11$\mspmsnsv.dll
[-] 2005-01-28 21:44 . 140EF97B64F560FD78643CAE2CDAD838 . 25088 . . [10.0.3790.3802] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSNSv.dll
.
[-] 2012-05-04 . 8E99A0CE02C1BEDA6C0935A4DDE9CEAA . 2069120 . . [5.1.2600.6223] . . c:\windows\$hf_mig$\KB2707511\SP3QFE\ntkrnlpa.exe
[-] 2012-05-04 . 5DD80D56AF1CEFBFF4F25951069B55BB . 2069120 . . [5.1.2600.6223] . . c:\windows\Driver Cache\i386\ntkrnlpa.exe
[-] 2012-05-04 . 5DD80D56AF1CEFBFF4F25951069B55BB . 2069120 . . [5.1.2600.6223] . . c:\windows\system32\ntkrnlpa.exe
[-] 2012-05-04 . 5DD80D56AF1CEFBFF4F25951069B55BB . 2069120 . . [5.1.2600.6223] . . c:\windows\system32\dllcache\ntkrnlpa.exe
[-] 2012-04-11 . 063A0F8A90D8E2B802E5243FE9AABCF3 . 2069120 . . [5.1.2600.6206] . . c:\windows\$hf_mig$\KB2676562\SP3QFE\ntkrnlpa.exe
[-] 2011-10-25 . DB19FFF0C805664CB95062C027B11FE9 . 2069376 . . [5.1.2600.6165] . . c:\windows\$hf_mig$\KB2633171\SP3QFE\ntkrnlpa.exe
[-] 2010-12-10 . F67CD97282E0ABFAF91A9A1359B16F2D . 2069376 . . [5.1.2600.6055] . . c:\windows\$hf_mig$\KB2393802\SP3QFE\ntkrnlpa.exe
[-] 2010-04-28 . 756362706DE8BC92F11E197C98A73844 . 2066944 . . [5.1.2600.5973] . . c:\windows\$hf_mig$\KB981852\SP3QFE\ntkrnlpa.exe
[-] 2009-02-06 . 607352B9CB3D708C67F6039097801B5A . 2066176 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe
.
[-] 2008-08-21 12:00 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\system32\ntmssvc.dll
[-] 2008-08-21 12:00 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\system32\dllcache\ntmssvc.dll
.
[-] 2008-08-21 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\system32\upnphost.dll
[-] 2008-08-21 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\upnphost.dll
.
[-] 2008-08-21 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:\windows\system32\dsound.dll
[-] 2008-08-21 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:\windows\system32\dllcache\dsound.dll
.
[-] 2008-08-21 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:\windows\system32\d3d9.dll
[-] 2008-08-21 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:\windows\system32\dllcache\d3d9.dll
.
[-] 2008-08-21 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512] . . c:\windows\system32\ddraw.dll
[-] 2008-08-21 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512] . . c:\windows\system32\dllcache\ddraw.dll
.
[-] 2008-08-21 12:00 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\system32\olepro32.dll
[-] 2008-08-21 12:00 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\olepro32.dll
.
[-] 2008-08-21 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\system32\perfctrs.dll
[-] 2008-08-21 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\perfctrs.dll
.
[-] 2008-08-21 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\version.dll
[-] 2008-08-21 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\version.dll
.
[-] 2012-05-04 . 099A0F80A563EBE935F4A9750F96C219 . 2192640 . . [5.1.2600.6223] . . c:\windows\$hf_mig$\KB2707511\SP3QFE\ntoskrnl.exe
[-] 2012-05-04 . DDF0CB8CD3C6007CDF4AD8F0409ED930 . 2192640 . . [5.1.2600.6223] . . c:\windows\Driver Cache\i386\ntoskrnl.exe
[-] 2012-05-04 . DDF0CB8CD3C6007CDF4AD8F0409ED930 . 2192640 . . [5.1.2600.6223] . . c:\windows\system32\ntoskrnl.exe
[-] 2012-05-04 . DDF0CB8CD3C6007CDF4AD8F0409ED930 . 2192640 . . [5.1.2600.6223] . . c:\windows\system32\dllcache\ntoskrnl.exe
[-] 2012-04-11 . 8D061BB825BC606C2B1C6F7452D1BAAA . 2192640 . . [5.1.2600.6206] . . c:\windows\$hf_mig$\KB2676562\SP3QFE\ntoskrnl.exe
[-] 2011-10-25 . F512C662874D7545E5BD8005E6800A44 . 2192768 . . [5.1.2600.6165] . . c:\windows\$hf_mig$\KB2633171\SP3QFE\ntoskrnl.exe
[-] 2010-12-09 . A531BBD3DE13121C1380ED7DC99082DB . 2192768 . . [5.1.2600.6055] . . c:\windows\$hf_mig$\KB2393802\SP3QFE\ntoskrnl.exe
[-] 2010-04-27 . A2ABBEC40CDB57454645D06B7EBD22F5 . 2190080 . . [5.1.2600.5973] . . c:\windows\$hf_mig$\KB981852\SP3QFE\ntoskrnl.exe
[-] 2009-02-08 . EFE8EACE83EAAD5849A7A548FB75B584 . 2189184 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
.
[-] 2008-08-21 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll
[-] 2008-08-21 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\srsvc.dll
.
[-] 2008-08-21 . 54AF4B1D5459500EF0937F6D33B1914F . 175104 . . [5.1.2600.5512] . . c:\windows\system32\w32time.dll
[-] 2008-08-21 . 54AF4B1D5459500EF0937F6D33B1914F . 175104 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\w32time.dll
.
[-] 2008-08-21 . 8BAD69CBAC032D4BBACFCE0306174C30 . 333824 . . [5.1.2600.5512] . . c:\windows\system32\wiaservc.dll
[-] 2008-08-21 . 8BAD69CBAC032D4BBACFCE0306174C30 . 333824 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\wiaservc.dll
.
[-] 2008-08-21 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\midimap.dll
[-] 2008-08-21 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\midimap.dll
.
[-] 2008-08-21 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512] . . c:\windows\system32\rasadhlp.dll
[-] 2008-08-21 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\rasadhlp.dll
.
[-] 2008-08-21 . 4E3D06D6E68EEDB52565080F55B460D3 . 19456 . . [5.1.2600.5512] . . c:\windows\system32\wshtcpip.dll
[-] 2008-08-21 . 4E3D06D6E68EEDB52565080F55B460D3 . 19456 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\wshtcpip.dll
.
c:\windows\System32\spoolsv.exe ... is missing !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-05-04 1519272]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVD2.dll" [2010-10-18 3908192]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-10-18 10:26 3908192 ----a-w- c:\program files\ConduitEngine\ConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
2010-10-18 10:26 3908192 ----a-w- c:\program files\DVDVideoSoftTB\tbDVD2.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2012-05-04 22:43 1519272 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVD2.dll" [2010-10-18 3908192]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-05-04 1519272]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"= "c:\program files\DVDVideoSoftTB\tbDVD2.dll" [2010-10-18 3908192]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-05-04 1519272]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-02-09 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-30 61440]
"RTHDCPL"="RTHDCPL.EXE" [2008-06-13 16871936]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"iTunesHelper"="d:\master itunes\iTunes 10.6\iTunesHelper.exe" [2012-03-27 421736]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2012-04-19 421888]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2012-05-04 1561768]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Find Fast.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1997-8-19 111376]
Office Startup.lnk - c:\program files\Microsoft Office\Office\OSA.EXE [1997-8-19 51984]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\FreeFileViewer\\FFVCheckForUpdates.exe"=
"c:\\Documents and Settings\\Lisa Narvaez\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\MASTER ITUNES\\iTunes 10.6\\iTunes.exe"=
.
R2 MBAMScheduler;MBAMScheduler;c:\documents and settings\Fox Ellis\Desktop\Malwarebytes' Anti-Malware\mbamscheduler.exe [9/14/2012 5:32 PM 399432]
R2 MBAMService;MBAMService;c:\documents and settings\Fox Ellis\Desktop\Malwarebytes' Anti-Malware\mbamservice.exe [9/14/2012 5:32 PM 676936]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [9/14/2012 5:32 PM 22856]
R3 swvspser;Sierra VSP using Ethernet;c:\windows\system32\drivers\swvspser.sys [8/13/2009 2:07 PM 30080]
S2 gupdate;Google Update Service (gupdate);"c:\program files\Google\Update\GoogleUpdate.exe" /svc --> c:\program files\Google\Update\GoogleUpdate.exe [?]
S2 vToolbarUpdater11.2.0;vToolbarUpdater11.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe --> c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe [?]
S3 87570506;87570506; [x]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [8/8/2012 8:33 PM 250056]
S3 gupdatem;Google Update Service (gupdatem);"c:\program files\Google\Update\GoogleUpdate.exe" /medsvc --> c:\program files\Google\Update\GoogleUpdate.exe [?]
.
Contents of the 'Scheduled Tasks' folder
.
2012-09-16 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-09 01:06]
.
2012-08-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-02 00:57]
.
2012-09-17 c:\windows\Tasks\Free File Viewer Update Checker.job
- c:\program files\FreeFileViewer\FFVCheckForUpdates.exe [2011-05-12 23:50]
.
2012-09-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2368579109-3610495512-2017815006-1004Core.job
- c:\documents and settings\Lisa Narvaez\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-07-23 15:50]
.
2012-09-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2368579109-3610495512-2017815006-1004UA.job
- c:\documents and settings\Lisa Narvaez\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-07-23 15:50]
.
2012-09-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2368579109-3610495512-2017815006-1005Core.job
- c:\documents and settings\Fox Ellis\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-08-14 20:59]
.
2012-09-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2368579109-3610495512-2017815006-1005UA.job
- c:\documents and settings\Fox Ellis\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-08-14 20:59]
.
2012-09-17 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2012-05-04 22:43]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000
IE: Free YouTube Download - c:\documents and settings\Fox Ellis\Application Data\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to Mp3 Converter - c:\documents and settings\Fox Ellis\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Se&nd to OneNote - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{7E4E2B85-3B1B-4058-99ED-039D17EB7474}: NameServer = 192.168.0.1
FF - ProfilePath -
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
BHO-{95B7759C-8C7F-4BF1-B163-73684A933233} - (no file)
Toolbar-{95B7759C-8C7F-4BF1-B163-73684A933233} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
SafeBoot-68876120.sys
AddRemove-Free Screen Video Recorder_is1 - g:\g file\Free Studio\Free Screen Video Recorder\unins000.exe
AddRemove-GamePack - E:\setup.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-09-17 01:40
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(576)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(968)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre7\bin\jqs.exe
c:\documents and settings\Fox Ellis\Desktop\Malwarebytes' Anti-Malware\mbamgui.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
.
**************************************************************************
.
Completion time: 2012-09-17 01:45:51 - machine was rebooted
ComboFix-quarantined-files.txt 2012-09-17 08:45
.
Pre-Run: 11,645,431,808 bytes free
Post-Run: 13,096,816,640 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - F1E9DE5CAE0E4E584BDF11E257E62DED

Broni · Sep 17, 2012

1. Please open Notepad (Start>All Programs>Accessories>Notepad).

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code:

Driver::
87570506

ClearJavaCache::

3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

Foxiffer · Sep 17, 2012

I still had to run it in safe mode but heres the Combofix log.

ComboFix 12-09-16.01 - Fox Ellis 09/17/2012 15:03:38.2.1 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2942.2544 [GMT -7:00]
Running from: c:\documents and settings\Fox Ellis\Desktop\C0mb0Fix.exe
Command switches used :: c:\documents and settings\Fox Ellis\Desktop\CFScript.txt
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_87570506
-------\Service_87570506
.
.
((((((((((((((((((((((((( Files Created from 2012-08-17 to 2012-09-17 )))))))))))))))))))))))))))))))
.
.
2012-09-17 08:17 . 2012-09-17 08:21 -------- dc----w- C:\C0mb0Fix
2012-09-15 03:20 . 2012-09-15 03:20 -------- dc----w- C:\TDSSKiller_Quarantine
2012-09-15 00:33 . 2012-09-15 00:33 -------- d-----w- c:\documents and settings\Fox Ellis\Application Data\Malwarebytes
2012-09-15 00:32 . 2012-09-15 00:32 -------- dc----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2012-09-15 00:32 . 2012-09-08 00:04 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-09-14 03:47 . 2012-09-14 03:47 -------- dc----w- c:\documents and settings\Guest\Local Settings\Application Data\Mozilla
2012-09-10 01:15 . 2012-09-10 01:15 -------- d-----w- c:\program files\Common Files\Java
2012-09-10 01:14 . 2012-09-10 01:14 93672 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2012-09-10 01:14 . 2012-09-10 01:14 -------- d-----w- c:\program files\Java
2012-09-10 01:13 . 2012-09-10 01:13 0 ----a-w- c:\windows\system32\REN8E.tmp
2012-09-10 01:13 . 2012-09-10 01:13 0 ----a-w- c:\windows\system32\REN8D.tmp
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-10 01:14 . 2012-05-09 03:27 821736 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-09-10 01:14 . 2011-03-08 23:54 143872 ----a-w- c:\windows\system32\javacpl.cpl
2012-09-10 01:14 . 2010-10-17 05:56 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-08-17 02:09 . 2012-08-17 02:09 0 ----a-w- c:\windows\system32\RENCA5.tmp
2012-08-17 02:09 . 2012-08-17 02:09 0 ----a-w- c:\windows\system32\RENCA4.tmp
2012-08-17 01:59 . 2012-08-17 01:59 263186 -c--a-w- C:\Minecraft.exe
2012-08-17 01:56 . 2012-08-17 01:56 0 ----a-w- c:\windows\system32\REN2C.tmp
2012-08-17 01:56 . 2012-08-17 01:56 0 ----a-w- c:\windows\system32\REN2B.tmp
2012-08-17 01:55 . 2012-08-17 01:55 0 ----a-w- c:\windows\system32\REN11.tmp
2012-08-17 01:55 . 2012-08-17 01:55 0 ----a-w- c:\windows\system32\REN10.tmp
2012-08-15 01:06 . 2012-08-09 03:33 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-15 01:06 . 2011-08-21 01:51 70344 -c--a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-08 21:37 . 2012-08-08 21:37 0 ----a-w- c:\windows\system32\REND45.tmp
2012-08-08 21:37 . 2012-08-08 21:37 0 ----a-w- c:\windows\system32\REND44.tmp
2012-08-08 21:27 . 2012-08-08 21:26 910128 -c--a-w- C:\jre-6u33-windows-i586-iftw.exe
2012-08-08 21:14 . 2012-08-08 21:14 0 ----a-w- c:\windows\system32\REND01.tmp
2012-08-08 21:14 . 2012-08-08 21:14 0 ----a-w- c:\windows\system32\REND00.tmp
2012-08-08 21:07 . 2012-08-08 21:06 88210392 -c--a-w- C:\jdk-7u3-windows-i586.exe
2012-08-08 20:44 . 2012-08-08 20:44 0 ----a-w- c:\windows\system32\RENCF3.tmp
2012-08-08 20:44 . 2012-08-08 20:44 0 ----a-w- c:\windows\system32\RENCF2.tmp
2012-08-08 20:44 . 2012-08-08 20:44 0 ----a-w- c:\windows\system32\RENCF1.tmp
2012-08-08 20:43 . 2012-08-08 20:43 16824096 -c--a-w- C:\jre-6u15-windows-i586-s.exe
2012-08-06 22:00 . 2012-08-06 22:00 0 ----a-w- c:\windows\system32\RENC27.tmp
2012-08-06 22:00 . 2012-08-06 22:00 0 ----a-w- c:\windows\system32\RENC26.tmp
2012-08-06 21:53 . 2012-08-06 21:53 893936 -c--a-w- C:\JavaSetup7u5.exe
2012-08-06 21:52 . 2012-08-06 21:52 0 ----a-w- c:\windows\system32\RENC05.tmp
2012-08-06 21:52 . 2012-08-06 21:52 0 ----a-w- c:\windows\system32\RENC04.tmp
2012-07-06 13:58 . 2010-03-11 15:45 78336 ----a-w- c:\windows\system32\browser.dll
2012-07-04 14:05 . 2010-03-11 16:57 139784 ------w- c:\windows\system32\drivers\rdpwd.sys
2012-07-03 13:40 . 2010-03-11 15:46 1866112 ------w- c:\windows\system32\win32k.sys
2012-07-02 17:49 . 2010-03-11 15:46 916992 ----a-w- c:\windows\system32\wininet.dll
2012-07-02 17:49 . 2010-03-11 15:45 43520 ------w- c:\windows\system32\licmgr10.dll
2012-07-02 17:49 . 2010-03-11 15:45 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-07-02 12:05 . 2010-03-11 15:45 385024 ------w- c:\windows\system32\html.iec
2012-06-22 23:32 . 2012-07-09 03:45 405144 ----a-w- c:\windows\system32\Newtonsoft.Json.Net20.dll
2011-11-21 04:04 . 2011-11-22 18:46 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-08-21 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\drivers\atapi.sys
.
[-] 2008-08-21 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\asyncmac.sys
[-] 2008-08-21 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\system32\drivers\asyncmac.sys
.
[-] 2008-08-21 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\dllcache\beep.sys
[-] 2008-08-21 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\drivers\beep.sys
.
[-] 2008-08-21 . 463C1EC80CD17420A542B7F36A36F128 . 24576 . . [5.1.2600.5512] . . c:\windows\system32\drivers\kbdclass.sys
.
[-] 2008-08-21 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ndis.sys
[-] 2008-08-21 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ndis.sys
.
[-] 2008-08-21 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\I386\NTFS.SYS
[-] 2008-08-21 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ntfs.sys
[-] 2008-08-21 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ntfs.sys
.
[-] 2008-08-21 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\dllcache\null.sys
[-] 2008-08-21 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys
.
[-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB2509553\SP3QFE\tcpip.sys
[-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
.
[-] 2012-07-06 . CFD4E51402DA9838B5A04AE680AF54A0 . 78336 . . [5.1.2600.6260] . . c:\windows\SoftwareDistribution\Download\4a0e4531b96faf560594eec84d879de6\sp3gdr\browser.dll
[-] 2012-07-06 . CFD4E51402DA9838B5A04AE680AF54A0 . 78336 . . [5.1.2600.6260] . . c:\windows\system32\browser.dll
[-] 2012-07-06 . CFD4E51402DA9838B5A04AE680AF54A0 . 78336 . . [5.1.2600.6260] . . c:\windows\system32\dllcache\browser.dll
[-] 2012-07-06 . FC6D1D80588D371F0321E15A75B2F8F2 . 78336 . . [5.1.2600.6260] . . c:\windows\$hf_mig$\KB2705219\SP3QFE\browser.dll
[-] 2012-07-06 . FC6D1D80588D371F0321E15A75B2F8F2 . 78336 . . [5.1.2600.6260] . . c:\windows\SoftwareDistribution\Download\4a0e4531b96faf560594eec84d879de6\sp3qfe\browser.dll
[-] 2008-08-21 . A06CE3399D16DB864F55FAEB1F1927A9 . 77824 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB2705219$\browser.dll
.
[-] 2008-08-21 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\system32\lsass.exe
[-] 2008-08-21 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\lsass.exe
.
[-] 2008-08-21 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\system32\netman.dll
[-] 2008-08-21 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\netman.dll
.
[-] 2008-08-21 12:00 . 1280A158C722FA95A80FB7AEBE78FA7D . 792064 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll
[-] 2008-08-21 12:00 . 1280A158C722FA95A80FB7AEBE78FA7D . 792064 . . [2001.12.4414.700] . . c:\windows\system32\dllcache\comres.dll
.
[-] 2008-08-21 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\qmgr.dll
[-] 2008-08-21 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\dllcache\qmgr.dll
.
[-] 2009-02-09 . 6B27A5C03DFB94B4245739065431322C . 401408 . . [5.1.2600.5755] . . c:\windows\system32\rpcss.dll
[-] 2009-02-09 . 6B27A5C03DFB94B4245739065431322C . 401408 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\rpcss.dll
[-] 2009-02-09 . 9222562D44021B988B9F9F62207FB6F2 . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\rpcss.dll
.
[-] 2009-02-06 . 65DF52F5B8B6E9BBD183505225C37315 . 110592 . . [5.1.2600.5755] . . c:\windows\system32\services.exe
[-] 2009-02-06 . 65DF52F5B8B6E9BBD183505225C37315 . 110592 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\services.exe
[-] 2009-02-06 . 020CEAAEDC8EB655B6506B8C70D53BB6 . 110592 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe
.
[-] 2008-08-21 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
[-] 2008-08-21 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\winlogon.exe
.
[-] 2008-08-21 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ipsec.sys
[-] 2008-08-21 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ipsec.sys
.
[-] 2010-08-23 . 93AFB83FBC1F9443CAC722FCA63D73BF . 617472 . . [5.82] . . c:\windows\system32\comctl32.dll
[-] 2010-08-23 . 93AFB83FBC1F9443CAC722FCA63D73BF . 617472 . . [5.82] . . c:\windows\system32\dllcache\comctl32.dll
[-] 2010-08-23 . 736B12B725AEB2B07F0241A9F680CB10 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
[-] 2008-08-21 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\I386\ASMS\6000\MSFT\WINDOWS\COMMON\CONTROLS\COMCTL32.DLL
[-] 2008-08-21 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
[-] 2008-08-21 . BD38D1EBE24A46BD3EDA059560AFBA12 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
.
[-] 2008-08-21 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\system32\cryptsvc.dll
[-] 2008-08-21 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\cryptsvc.dll
.
[-] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\system32\es.dll
[-] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\system32\dllcache\es.dll
[-] 2008-07-07 20:23 . F17F6226BDC0CD5F0BEF0DAF84D29BEC . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3QFE\es.dll
.
[-] 2008-08-21 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\system32\imm32.dll
[-] 2008-08-21 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\imm32.dll
.
[-] 2009-03-21 . B921FB870C9AC0D509B2CCABBBBE95F3 . 989696 . . [5.1.2600.5781] . . c:\windows\system32\kernel32.dll
[-] 2009-03-21 . B921FB870C9AC0D509B2CCABBBBE95F3 . 989696 . . [5.1.2600.5781] . . c:\windows\system32\dllcache\kernel32.dll
[-] 2009-03-21 . DA11D9D6ECBDF0F93436A4B7C13F7BEC . 991744 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll
.
[-] 2008-08-21 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\linkinfo.dll
[-] 2008-08-21 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\linkinfo.dll
.
[-] 2008-08-21 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\system32\lpk.dll
[-] 2008-08-21 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\lpk.dll
.
[-] 2012-07-02 . 13D2E016B784730A98F24D6E5BEED22F . 6008320 . . [8.00.6001.19298] . . c:\windows\SoftwareDistribution\Download\06af2d630217aa32a4f6f6b9c5c1a3ba\SP3GDR\mshtml.dll
[-] 2012-07-02 . 13D2E016B784730A98F24D6E5BEED22F . 6008320 . . [8.00.6001.19298] . . c:\windows\system32\mshtml.dll
[-] 2012-07-02 . 13D2E016B784730A98F24D6E5BEED22F . 6008320 . . [8.00.6001.19298] . . c:\windows\system32\dllcache\mshtml.dll
[-] 2012-07-02 . DF599AC52B62DE001E42D36F92B45E68 . 6010368 . . [8.00.6001.23385] . . c:\windows\$hf_mig$\KB2722913-IE8\SP3QFE\mshtml.dll
[-] 2012-07-02 . DF599AC52B62DE001E42D36F92B45E68 . 6010368 . . [8.00.6001.23385] . . c:\windows\SoftwareDistribution\Download\06af2d630217aa32a4f6f6b9c5c1a3ba\SP3QFE\mshtml.dll
[-] 2012-05-11 . 886B62A906B3967CBBF0FD2C833A30BF . 6007808 . . [8.00.6001.19258] . . c:\windows\ie8updates\KB2722913-IE8\mshtml.dll
[-] 2012-05-11 . 55F148B94246A77FB4AC33346671CAC8 . 6009344 . . [8.00.6001.23345] . . c:\windows\$hf_mig$\KB2699988-IE8\SP3QFE\mshtml.dll
[-] 2012-03-01 . DADE53318D8E5335EE2E1745F1C3FC4D . 5978624 . . [8.00.6001.19222] . . c:\windows\ie8updates\KB2699988-IE8\mshtml.dll
[-] 2012-03-01 . 5DBB0C997AD276BCE9D30CD609BDBF67 . 5980672 . . [8.00.6001.23318] . . c:\windows\$hf_mig$\KB2675157-IE8\SP3QFE\mshtml.dll
[-] 2011-12-17 . A9259CD226283CD4F798C00909754A94 . 5979136 . . [8.00.6001.19190] . . c:\windows\ie8updates\KB2675157-IE8\mshtml.dll
[-] 2011-12-17 . 49B88A833ECA99EFBFFC5AAE5CC998ED . 5980160 . . [8.00.6001.23286] . . c:\windows\$hf_mig$\KB2647516-IE8\SP3QFE\mshtml.dll
[-] 2011-11-04 . DD8D655E1881B70A5259A23A6018A6C2 . 5978112 . . [8.00.6001.19170] . . c:\windows\ie8updates\KB2647516-IE8\mshtml.dll
[-] 2011-11-04 . 699421E2E1313C18671A703953CAE14B . 5978624 . . [8.00.6001.23266] . . c:\windows\$hf_mig$\KB2618444-IE8\SP3QFE\mshtml.dll
[-] 2011-10-03 . 4963CB503600FC3BCBDBFBA51FBA1FAC . 5971456 . . [8.00.6001.19154] . . c:\windows\ie8updates\KB2618444-IE8\mshtml.dll
[-] 2011-10-03 . 1240A6B7B470BED0AA6C9FEC7AB0EA26 . 5972992 . . [8.00.6001.23250] . . c:\windows\$hf_mig$\KB2586448-IE8\SP3QFE\mshtml.dll
[-] 2011-07-25 . 23B3C8E9F3F280180573569253CE98AB . 5969920 . . [8.00.6001.19120] . . c:\windows\ie8updates\KB2586448-IE8\mshtml.dll
[-] 2011-07-25 . BCE7CCEBAD6C8955D2B4C3B246BD0E57 . 5971456 . . [8.00.6001.23216] . . c:\windows\$hf_mig$\KB2559049-IE8\SP3QFE\mshtml.dll
[-] 2011-05-30 . 22BA5235EA846EDA87F68A1DCC2BFCF9 . 5964800 . . [8.00.6001.19088] . . c:\windows\ie8updates\KB2559049-IE8\mshtml.dll
[-] 2011-05-30 . D0B1DB576941CB0B6669B8752FFAC79A . 5967360 . . [8.00.6001.23181] . . c:\windows\$hf_mig$\KB2530548-IE8\SP3QFE\mshtml.dll
[-] 2011-02-22 . 3422847AA07E37076A87D0B7D5044DC6 . 5964800 . . [8.00.6001.23141] . . c:\windows\$hf_mig$\KB2497640-IE8\SP3QFE\mshtml.dll
[-] 2011-02-22 . C2EF2335F1B6C2BE20A67D9098F6C9A1 . 5962240 . . [8.00.6001.19046] . . c:\windows\ie8updates\KB2530548-IE8\mshtml.dll
[-] 2010-12-20 . 1EDCEC5D649DBAC37ED9FFB5A14CEB0C . 5961216 . . [8.00.6001.19019] . . c:\windows\ie8updates\KB2497640-IE8\mshtml.dll
[-] 2010-12-20 . 2A2C070EC691CE410533A1DA7AA3CD86 . 5962240 . . [8.00.6001.23111] . . c:\windows\$hf_mig$\KB2482017-IE8\SP3QFE\mshtml.dll
[-] 2010-11-06 . 864E69F32656A7121444BA0193D7B64B . 5960704 . . [8.00.6001.23091] . . c:\windows\$hf_mig$\KB2416400-IE8\SP3QFE\mshtml.dll
[-] 2010-11-06 . D7CCA87057901C87ED8CC40DDCC7FA1B . 5959168 . . [8.00.6001.18999] . . c:\windows\ie8updates\KB2482017-IE8\mshtml.dll
[-] 2010-09-10 . DE41132DA8E5A3CD57201C6F2175EC05 . 5957120 . . [8.00.6001.18975] . . c:\windows\ie8updates\KB2416400-IE8\mshtml.dll
[-] 2010-09-10 . DE41132DA8E5A3CD57201C6F2175EC05 . 5957120 . . [8.00.6001.18975] . . c:\windows\SoftwareDistribution\Download\c0b2667570bfaadca71db300b030c7f4\SP3GDR\mshtml.dll
[-] 2010-09-10 . 8A03CC037E6B7D1796192815231B0C3F . 5958656 . . [8.00.6001.23067] . . c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\mshtml.dll
[-] 2010-09-10 . 8A03CC037E6B7D1796192815231B0C3F . 5958656 . . [8.00.6001.23067] . . c:\windows\SoftwareDistribution\Download\c0b2667570bfaadca71db300b030c7f4\SP3QFE\mshtml.dll
[-] 2010-09-09 . 575FBCB3E2C6E848F0386F38AAF0E4ED . 3074560 . . [6.00.2900.6036] . . c:\windows\$hf_mig$\KB2360131\SP3QFE\mshtml.dll
[-] 2010-05-06 . C7B7A88CC7D7ABA5C395145BF92F46F7 . 5950976 . . [8.00.6001.18928] . . c:\windows\ie8updates\KB2360131-IE8\mshtml.dll
[-] 2010-05-06 . C7B7A88CC7D7ABA5C395145BF92F46F7 . 5950976 . . [8.00.6001.18928] . . c:\windows\SoftwareDistribution\Download\e9e3bc7b49018c1f53cc0d1bd73cad37\SP3GDR\mshtml.dll
[-] 2010-05-06 . 9BE28F749A7FE7F8F177C6AA2E9DA609 . 5953024 . . [8.00.6001.23019] . . c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\mshtml.dll
[-] 2010-05-06 . 9BE28F749A7FE7F8F177C6AA2E9DA609 . 5953024 . . [8.00.6001.23019] . . c:\windows\SoftwareDistribution\Download\e9e3bc7b49018c1f53cc0d1bd73cad37\SP3QFE\mshtml.dll
[-] 2009-03-08 . D469A0EBA2EF5C6BEE8065B7E3196E5E . 5937152 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB982381-IE8\mshtml.dll
[-] 2008-08-21 . A706E122B398FE1AB85CB9B75D044223 . 3066880 . . [6.00.2900.5512] . . c:\windows\ie8\mshtml.dll
.
[-] 2008-08-21 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\I386\ASMS\7000\MSFT\WINDOWS\MSWINCRT\MSVCRT.DLL
[-] 2008-08-21 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\system32\msvcrt.dll
[-] 2008-08-21 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\system32\dllcache\msvcrt.dll
[-] 2008-08-21 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll
[-] 2008-08-21 . D7075E95AA599EE77B7A89D39296BD3D . 343040 . . [7.0.2600.5512] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll
.
[-] 2008-06-20 . FCEE5FCB99F7C724593365C706D28388 . 245248 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB2509553\SP3QFE\mswsock.dll
[-] 2008-06-20 . FCEE5FCB99F7C724593365C706D28388 . 245248 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\mswsock.dll
[-] 2008-06-20 . 943337D786A56729263071623BBB9DE5 . 245248 . . [5.1.2600.5625] . . c:\windows\system32\mswsock.dll
[-] 2008-06-20 . 943337D786A56729263071623BBB9DE5 . 245248 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\mswsock.dll
.
[-] 2008-08-21 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\system32\netlogon.dll
[-] 2008-08-21 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\netlogon.dll
.
[-] 2008-08-21 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\system32\powrprof.dll
[-] 2008-08-21 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\powrprof.dll
.
[-] 2008-08-21 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\system32\scecli.dll
[-] 2008-08-21 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\scecli.dll
.
[-] 2008-08-21 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\system32\sfc.dll
[-] 2008-08-21 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\sfc.dll
.
[-] 2008-08-21 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\system32\svchost.exe
[-] 2008-08-21 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\svchost.exe
.
[-] 2008-08-21 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\system32\tapisrv.dll
[-] 2008-08-21 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\tapisrv.dll
.
[-] 2008-08-21 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll
[-] 2008-08-21 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\user32.dll
.
[-] 2008-08-21 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\system32\userinit.exe
[-] 2008-08-21 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\userinit.exe
.
[-] 2012-07-02 . C4300CB4D20B1159DC77E01E8A2525EC . 916992 . . [8.00.6001.19298] . . c:\windows\SoftwareDistribution\Download\06af2d630217aa32a4f6f6b9c5c1a3ba\SP3GDR\wininet.dll
[-] 2012-07-02 . C4300CB4D20B1159DC77E01E8A2525EC . 916992 . . [8.00.6001.19298] . . c:\windows\system32\wininet.dll
[-] 2012-07-02 . C4300CB4D20B1159DC77E01E8A2525EC . 916992 . . [8.00.6001.19298] . . c:\windows\system32\dllcache\wininet.dll
[-] 2012-07-02 . EFB2241DE3AA6480521A16D0CB67B0EC . 920064 . . [8.00.6001.23385] . . c:\windows\$hf_mig$\KB2722913-IE8\SP3QFE\wininet.dll
[-] 2012-07-02 . EFB2241DE3AA6480521A16D0CB67B0EC . 920064 . . [8.00.6001.23385] . . c:\windows\SoftwareDistribution\Download\06af2d630217aa32a4f6f6b9c5c1a3ba\SP3QFE\wininet.dll
[-] 2012-05-16 . 6B1774334E2975AA60596E54F5EA1430 . 916992 . . [8.00.6001.19272] . . c:\windows\ie8updates\KB2722913-IE8\wininet.dll
[-] 2012-05-16 . 553AD35768CD27959391DD5AA82CEF6F . 920064 . . [8.00.6001.23359] . . c:\windows\$hf_mig$\KB2699988-IE8\SP3QFE\wininet.dll
[-] 2012-03-01 . 009E7B4C284F080608D7286484015EE5 . 916992 . . [8.00.6001.19222] . . c:\windows\ie8updates\KB2699988-IE8\wininet.dll
[-] 2012-03-01 . 4EC67FAB39F37626AD6D9895FC094ABF . 919552 . . [8.00.6001.23318] . . c:\windows\$hf_mig$\KB2675157-IE8\SP3QFE\wininet.dll
[-] 2011-12-17 . F362D50FBDC6E34918DF41BDE1770E5C . 916992 . . [8.00.6001.19190] . . c:\windows\ie8updates\KB2675157-IE8\wininet.dll
[-] 2011-12-17 . 84A48E9818E8440DDBFD8EEC37C8A937 . 919552 . . [8.00.6001.23286] . . c:\windows\$hf_mig$\KB2647516-IE8\SP3QFE\wininet.dll
[-] 2011-11-04 . 552263502EA8C24D301A0C43FF90B3ED . 916992 . . [8.00.6001.19165] . . c:\windows\ie8updates\KB2647516-IE8\wininet.dll
[-] 2011-11-04 . 4E4716CAF514717814D07113AD0425B6 . 919552 . . [8.00.6001.23261] . . c:\windows\$hf_mig$\KB2618444-IE8\SP3QFE\wininet.dll
[-] 2011-08-22 . 1A377838B4B468E37C3EEB5BAA24F925 . 916480 . . [8.00.6001.19131] . . c:\windows\ie8updates\KB2618444-IE8\wininet.dll
[-] 2011-08-22 . 19630AEBBFAEB06984CAB91848270AAF . 919552 . . [8.00.6001.23227] . . c:\windows\$hf_mig$\KB2586448-IE8\SP3QFE\wininet.dll
[-] 2011-06-23 . AF4EDDC6C0446FCE5681B5DED52B8F0E . 916480 . . [8.00.6001.19098] . . c:\windows\ie8updates\KB2586448-IE8\wininet.dll
[-] 2011-06-23 . 509CF67AE762A38E23A5455A0053853C . 919552 . . [8.00.6001.23192] . . c:\windows\$hf_mig$\KB2559049-IE8\SP3QFE\wininet.dll
[-] 2011-04-25 . CC951C2212A200475A587A440E0AA804 . 916480 . . [8.00.6001.19072] . . c:\windows\ie8updates\KB2559049-IE8\wininet.dll
[-] 2011-04-25 . 7F4F1697001B9E9A7924D219DC215903 . 919552 . . [8.00.6001.23165] . . c:\windows\$hf_mig$\KB2530548-IE8\SP3QFE\wininet.dll
[-] 2011-02-22 . A9FA95F0D7F511959AC721E4843E5967 . 919552 . . [8.00.6001.23139] . . c:\windows\$hf_mig$\KB2497640-IE8\SP3QFE\wininet.dll
[-] 2011-02-22 . F192D49EEFE297FA858B2C774BA2291D . 916480 . . [8.00.6001.19044] . . c:\windows\ie8updates\KB2530548-IE8\wininet.dll
[-] 2010-12-20 . 88014D62B5E3CDB0AC67948D86C926C8 . 916480 . . [8.00.6001.19019] . . c:\windows\ie8updates\KB2497640-IE8\wininet.dll
[-] 2010-12-20 . 5504B4ECCE892EB82CD2C5FA71940AC1 . 919552 . . [8.00.6001.23111] . . c:\windows\$hf_mig$\KB2482017-IE8\SP3QFE\wininet.dll
[-] 2010-11-06 . 9357C4249F4810FB0E49C13387A8A77C . 919552 . . [8.00.6001.23084] . . c:\windows\$hf_mig$\KB2416400-IE8\SP3QFE\wininet.dll
[-] 2010-11-06 . 306A2B05EA9846278113964DC6E2C940 . 916480 . . [8.00.6001.18992] . . c:\windows\ie8updates\KB2482017-IE8\wininet.dll
[-] 2010-09-10 . 36FE8ABC59AAFBE20CBE54BC372F9429 . 916480 . . [8.00.6001.18968] . . c:\windows\ie8updates\KB2416400-IE8\wininet.dll
[-] 2010-09-10 . 36FE8ABC59AAFBE20CBE54BC372F9429 . 916480 . . [8.00.6001.18968] . . c:\windows\SoftwareDistribution\Download\c0b2667570bfaadca71db300b030c7f4\SP3GDR\wininet.dll
[-] 2010-09-10 . 0555E190DCD06B8998E6DDCA42DAEB82 . 919552 . . [8.00.6001.23060] . . c:\windows\$hf_mig$\KB2360131-IE8\SP3QFE\wininet.dll
[-] 2010-09-10 . 0555E190DCD06B8998E6DDCA42DAEB82 . 919552 . . [8.00.6001.23060] . . c:\windows\SoftwareDistribution\Download\c0b2667570bfaadca71db300b030c7f4\SP3QFE\wininet.dll
[-] 2010-09-09 . D7275E6DA8D1A8BEB36468548899522C . 668672 . . [6.00.2900.6036] . . c:\windows\$hf_mig$\KB2360131\SP3QFE\wininet.dll
[-] 2010-05-06 . 2D9C7B010409372C34F725DA5CCED083 . 916480 . . [8.00.6001.18923] . . c:\windows\ie8updates\KB2360131-IE8\wininet.dll
[-] 2010-05-06 . 2D9C7B010409372C34F725DA5CCED083 . 916480 . . [8.00.6001.18923] . . c:\windows\SoftwareDistribution\Download\e9e3bc7b49018c1f53cc0d1bd73cad37\SP3GDR\wininet.dll
[-] 2010-05-06 . C1490F68B44AF8B781F52F12F564625D . 919040 . . [8.00.6001.23014] . . c:\windows\$hf_mig$\KB982381-IE8\SP3QFE\wininet.dll
[-] 2010-05-06 . C1490F68B44AF8B781F52F12F564625D . 919040 . . [8.00.6001.23014] . . c:\windows\SoftwareDistribution\Download\e9e3bc7b49018c1f53cc0d1bd73cad37\SP3QFE\wininet.dll
[-] 2009-03-08 . 6CE32F7778061CCC5814D5E0F282D369 . 914944 . . [8.00.6001.18702] . . c:\windows\ie8updates\KB982381-IE8\wininet.dll
[-] 2008-08-21 . 7A4F775ABB2F1C97DEF3E73AFA2FAEDD . 666112 . . [6.00.2900.5512] . . c:\windows\ie8\wininet.dll
.
[-] 2008-08-21 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\system32\ws2_32.dll
[-] 2008-08-21 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ws2_32.dll
.
[-] 2008-08-21 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\ws2help.dll

Foxiffer · Sep 17, 2012

[-] 2008-08-21 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ws2help.dll
.
[-] 2008-08-21 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\explorer.exe
[-] 2008-08-21 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\explorer.exe
.
[-] 2008-08-21 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\regedit.exe
[-] 2008-08-21 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\I386\REGEDIT.EXE
[-] 2008-08-21 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\regedit.exe
.
[-] 2011-11-01 . 6BAD1BED9872E62049E487FB91AE2F3A . 1288704 . . [5.1.2600.6168] . . c:\windows\system32\ole32.dll
[-] 2011-11-01 . 6BAD1BED9872E62049E487FB91AE2F3A . 1288704 . . [5.1.2600.6168] . . c:\windows\system32\dllcache\ole32.dll
[-] 2011-11-01 . 7D9DDE1AB4B00DDB173F5A16E9206517 . 1289216 . . [5.1.2600.6168] . . c:\windows\$hf_mig$\KB2624667\SP3QFE\ole32.dll
[-] 2010-07-16 . 8D51FB47062F2A1A9EFECCEF338A4C46 . 1289216 . . [5.1.2600.6010] . . c:\windows\$hf_mig$\KB979687\SP3QFE\ole32.dll
.
[-] 2010-04-16 . 9E03DC5AB51CFD0190541CE2038D819D . 406016 . . [1.0420.2600.5969] . . c:\windows\system32\usp10.dll
[-] 2010-04-16 . 9E03DC5AB51CFD0190541CE2038D819D . 406016 . . [1.0420.2600.5969] . . c:\windows\system32\dllcache\usp10.dll
[-] 2010-04-16 . F8894BCC961D461674002B4BAE7AECC1 . 406016 . . [1.0420.2600.5969] . . c:\windows\$hf_mig$\KB981322\SP3QFE\usp10.dll
.
[-] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\system32\ksuser.dll
[-] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\system32\dllcache\ksuser.dll
.
[-] 2008-08-21 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe
[-] 2008-08-21 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ctfmon.exe
.
[-] 2009-07-27 . 99BC0B50F511924348BE19C7C7313BBF . 135168 . . [6.00.2900.5853] . . c:\windows\system32\shsvcs.dll
[-] 2009-07-27 . 99BC0B50F511924348BE19C7C7313BBF . 135168 . . [6.00.2900.5853] . . c:\windows\system32\dllcache\shsvcs.dll
[-] 2009-07-27 . 888CD7B39C37E13A2419BECFAAF0A28C . 135168 . . [6.00.2900.5853] . . c:\windows\$hf_mig$\KB971029\SP3QFE\shsvcs.dll
.
[-] 2008-08-21 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll
[-] 2008-08-21 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\srsvc.dll
.
[-] 2008-08-21 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\system32\wscntfy.exe
[-] 2008-08-21 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\wscntfy.exe
.
[-] 2008-08-21 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\system32\xmlprov.dll
[-] 2008-08-21 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\xmlprov.dll
.
[-] 2010-12-09 . 15CE4DBC22FAB90B3CA5352AF1FFF81C . 718336 . . [5.1.2600.6055] . . c:\windows\$hf_mig$\KB2393802\SP3QFE\ntdll.dll
[-] 2010-12-09 . F8F0D25CA553E39DDE485D8FC7FCCE89 . 718336 . . [5.1.2600.6055] . . c:\windows\system32\ntdll.dll
[-] 2010-12-09 . F8F0D25CA553E39DDE485D8FC7FCCE89 . 718336 . . [5.1.2600.6055] . . c:\windows\system32\dllcache\ntdll.dll
[-] 2009-02-09 . B0913005EE3FC15D7F72472D0B8A30EB . 715264 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntdll.dll
[-] 2008-08-21 . 27D9ED8CB8B62D1E0A8E5ACE6CF52E2F . 706048 . . [5.1.2600.5512] . . c:\windows\I386\NTDLL.DLL
[-] 2008-08-21 . 27D9ED8CB8B62D1E0A8E5ACE6CF52E2F . 706048 . . [5.1.2600.5512] . . c:\windows\I386\SYSTEM32\NTDLL.DLL
.
[-] 2008-08-21 . 5733177BCF16EE78B99543C9B0AB81EA . 177152 . . [5.1.2600.5512] . . c:\windows\system32\MSCTFIME.IME
[-] 2008-08-21 . 5733177BCF16EE78B99543C9B0AB81EA . 177152 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\msctfime.ime
.
[-] 2008-08-21 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\system32\eventlog.dll
[-] 2008-08-21 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\eventlog.dll
.
[-] 2008-08-21 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
[-] 2008-08-21 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\sfcfiles.dll
.
[-] 2008-08-21 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ipsec.sys
[-] 2008-08-21 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ipsec.sys
.
[-] 2008-08-21 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\system32\regsvc.dll
[-] 2008-08-21 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\regsvc.dll
.
[-] 2008-08-21 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\system32\schedsvc.dll
[-] 2008-08-21 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\schedsvc.dll
.
[-] 2008-08-21 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\system32\ssdpsrv.dll
[-] 2008-08-21 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ssdpsrv.dll
.
[-] 2008-08-21 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\system32\termsrv.dll
[-] 2008-08-21 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\termsrv.dll
.
[-] 2008-08-21 . 3CB32D3B8CBE79899D63280BB7A83CD9 . 344064 . . [5.1.2600.5512] . . c:\windows\system32\hnetcfg.dll
[-] 2008-08-21 . 3CB32D3B8CBE79899D63280BB7A83CD9 . 344064 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\hnetcfg.dll
.
[-] 2008-08-21 . D8849F77C0B66226335A59D26CB4EDC6 . 167936 . . [5.1.2600.5512] . . c:\windows\system32\appmgmts.dll
[-] 2008-08-21 . D8849F77C0B66226335A59D26CB4EDC6 . 167936 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\appmgmts.dll
.
[-] 2008-08-21 . 9859C0F6936E723E4892D7141B1327D5 . 11648 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys
.
[-] 2008-04-14 06:09 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\system32\dllcache\aec.sys
[-] 2008-04-14 06:09 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\system32\drivers\aec.sys
.
[-] 2008-08-21 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ip6fw.sys
[-] 2008-08-21 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ip6fw.sys
.
[-] 2010-09-18 07:18 . 842900DEDBC8E3E8DBCCCB298FD88F65 . 953856 . . [4.1.6151] . . c:\windows\$hf_mig$\KB2387149\SP3QFE\mfc40u.dll
[-] 2010-09-18 06:53 . E76A5C202E68AF5A322D16B5A78F48B9 . 953856 . . [4.1.6151] . . c:\windows\system32\mfc40u.dll
[-] 2010-09-18 06:53 . E76A5C202E68AF5A322D16B5A78F48B9 . 953856 . . [4.1.6151] . . c:\windows\system32\dllcache\mfc40u.dll
.
[-] 2008-08-21 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\system32\msgsvc.dll
[-] 2008-08-21 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\msgsvc.dll
.
[-] 2008-08-21 12:00 . C7E39EA41233E9F5B86C8DA3A9F1E4A8 . 52224 . . [9.0.1.56] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MsPMSNSv.dll
[-] 2006-10-19 04:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll
[-] 2006-10-19 04:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\dllcache\mspmsnsv.dll
[-] 2005-01-28 21:44 . 140EF97B64F560FD78643CAE2CDAD838 . 25088 . . [10.0.3790.3802] . . c:\windows\$NtUninstallWMFDist11$\mspmsnsv.dll
[-] 2005-01-28 21:44 . 140EF97B64F560FD78643CAE2CDAD838 . 25088 . . [10.0.3790.3802] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSNSv.dll
.
[-] 2012-05-04 . 8E99A0CE02C1BEDA6C0935A4DDE9CEAA . 2069120 . . [5.1.2600.6223] . . c:\windows\$hf_mig$\KB2707511\SP3QFE\ntkrnlpa.exe
[-] 2012-05-04 . 5DD80D56AF1CEFBFF4F25951069B55BB . 2069120 . . [5.1.2600.6223] . . c:\windows\Driver Cache\i386\ntkrnlpa.exe
[-] 2012-05-04 . 5DD80D56AF1CEFBFF4F25951069B55BB . 2069120 . . [5.1.2600.6223] . . c:\windows\system32\ntkrnlpa.exe
[-] 2012-05-04 . 5DD80D56AF1CEFBFF4F25951069B55BB . 2069120 . . [5.1.2600.6223] . . c:\windows\system32\dllcache\ntkrnlpa.exe
[-] 2012-04-11 . 063A0F8A90D8E2B802E5243FE9AABCF3 . 2069120 . . [5.1.2600.6206] . . c:\windows\$hf_mig$\KB2676562\SP3QFE\ntkrnlpa.exe
[-] 2011-10-25 . DB19FFF0C805664CB95062C027B11FE9 . 2069376 . . [5.1.2600.6165] . . c:\windows\$hf_mig$\KB2633171\SP3QFE\ntkrnlpa.exe
[-] 2010-12-10 . F67CD97282E0ABFAF91A9A1359B16F2D . 2069376 . . [5.1.2600.6055] . . c:\windows\$hf_mig$\KB2393802\SP3QFE\ntkrnlpa.exe
[-] 2010-04-28 . 756362706DE8BC92F11E197C98A73844 . 2066944 . . [5.1.2600.5973] . . c:\windows\$hf_mig$\KB981852\SP3QFE\ntkrnlpa.exe
[-] 2009-02-06 . 607352B9CB3D708C67F6039097801B5A . 2066176 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe
.
[-] 2008-08-21 12:00 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\system32\ntmssvc.dll
[-] 2008-08-21 12:00 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\system32\dllcache\ntmssvc.dll
.
[-] 2008-08-21 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\system32\upnphost.dll
[-] 2008-08-21 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\upnphost.dll
.
[-] 2008-08-21 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:\windows\system32\dsound.dll
[-] 2008-08-21 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:\windows\system32\dllcache\dsound.dll
.
[-] 2008-08-21 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:\windows\system32\d3d9.dll
[-] 2008-08-21 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:\windows\system32\dllcache\d3d9.dll
.
[-] 2008-08-21 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512] . . c:\windows\system32\ddraw.dll
[-] 2008-08-21 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512] . . c:\windows\system32\dllcache\ddraw.dll
.
[-] 2008-08-21 12:00 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\system32\olepro32.dll
[-] 2008-08-21 12:00 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\olepro32.dll
.
[-] 2008-08-21 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\system32\perfctrs.dll
[-] 2008-08-21 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\perfctrs.dll
.
[-] 2008-08-21 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\version.dll
[-] 2008-08-21 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\version.dll
.
[-] 2012-05-04 . 099A0F80A563EBE935F4A9750F96C219 . 2192640 . . [5.1.2600.6223] . . c:\windows\$hf_mig$\KB2707511\SP3QFE\ntoskrnl.exe
[-] 2012-05-04 . DDF0CB8CD3C6007CDF4AD8F0409ED930 . 2192640 . . [5.1.2600.6223] . . c:\windows\Driver Cache\i386\ntoskrnl.exe
[-] 2012-05-04 . DDF0CB8CD3C6007CDF4AD8F0409ED930 . 2192640 . . [5.1.2600.6223] . . c:\windows\system32\ntoskrnl.exe
[-] 2012-05-04 . DDF0CB8CD3C6007CDF4AD8F0409ED930 . 2192640 . . [5.1.2600.6223] . . c:\windows\system32\dllcache\ntoskrnl.exe
[-] 2012-04-11 . 8D061BB825BC606C2B1C6F7452D1BAAA . 2192640 . . [5.1.2600.6206] . . c:\windows\$hf_mig$\KB2676562\SP3QFE\ntoskrnl.exe
[-] 2011-10-25 . F512C662874D7545E5BD8005E6800A44 . 2192768 . . [5.1.2600.6165] . . c:\windows\$hf_mig$\KB2633171\SP3QFE\ntoskrnl.exe
[-] 2010-12-09 . A531BBD3DE13121C1380ED7DC99082DB . 2192768 . . [5.1.2600.6055] . . c:\windows\$hf_mig$\KB2393802\SP3QFE\ntoskrnl.exe
[-] 2010-04-27 . A2ABBEC40CDB57454645D06B7EBD22F5 . 2190080 . . [5.1.2600.5973] . . c:\windows\$hf_mig$\KB981852\SP3QFE\ntoskrnl.exe
[-] 2009-02-08 . EFE8EACE83EAAD5849A7A548FB75B584 . 2189184 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
.
[-] 2008-08-21 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll
[-] 2008-08-21 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\srsvc.dll
.
[-] 2008-08-21 . 54AF4B1D5459500EF0937F6D33B1914F . 175104 . . [5.1.2600.5512] . . c:\windows\system32\w32time.dll
[-] 2008-08-21 . 54AF4B1D5459500EF0937F6D33B1914F . 175104 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\w32time.dll
.
[-] 2008-08-21 . 8BAD69CBAC032D4BBACFCE0306174C30 . 333824 . . [5.1.2600.5512] . . c:\windows\system32\wiaservc.dll
[-] 2008-08-21 . 8BAD69CBAC032D4BBACFCE0306174C30 . 333824 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\wiaservc.dll
.
[-] 2008-08-21 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\midimap.dll
[-] 2008-08-21 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\midimap.dll
.
[-] 2008-08-21 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512] . . c:\windows\system32\rasadhlp.dll
[-] 2008-08-21 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\rasadhlp.dll
.
[-] 2008-08-21 . 4E3D06D6E68EEDB52565080F55B460D3 . 19456 . . [5.1.2600.5512] . . c:\windows\system32\wshtcpip.dll
[-] 2008-08-21 . 4E3D06D6E68EEDB52565080F55B460D3 . 19456 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\wshtcpip.dll
.
((((((((((((((((((((((((((((( SnapShot@2012-09-17_08.39.55 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-09-17 22:11 . 2012-09-17 22:11 16384 c:\windows\temp\Perflib_Perfdata_6a0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-05-04 1519272]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVD2.dll" [2010-10-18 3908192]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-10-18 10:26 3908192 ----a-w- c:\program files\ConduitEngine\ConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
2010-10-18 10:26 3908192 ----a-w- c:\program files\DVDVideoSoftTB\tbDVD2.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2012-05-04 22:43 1519272 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVD2.dll" [2010-10-18 3908192]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-05-04 1519272]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"= "c:\program files\DVDVideoSoftTB\tbDVD2.dll" [2010-10-18 3908192]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2012-05-04 1519272]
.
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-02-09 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-30 61440]
"RTHDCPL"="RTHDCPL.EXE" [2008-06-13 16871936]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"iTunesHelper"="d:\master itunes\iTunes 10.6\iTunesHelper.exe" [2012-03-27 421736]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2012-04-19 421888]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2012-05-04 1561768]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Find Fast.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1997-8-19 111376]
Office Startup.lnk - c:\program files\Microsoft Office\Office\OSA.EXE [1997-8-19 51984]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\FreeFileViewer\\FFVCheckForUpdates.exe"=
"c:\\Documents and Settings\\Lisa Narvaez\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\MASTER ITUNES\\iTunes 10.6\\iTunes.exe"=
.
R2 MBAMScheduler;MBAMScheduler;c:\documents and settings\Fox Ellis\Desktop\Malwarebytes' Anti-Malware\mbamscheduler.exe [9/14/2012 5:32 PM 399432]
R2 MBAMService;MBAMService;c:\documents and settings\Fox Ellis\Desktop\Malwarebytes' Anti-Malware\mbamservice.exe [9/14/2012 5:32 PM 676936]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [9/14/2012 5:32 PM 22856]
R3 swvspser;Sierra VSP using Ethernet;c:\windows\system32\drivers\swvspser.sys [8/13/2009 2:07 PM 30080]
S2 gupdate;Google Update Service (gupdate);"c:\program files\Google\Update\GoogleUpdate.exe" /svc --> c:\program files\Google\Update\GoogleUpdate.exe [?]
S2 vToolbarUpdater11.2.0;vToolbarUpdater11.2.0;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe --> c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe [?]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [8/8/2012 8:33 PM 250056]
S3 gupdatem;Google Update Service (gupdatem);"c:\program files\Google\Update\GoogleUpdate.exe" /medsvc --> c:\program files\Google\Update\GoogleUpdate.exe [?]
.
Contents of the 'Scheduled Tasks' folder
.
2012-09-17 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-09 01:06]
.
2012-08-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-02 00:57]
.
2012-09-17 c:\windows\Tasks\Free File Viewer Update Checker.job
- c:\program files\FreeFileViewer\FFVCheckForUpdates.exe [2011-05-12 23:50]
.
2012-09-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2368579109-3610495512-2017815006-1004Core.job
- c:\documents and settings\Lisa Narvaez\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-07-23 15:50]
.
2012-09-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2368579109-3610495512-2017815006-1004UA.job
- c:\documents and settings\Lisa Narvaez\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-07-23 15:50]
.
2012-09-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2368579109-3610495512-2017815006-1005Core.job
- c:\documents and settings\Fox Ellis\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-08-14 20:59]
.
2012-09-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2368579109-3610495512-2017815006-1005UA.job
- c:\documents and settings\Fox Ellis\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-08-14 20:59]
.
2012-09-17 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2012-05-04 22:43]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000
IE: Free YouTube Download - c:\documents and settings\Fox Ellis\Application Data\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to Mp3 Converter - c:\documents and settings\Fox Ellis\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Se&nd to OneNote - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{7E4E2B85-3B1B-4058-99ED-039D17EB7474}: NameServer = 192.168.0.1
FF - ProfilePath -
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-09-17 15:12
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(576)
c:\windows\system32\Ati2evxx.dll
.
- - - - - - - > 'explorer.exe'(3432)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre7\bin\jqs.exe
c:\windows\system32\wscntfy.exe
c:\documents and settings\Fox Ellis\Desktop\Malwarebytes' Anti-Malware\mbamgui.exe
c:\windows\RTHDCPL.EXE
c:\program files\iPod\bin\iPodService.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
.
**************************************************************************
.
Completion time: 2012-09-17 15:19:14 - machine was rebooted
ComboFix-quarantined-files.txt 2012-09-17 22:19
ComboFix2.txt 2012-09-17 08:45
.
Pre-Run: 13,061,971,968 bytes free
Post-Run: 13,108,752,384 bytes free
.
- - End Of File - - 1EC76B1BA7E2357577A62EDD7C7FBAEF

Broni · Sep 17, 2012

Looks good.

How is computer doing?

You can reinstall AVG now.

================================

Download OTL to your Desktop.
Alternate download: http://www.itxassociates.com/OT-Tools/OTL.exe

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click the Scan All Users checkbox.
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

Foxiffer · Sep 17, 2012

Ok I think. I downloaded avast instead too. heres the logs

OTL logfile created on: 9/17/2012 5:03:59 PM - Run 1
OTL by OldTimer - Version 3.2.56.0 Folder = C:\Documents and Settings\Fox Ellis\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.87 Gb Total Physical Memory | 2.27 Gb Available Physical Memory | 78.88% Memory free
4.03 Gb Paging File | 3.58 Gb Available in Paging File | 88.66% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 69.64 Gb Total Space | 11.88 Gb Free Space | 17.06% Space Free | Partition Type: NTFS
Drive D: | 931.51 Gb Total Space | 802.72 Gb Free Space | 86.17% Space Free | Partition Type: NTFS

Computer Name: HPDC5750 | User Name: Fox Ellis | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/09/17 17:03:22 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Fox Ellis\Desktop\OTL.exe
PRC - [2012/09/09 18:14:24 | 000,161,768 | ---- | M] (Oracle Corporation) -- C:\Program Files\Java\jre7\bin\jqs.exe
PRC - [2012/09/07 17:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) -- C:\Documents and Settings\Fox Ellis\Desktop\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012/09/07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Documents and Settings\Fox Ellis\Desktop\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012/09/07 17:04:44 | 000,766,536 | ---- | M] (Malwarebytes Corporation) -- C:\Documents and Settings\Fox Ellis\Desktop\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012/08/21 02:12:26 | 004,282,728 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2012/08/21 02:12:25 | 000,044,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2012/05/04 15:43:20 | 001,561,768 | ---- | M] (Ask) -- C:\Program Files\Ask.com\Updater\Updater.exe
PRC - [2012/03/27 05:09:24 | 000,421,736 | ---- | M] (Apple Inc.) -- D:\MASTER ITUNES\iTunes 10.6\iTunesHelper.exe
PRC - [2008/08/21 05:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [1997/08/19 00:00:00 | 000,051,984 | ---- | M] () -- C:\Program Files\Microsoft Office\Office\OSA.EXE

========== Modules (No Company Name) ==========

MOD - [2012/09/17 13:14:04 | 001,810,432 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\12091701\algo.dll
MOD - [2012/06/12 20:18:50 | 011,817,472 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\dbc413807cb7360b3e26ef3ca1d54f9a\System.Web.ni.dll
MOD - [2012/06/12 19:54:03 | 012,433,920 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\01abbadafaf265d9f4ac9bbb247acb98\System.Windows.Forms.ni.dll
MOD - [2012/06/12 19:53:44 | 001,592,320 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\d86f2038209a4cf0d0f5b30f6375c9b2\System.Drawing.ni.dll
MOD - [2012/06/12 19:42:31 | 000,303,104 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
MOD - [2012/05/10 03:22:18 | 000,971,264 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\3d5b7368bde0f65aa15d9f46b498cc89\System.Configuration.ni.dll
MOD - [2012/05/10 03:22:12 | 000,025,600 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\016444dfc5f7e3d11c776f2fbc7a4594\Accessibility.ni.dll
MOD - [2012/05/10 03:20:01 | 005,450,752 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\3bba1b8b0b5ef0be238b011cc7a0575e\System.Xml.ni.dll
MOD - [2012/05/10 03:17:42 | 007,953,408 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\e4b5afc4da43b1c576f9322f9f2e1bfe\System.ni.dll
MOD - [2012/05/10 03:17:20 | 011,492,352 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\e337c89bc9f81b69d7237aa70e935900\mscorlib.ni.dll
MOD - [2012/02/20 21:29:04 | 000,087,912 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/02/20 21:28:42 | 001,242,472 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010/11/03 09:52:24 | 003,792,896 | ---- | M] () -- C:\Program Files\Microsoft Office\Office\mso97.dll
MOD - [2010/03/11 10:32:20 | 001,691,648 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.3238.38646__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll
MOD - [2010/03/11 10:32:20 | 000,466,944 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3238.38722__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll
MOD - [2010/03/11 10:32:20 | 000,364,544 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Wizard\2.0.3238.38708__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Wizard.dll
MOD - [2010/03/11 10:32:20 | 000,307,200 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.HydraVision.Wizard\2.0.3238.38744__90ba9c70f846762e\CLI.Aspect.HydraVision.Wizard.dll
MOD - [2010/03/11 10:32:20 | 000,278,528 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3238.38632__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll
MOD - [2010/03/11 10:32:20 | 000,204,800 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3238.38648__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll
MOD - [2010/03/11 10:32:20 | 000,077,824 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3238.38703__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll
MOD - [2010/03/11 10:32:20 | 000,069,632 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3238.38684__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll
MOD - [2010/03/11 10:32:20 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3238.38643__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll
MOD - [2010/03/11 10:32:20 | 000,036,864 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3238.38670__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll
MOD - [2010/03/11 10:32:20 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3238.38639__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll
MOD - [2010/03/11 10:32:20 | 000,011,776 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.HydraVision.Runtime\2.0.3238.38738__90ba9c70f846762e\CLI.Caste.HydraVision.Runtime.dll
MOD - [2010/03/11 10:32:20 | 000,008,704 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.HydraVision.Shared\2.0.3238.38737__90ba9c70f846762e\CLI.Caste.HydraVision.Shared.dll
MOD - [2010/03/11 10:32:20 | 000,007,680 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.HydraVision.Wizard\2.0.3238.38741__90ba9c70f846762e\CLI.Caste.HydraVision.Wizard.dll
MOD - [2010/03/11 10:32:20 | 000,007,680 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.HydraVision.Dashboard\2.0.3238.38737__90ba9c70f846762e\CLI.Caste.HydraVision.Dashboard.dll
MOD - [2010/03/11 10:32:19 | 000,811,008 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.3238.38673__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll
MOD - [2010/03/11 10:32:19 | 000,405,504 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.3238.38698__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll
MOD - [2010/03/11 10:32:19 | 000,344,064 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.3238.38689__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll
MOD - [2010/03/11 10:32:19 | 000,135,168 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3238.38723__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll
MOD - [2010/03/11 10:32:19 | 000,106,496 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.VPURecover.Graphics.Dashboard\2.0.3238.38647__90ba9c70f846762e\CLI.Aspect.VPURecover.Graphics.Dashboard.dll
MOD - [2010/03/11 10:32:19 | 000,094,208 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3238.38690__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll
MOD - [2010/03/11 10:32:19 | 000,081,920 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.3238.38672__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll
MOD - [2010/03/11 10:32:19 | 000,073,728 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3238.38638__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll
MOD - [2010/03/11 10:32:19 | 000,057,344 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.3238.38689__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll
MOD - [2010/03/11 10:32:19 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.VPURecover.Graphics.Runtime\2.0.3238.38647__90ba9c70f846762e\CLI.Aspect.VPURecover.Graphics.Runtime.dll
MOD - [2010/03/11 10:32:18 | 000,798,720 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Dashboard\2.0.3238.38704__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Dashboard.dll
MOD - [2010/03/11 10:32:18 | 000,716,800 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.3238.38640__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.dll
MOD - [2010/03/11 10:32:18 | 000,589,824 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.3238.38649__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll
MOD - [2010/03/11 10:32:18 | 000,450,560 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.3238.38666__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll
MOD - [2010/03/11 10:32:18 | 000,438,272 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3238.38671__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll
MOD - [2010/03/11 10:32:18 | 000,225,280 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3238.38648__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll
MOD - [2010/03/11 10:32:18 | 000,122,880 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.3238.38681__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll
MOD - [2010/03/11 10:32:18 | 000,073,728 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation\2.0.3218.28666__90ba9c70f846762e\CLI.Foundation.dll
MOD - [2010/03/11 10:32:18 | 000,061,440 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3218.28678__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll
MOD - [2010/03/11 10:32:18 | 000,061,440 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3238.38670__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll
MOD - [2010/03/11 10:32:18 | 000,045,056 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll
MOD - [2010/03/11 10:32:18 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.3238.38651__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll
MOD - [2010/03/11 10:32:18 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3238.38671__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll
MOD - [2010/03/11 10:32:18 | 000,036,864 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.3238.38681__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll
MOD - [2010/03/11 10:32:18 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation\2.0.3218.28664__90ba9c70f846762e\LOG.Foundation.dll
MOD - [2010/03/11 10:32:18 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3238.38682__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll
MOD - [2010/03/11 10:32:18 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3218.28665__90ba9c70f846762e\NEWAEM.Foundation.dll
MOD - [2010/03/11 10:32:18 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3218.28727__90ba9c70f846762e\CLI.Foundation.XManifest.dll
MOD - [2010/03/11 10:32:18 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.OS.I0602\2.0.3218.28687__90ba9c70f846762e\DEM.OS.I0602.dll
MOD - [2010/03/11 10:32:18 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3218.28681__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll
MOD - [2010/03/11 10:32:18 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3218.28678__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll
MOD - [2010/03/11 10:32:18 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3218.28672__90ba9c70f846762e\CLI.Component.Client.Shared.dll
MOD - [2010/03/11 10:32:18 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3218.28677__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll
MOD - [2010/03/11 10:32:18 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3218.28672__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll
MOD - [2010/03/11 10:32:18 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\MOM.Foundation\2.0.3218.28686__90ba9c70f846762e\MOM.Foundation.dll
MOD - [2010/03/11 10:32:18 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.OS\2.0.3218.28687__90ba9c70f846762e\DEM.OS.dll
MOD - [2010/03/11 10:32:18 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll
MOD - [2010/03/11 10:32:18 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics\2.0.3218.28688__90ba9c70f846762e\DEM.Graphics.dll
MOD - [2010/03/11 10:32:18 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll
MOD - [2010/03/11 10:32:18 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3218.28676__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll
MOD - [2010/03/11 10:32:18 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.3218.28690__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll
MOD - [2010/03/11 10:32:18 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.3218.28688__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll
MOD - [2010/03/11 10:32:18 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3218.28683__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll
MOD - [2010/03/11 10:32:18 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3218.28705__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll
MOD - [2010/03/11 10:32:18 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.3218.28685__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll
MOD - [2010/03/11 10:32:18 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3218.28705__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll
MOD - [2010/03/11 10:32:18 | 000,006,656 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll
MOD - [2010/03/11 10:32:17 | 000,106,496 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\MOM.Implementation\2.0.3238.38717__90ba9c70f846762e\MOM.Implementation.dll
MOD - [2010/03/11 10:32:17 | 000,065,536 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.3218.28694__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll
MOD - [2010/03/11 10:32:17 | 000,061,440 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3238.38716__90ba9c70f846762e\LOG.Foundation.Implementation.dll
MOD - [2010/03/11 10:32:17 | 000,053,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.3218.28693__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll
MOD - [2010/03/11 10:32:17 | 000,053,248 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.3218.28692__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll
MOD - [2010/03/11 10:32:17 | 000,049,152 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.3218.28694__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll
MOD - [2010/03/11 10:32:17 | 000,049,152 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.3218.28692__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll
MOD - [2010/03/11 10:32:17 | 000,045,056 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3238.38731__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll
MOD - [2010/03/11 10:32:17 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3218.28670__90ba9c70f846762e\CLI.Foundation.Private.dll
MOD - [2010/03/11 10:32:17 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.3218.28702__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll
MOD - [2010/03/11 10:32:17 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.3218.28694__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll
MOD - [2010/03/11 10:32:17 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3218.28672__90ba9c70f846762e\LOG.Foundation.Private.dll
MOD - [2010/03/11 10:32:17 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.3218.28685__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll
MOD - [2010/03/11 10:32:17 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.3218.28690__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll
MOD - [2010/03/11 10:32:17 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.3218.28688__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll
MOD - [2010/03/11 10:32:17 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.3218.28686__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll
MOD - [2010/03/11 10:32:17 | 000,024,576 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.3218.28693__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll
MOD - [2010/03/11 10:32:17 | 000,024,576 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll
MOD - [2010/03/11 10:32:17 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3218.28686__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll
MOD - [2010/03/11 10:32:17 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.VPURecover.Graphics.Shared\2.0.3218.28690__90ba9c70f846762e\CLI.Aspect.VPURecover.Graphics.Shared.dll
MOD - [2010/03/11 10:32:17 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.3218.28689__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll
MOD - [2010/03/11 10:32:17 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\APM.Foundation\2.0.3218.28685__90ba9c70f846762e\APM.Foundation.dll
MOD - [2010/03/11 10:32:17 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOCALIZATION.Foundation.Private\2.0.3218.28670__90ba9c70f846762e\LOCALIZATION.Foundation.Private.dll
MOD - [2010/03/11 10:32:17 | 000,016,384 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3218.28678__90ba9c70f846762e\AEM.Server.Shared.dll
MOD - [2010/03/11 10:32:17 | 000,014,848 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll
MOD - [2010/03/11 10:32:17 | 000,013,312 | ---- | M] () -- C:\WINDOWS\assembly\GAC\Interop.WBOCXLib\1.0.0.0__90ba9c70f846762e\Interop.WBOCXLib.dll
MOD - [2010/03/11 10:32:17 | 000,011,264 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\LOCALIZATION.Foundation.Implementation\2.0.3238.38739__90ba9c70f846762e\LOCALIZATION.Foundation.Implementation.dll
MOD - [2010/03/11 10:32:17 | 000,007,168 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3238.38630__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll
MOD - [2010/03/11 10:32:16 | 001,073,152 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3238.38636__90ba9c70f846762e\CLI.Component.Dashboard.dll
MOD - [2010/03/11 10:32:16 | 000,532,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3238.38712__90ba9c70f846762e\CLI.Component.Systemtray.dll
MOD - [2010/03/11 10:32:16 | 000,393,216 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3238.38643__90ba9c70f846762e\CLI.Component.Wizard.dll
MOD - [2010/03/11 10:32:16 | 000,073,728 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\ATIDEMOS\2.0.3238.38630__90ba9c70f846762e\ATIDEMOS.dll
MOD - [2010/03/11 10:32:16 | 000,069,632 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3238.38630__90ba9c70f846762e\CLI.Component.Runtime.dll
MOD - [2010/03/11 10:32:16 | 000,061,440 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\APM.Server\2.0.3238.38628__90ba9c70f846762e\APM.Server.dll
MOD - [2010/03/11 10:32:16 | 000,057,344 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3238.38631__90ba9c70f846762e\CLI.Component.SkinFactory.dll
MOD - [2010/03/11 10:32:16 | 000,045,056 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3218.28682__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll
MOD - [2010/03/11 10:32:16 | 000,045,056 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\AEM.Server\2.0.3238.38629__90ba9c70f846762e\AEM.Server.dll
MOD - [2010/03/11 10:32:16 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3218.28675__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll
MOD - [2010/03/11 10:32:16 | 000,032,768 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll
MOD - [2010/03/11 10:32:16 | 000,028,672 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CCC.Implementation\2.0.3238.38717__90ba9c70f846762e\CCC.Implementation.dll
MOD - [2010/03/11 10:32:16 | 000,024,576 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3218.28681__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll
MOD - [2010/03/11 10:32:16 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3218.28682__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll
MOD - [2010/03/11 10:32:16 | 000,020,480 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.3218.28695__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll
MOD - [2008/08/07 18:03:38 | 000,016,384 | ---- | M] () -- c:\Program Files\ATI Technologies\ATI.ACE\Branding\Branding.dll
MOD - [1997/08/19 00:00:00 | 000,051,984 | ---- | M] () -- C:\Program Files\Microsoft Office\Office\OSA.EXE

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe -- (vToolbarUpdater11.2.0)
SRV - File not found [Auto | Stopped] -- C:\WINDOWS\system32\spoolsv.exe -- (Spooler)
SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Google\Update\GoogleUpdate.exe /medsvc -- (gupdatem)
SRV - File not found [Auto | Stopped] -- C:\Program Files\Google\Update\GoogleUpdate.exe /svc -- (gupdate)
SRV - [2012/09/09 18:14:24 | 000,161,768 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2012/09/07 17:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Documents and Settings\Fox Ellis\Desktop\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012/09/07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Documents and Settings\Fox Ellis\Desktop\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012/08/21 02:12:25 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2012/08/14 18:06:43 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2011/03/16 10:42:06 | 000,407,336 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | On_Demand | Unknown] -- C:\DOCUME~1\FOXELL~1\LOCALS~1\Temp\mbr.sys -- (mbr)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Running] -- C:\C0mb0Fix20646C\catchme.sys -- (catchme)
DRV - [2012/09/07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2012/08/21 02:13:15 | 000,729,752 | ---- | M] (AVAST Software) [File_System | System | Stopped] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012/08/21 02:13:15 | 000,355,632 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012/08/21 02:13:15 | 000,054,232 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012/08/21 02:13:14 | 000,097,608 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2012/08/21 02:13:14 | 000,035,928 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (AswRdr)
DRV - [2012/08/21 02:13:13 | 000,025,256 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2012/08/21 02:13:13 | 000,021,256 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2009/10/20 13:08:44 | 000,037,248 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\swmsflt.sys -- (swmsflt)
DRV - [2009/08/13 15:07:42 | 000,030,080 | ---- | M] (Sierra Wireless Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\swvspser.sys -- (swvspser)
DRV - [2009/08/04 11:39:02 | 000,157,440 | ---- | M] (Sierra Wireless Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\swmx00.sys -- (SWMX00)
DRV - [2009/08/04 11:38:50 | 000,203,008 | ---- | M] (Sierra Wireless Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SWNC5E00.sys -- (SWNC5E00)
DRV - [2008/11/12 23:41:04 | 003,451,904 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2008/06/17 17:49:22 | 004,756,992 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService)
DRV - [2007/05/02 04:34:32 | 000,161,792 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {9668738A-FD4B-41FF-A38A-0AB70DB3C40C}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{9668738A-FD4B-41FF-A38A-0AB70DB3C40C}: "URL" = http://www.google.com/search?q={sea...putEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}: "URL" = http://us.yhs.search.yahoo.com/avg/...yahoo_avg_hs2-tb-web_chrome_us&p={searchTerms}

IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2368579109-3610495512-2017815006-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-2368579109-3610495512-2017815006-1005\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\S-1-5-21-2368579109-3610495512-2017815006-1005\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\tbDVD2.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-2368579109-3610495512-2017815006-1005\..\SearchScopes,DefaultScope = {9668738A-FD4B-41FF-A38A-0AB70DB3C40C}

Foxiffer · Sep 17, 2012

IE - HKU\S-1-5-21-2368579109-3610495512-2017815006-1005\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2368579109-3610495512-2017815006-1005\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={...0ba1d807070&lang=en&ds=AVG&pr=pr&d=2012-08-04 15:10:47&v=11.1.0.12&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-2368579109-3610495512-2017815006-1005\..\SearchScopes\{9668738A-FD4B-41FF-A38A-0AB70DB3C40C}: "URL" = http://www.google.com/search?q={sea...putEncoding}&sourceid=ie7&rlz=1I7GGIE_enUS470
IE - HKU\S-1-5-21-2368579109-3610495512-2017815006-1005\..\SearchScopes\{9DC4AABA-5411-45AD-95FE-4FE68EF32D4A}: "URL" = http://websearch.ask.com/redirect?c...pn_sauid=FEFADC47-5C06-408C-A4F9-6FAA659E78A2
IE - HKU\S-1-5-21-2368579109-3610495512-2017815006-1005\..\SearchScopes\{B373341F-DA28-4B5B-8BB7-AED56E0FBF07}: "URL" = http://search.avg.com/route/?d=4cba...e&q={searchTerms}&lng={language}&iy=&ychte=us
IE - HKU\S-1-5-21-2368579109-3610495512-2017815006-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\MASTER ITUNES\iTunes 10.6\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\\npsitesafety.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Fox Ellis\Local Settings\Application Data\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Fox Ellis\Local Settings\Application Data\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\m3ffxtbr@mywebsearch.com: C:\Program Files\MyWebSearch\bar\1.bin
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F53C93F1-07D5-430c-86D4-C9531B27DFAF}: C:\Program Files\AVG\AVG2012\Firefox\DoNotTrack\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.1.0.12\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012/09/17 16:22:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/05 18:37:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2012/08/08 13:44:04 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/11/20 21:04:51 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/08/05 15:40:44 | 000,003,767 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2011/11/20 18:04:05 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/11/20 18:04:05 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage:
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google

riginalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage:
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\Fox Ellis\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.79\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\Fox Ellis\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.89\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_270.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\Fox Ellis\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.89\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\Fox Ellis\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.89\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.2 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\Fox Ellis\Local Settings\Application Data\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: AVG SiteSafety plugin (Enabled) = C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\\npsitesafety.dll
CHR - plugin: My Web Search Plugin Stub (Enabled) = C:\Program Files\MyWebSearch\bar\1.bin\NPMyWebS.dll
CHR - plugin: Java(TM) Platform SE 7 U5 (Enabled) = C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 7.0.50.255 (Enabled) = C:\WINDOWS\system32\npDeployJava1.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: iTunes Application Detector (Enabled) = D:\MASTER ITUNES\iTunes 10.6\Mozilla Plugins\npitunes.dll
CHR - Extension: avast! WebRep = C:\Documents and Settings\Fox Ellis\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1466_0\

O1 HOSTS File: ([2012/09/17 15:12:41 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files\AVG\AVG2012\avgdtiex.dll File not found
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\tbDVD2.dll (Conduit Ltd.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\tbDVD2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-21-2368579109-3610495512-2017815006-1005\..\Toolbar\WebBrowser: (no name) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - No CLSID value found.
O3 - HKU\S-1-5-21-2368579109-3610495512-2017815006-1005\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Program Files\DVDVideoSoftTB\tbDVD2.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-2368579109-3610495512-2017815006-1005\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [iTunesHelper] D:\MASTER ITUNES\iTunes 10.6\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE ()
O4 - Startup: C:\Documents and Settings\Lisa Narvaez\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk = C:\Program Files\MSWorks\Calendar\WKCALREM.EXE (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2368579109-3610495512-2017815006-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2368579109-3610495512-2017815006-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-2368579109-3610495512-2017815006-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-2368579109-3610495512-2017815006-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube Download - C:\Documents and Settings\Fox Ellis\Application Data\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Documents and Settings\Fox Ellis\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~4\Office14\ONBttnIE.dll/105 File not found
O9 - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files\AVG\AVG2012\avgdtiex.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1343914799140 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.7.0_05)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{55380F71-DB74-49F2-86C3-F830E6329366}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7E4E2B85-3B1B-4058-99ED-039D17EB7474}: NameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F036F97B-198F-4149-AE78-4C76949467EE}: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Fox Ellis\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Fox Ellis\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/03/11 10:00:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/09/17 17:02:56 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Fox Ellis\Desktop\OTL.exe
[2012/09/17 16:23:18 | 000,021,256 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2012/09/17 16:23:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2012/09/17 16:23:17 | 000,355,632 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2012/09/17 16:23:15 | 000,054,232 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2012/09/17 16:23:15 | 000,035,928 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2012/09/17 16:23:14 | 000,729,752 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2012/09/17 16:23:13 | 000,097,608 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2012/09/17 16:23:13 | 000,089,624 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2012/09/17 16:23:12 | 000,025,256 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2012/09/17 16:22:07 | 000,041,224 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2012/09/17 16:22:06 | 000,227,648 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2012/09/17 16:21:46 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2012/09/17 16:21:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2012/09/17 15:09:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2012/09/17 01:29:10 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2012/09/17 01:23:28 | 000,000,000 | -HSD | C] -- C:\WINDOWS\CSC
[2012/09/17 01:17:35 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2012/09/17 01:17:35 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2012/09/17 01:17:35 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2012/09/17 01:17:35 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2012/09/17 01:17:21 | 000,000,000 | ---D | C] -- C:\C0mb0Fix
[2012/09/17 00:55:29 | 001,659,808 | ---- | C] (Bleeping Computer, LLC) -- C:\Documents and Settings\Fox Ellis\Desktop\rkill.exe
[2012/09/17 00:53:52 | 004,751,448 | R--- | C] (Swearware) -- C:\Documents and Settings\Fox Ellis\Desktop\C0mb0Fix.exe
[2012/09/17 00:45:18 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/09/15 19:29:04 | 000,000,000 | ---D | C] -- C:\WINDOWS\erdnt
[2012/09/15 17:53:53 | 010,901,120 | ---- | C] (OPSWAT, Inc.) -- C:\Documents and Settings\Fox Ellis\Desktop\AppRemover.exe
[2012/09/14 22:34:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Fox Ellis\Desktop\remv vis fld
[2012/09/14 22:33:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Fox Ellis\Desktop\logs
[2012/09/14 20:46:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Fox Ellis\Desktop\RK_Quarantine
[2012/09/14 20:42:40 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Documents and Settings\Fox Ellis\Desktop\aswMBR.exe
[2012/09/14 20:20:16 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
[2012/09/14 20:15:31 | 002,211,928 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Fox Ellis\Desktop\TDSSKiller.exe
[2012/09/14 18:40:41 | 000,607,260 | R--- | C] (Swearware) -- C:\Documents and Settings\Fox Ellis\Desktop\dds.com
[2012/09/14 17:33:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Fox Ellis\Application Data\Malwarebytes
[2012/09/14 17:32:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/09/14 17:32:50 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012/09/14 17:32:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Fox Ellis\Desktop\Malwarebytes' Anti-Malware
[2012/09/14 17:32:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2012/09/11 08:24:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\AVG
[2012/09/09 18:15:16 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2012/09/09 18:14:18 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[21 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/09/17 17:08:00 | 000,000,242 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2012/09/17 17:04:15 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/09/17 17:03:22 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Fox Ellis\Desktop\OTL.exe
[2012/09/17 16:28:31 | 000,002,625 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2012/09/17 16:28:31 | 000,000,316 | -H-- | M] () -- C:\WINDOWS\tasks\avast! Emergency Update.job
[2012/09/17 16:26:00 | 000,001,006 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2368579109-3610495512-2017815006-1004UA.job
[2012/09/17 16:23:18 | 000,001,689 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2012/09/17 16:15:00 | 000,000,994 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2368579109-3610495512-2017815006-1005UA.job
[2012/09/17 15:12:41 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2012/09/17 15:12:37 | 000,012,686 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/09/17 15:12:36 | 000,000,386 | ---- | M] () -- C:\WINDOWS\tasks\Free File Viewer Update Checker.job
[2012/09/17 15:11:38 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/09/17 14:26:00 | 000,000,954 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2368579109-3610495512-2017815006-1004Core.job
[2012/09/17 01:29:13 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2012/09/17 00:55:37 | 001,659,808 | ---- | M] (Bleeping Computer, LLC) -- C:\Documents and Settings\Fox Ellis\Desktop\rkill.exe
[2012/09/17 00:53:52 | 004,751,448 | R--- | M] (Swearware) -- C:\Documents and Settings\Fox Ellis\Desktop\C0mb0Fix.exe
[2012/09/16 10:37:10 | 000,204,120 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012/09/16 10:27:14 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/09/15 18:15:06 | 000,000,942 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2368579109-3610495512-2017815006-1005Core.job
[2012/09/15 17:54:22 | 010,901,120 | ---- | M] (OPSWAT, Inc.) -- C:\Documents and Settings\Fox Ellis\Desktop\AppRemover.exe
[2012/09/14 23:32:34 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\Fox Ellis\Desktop\MBR.dat
[2012/09/14 20:45:29 | 001,378,816 | ---- | M] () -- C:\Documents and Settings\Fox Ellis\Desktop\r0gueki1ler.exe
[2012/09/14 20:42:40 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Fox Ellis\Desktop\aswMBR.exe
[2012/09/14 18:40:43 | 000,607,260 | R--- | M] (Swearware) -- C:\Documents and Settings\Fox Ellis\Desktop\dds.com
[2012/09/14 17:32:52 | 000,000,732 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/09/13 20:40:05 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\Fox Ellis\Desktop\wo2ryh1c.exe
[2012/09/09 20:04:01 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/09/09 19:12:25 | 000,002,316 | ---- | M] () -- C:\Documents and Settings\Fox Ellis\Desktop\Google Chrome.lnk
[2012/09/09 19:12:25 | 000,002,294 | ---- | M] () -- C:\Documents and Settings\Fox Ellis\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/09/08 12:17:07 | 000,081,408 | ---- | M] () -- C:\Documents and Settings\Fox Ellis\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/09/07 20:36:26 | 000,263,186 | ---- | M] () -- C:\Documents and Settings\Fox Ellis\Desktop\Minecraft.exe
[2012/09/07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012/09/02 12:48:57 | 000,075,582 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2012/08/26 16:33:46 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Fox Ellis\Local Settings\Application Data\prvlcl.dat
[2012/08/24 13:28:40 | 002,211,928 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Fox Ellis\Desktop\TDSSKiller.exe
[2012/08/21 02:13:15 | 000,729,752 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2012/08/21 02:13:15 | 000,355,632 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2012/08/21 02:13:15 | 000,054,232 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2012/08/21 02:13:14 | 000,097,608 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2012/08/21 02:13:14 | 000,089,624 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2012/08/21 02:13:14 | 000,035,928 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2012/08/21 02:13:13 | 000,025,256 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2012/08/21 02:13:13 | 000,021,256 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2012/08/21 02:12:33 | 000,041,224 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2012/08/21 02:12:23 | 000,227,648 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[21 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/09/17 16:23:18 | 000,001,689 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2012/09/17 16:23:14 | 000,000,316 | -H-- | C] () -- C:\WINDOWS\tasks\avast! Emergency Update.job
[2012/09/17 01:29:13 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2012/09/17 01:29:11 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2012/09/17 01:17:35 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012/09/17 01:17:35 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012/09/17 01:17:35 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012/09/17 01:17:35 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012/09/17 01:17:35 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012/09/14 23:32:34 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\Fox Ellis\Desktop\MBR.dat
[2012/09/14 20:45:29 | 001,378,816 | ---- | C] () -- C:\Documents and Settings\Fox Ellis\Desktop\r0gueki1ler.exe
[2012/09/14 17:32:52 | 000,000,732 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/09/13 20:39:58 | 000,302,592 | ---- | C] () -- C:\Documents and Settings\Fox Ellis\Desktop\wo2ryh1c.exe
[2012/09/07 20:36:23 | 000,263,186 | ---- | C] () -- C:\Documents and Settings\Fox Ellis\Desktop\Minecraft.exe
[2012/08/12 19:11:27 | 000,027,520 | ---- | C] () -- C:\Documents and Settings\Fox Ellis\Local Settings\Application Data\dt.dat
[2012/06/06 14:52:48 | 000,063,488 | ---- | C] () -- C:\WINDOWS\xobglu16.dll
[2012/06/06 14:52:48 | 000,023,552 | ---- | C] () -- C:\WINDOWS\xobglu32.dll
[2012/06/05 18:43:20 | 000,000,349 | ---- | C] () -- C:\WINDOWS\QTW.INI
[2012/02/14 20:03:38 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/12/11 00:25:33 | 000,398,574 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-2368579109-3610495512-2017815006-1005-0.dat
[2011/11/21 16:03:08 | 000,000,040 | ---- | C] () -- C:\Documents and Settings\Fox Ellis\jagex_cl_runescape_LIVE.dat
[2011/11/07 00:31:59 | 000,234,510 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2011/09/13 19:31:32 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Fox Ellis\Local Settings\Application Data\prvlcl.dat
[2011/03/03 21:04:00 | 000,000,117 | ---- | C] () -- C:\Documents and Settings\Fox Ellis\jagex_runescape_preferences2.dat
[2011/03/03 21:02:04 | 000,000,034 | ---- | C] () -- C:\Documents and Settings\Fox Ellis\jagex_runescape_preferences.dat
[2011/02/22 22:34:03 | 000,000,179 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2011/02/22 22:33:53 | 000,000,000 | ---- | C] () -- C:\WINDOWS\SETUP32.INI
[2010/11/03 09:52:24 | 000,000,210 | ---- | C] () -- C:\WINDOWS\System32\sr2spec.ini
[2010/10/31 18:02:54 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2010/10/29 01:18:37 | 000,081,408 | ---- | C] () -- C:\Documents and Settings\Fox Ellis\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/23 13:05:41 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/10/16 19:59:33 | 000,057,496 | ---- | C] () -- C:\WINDOWS\System32\mlfcache.dat

========== LOP Check ==========

[2010/03/11 10:54:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\InterVideo
[2012/08/04 23:52:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ask
[2012/09/17 16:21:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2011/03/13 12:55:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2012/03/02 21:32:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Babylon
[2011/02/22 22:35:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Broderbund
[2011/02/22 22:40:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Broderbund LLC
[2010/12/21 18:45:53 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ
[2011/01/16 14:30:39 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonIJEGV
[2010/12/24 16:28:53 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonIJScan
[2011/03/14 09:33:41 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2011/03/05 12:00:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Individual Software
[2011/08/03 09:45:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2010/03/11 10:23:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Uninstall
[2011/05/11 17:27:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\W3i
[2010/10/16 19:29:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/03/11 10:54:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\InterVideo
[2012/08/16 19:14:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fox Ellis\Application Data\.minecraft
[2012/03/02 21:32:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fox Ellis\Application Data\Babylon
[2012/03/04 22:14:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fox Ellis\Application Data\BabylonToolbar
[2011/07/15 09:39:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fox Ellis\Application Data\Canon
[2010/12/25 14:45:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fox Ellis\Application Data\Canon Easy-WebPrint EX
[2011/12/22 23:08:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fox Ellis\Application Data\com.adobe.downloadassistant.AdobeDownloadAssistant
[2012/03/24 01:14:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fox Ellis\Application Data\ConverterLite
[2012/07/23 16:04:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fox Ellis\Application Data\DVDVideoSoft
[2011/11/14 21:08:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fox Ellis\Application Data\DVDVideoSoftIEHelpers
[2011/03/21 21:45:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fox Ellis\Application Data\FCSB000062035
[2011/05/13 16:00:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fox Ellis\Application Data\FreeFileViewer
[2010/03/11 10:54:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fox Ellis\Application Data\InterVideo
[2012/05/08 20:27:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fox Ellis\Application Data\Oracle
[2011/05/21 10:19:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fox Ellis\Application Data\PDF Software
[2012/02/16 22:44:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fox Ellis\Application Data\redsn0w
[2011/09/27 16:30:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fox Ellis\Application Data\Screaming Bee
[2011/05/30 19:02:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fox Ellis\Application Data\Superfish
[2012/03/28 15:51:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Guest\Application Data\AVG Secure Search
[2012/08/05 20:26:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Guest\Application Data\AVG2012
[2011/01/04 15:54:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Guest\Application Data\Canon
[2011/01/02 12:48:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Guest\Application Data\Canon Easy-WebPrint EX
[2011/03/23 13:28:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Guest\Application Data\FCSB000062035
[2010/03/11 10:54:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Guest\Application Data\InterVideo
[2011/05/18 11:05:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Guest\Application Data\PDF Software
[2012/04/19 15:05:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Guest\Application Data\uTorrent
[2012/08/13 15:30:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lisa Narvaez\Application Data\.minecraft
[2012/08/04 15:57:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lisa Narvaez\Application Data\AVG
[2012/08/04 15:10:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lisa Narvaez\Application Data\AVG Secure Search
[2012/08/04 15:11:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lisa Narvaez\Application Data\AVG2012
[2010/10/17 20:56:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lisa Narvaez\Application Data\AVG9
[2011/12/17 17:18:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lisa Narvaez\Application Data\Canon
[2012/03/03 19:23:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lisa Narvaez\Application Data\ConverterLite
[2012/07/08 20:47:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lisa Narvaez\Application Data\DVDVideoSoft
[2011/03/25 17:37:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lisa Narvaez\Application Data\DVDVideoSoftIEHelpers
[2010/03/11 10:54:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lisa Narvaez\Application Data\InterVideo
[2011/05/20 22:38:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lisa Narvaez\Application Data\PDF Software
[2010/11/08 21:10:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lisa Narvaez\Application Data\PriceGong
[2010/11/21 14:16:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lisa Narvaez\Application Data\Sierra Wireless
[2011/11/06 13:33:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lisa Narvaez\Application Data\start
[2011/03/21 23:22:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lisa Narvaez\Application Data\TeamViewer
[2011/05/19 15:06:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\PDF Software
[2012/09/17 16:28:31 | 000,000,316 | -H-- | M] () -- C:\WINDOWS\Tasks\avast! Emergency Update.job
[2012/09/17 15:12:36 | 000,000,386 | ---- | M] () -- C:\WINDOWS\Tasks\Free File Viewer Update Checker.job
[2012/09/17 17:08:00 | 000,000,242 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

========== Purity Check ==========

< End of report >

Foxiffer · Sep 17, 2012

Here is the other one.

OTL Extras logfile created on: 9/17/2012 5:03:59 PM - Run 1
OTL by OldTimer - Version 3.2.56.0 Folder = C:\Documents and Settings\Fox Ellis\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.87 Gb Total Physical Memory | 2.27 Gb Available Physical Memory | 78.88% Memory free
4.03 Gb Paging File | 3.58 Gb Available in Paging File | 88.66% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 69.64 Gb Total Space | 11.88 Gb Free Space | 17.06% Space Free | Partition Type: NTFS
Drive D: | 931.51 Gb Total Space | 802.72 Gb Free Space | 86.17% Space Free | Partition Type: NTFS

Computer Name: HPDC5750 | User Name: Fox Ellis | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_USERS\S-1-5-21-2368579109-3610495512-2017815006-1005\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet

isabled

xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet

isabled

xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet

isabled

xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet

isabled

xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet

isabled

xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet

isabled

xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\FreeFileViewer\FFVCheckForUpdates.exe" = C:\Program Files\FreeFileViewer\FFVCheckForUpdates.exe:*:Enabled:Free File Viewer Update Checker -- (Bitberry Software)
"C:\Documents and Settings\Lisa Narvaez\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe" = C:\Documents and Settings\Lisa Narvaez\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin -- (Google)
"C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit -- (Apple Inc.)
"D:\MASTER ITUNES\iTunes 10.6\iTunes.exe" = D:\MASTER ITUNES\iTunes 10.6\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{07C3089C-BF32-B21D-58C2-EA1A7596CC48}" = CCC Help Chinese Standard
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0CA6F07E-7967-4780-BBF5-31DF2FB623AB}" = Catalyst Control Center - Branding
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{1052574B-DD82-0F27-FA8D-84FDC3D8D1E8}" = Catalyst Control Center Localization Norwegian
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP270_series" = Canon MP270 series MP Drivers
"{1282A949-7BA4-3B44-4428-D3FBF9136DD9}" = CCC Help Danish
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{22C25ED6-C2DA-CF7D-EE02-B4F72909DA87}" = Catalyst Control Center Core Implementation
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{23B8A91D-680B-462B-87AD-3D70F7341731}" = iTunes
"{26A24AE4-039D-4CA4-87B4-2F83216015F0}" = Java(TM) 6 Update 15
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 24
"{26A24AE4-039D-4CA4-87B4-2F83217004F0}" = Java(TM) 7 Update 4
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7
"{2BA46990-AFE9-BA70-28E5-7701CA9970D0}" = CCC Help Hungarian
"{2BA6C4F9-C833-F04C-077B-F63304211381}" = Catalyst Control Center Localization Czech
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{2CE251EF-7AC1-40EA-5034-33C04B0D5962}" = ccc-utility
"{2F1F1C89-26B5-E21F-39DC-903E565AD37D}" = CCC Help Chinese Traditional
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35E06C79-EEB4-B5F7-1C26-A0F7742A1D58}" = CCC Help French
"{36C61FC0-23A1-0A7C-51C3-2D785E11FF6C}" = Catalyst Control Center Localization Hungarian
"{37EB2D33-16FE-A445-BAA1-9AEE4956891B}" = Skins
"{3893DD9B-3D62-E694-F2A5-6B184C892132}" = CCC Help Greek
"{3920097B-2A5A-753E-3AE2-8BDDC4156836}" = CCC Help Russian
"{3B1C3FA7-917A-DB02-29AB-5B2A1935A7DB}" = ccc-core-static
"{3BB645DB-C2D3-9200-35A7-64607A1182E9}" = CCC Help Italian
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{47BBA5AA-CA6F-4A41-858D-A7A776F29A8B}" = Google SketchUp 8
"{487B8646-FCA3-C847-512C-048D2D286B79}" = Catalyst Control Center Localization German
"{48A3688C-8DB7-BD1A-A9F3-8D32FFD8CDF6}" = CCC Help Portuguese
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4BE2A9A0-692D-1DC2-7884-E09C58F06F03}" = Catalyst Control Center Localization Russian
"{5329210A-9F07-FE1C-F407-97A9153847FB}" = Catalyst Control Center Localization Japanese
"{54CEFF70-0F62-F138-30C3-6D224839E2A6}" = CCC Help Swedish
"{555B55D6-5D60-4DDF-1850-F28DC81256A6}" = Catalyst Control Center Localization Finnish
"{5600094C-5EA0-4BE8-9ECE-4C9B726AC9D9}" = Sierra Wireless USB MUX Driver Package
"{58E58991-59FB-3DD5-5F4F-72A6FE2EBEE2}" = CCC Help Norwegian
"{5DA6F06A-B389-407B-BF8C-1548767914D8}" = ATI Problem Report Wizard
"{5E64954E-F876-4F48-1A4B-8FF2E8F1DC60}" = Catalyst Control Center Localization Portuguese
"{638B6C79-6DBB-457C-2A35-F8FE2F595F09}" = Catalyst Control Center Graphics Full New
"{6990938B-00F8-A0AA-83C5-06473FD133A7}" = CCC Help Thai
"{6CFBAEA3-17C5-FA7B-1F63-8AD8F3E7CF96}" = Catalyst Control Center Localization Polish
"{6E9DF224-4BBF-11CE-9782-D55E1D34998F}" = CCC Help Korean
"{7391ABC8-0EA4-3798-ACE3-96B8C8D84EA8}" = Google Talk Plugin
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7D105B2B-A19F-9FE9-3AFE-EF1FD40E2B2B}" = Catalyst Control Center Graphics Light
"{7FB0C0CA-8D90-288F-3070-89ACB0FAE507}" = CCC Help English
"{818AFA12-88BD-2276-3699-F08873C71E37}" = Catalyst Control Center Localization Korean
"{83CA300D-FB06-B5DA-7616-A862486738B2}" = Catalyst Control Center HydraVision Full
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{87A733DC-27B6-5E5C-6FB0-30A0B678CF4C}" = CCC Help Turkish
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D075F05-8D87-1D3E-F220-E70CA53C59BB}" = Catalyst Control Center Graphics Full Existing
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90850409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{917B9C1D-E2F9-870F-1285-AD923E2D1E10}" = Catalyst Control Center Graphics Previews Common
"{92C5DB3D-9D6F-4324-BB11-57825F4C2635}" = DVD Decoder Pak for Windows XP
"{95FCD79D-FBF4-53DC-ACAE-A9392E29AA44}" = Catalyst Control Center Localization Chinese Traditional
"{96334581-5554-3E5F-8BC9-924C3C3AC5BE}" = Google Talk Plugin
"{96AF4F64-A6EA-0279-523B-D8A21E8E7E84}" = CCC Help Finnish
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A2003EB7-48C4-4D0F-6EA2-3D3137FC2322}" = Catalyst Control Center Localization Swedish
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9FE59F0-5BFA-4FDF-84C6-F45457715379}" = InstallIQ Updater
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.4)
"{AD7BF3FC-56AC-27ED-699A-4470D29222C3}" = CCC Help Japanese
"{AF9E97C1-7431-426D-A8D5-ABE40995C0B1}" = DirectX 9 Runtime
"{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
"{B093DC31-4FC6-EA93-B8AD-C11AB95C26DC}" = Catalyst Control Center Localization Dutch
"{B0D43528-56AE-DCE9-8C7F-00BB97C465D9}" = Catalyst Control Center Localization Italian
"{B1AE853E-64D7-9F9F-64B0-725CC834D6B6}" = Catalyst Control Center Localization Danish
"{B30BC2D6-7A04-DC17-071C-5760D45A522D}" = ccc-core-preinstall
"{B9EA1809-F802-22DB-E66A-2D6180AD95CE}" = Catalyst Control Center Localization Spanish
"{BB6D5C3B-5936-37E8-CD8B-5E8F39218D3C}" = Catalyst Control Center Localization Turkish
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C32CEE42-B7F1-D205-F82B-F571B41085E9}" = Catalyst Control Center Localization Chinese Standard
"{C792A75A-2A1F-4991-9B85-291745478A79}" = NetAssistant
"{C8AFA9F4-A015-8B87-889C-EBDCE2D6412B}" = CCC Help Dutch
"{CAFB373F-3ADA-7383-CC92-017301A4BCCA}" = CCC Help German
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE69DB03-D1DF-3C99-2DDC-99A44BDD623F}" = Catalyst Control Center Localization French
"{D2E7476C-D130-8237-327F-B1A7FE6F0E11}" = Catalyst Control Center Localization Greek
"{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser
"{E1845F1C-068C-F8F4-D31D-D3540D47C453}" = Adobe Download Assistant
"{E3E9B8FF-30C1-A86A-EAB9-EA7FC960E48D}" = CCC Help Czech
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{ED0059F3-C6F1-BDD4-692A-85A640644875}" = CCC Help Spanish
"{EFC04D3F-A152-47E7-8517-EE0F6201AFEF}" = Apple Mobile Device Support
"{F1191B7E-84BF-4325-9FFD-80BD8996ED4B}" = MorphVOX Junior
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F8B474DB-06E5-0325-5CA8-4FB5C9E8FE33}" = CCC Help Polish
"{FB2527DA-4D7B-CB3B-126E-10DAECBECD4F}" = Catalyst Control Center Localization Thai
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"avast" = avast! Free Antivirus
"Canon MP270 series User Registration" = Canon MP270 series User Registration
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"ConverterLite" = ConverterLite 1.0.1
"Cursor" = Microsoft Office 97 Animated Cursors
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"Free Studio_is1" = Free Studio version 5.2.1
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.26.706
"FreeFileViewer_is1" = Free File Viewer 2011
"ie8" = Windows Internet Explorer 8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.65.0.1400
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mozilla Firefox 8.0.1 (x86 en-US)" = Mozilla Firefox 8.0.1 (x86 en-US)
"MP Navigator EX 3.0" = Canon MP Navigator EX 3.0
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"PPTView97" = Microsoft PowerPoint Viewer 97
"QuickTime32" = QuickTime for Windows (32-bit)
"Uninstall_is1" = Uninstall 1.0.0.1
"Viewer97" = Microsoft Word Viewer 97
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinRAR archiver" = WinRAR 4.00 (32-bit)
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Word8.0" = Microsoft Word 97
"Works" = Microsoft Works 4.5
"Works Calendar" = Microsoft Works Calendar 1.0
"Works99Setup" = Microsoft Works Setup Launcher
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XLViewer97" = Microsoft Excel Viewer 97

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2368579109-3610495512-2017815006-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Ask Toolbar Updater
"Google Chrome" = Google Chrome
"NetAssistant" = Freeze.com NetAssistant

========== Last 20 Event Log Errors ==========

[ System Events ]
Error - 9/17/2012 6:02:29 PM | Computer Name = HPDC5750 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
Fips i8042prt Processor

Error - 9/17/2012 6:09:48 PM | Computer Name = HPDC5750 | Source = PlugPlayManager | ID = 11
Description = The device Root\LEGACY_87570506\0000 disappeared from the system without
first being prepared for removal.

Error - 9/17/2012 6:09:59 PM | Computer Name = HPDC5750 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 9/17/2012 6:11:45 PM | Computer Name = HPDC5750 | Source = WPDMTPDriver | ID = 80836
Description = MTP WPD Driver has failed to start. Error 0x80070005.

Error - 9/17/2012 6:12:14 PM | Computer Name = HPDC5750 | Source = Service Control Manager | ID = 7000
Description = The Print Spooler service failed to start due to the following error:
%%2

Error - 9/17/2012 6:12:14 PM | Computer Name = HPDC5750 | Source = Service Control Manager | ID = 7000
Description = The Google Update Service (gupdate) service failed to start due to
the following error: %%3

Error - 9/17/2012 6:12:14 PM | Computer Name = HPDC5750 | Source = Service Control Manager | ID = 7000
Description = The vToolbarUpdater11.2.0 service failed to start due to the following
error: %%2

Error - 9/17/2012 6:12:20 PM | Computer Name = HPDC5750 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
i8042prt

Error - 9/17/2012 6:31:46 PM | Computer Name = HPDC5750 | Source = Service Control Manager | ID = 7034
Description = The Ati HotKey Poller service terminated unexpectedly. It has done
this 1 time(s).

Error - 9/17/2012 6:31:47 PM | Computer Name = HPDC5750 | Source = Service Control Manager | ID = 7034
Description = The Application Layer Gateway Service service terminated unexpectedly.
It has done this 1 time(s).

< End of report >

Broni · Sep 17, 2012

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

Code:

:OTL
SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe -- (vToolbarUpdater11.2.0)
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKU\S-1-5-21-2368579109-3610495512-2017815006-1005\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files\AVG\AVG2012\avgdtiex.dll File not found
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-21-2368579109-3610495512-2017815006-1005\..\Toolbar\WebBrowser: (no name) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - No CLSID value found.
O3 - HKU\S-1-5-21-2368579109-3610495512-2017815006-1005\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~4\Office14\ONBttnIE.dll/105 File not found
O9 - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files\AVG\AVG2012\avgdtiex.dll File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_05-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
[2012/08/04 23:52:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ask
[2011/03/13 12:55:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2012/03/02 21:32:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Babylon
[2012/03/02 21:32:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fox Ellis\Application Data\Babylon
[2012/03/04 22:14:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Fox Ellis\Application Data\BabylonToolbar
[2012/03/28 15:51:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Guest\Application Data\AVG Secure Search
[2012/08/05 20:26:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Guest\Application Data\AVG2012
[2012/08/04 15:57:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lisa Narvaez\Application Data\AVG
[2012/08/04 15:10:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lisa Narvaez\Application Data\AVG Secure Search
[2012/08/04 15:11:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lisa Narvaez\Application Data\AVG2012
[2010/10/17 20:56:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Lisa Narvaez\Application Data\AVG9
[2012/09/17 17:08:00 | 000,000,242 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

:Services

:Reg

:Files
C:\Program Files\Ask.com

:Commands
[purity]
[emptytemp]
[emptyjava]
[emptyflash]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
You will get a log that shows the results of the fix. Please post it.

NOTE. If for any reason OTL stalls (most likely at "killing processes..." step) run the fix from safe mode.

===================================

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe
Follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

Make sure the following options are checked:
- Internet Services
- Windows Firewall
- System Restore
- Security Center
- Windows Update
- Windows Defender
Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.

3. Please download AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on adwcleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the contents of that logfile with your next reply.
You can find the logfile at C:\AdwCleaner[S1].txt as well.

Next...

Double click on adwcleaner.exe to run the tool.
Click on Uninstall.
Confirm with yes.

4. Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe

Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

5. Please run a free online scan with the ESET Online Scanner

Disable your antivirus program
Tick the box next to YES, I accept the Terms of Use
Click Start
Accept any security warnings from your browser.
Check Scan archives
Click Start
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, click on List of found threats
Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
NOTE. If Eset won't find any threats, it won't produce any log.

Foxiffer · Sep 18, 2012

Here is OTL log.

All processes killed
========== OTL ==========
Service vToolbarUpdater11.2.0 stopped successfully!
Service vToolbarUpdater11.2.0 deleted successfully!
File C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe not found.
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\URLSearchHooks\\{A3BC75A2-1F87-4686-AA43-5347D756017C} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3BC75A2-1F87-4686-AA43-5347D756017C}\ not found.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\URLSearchHooks\\{A3BC75A2-1F87-4686-AA43-5347D756017C} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3BC75A2-1F87-4686-AA43-5347D756017C}\ not found.
Registry value HKEY_USERS\S-1-5-21-2368579109-3610495512-2017815006-1005\Software\Microsoft\Internet Explorer\URLSearchHooks\\{00000000-6E41-4FD3-8538-502F5495E5FC} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}\ deleted successfully.
C:\Program Files\Ask.com\GenericAskToolbar.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31332EEF-CB9F-458F-AFEB-D30E9A66B6BA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31332EEF-CB9F-458F-AFEB-D30E9A66B6BA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_USERS\S-1-5-21-2368579109-3610495512-2017815006-1005\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{759D9886-0C6F-4498-BAB6-4A5F47C6C72F}\ not found.
Registry value HKEY_USERS\S-1-5-21-2368579109-3610495512-2017815006-1005\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ApnUpdater deleted successfully.
C:\Program Files\Ask.com\Updater\Updater.exe moved successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{68BCFFE1-A2DA-4B40-9068-87ECBFC19D16}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{68BCFFE1-A2DA-4B40-9068-87ECBFC19D16}\ deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\WINDOWS\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
C:\Documents and Settings\All Users\Application Data\Ask\APN-Stub folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Ask folder moved successfully.
C:\Documents and Settings\All Users\Application Data\avg9\update\prepare\temp folder moved successfully.
C:\Documents and Settings\All Users\Application Data\avg9\update\prepare folder moved successfully.
C:\Documents and Settings\All Users\Application Data\avg9\update\backup folder moved successfully.
C:\Documents and Settings\All Users\Application Data\avg9\update folder moved successfully.
C:\Documents and Settings\All Users\Application Data\avg9\Temp folder moved successfully.
C:\Documents and Settings\All Users\Application Data\avg9\scanlogs folder moved successfully.
C:\Documents and Settings\All Users\Application Data\avg9\Log\IDP\log folder moved successfully.
C:\Documents and Settings\All Users\Application Data\avg9\Log\IDP folder moved successfully.
C:\Documents and Settings\All Users\Application Data\avg9\Log folder moved successfully.
C:\Documents and Settings\All Users\Application Data\avg9\emc\Queue\TEMP folder moved successfully.
C:\Documents and Settings\All Users\Application Data\avg9\emc\Queue\OUT folder moved successfully.
C:\Documents and Settings\All Users\Application Data\avg9\emc\Queue\ACTIVE folder moved successfully.
C:\Documents and Settings\All Users\Application Data\avg9\emc\Queue folder moved successfully.
C:\Documents and Settings\All Users\Application Data\avg9\emc\Log folder moved successfully.
C:\Documents and Settings\All Users\Application Data\avg9\emc folder moved successfully.
C:\Documents and Settings\All Users\Application Data\avg9\Dumps folder moved successfully.
C:\Documents and Settings\All Users\Application Data\avg9\CfgAll folder moved successfully.
C:\Documents and Settings\All Users\Application Data\avg9\Cfg folder moved successfully.
C:\Documents and Settings\All Users\Application Data\avg9\AvgApi folder moved successfully.
C:\Documents and Settings\All Users\Application Data\avg9\AvgAm folder moved successfully.
C:\Documents and Settings\All Users\Application Data\avg9\admincli folder moved successfully.
C:\Documents and Settings\All Users\Application Data\avg9 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Babylon folder moved successfully.
C:\Documents and Settings\Fox Ellis\Application Data\Babylon folder moved successfully.
C:\Documents and Settings\Fox Ellis\Application Data\BabylonToolbar\BabylonToolbar folder moved successfully.
C:\Documents and Settings\Guest\Application Data\AVG Secure Search\cache\tmp folder moved successfully.
C:\Documents and Settings\Guest\Application Data\AVG Secure Search\cache folder moved successfully.
C:\Documents and Settings\Guest\Application Data\AVG Secure Search folder moved successfully.
C:\Documents and Settings\Guest\Application Data\AVG2012\cfgall folder moved successfully.
C:\Documents and Settings\Guest\Application Data\AVG2012 folder moved successfully.
C:\Documents and Settings\Lisa Narvaez\Application Data\AVG\Rescue\PC Tuneup 2011 folder moved successfully.
C:\Documents and Settings\Lisa Narvaez\Application Data\AVG\Rescue folder moved successfully.
C:\Documents and Settings\Lisa Narvaez\Application Data\AVG\PC Tuneup\User Reports folder moved successfully.
C:\Documents and Settings\Lisa Narvaez\Application Data\AVG\PC Tuneup\Logs folder moved successfully.
C:\Documents and Settings\Lisa Narvaez\Application Data\AVG\PC Tuneup folder moved successfully.
C:\Documents and Settings\Lisa Narvaez\Application Data\AVG folder moved successfully.
C:\Documents and Settings\Lisa Narvaez\Application Data\AVG Secure Search\cache\tmp folder moved successfully.
C:\Documents and Settings\Lisa Narvaez\Application Data\AVG Secure Search\cache folder moved successfully.
C:\Documents and Settings\Lisa Narvaez\Application Data\AVG Secure Search folder moved successfully.
C:\Documents and Settings\Lisa Narvaez\Application Data\AVG2012\cfgall folder moved successfully.
C:\Documents and Settings\Lisa Narvaez\Application Data\AVG2012 folder moved successfully.
C:\Documents and Settings\Lisa Narvaez\Application Data\AVG9\cfgall folder moved successfully.
C:\Documents and Settings\Lisa Narvaez\Application Data\AVG9 folder moved successfully.
C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job moved successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Program Files\Ask.com\Updater folder moved successfully.
C:\Program Files\Ask.com\assets\oobe folder moved successfully.
C:\Program Files\Ask.com\assets folder moved successfully.
C:\Program Files\Ask.com folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

User: All Users

User: Default User
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56466 bytes

User: Fox Ellis
->Temp folder emptied: 116104 bytes
->Temporary Internet Files folder emptied: 21137559 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 97763307 bytes
->Apple Safari cache emptied: 49152 bytes
->Flash cache emptied: 3187321 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 294871 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 6944632 bytes
->Flash cache emptied: 66812 bytes

User: Lisa Narvaez
->Temp folder emptied: 39668751 bytes
->Temporary Internet Files folder emptied: 15155605 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 61126904 bytes
->Apple Safari cache emptied: 43008 bytes
->Flash cache emptied: 506 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 27159 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 72007 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 483 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 235.00 mb

[EMPTYJAVA]

User: Administrator

User: All Users

User: Default User

User: Fox Ellis
->Java cache emptied: 0 bytes

User: Guest
->Java cache emptied: 0 bytes

User: Lisa Narvaez
->Java cache emptied: 0 bytes

User: LocalService

User: NetworkService

Total Java Files Cleaned = 0.00 mb

[EMPTYFLASH]

User: Administrator

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: Fox Ellis
->Flash cache emptied: 0 bytes

User: Guest
->Flash cache emptied: 0 bytes

User: Lisa Narvaez
->Flash cache emptied: 0 bytes

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.56.0 log created on 09182012_092612
Files\Folders moved on Reboot...
PendingFileRenameOperations files...
Registry entries deleted on Reboot...

Foxiffer · Sep 18, 2012

Here is the checkup log.

Results of screen317's Security Check version 0.99.51
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Disabled!
avast! Antivirus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.65.0.1400
JavaFX 2.1.1
Java(TM) 6 Update 15
Java(TM) 6 Update 24
Java(TM) 7 Update 4
Java 7 Update 7
Adobe Flash Player 11.3.300.271
Adobe Reader X (10.1.4)
Mozilla Firefox (8.0.1)
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
Fox Ellis Desktop Malwarebytes' Anti-Malware mbamscheduler.exe
AVAST Software Avast AvastSvc.exe
AVAST Software Avast avastUI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:: 34% Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````

Foxiffer · Sep 18, 2012

Here's FSS log.

Farbar Service Scanner Version: 06-08-2012
Ran by Fox Ellis (administrator) on 18-09-2012 at 09:43:23
Running from "C:\Documents and Settings\Fox Ellis\Desktop"
Microsoft Windows XP Professional Service Pack 3 (X86)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Dnscache Service is not running. Checking service configuration:
The start type of Dnscache service is set to Disabled. The default start type is Auto.
The ImagePath of Dnscache service is OK.
The ServiceDll of Dnscache service is OK.

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============
Firewall Disabled Policy:
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0

System Restore:
============
System Restore Disabled Policy:
========================

Security Center:
============
Windows Update:
============
Windows Autoupdate Disabled Policy:
============================

File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit
C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit
C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit
C:\WINDOWS\system32\ipnathlp.dll => MD5 is legit
C:\WINDOWS\system32\netman.dll => MD5 is legit
C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
C:\WINDOWS\system32\srsvc.dll => MD5 is legit
C:\WINDOWS\system32\Drivers\sr.sys => MD5 is legit
C:\WINDOWS\system32\wscsvc.dll => MD5 is legit
C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit
C:\WINDOWS\system32\wuauserv.dll => MD5 is legit
C:\WINDOWS\system32\qmgr.dll => MD5 is legit
C:\WINDOWS\system32\es.dll => MD5 is legit
C:\WINDOWS\system32\cryptsvc.dll => MD5 is legit
C:\WINDOWS\system32\svchost.exe => MD5 is legit
C:\WINDOWS\system32\rpcss.dll => MD5 is legit
C:\WINDOWS\system32\services.exe => MD5 is legit
Extra List:
=======
aswTdi(12) Gpc(6) IPSec(4) NetBT(5) PSched(7) Tcpip(3)
0x0D000000040000000100000002000000030000000C0000000800000056000000090000000A0000000B000000050000000600000007000000
IpSec Tag value is correct.
**** End of log ****

Foxiffer · Sep 18, 2012

Here is the adwcleaner log.

# AdwCleaner v2.002 - Logfile created 09/18/2012 at 09:46:31
# Updated 16/09/2012 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : Fox Ellis - HPDC5750
# Boot Mode : Normal
# Running from : C:\Documents and Settings\Fox Ellis\Desktop\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****
File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml
File Deleted : C:\user.js
Folder Deleted : C:\Documents and Settings\Fox Ellis\Application Data\BabylonToolbar
Folder Deleted : C:\Documents and Settings\Fox Ellis\Local Settings\Application Data\AskToolbar
Folder Deleted : C:\Documents and Settings\Fox Ellis\Local Settings\Application Data\AVG Secure Search
Folder Deleted : C:\Documents and Settings\Fox Ellis\Local Settings\Application Data\Babylon
Folder Deleted : C:\Documents and Settings\Fox Ellis\Local Settings\Application Data\Conduit
Folder Deleted : C:\Documents and Settings\Fox Ellis\Local Settings\Application Data\ConduitEngine
Folder Deleted : C:\Documents and Settings\Fox Ellis\Local Settings\Application Data\DVDVideoSoftTB
Folder Deleted : C:\Documents and Settings\Lisa Narvaez\Application Data\PriceGong
Folder Deleted : C:\Documents and Settings\Lisa Narvaez\Local Settings\Application Data\AskToolbar
Folder Deleted : C:\Documents and Settings\Lisa Narvaez\Local Settings\Application Data\AVG Secure Search
Folder Deleted : C:\Documents and Settings\Lisa Narvaez\Local Settings\Application Data\Conduit
Folder Deleted : C:\Documents and Settings\Lisa Narvaez\Local Settings\Application Data\ConduitEngine
Folder Deleted : C:\Documents and Settings\Lisa Narvaez\Local Settings\Application Data\DVDVideoSoftTB
Folder Deleted : C:\Documents and Settings\Lisa Narvaez\Local Settings\Application Data\Ilivid Player
Folder Deleted : C:\Program Files\Conduit
Folder Deleted : C:\Program Files\ConduitEngine
Folder Deleted : C:\Program Files\DVDVideoSoftTB
Folder Deleted : C:\WINDOWS\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
***** [Registry] *****
Key Deleted : HKCU\Software\APN
Key Deleted : HKCU\Software\Ask.com
Key Deleted : HKCU\Software\AskToolbar
Key Deleted : HKCU\Software\BabylonToolbar
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\conduitEngine
Key Deleted : HKCU\Software\DVDVideoSoftTB
Key Deleted : HKCU\Software\FCSB000062035
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKCU\Toolbar
Key Deleted : HKLM\Software\APN
Key Deleted : HKLM\Software\AskToolbar
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2312170F-8CEC-4AA6-B7DF-BA9242FD8747}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Deleted : HKLM\SOFTWARE\Classes\Conduit.Engine
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{07B18EAC-A523-4961-B6BB-170DE4475CCA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{120927BF-1700-43BC-810F-FAB92549B390}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1F52A5FA-A705-4415-B975-88503B291728}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{247A115F-06C2-4FB3-967D-2D62D3CF4F0A}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3E53E2CB-86DB-4A4A-8BD9-FFEB7A64DF82}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3E720453-B472-4954-B7AA-33069EB53906}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{63D0ED2D-B45B-4458-8B3B-60C69BBBD83C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8E9CF769-3D3B-40EB-9E2D-76E7A205E4D2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{90449521-D834-4703-BB4E-D3AA44042FF8}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{991AAC62-B100-47CE-8B75-253965244F69}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A626CDBD-3D13-4F78-B819-440A28D7E8FC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BBABDC90-F3D5-4801-863A-EE6AE529862D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D6FF3684-AD3B-48EB-BBB4-B9E6C5A355C1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DE38C398-B328-4F4C-A3AD-1B5E4ED93477}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E79DFBC9-5697-4FBD-94E5-5B2A9C7C1612}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E79DFBCB-5697-4FBD-94E5-5B2A9C7C1612}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EB9E5C1C-B1F9-4C2B-BE8A-27D6446FDAF8}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F87D7FB5-9DC5-4C8C-B998-D8DFE02E2978}
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2269050
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\conduitEngine
Key Deleted : HKLM\Software\DVDVideoSoftTB
Key Deleted : HKLM\Software\Freeze.com
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{23A49419-0F39-4BF0-9E64-B7D1AFF321C8}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CCEDC84F-4E1B-4835-B61C-4B3AE7E7BDD0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DVDVideoSoftTB Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\mywebsearch bar uninstall
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2312170F-8CEC-4AA6-B7DF-BA9242FD8747}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DVDVideoSoftTB Toolbar
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [m3ffxtbr@mywebsearch.com]
***** [Internet Browsers] *****
-\\ Internet Explorer v8.0.6001.18702
Restored : [HKCU\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Restored : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Restored : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Restored : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Restored : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://isearch.avg.com/tab?cid={C20928B9-2845-4528-9D60-2EFFC417C43B}&mid=e1410c27fc1ca98200005e10ad337918-96be17212521bdba4ceda714a3a7f0ba1d807070&lang=en&ds=AVG&pr=pr&d=2012-08-04 15:10:47&v=11.1.0.12&sap=nt --> hxxp://www.google.com
-\\ Google Chrome v21.0.1180.89
File : C:\Documents and Settings\Lisa Narvaez\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences
[OK] File is clean.
File : C:\Documents and Settings\Fox Ellis\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences
[OK] File is clean.
*************************
AdwCleaner[S1].txt - [11942 octets] - [18/09/2012 09:46:31]
########## EOF - C:\AdwCleaner[S1].txt - [12003 octets] ##########

Foxiffer · Sep 18, 2012

TFC log.

Getting user folders.

Stopping running processes.

Emptying Temp folders.

User: Administrator

User: All Users

User: Default User
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Fox Ellis
->Temp folder emptied: 590574 bytes
->Temporary Internet Files folder emptied: 1262857 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 506 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Lisa Narvaez
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 483 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes

Emptying RecycleBin. Do not interrupt.

RecycleBin emptied: 0 bytes
Process complete!

Total Files Cleaned = 2.00 mb

Foxiffer · Sep 18, 2012

ESETScan log.

C:\Documents and Settings\Lisa Narvaez\My Documents\Downloads\iLividSetupV1.exe Win32/Toolbar.SearchSuite application cleaned by deleting - quarantined
C:\Documents and Settings\Lisa Narvaez\My Documents\Downloads\Setup_FreeBurner.exe Win32/Toolbar.SearchSuite application cleaned by deleting - quarantined
C:\TDSSKiller_Quarantine\14.09.2012_20.18.04\mbr0000\tdlfs0000\tsk0001.dta a variant of Win32/Olmarik.AYI trojan cleaned by deleting - quarantined
C:\TDSSKiller_Quarantine\14.09.2012_20.18.04\mbr0000\tdlfs0000\tsk0002.dta Win64/Olmarik.AK trojan cleaned by deleting - quarantined
C:\TDSSKiller_Quarantine\14.09.2012_20.18.04\mbr0000\tdlfs0000\tsk0003.dta Win32/Olmarik.AYH trojan cleaned by deleting - quarantined
C:\TDSSKiller_Quarantine\14.09.2012_20.18.04\mbr0000\tdlfs0000\tsk0004.dta Win64/Olmarik.AL trojan cleaned by deleting - quarantined
C:\TDSSKiller_Quarantine\14.09.2012_20.18.04\mbr0000\tdlfs0000\tsk0005.dta a variant of Win32/Rootkit.Kryptik.LA trojan cleaned by deleting - quarantined
C:\TDSSKiller_Quarantine\14.09.2012_20.18.04\mbr0000\tdlfs0000\tsk0006.dta Win64/Olmarik.AK trojan cleaned by deleting - quarantined
C:\TDSSKiller_Quarantine\14.09.2012_20.18.04\mbr0000\tdlfs0000\tsk0010.dta Win32/Olmarik.AFK trojan cleaned by deleting - quarantined
C:\TDSSKiller_Quarantine\14.09.2012_20.18.04\mbr0000\tdlfs0000\tsk0011.dta Win64/Olmarik.AK trojan cleaned by deleting - quarantined
C:\TDSSKiller_Quarantine\14.09.2012_20.18.04\mbr0000\tdlfs0000\tsk0014.dta a variant of Win32/Olmarik.AYI trojan cleaned by deleting - quarantined
C:\_OTL\MovedFiles\09182012_092612\C_Documents and Settings\Lisa Narvaez\Application Data\AVG\Rescue\PC Tuneup 2011\120804155735828.rsc multiple threats deleted - quarantined
D:\FOX\setup-converterlite-ic-1.0.0.exe a variant of Win32/InstallCore.N application deleted - quarantined
D:\FOX\minecraft mods\iLividSetupV1.exe Win32/Toolbar.SearchSuite application cleaned by deleting - quarantined
D:\OLD FILES ON D\Virus Progress\rmdndup Virus removal worm_Downadup.exe probably unknown NewHeur_PE virus deleted - quarantined
D:\System Volume Information\_restore{FA16FBFE-BF24-4ADB-B711-5A54962EAAC3}\RP663\A0144932.exe a variant of Win32/InstallCore.N application deleted - quarantined
D:\System Volume Information\_restore{FA16FBFE-BF24-4ADB-B711-5A54962EAAC3}\RP663\A0144933.exe Win32/Toolbar.SearchSuite application cleaned by deleting - quarantined
D:\System Volume Information\_restore{FA16FBFE-BF24-4ADB-B711-5A54962EAAC3}\RP663\A0144934.exe probably unknown NewHeur_PE virus deleted - quarantined

Broni · Sep 18, 2012

Uninstall:
Java(TM) 6 Update 15
Java(TM) 6 Update 24
Java(TM) 7 Update 4

===================================

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following:

Code:

:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[emptyjava]
[CLEARALLRESTOREPOINTS]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current.

4. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC) weekly.

8. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. (Windows XP only) Run defrag at your convenience.

11. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

12. Read:
How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/

13. Please, let me know, how your computer is doing.

Foxiffer · Sep 18, 2012

How do I delete all the javas so I can install new only.

Broni · Sep 18, 2012

Add\Remove.

You have the latest one installed but there are some older versions present.

Solved Problem with AVG not removing unknown rootkit

Posts: 39 +0

Posts: 56,041 +517

Posts: 39 +0

Posts: 56,041 +517

Posts: 39 +0

Posts: 39 +0

Posts: 39 +0

Posts: 39 +0

Posts: 56,041 +517

Posts: 39 +0

Posts: 39 +0

Posts: 56,041 +517

Posts: 39 +0

Posts: 39 +0

Posts: 39 +0

Posts: 56,041 +517

Posts: 39 +0

Posts: 39 +0

Posts: 39 +0

Posts: 39 +0

Posts: 39 +0

Posts: 39 +0

Posts: 56,041 +517

Posts: 39 +0

Posts: 56,041 +517

Similar threads