[rklamer]

Hey guys,

This computer is infected with Vundo, and I need some help removing it. I've tried all the usual programs to no avail (including Malwarebytes). Any help would be greatly appreciated. Thanks.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:20:48 PM, on 12/30/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\lxdecoms.exe
C:\WINDOWS\system32\LxrSII1s.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sparkpeople.com/websearch/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RTHDCPL] "C:\WINDOWS\RTHDCPL.EXE"
O4 - HKLM\..\Run: [NvCplDaemon] "C:\WINDOWS\system32\RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "C:\WINDOWS\system32\nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "C:\WINDOWS\system32\RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [LightScribe Control Panel] "C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" -hidden
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\The Print Shop 23\Remind.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.mi...b?1197245513500
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebo...oUploader55.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com...obat/nos/gp.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.ad...Plus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Application Layer Gateway Service (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: lxdeCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdeserv.exe
O23 - Service: lxde_device - - C:\WINDOWS\system32\lxdecoms.exe
O23 - Service: Lexar Secure II (LxrSII1s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrSII1s.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

--
End of file - 8412 bytes

[Advertisements]

(Woops, was trying to test email notification... guess it doesn't work with my own posts. Mods, please delete this message, but leave the topic, thanks.)

Edited by rklamer, 30 December 2009 - 08:34 PM.

[rklamer]

(Woops, was trying to test email notification... guess it doesn't work with my own posts. Mods, please delete this message, but leave the topic, thanks.)

Edited by rklamer, 30 December 2009 - 08:34 PM.

[azarl]

Hi

Welcome to Geekstogo. I'll be helping you with this problem.

• Please read all of my response through at least once before attempting to follow the procedures described. I would recommend printing them out, if you can, as you can check off each step as you complete it. If there's anything you don't understand or isn't totally clear, please come back to me for clarification.
  
  
• Please do not attach any log files to your replies unless I specifically ask you. Instead please copy and paste so as to include the log in your reply. You can do this in separate posts if it's easier for you

We no longer use HJT as it does not show enough information to deal with current infections.

Firstly, please follow all of the steps in this section of the Malware Forum, then please post the MBAM, GMER and OTL Logs in this thread.

[rklamer]

Hello,

I was unable to get a GMER log as GMER crashed halfway through on both attempts (the program was still running; however, when I tried to bring it up, nothing happened -- this was at least an hour after starting it both times). OTL also gave me trouble -- I tried running it with the steps provided twice, and both times it completely locked up my computer, forcing me to need to restart the entire box. Here's what MBAM had, though.

Malwarebytes' Anti-Malware 1.43
Database version: 3510
Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13

1/7/2010 2:37:03 PM
mbam-log-2010-01-07 (14-37-03).txt

Scan type: Quick Scan
Objects scanned: 135155
Time elapsed: 4 minute(s), 38 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BITS\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemRoot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\wuauserv\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemroot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[azarl]

ComboFix
Download ComboFix from one of these locations:

Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
• Double click on ComboFix.exe & follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

[rklamer]

ComboFix 10-01-11.01 - tammy 01/11/2010 14:35:26.8.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1021.626 [GMT -7:00]
Running from: c:\documents and settings\tammy\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\WinPCap
c:\program files\WinPCap\daemon_mgm.exe
c:\program files\WinPCap\INSTALL.LOG
c:\program files\WinPCap\NetMonInstaller.exe
c:\program files\WinPCap\npf_mgm.exe
c:\program files\WinPCap\rpcapd.exe
c:\program files\WinPCap\Uninstall.exe
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\EventSystem.log
c:\windows\system32\inf
c:\windows\system32\twain_32.dll

.
((((((((((((((((((((((((( Files Created from 2009-12-11 to 2010-01-11 )))))))))))))))))))))))))))))))
.

2010-01-07 22:35 . 2010-01-07 22:35 -------- d--h--w- c:\windows\PIF
2010-01-07 21:27 . 2010-01-07 21:27 5061520 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-01-07 21:19 . 2010-01-07 21:19 -------- d-----w- c:\program files\ERUNT
2009-12-14 19:15 . 2009-12-14 19:15 2146304 ----a-w- c:\windows\system32\GPhotos.scr

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-11 02:43 . 2008-02-10 03:31 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-07 21:27 . 2008-10-25 20:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-30 21:55 . 2008-10-25 20:45 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-30 21:54 . 2008-10-25 20:45 19160 -c--a-w- c:\windows\system32\drivers\mbam.sys
2009-12-18 04:44 . 2008-08-02 20:25 -------- d-----w- c:\documents and settings\All Users\Application Data\LxThumbs
2009-11-28 04:02 . 2007-12-12 05:05 -------- d-----w- c:\program files\Google
2007-12-12 17:38 . 2007-12-12 17:38 23405072 -c--a-w- c:\program files\AdbeRdr811_en_US.exe
2007-03-17 06:00 . 2008-03-13 21:53 35979 ----a-w- c:\program files\Photoshop CS3 Read Me.html
2009-03-01 09:24 . 2009-02-26 19:46 11649056 -csha-w- c:\windows\system32\drivers\fidbox.dat
.

------- Sigcheck -------

[-] 2009-02-14 . EC1C2A4BF53C35C83F83EC929278C661 . 984576 . . [5.1.2600.3119] . . c:\windows\system32\kernel32.dll
[-] 2008-04-14 . C24B983D211C34DA8FCC1AC38477971D . 989696 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\kernel32.dll
[7] 2007-04-16 . 09F7CB3687F86EDAA4CA081F7AB66C03 . 986112 . . [5.1.2600.3119] . . c:\windows\$hf_mig$\KB935839\SP2QFE\kernel32.dll
[7] 2007-04-16 . A01F9CA902A88F7CED06884174D6419D . 984576 . . [5.1.2600.3119] . . c:\windows\system32\dllcache\kernel32.dll
[7] 2004-08-04 . 888190E31455FAD793312F8D087146EB . 983552 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB935839$\kernel32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-10-23 2363392]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-08 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 2178832]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 563984]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-01 282624]
"RTHDCPL"="c:\windows\RTHDCPL.EXE" [2008-05-14 16862720]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-04 8523776]
"nwiz"="c:\windows\system32\nwiz.exe" [2007-12-04 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-04 81920]

c:\documents and settings\Gaming\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Event Reminder.lnk - c:\program files\The Print Shop 23\Remind.exe [2008-7-16 344064]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^tammy^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\tammy\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^tammy^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\tammy\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-11 03:51 39792 -c--a-w- c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-02-19 18:10 267048 -c--a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
2007-10-25 21:33 563984 ----a-w- c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2007-10-25 21:37 2178832 ----a-w- c:\program files\Logitech\QuickCam\Quickcam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2006-09-01 23:57 282624 ----a-w- c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2006-07-21 23:14 86016 -c----r- c:\windows\SoundMan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-10-08 23:13 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2008-06-09 08:36 185632 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USRobotics USB Internet Mini Phone]
2007-02-15 18:31 338944 -c--a-w- c:\program files\U.S. Robotics\USB Internet Mini Phone\USRobotics USB Internet Mini Phone.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USRobotics USB Internet Mini Phone Control Panel]
2007-02-15 18:29 2123264 -c--a-w- c:\program files\U.S. Robotics\USB Internet Mini Phone\USB Internet Mini Phone UI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
2007-08-30 23:43 4670704 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"FLEXnet Licensing Service"=3 (0x3)
"iPod Service"=3 (0x3)
"gusvc"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"aawservice"=2 (0x2)
"Symantec AntiVirus"=2 (0x2)
"StkASSrv"=2 (0x2)
"SPBBCSvc"=2 (0x2)
"DefWatch"=2 (0x2)
"ccSetMgr"=2 (0x2)
"ccEvtMgr"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\lxdecoms.exe"=
"c:\\Program Files\\Lexmark 4800 Series\\frun.exe"=
"c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\Scan\\ScanMan6.exe"=
"c:\\Program Files\\Lexmark Fax Solutions\\FaxCtr.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdepswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdetime.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdejswx.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Lexmark 4800 Series\\Wireless\\lxdewpss.exe"=
"c:\\WINDOWS\\system32\\lxdecfg.exe"=
"c:\\Program Files\\Logitech\\QuickCam\\Quickcam.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Lexmark 4800 Series\\lxdemon.exe"=

R0 ahcix86;ahcix86;c:\windows\system32\drivers\ahcix86.sys [10/3/2008 3:28 PM 176136]
R2 lxde_device;lxde_device;c:\windows\system32\lxdecoms.exe -service --> c:\windows\system32\lxdecoms.exe -service [?]
R2 LxrSII1d;Secure II Driver;c:\windows\system32\drivers\LxrSII1d.sys [4/5/2008 11:35 PM 70016]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [12/9/2007 6:29 PM 717296]
S1 de436477;de436477;c:\windows\system32\drivers\de436477.sys [2/13/2009 12:31 PM 0]
S2 lxdeCATSCustConnectService;lxdeCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdeserv.exe [12/12/2007 2:42 PM 99248]
S3 PsSdk30;PsSdk30;\??\c:\windows\system32\Drivers\PsSdk30.drv --> c:\windows\system32\Drivers\PsSdk30.drv [?]
S3 xbreader;MaxDrive XBox Driver (xbreader.sys);c:\windows\system32\drivers\xbreader.sys [1/2/2001 9:53 PM 19677]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-10-23 02:55 451872 -c--a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-01-11 c:\windows\Tasks\User_Feed_Synchronization-{59B3E264-20D2-4BFE-864F-F7C4E1F84BFC}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 02:36]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.sparkpeople.com/websearch/
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\tammy\Application Data\Mozilla\Firefox\Profiles\p04rj5jz.Default User\
FF - prefs.js: browser.startup.homepage - hxxp://www.sparkpeople.com/
FF - plugin: c:\documents and settings\tammy\Application Data\Mozilla\Firefox\Profiles\p04rj5jz.Default User\extensions\[email protected]\platform\WINNT_x86-msvc\plugins\npmnqmp071303000004.dll
FF - plugin: c:\documents and settings\tammy\Local Settings\Application Data\Yahoo!\BrowserPlus\2.4.21\Plugins\npybrowserplus_2.4.21.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npampx3.0.84.2.dll
FF - HiddenExtension: XUL Cache: {DB1C0118-51D0-472E-B776-5A9BC86F3A1E} - c:\documents and settings\tammy\Local Settings\Application Data\{DB1C0118-51D0-472E-B776-5A9BC86F3A1E}
FF - HiddenExtension: XUL Cache: {9DAA848C-30E0-405D-823D-CC2F6A047443} - c:\documents and settings\Gaming\Local Settings\Application Data\{9DAA848C-30E0-405D-823D-CC2F6A047443}
.
- - - - ORPHANS REMOVED - - - -

AddRemove-WinPcapInst - c:\program files\WinPcap\Uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-11 14:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PsSdk30]
"ImagePath"="\??\c:\windows\system32\Drivers\PsSdk30.drv"
.
Completion time: 2010-01-11 14:44:01
ComboFix-quarantined-files.txt 2010-01-11 21:43
ComboFix2.txt 2009-02-19 06:40
ComboFix3.txt 2009-02-16 02:09
ComboFix4.txt 2008-12-28 21:52
ComboFix5.txt 2010-01-11 21:34

Pre-Run: 4,898,926,592 bytes free
Post-Run: 4,873,527,296 bytes free

- - End Of File - - 724A92E32D4B33D182EC5D1B42A77609

[azarl]

Hi rklamer

Looks like you have a rootkit here

• Click Start > Run and enter notepad.exe. Copy and paste ALL of the text below in the quote box to notepad.
  

  @ECHO OFF
  echo userprofile > log.txt
  Copy c:\windows\$hf_mig$\KB935839\SP2QFE\kernel32.dll C:\kernel32.dll >> log.txt
  start log.txt
  DEL %0

• Go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES
• Then in the File name box type RunMe.bat and save to your desktop.
• Double-click on RunMe.bat to run it; you may see a black box appear, this is normal
• A text file should open in notepad - copy/paste the contents here

[rklamer]

Hello,

I probably need to clarify something here -- I created this topic originally because MBAM detected Vundo, and knowing how difficult it is to get rid of Vundo I went ahead and made a topic. Now MBAM scans show no signs of Vundo, but my computer is still running incredibly slowly -- but only on the internet side of things. The computer is fine until I open an Internet browser -- the browser opens slowly, runs slowly, and transfers/downloads go at about 15Kb/s (compared to 150-200Kb/s on other computers connected to this same network), regardless of what browser (Chrome, Internet Explorer, Firefox)... and I can hear little "windows link clicks" like a new page is opening up every few minutes or so, but there's nothing onscreen. I kind of just assumed I still had Vundo... sorry about that.

Anyway, here's all that that said:

"userprofile
1 file(s) copied."

Thanks!

[azarl]

Hi

Unfortunately Vundo now has a habit of coming with other surprises. In this case it looks like the Kernel32 (system) file is borked. We'll replace it tomorrow and see how it goes

[azarl]

ComboFix Script

• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
• Open notepad and copy/paste the text in the quotebox below into it:

FCopy::
C:\kernel32.dll | c:\windows\system32\kernel32.dll

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it will produce a log for you at C:\ComboFix.txt which I need you to include in your next reply.

[rklamer]

Here's the log.

A few more symptoms I think you should know about...

1. My computer keeps changing the default Internet browser to something other than Firefox (I'm going to assume it's IE). I have to re-change it every time I start up Firefox, so I'm guessing it switches back every time I click "yes" to the prompt Firefox gives me.

2. Java applets on various websites are not working anymore. This happened directly after initially running ComboFix.

3. A very important business application that is on this computer, called "The Print Shop 23", does not work anymore. Upon clicking the shortcut on the Desktop/shotcut in the Start Menu, I get a Windows Installer prompt asking me to put in the installation CD. This happened directly after running ComboFix. It's incredibly important that this gets fixed ASAP as there is a time-based project that needs to be finished on it. Any help would be great.

Here's the log:

ComboFix 10-01-14.02 - tammy 01/14/2010 16:07:12.9.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1021.577 [GMT -7:00]
Running from: c:\documents and settings\tammy\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\tammy\Desktop\CFScript.txt
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Gaming\Local Settings\Application Data\{9DAA848C-30E0-405D-823D-CC2F6A047443}
c:\documents and settings\Gaming\Local Settings\Application Data\{9DAA848C-30E0-405D-823D-CC2F6A047443}\chrome.manifest
c:\documents and settings\Gaming\Local Settings\Application Data\{9DAA848C-30E0-405D-823D-CC2F6A047443}\chrome\content\_cfg.js
c:\documents and settings\Gaming\Local Settings\Application Data\{9DAA848C-30E0-405D-823D-CC2F6A047443}\chrome\content\c.js
c:\documents and settings\Gaming\Local Settings\Application Data\{9DAA848C-30E0-405D-823D-CC2F6A047443}\chrome\content\overlay.xul
c:\documents and settings\Gaming\Local Settings\Application Data\{9DAA848C-30E0-405D-823D-CC2F6A047443}\install.rdf

.
--------------- FCopy ---------------

c:\kernel32.dll --> c:\windows\system32\kernel32.dll
.
((((((((((((((((((((((((( Files Created from 2009-12-14 to 2010-01-14 )))))))))))))))))))))))))))))))
.

2010-01-14 05:21 . 2010-01-14 05:21 -------- d-----w- c:\windows\system32\KB905474
2010-01-14 05:21 . 2009-03-11 05:26 1403264 ----a-w- c:\windows\system32\KB905474\wganotifypackageinner.exe
2010-01-14 05:21 . 2009-03-11 05:18 453512 ----a-w- c:\windows\system32\KB905474\wgasetup.exe
2010-01-13 04:49 . 2010-01-13 04:49 -------- d-----w- c:\windows\ServicePackFiles
2010-01-11 22:18 . 2007-04-16 16:07 986112 ------w- C:\kernel32.dll
2010-01-07 22:35 . 2010-01-07 22:35 -------- d--h--w- c:\windows\PIF
2010-01-07 21:27 . 2010-01-07 21:27 5061520 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-01-07 21:19 . 2010-01-07 21:19 -------- d-----w- c:\program files\ERUNT

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-13 08:57 . 2008-11-14 22:09 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-13 05:05 . 2007-12-10 01:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-11 02:43 . 2008-02-10 03:31 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-07 21:27 . 2008-10-25 20:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-30 21:55 . 2008-10-25 20:45 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-30 21:54 . 2008-10-25 20:45 19160 -c--a-w- c:\windows\system32\drivers\mbam.sys
2009-12-18 04:44 . 2008-08-02 20:25 -------- d-----w- c:\documents and settings\All Users\Application Data\LxThumbs
2009-12-14 19:15 . 2009-12-14 19:15 2146304 ----a-w- c:\windows\system32\GPhotos.scr
2009-11-28 04:02 . 2007-12-12 05:05 -------- d-----w- c:\program files\Google
2009-11-21 16:36 . 2004-08-04 05:56 470528 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-10-29 07:46 . 2004-08-04 05:56 832512 ----a-w- c:\windows\system32\wininet.dll
2009-10-29 07:46 . 2004-08-04 05:56 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:46 . 2004-08-04 05:56 17408 ------w- c:\windows\system32\corpol.dll
2009-10-21 06:00 . 2004-08-04 05:56 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 06:00 . 2004-08-04 05:56 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 14:58 . 2004-08-04 04:00 263552 ----a-w- c:\windows\system32\drivers\http.sys
2007-12-12 17:38 . 2007-12-12 17:38 23405072 -c--a-w- c:\program files\AdbeRdr811_en_US.exe
2007-03-17 06:00 . 2008-03-13 21:53 35979 ----a-w- c:\program files\Photoshop CS3 Read Me.html
2009-03-01 09:24 . 2009-02-26 19:46 11649056 -csha-w- c:\windows\system32\drivers\fidbox.dat
.

((((((((((((((((((((((((((((( SnapShot@2010-01-11_21.41.47 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-12 02:41 . 2009-07-12 02:41 97280 c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd\ATL80.dll
+ 2007-07-31 03:19 . 2009-08-07 02:24 44768 c:\windows\system32\wups2.dll
+ 2007-12-10 00:30 . 2009-08-07 02:24 35552 c:\windows\system32\wups.dll
+ 2007-12-10 00:30 . 2009-08-07 02:24 53472 c:\windows\system32\wuauclt.exe
+ 2004-08-04 05:56 . 2009-06-25 08:44 59392 c:\windows\system32\wdigest.dll
+ 2007-07-18 12:42 . 2009-10-28 15:07 46080 c:\windows\system32\tzchange.exe
+ 2004-08-04 05:56 . 2009-06-12 11:50 80896 c:\windows\system32\tlntsess.exe
+ 2004-08-04 05:56 . 2009-06-12 11:50 76288 c:\windows\system32\telnet.exe
+ 2007-12-10 00:13 . 2008-07-09 07:38 26488 c:\windows\system32\spupdsvc.exe
+ 2008-01-01 06:29 . 2009-05-26 11:40 17272 c:\windows\system32\spmsg.dll
- 2008-01-01 06:29 . 2007-11-30 12:39 17272 c:\windows\system32\spmsg.dll
+ 2010-01-13 00:15 . 2009-08-07 02:24 44768 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.4.7600.226\wups2.dll
+ 2010-01-13 00:15 . 2009-08-07 02:24 35552 c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.4.7600.226\wups.dll
+ 2004-08-04 05:56 . 2009-06-25 08:44 56320 c:\windows\system32\secur32.dll
+ 2001-08-23 18:00 . 2009-02-06 16:54 35328 c:\windows\system32\sc.exe
- 2004-08-04 05:56 . 2004-08-04 05:56 69632 c:\windows\system32\raschap.dll
+ 2004-08-04 05:56 . 2009-10-12 13:54 69632 c:\windows\system32\raschap.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 44544 c:\windows\system32\pngfilt.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 44544 c:\windows\system32\pngfilt.dll
+ 2001-08-23 18:00 . 2010-01-14 23:06 64518 c:\windows\system32\perfc009.dat
- 2001-08-23 18:00 . 2010-01-11 21:38 64518 c:\windows\system32\perfc009.dat
+ 2007-12-10 00:28 . 2008-06-12 14:16 91648 c:\windows\system32\mtxoci.dll
+ 2004-08-04 05:56 . 2008-06-12 14:16 66560 c:\windows\system32\mtxclu.dll
- 2004-08-04 05:56 . 2006-03-01 19:42 66560 c:\windows\system32\mtxclu.dll
- 2007-08-14 02:54 . 2008-10-16 20:38 52224 c:\windows\system32\msfeedsbs.dll
+ 2007-08-14 02:54 . 2009-10-29 07:46 52224 c:\windows\system32\msfeedsbs.dll
- 2007-12-10 00:28 . 2004-08-04 05:56 58880 c:\windows\system32\msdtclog.dll
+ 2007-12-10 00:28 . 2008-06-12 14:16 58880 c:\windows\system32\msdtclog.dll
+ 2004-08-04 05:56 . 2009-09-04 20:45 58880 c:\windows\system32\msasn1.dll
- 2004-08-04 05:56 . 2007-07-06 12:46 48640 c:\windows\system32\mqupgrd.dll
+ 2004-08-04 05:56 . 2009-06-25 18:36 48640 c:\windows\system32\mqupgrd.dll
+ 2004-08-04 05:56 . 2009-06-25 18:36 95744 c:\windows\system32\mqsec.dll
- 2004-08-04 05:56 . 2007-07-06 12:46 95744 c:\windows\system32\mqsec.dll
+ 2004-08-04 05:56 . 2009-06-25 18:36 16896 c:\windows\system32\mqise.dll
- 2004-08-04 05:56 . 2007-07-06 12:46 16896 c:\windows\system32\mqise.dll
- 2004-08-04 05:56 . 2007-07-06 12:46 47104 c:\windows\system32\mqdscli.dll
+ 2004-08-04 05:56 . 2009-06-25 18:36 47104 c:\windows\system32\mqdscli.dll
+ 2004-08-04 05:56 . 2009-06-22 11:49 19968 c:\windows\system32\mqbkup.exe
- 2004-08-04 05:56 . 2004-08-04 05:56 19968 c:\windows\system32\mqbkup.exe
+ 2004-08-04 05:56 . 2009-10-29 07:46 27648 c:\windows\system32\jsproxy.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 27648 c:\windows\system32\jsproxy.dll
+ 2007-08-14 02:39 . 2009-10-28 14:36 13824 c:\windows\system32\ieudinit.exe
- 2007-08-14 02:39 . 2008-10-16 13:11 13824 c:\windows\system32\ieudinit.exe
+ 2004-08-04 05:56 . 2009-10-29 07:46 44544 c:\windows\system32\iernonce.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 44544 c:\windows\system32\iernonce.dll
- 2004-08-04 05:56 . 2008-10-16 13:11 70656 c:\windows\system32\ie4uinit.exe
+ 2004-08-04 05:56 . 2009-10-28 14:36 70656 c:\windows\system32\ie4uinit.exe
- 2007-08-14 02:36 . 2008-10-16 20:38 63488 c:\windows\system32\icardie.dll
+ 2007-08-14 02:36 . 2009-10-29 07:46 63488 c:\windows\system32\icardie.dll
+ 2001-08-23 18:00 . 2009-10-15 17:21 82432 c:\windows\system32\fontsub.dll
+ 2004-08-04 03:58 . 2009-06-22 11:48 91776 c:\windows\system32\drivers\mqac.sys
+ 2004-08-04 03:59 . 2009-06-22 11:34 92544 c:\windows\system32\drivers\ksecdd.sys
+ 2007-12-10 00:30 . 2009-08-07 02:24 35552 c:\windows\system32\dllcache\wups.dll
+ 2007-12-10 00:30 . 2009-08-07 02:24 53472 c:\windows\system32\dllcache\wuauclt.exe
+ 2004-08-04 05:56 . 2009-06-25 08:44 59392 c:\windows\system32\dllcache\wdigest.dll
+ 2004-08-04 05:56 . 2009-06-12 11:50 80896 c:\windows\system32\dllcache\tlntsess.exe
+ 2004-08-04 05:56 . 2009-06-12 11:50 76288 c:\windows\system32\dllcache\telnet.exe
- 2004-08-04 05:56 . 2004-08-04 05:56 75776 c:\windows\system32\dllcache\strmfilt.dll
+ 2004-08-04 05:56 . 2009-10-21 06:00 75776 c:\windows\system32\dllcache\strmfilt.dll
+ 2004-08-04 05:56 . 2009-06-25 08:44 56320 c:\windows\system32\dllcache\secur32.dll
+ 2001-08-23 18:00 . 2009-02-06 16:54 35328 c:\windows\system32\dllcache\sc.exe
- 2004-08-04 05:56 . 2004-08-04 05:56 69632 c:\windows\system32\dllcache\raschap.dll
+ 2004-08-04 05:56 . 2009-10-12 13:54 69632 c:\windows\system32\dllcache\raschap.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 44544 c:\windows\system32\dllcache\pngfilt.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 44544 c:\windows\system32\dllcache\pngfilt.dll
+ 2007-12-10 00:28 . 2008-06-12 14:16 91648 c:\windows\system32\dllcache\mtxoci.dll
- 2004-08-04 05:56 . 2006-03-01 19:42 66560 c:\windows\system32\dllcache\mtxclu.dll
+ 2004-08-04 05:56 . 2008-06-12 14:16 66560 c:\windows\system32\dllcache\mtxclu.dll
+ 2007-12-11 19:05 . 2009-10-29 07:46 52224 c:\windows\system32\dllcache\msfeedsbs.dll
- 2007-12-11 19:05 . 2008-10-16 20:38 52224 c:\windows\system32\dllcache\msfeedsbs.dll
+ 2007-12-10 00:28 . 2008-06-12 14:16 58880 c:\windows\system32\dllcache\msdtclog.dll
- 2007-12-10 00:28 . 2004-08-04 05:56 58880 c:\windows\system32\dllcache\msdtclog.dll
+ 2004-08-04 05:56 . 2009-09-04 20:45 58880 c:\windows\system32\dllcache\msasn1.dll
- 2004-08-04 05:56 . 2007-07-06 12:46 48640 c:\windows\system32\dllcache\mqupgrd.dll
+ 2004-08-04 05:56 . 2009-06-25 18:36 48640 c:\windows\system32\dllcache\mqupgrd.dll
+ 2004-08-04 05:56 . 2009-06-25 18:36 95744 c:\windows\system32\dllcache\mqsec.dll
- 2004-08-04 05:56 . 2007-07-06 12:46 95744 c:\windows\system32\dllcache\mqsec.dll
- 2004-08-04 05:56 . 2007-07-06 12:46 16896 c:\windows\system32\dllcache\mqise.dll
+ 2004-08-04 05:56 . 2009-06-25 18:36 16896 c:\windows\system32\dllcache\mqise.dll
- 2004-08-04 05:56 . 2007-07-06 12:46 47104 c:\windows\system32\dllcache\mqdscli.dll
+ 2004-08-04 05:56 . 2009-06-25 18:36 47104 c:\windows\system32\dllcache\mqdscli.dll
- 2004-08-04 05:56 . 2004-08-04 05:56 19968 c:\windows\system32\dllcache\mqbkup.exe
+ 2004-08-04 05:56 . 2009-06-22 11:49 19968 c:\windows\system32\dllcache\mqbkup.exe
+ 2004-08-04 03:58 . 2009-06-22 11:48 91776 c:\windows\system32\dllcache\mqac.sys
+ 2004-08-04 03:59 . 2009-06-22 11:34 92544 c:\windows\system32\dllcache\ksecdd.sys
+ 2004-08-04 05:56 . 2009-10-29 07:46 27648 c:\windows\system32\dllcache\jsproxy.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 27648 c:\windows\system32\dllcache\jsproxy.dll
+ 2007-12-11 19:05 . 2009-10-28 14:36 13824 c:\windows\system32\dllcache\ieudinit.exe
- 2007-12-11 19:05 . 2008-10-16 13:11 13824 c:\windows\system32\dllcache\ieudinit.exe
+ 2004-08-04 05:56 . 2009-10-29 07:46 44544 c:\windows\system32\dllcache\iernonce.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 44544 c:\windows\system32\dllcache\iernonce.dll
- 2004-08-04 05:56 . 2007-08-14 02:45 78336 c:\windows\system32\dllcache\ieencode.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 78336 c:\windows\system32\dllcache\ieencode.dll
- 2004-08-04 05:56 . 2008-10-16 13:11 70656 c:\windows\system32\dllcache\ie4uinit.exe
+ 2004-08-04 05:56 . 2009-10-28 14:36 70656 c:\windows\system32\dllcache\ie4uinit.exe
- 2007-12-11 19:05 . 2008-10-16 20:38 63488 c:\windows\system32\dllcache\icardie.dll
+ 2007-12-11 19:05 . 2009-10-29 07:46 63488 c:\windows\system32\dllcache\icardie.dll
+ 2004-08-04 05:56 . 2009-10-21 06:00 25088 c:\windows\system32\dllcache\httpapi.dll
+ 2001-08-23 18:00 . 2009-10-15 17:21 82432 c:\windows\system32\dllcache\fontsub.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 17408 c:\windows\system32\dllcache\corpol.dll
+ 2004-08-04 05:56 . 2009-08-07 02:24 96480 c:\windows\system32\dllcache\cdm.dll
+ 2004-08-04 05:56 . 2009-06-10 14:21 84992 c:\windows\system32\dllcache\avifil32.dll
- 2004-08-04 05:56 . 2004-08-04 05:56 84992 c:\windows\system32\dllcache\avifil32.dll
+ 2004-08-04 05:56 . 2009-07-17 18:55 58880 c:\windows\system32\dllcache\atl.dll
- 2004-08-04 05:56 . 2004-08-04 05:56 58880 c:\windows\system32\dllcache\atl.dll
+ 2004-08-04 05:56 . 2009-08-07 02:24 96480 c:\windows\system32\cdm.dll
+ 2004-08-04 05:56 . 2009-06-10 14:21 84992 c:\windows\system32\avifil32.dll
- 2004-08-04 05:56 . 2004-08-04 05:56 84992 c:\windows\system32\avifil32.dll
- 2004-08-04 05:56 . 2004-08-04 05:56 58880 c:\windows\system32\atl.dll
+ 2004-08-04 05:56 . 2009-07-17 18:55 58880 c:\windows\system32\atl.dll
+ 2009-06-25 02:56 . 2009-06-25 02:56 73728 c:\windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe
+ 2008-05-28 07:49 . 2008-05-28 07:49 77824 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll
- 2007-04-14 04:58 . 2007-04-14 04:58 77824 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll
- 2007-04-14 04:57 . 2007-04-14 04:57 86016 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorie.dll
+ 2008-05-28 07:49 . 2008-05-28 07:49 86016 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorie.dll
+ 2008-05-28 07:49 . 2008-05-28 07:49 81920 c:\windows\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll
- 2007-04-14 04:57 . 2007-04-14 04:57 81920 c:\windows\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll
- 2007-04-14 05:30 . 2007-04-14 05:30 32768 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
+ 2008-05-28 08:30 . 2008-05-28 08:30 32768 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe
+ 2010-01-13 04:49 . 2010-01-13 04:49 32768 c:\windows\Installer\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}\icon.exe
+ 2007-12-10 01:41 . 2010-01-13 05:05 35088 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
- 2007-12-10 01:41 . 2009-01-15 07:57 35088 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
- 2007-12-10 01:41 . 2009-01-15 07:57 18704 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
+ 2007-12-10 01:41 . 2010-01-13 05:05 18704 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
- 2007-12-10 01:41 . 2009-01-15 07:57 20240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
+ 2007-12-10 01:41 . 2010-01-13 05:05 20240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
+ 2006-10-27 05:13 . 2006-10-27 05:13 72472 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\XL12CNVP.DLL
+ 2006-10-27 06:58 . 2006-10-27 06:58 33080 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\VPREVIEW.EXE
+ 2006-10-27 04:55 . 2006-10-27 04:55 55056 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\SCANOST.EXE
+ 2006-10-27 04:55 . 2006-10-27 04:55 76576 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\RM.DLL
+ 2006-10-27 04:55 . 2006-10-27 04:55 39208 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\RECALL.DLL
+ 2006-10-27 04:09 . 2006-10-27 04:09 48448 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\PUBTRAP.DLL
+ 2006-10-27 04:55 . 2006-10-27 04:55 53048 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\OUTLVBA.DLL
+ 2006-10-27 04:55 . 2006-10-27 04:55 21312 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\MLSHEXT.DLL
+ 2006-10-27 04:55 . 2006-10-27 04:55 35160 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\DUMPSTER.DLL
+ 2010-01-13 04:56 . 2008-12-20 23:15 44544 c:\windows\ie7updates\KB976325-IE7\pngfilt.dll
+ 2010-01-13 04:56 . 2008-12-20 23:15 52224 c:\windows\ie7updates\KB976325-IE7\msfeedsbs.dll
+ 2010-01-13 04:56 . 2008-12-20 23:15 27648 c:\windows\ie7updates\KB976325-IE7\jsproxy.dll
+ 2010-01-13 04:56 . 2008-12-19 09:10 13824 c:\windows\ie7updates\KB976325-IE7\ieudinit.exe
+ 2010-01-13 04:56 . 2008-12-20 23:15 44544 c:\windows\ie7updates\KB976325-IE7\iernonce.dll
+ 2010-01-13 04:56 . 2007-08-14 02:45 78336 c:\windows\ie7updates\KB976325-IE7\ieencode.dll
+ 2010-01-13 04:56 . 2008-12-19 09:10 70656 c:\windows\ie7updates\KB976325-IE7\ie4uinit.exe
+ 2010-01-13 04:56 . 2008-12-20 23:15 63488 c:\windows\ie7updates\KB976325-IE7\icardie.dll
+ 2010-01-13 04:56 . 2004-08-04 05:56 35328 c:\windows\ie7updates\KB976325-IE7\corpol.dll
+ 2010-01-13 00:11 . 2008-10-16 20:38 44544 c:\windows\ie7updates\KB961260-IE7\pngfilt.dll
+ 2010-01-13 00:11 . 2008-10-16 20:38 52224 c:\windows\ie7updates\KB961260-IE7\msfeedsbs.dll
+ 2010-01-13 00:11 . 2008-10-16 20:38 27648 c:\windows\ie7updates\KB961260-IE7\jsproxy.dll
+ 2010-01-13 00:11 . 2008-10-16 13:11 13824 c:\windows\ie7updates\KB961260-IE7\ieudinit.exe
+ 2010-01-13 00:11 . 2008-10-16 20:38 44544 c:\windows\ie7updates\KB961260-IE7\iernonce.dll
+ 2010-01-13 00:11 . 2008-10-16 13:11 70656 c:\windows\ie7updates\KB961260-IE7\ie4uinit.exe
+ 2010-01-13 00:11 . 2008-10-16 20:38 63488 c:\windows\ie7updates\KB961260-IE7\icardie.dll
+ 2010-01-13 04:51 . 2010-01-13 04:51 90112 c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_b5e70cf6\System.Drawing.Design.dll
+ 2010-01-13 04:51 . 2010-01-13 04:51 61440 c:\windows\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_37fee62e\CustomMarshalers.dll
+ 2010-01-13 04:58 . 2010-01-13 04:58 81920 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\e299fd71b4c71854673c47f85b4cf180\Microsoft.Build.Framework.ni.dll
+ 2010-01-13 04:58 . 2010-01-13 04:58 15360 c:\windows\assembly\NativeImages_v2.0.50727_32\dfsvc\662febc2f309e92a880682f527f4e426\dfsvc.ni.exe
+ 2010-01-13 04:58 . 2010-01-13 04:58 27136 c:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\1a67452bf4558b2574698b6008e7af74\Accessibility.ni.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 90112 c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 90112 c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 81920 c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 81920 c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 81920 c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 81920 c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 32768 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 32768 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 12800 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 12800 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 77824 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 77824 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 77824 c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 77824 c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 13312 c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 13312 c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 10752 c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 10752 c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 72192 c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 72192 c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 69120 c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 69120 c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 8192 c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 8192 c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
- 2004-08-04 05:56 . 2004-08-04 05:56 4608 c:\windows\system32\mqsvc.exe
+ 2004-08-04 05:56 . 2009-06-22 11:49 4608 c:\windows\system32\mqsvc.exe
+ 2004-08-04 05:56 . 2009-06-22 11:49 4608 c:\windows\system32\dllcache\mqsvc.exe
- 2004-08-04 05:56 . 2004-08-04 05:56 4608 c:\windows\system32\dllcache\mqsvc.exe
+ 2010-01-13 04:54 . 2010-01-13 04:54 7168 c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 7168 c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 5632 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
- 2008-01-24 09:02 . 2008-01-24 09:02 5632 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 6656 c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 6656 c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 8192 c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 8192 c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 113664 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 113664 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 258048 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 258048 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2006-10-16 10:21 . 2009-04-15 09:24 351744 c:\windows\system32\xpsp3res.dll
+ 2007-12-10 00:30 . 2009-08-07 02:24 209632 c:\windows\system32\wuweb.dll
+ 2007-12-10 00:30 . 2009-08-07 02:24 327896 c:\windows\system32\wucltui.dll
+ 2007-12-10 00:30 . 2009-08-07 02:23 575704 c:\windows\system32\wuapi.dll
+ 2004-08-04 05:56 . 2009-04-02 06:02 604160 c:\windows\system32\wmspdmod.dll
+ 2004-08-04 05:56 . 2009-07-14 06:43 286208 c:\windows\system32\wmpdxm.dll
+ 2004-08-04 05:56 . 2009-06-10 06:32 132096 c:\windows\system32\wkssvc.dll
- 2004-08-04 05:56 . 2006-08-17 12:28 132096 c:\windows\system32\wkssvc.dll
+ 2004-08-04 05:56 . 2009-08-25 09:47 352256 c:\windows\system32\winhttp.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 233472 c:\windows\system32\webcheck.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 233472 c:\windows\system32\webcheck.dll
+ 2007-12-10 00:28 . 2009-02-06 16:39 227840 c:\windows\system32\wbem\wmiprvse.exe
+ 2007-12-10 00:28 . 2009-02-09 10:20 453120 c:\windows\system32\wbem\wmiprvsd.dll
+ 2007-12-10 00:28 . 2009-02-09 10:20 473088 c:\windows\system32\wbem\fastprox.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 105984 c:\windows\system32\url.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 105984 c:\windows\system32\url.dll
+ 2004-08-04 05:56 . 2009-10-16 05:51 119808 c:\windows\system32\t2embed.dll
- 2004-08-04 05:56 . 2008-10-03 10:15 247326 c:\windows\system32\strmdll.dll
+ 2004-08-04 05:56 . 2009-08-26 08:16 247326 c:\windows\system32\strmdll.dll
+ 2004-08-04 05:56 . 2009-06-25 18:36 169472 c:\windows\system32\Setup\msmqocm.dll
+ 2004-08-04 05:56 . 2009-02-06 17:14 110592 c:\windows\system32\services.exe
+ 2004-08-04 05:56 . 2009-06-25 08:44 168448 c:\windows\system32\schannel.dll
+ 2004-08-04 05:56 . 2009-02-09 10:20 399360 c:\windows\system32\rpcss.dll
+ 2004-08-04 05:56 . 2009-04-15 15:11 584192 c:\windows\system32\rpcrt4.dll
- 2004-08-04 05:56 . 2007-07-09 13:09 584192 c:\windows\system32\rpcrt4.dll
+ 2004-08-04 05:56 . 2009-10-12 13:54 112128 c:\windows\system32\rastls.dll
- 2004-08-04 05:56 . 2004-08-04 05:56 112128 c:\windows\system32\rastls.dll
- 2001-08-23 18:00 . 2010-01-11 21:38 409122 c:\windows\system32\perfh009.dat
+ 2001-08-23 18:00 . 2010-01-14 23:06 409122 c:\windows\system32\perfh009.dat
- 2004-08-04 05:56 . 2004-08-04 05:56 283648 c:\windows\system32\pdh.dll
+ 2004-08-04 05:56 . 2009-03-06 14:44 283648 c:\windows\system32\pdh.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 102912 c:\windows\system32\occache.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 102912 c:\windows\system32\occache.dll
- 2004-08-04 05:56 . 2004-08-04 05:56 266752 c:\windows\system32\oakley.dll
+ 2004-08-04 05:56 . 2009-10-13 10:53 266752 c:\windows\system32\oakley.dll
+ 2004-08-04 05:56 . 2009-02-09 10:20 714752 c:\windows\system32\ntdll.dll
+ 2007-07-31 03:18 . 2009-08-07 02:23 215920 c:\windows\system32\muweb.dll
+ 2007-12-11 15:02 . 2009-08-07 02:23 274288 c:\windows\system32\mucltui.dll
+ 2004-08-04 05:56 . 2009-08-05 09:11 204800 c:\windows\system32\mswebdvd.dll
+ 2004-08-04 05:56 . 2009-09-11 14:33 133632 c:\windows\system32\msv1_0.dll
+ 2007-12-10 00:28 . 2009-06-05 07:42 655872 c:\windows\system32\mstscax.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 671232 c:\windows\system32\mstime.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 671232 c:\windows\system32\mstime.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 193024 c:\windows\system32\msrating.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 193024 c:\windows\system32\msrating.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 477696 c:\windows\system32\mshtmled.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 477696 c:\windows\system32\mshtmled.dll
+ 2007-08-14 02:54 . 2009-10-29 07:46 459264 c:\windows\system32\msfeeds.dll
- 2007-08-14 02:54 . 2008-10-16 20:38 459264 c:\windows\system32\msfeeds.dll
+ 2007-12-10 00:28 . 2008-06-12 14:16 161792 c:\windows\system32\msdtcuiu.dll
+ 2007-12-10 00:28 . 2008-06-12 14:16 956928 c:\windows\system32\msdtctm.dll
+ 2007-12-10 00:28 . 2008-06-12 14:16 428032 c:\windows\system32\msdtcprx.dll
+ 2004-08-04 05:56 . 2009-06-25 18:36 471552 c:\windows\system32\mqutil.dll
- 2004-08-04 05:56 . 2007-07-06 12:46 471552 c:\windows\system32\mqutil.dll
- 2004-08-04 05:56 . 2004-08-04 05:56 186880 c:\windows\system32\mqtrig.dll
+ 2004-08-04 05:56 . 2009-06-25 18:36 186880 c:\windows\system32\mqtrig.dll
- 2004-08-04 05:56 . 2004-08-04 05:56 117248 c:\windows\system32\mqtgsvc.exe
+ 2004-08-04 05:56 . 2009-06-22 11:49 117248 c:\windows\system32\mqtgsvc.exe
+ 2004-08-04 05:56 . 2009-06-25 18:36 517120 c:\windows\system32\mqsnap.dll
- 2004-08-04 05:56 . 2004-08-04 05:56 123392 c:\windows\system32\mqrtdep.dll
+ 2004-08-04 05:56 . 2009-06-25 18:36 123392 c:\windows\system32\mqrtdep.dll
- 2004-08-04 05:56 . 2007-07-06 12:46 177152 c:\windows\system32\mqrt.dll
+ 2004-08-04 05:56 . 2009-06-25 18:36 177152 c:\windows\system32\mqrt.dll
+ 2004-08-04 05:56 . 2009-06-25 18:36 661504 c:\windows\system32\mqqm.dll
+ 2004-08-04 05:56 . 2009-06-25 18:36 225280 c:\windows\system32\mqoa.dll
- 2004-08-04 05:56 . 2004-08-04 05:56 225280 c:\windows\system32\mqoa.dll
+ 2004-08-04 05:56 . 2009-06-25 18:36 138240 c:\windows\system32\mqad.dll
- 2004-08-04 05:56 . 2007-07-06 12:46 138240 c:\windows\system32\mqad.dll
+ 2004-08-04 05:56 . 2009-06-25 08:44 724480 c:\windows\system32\lsasrv.dll
+ 2004-08-04 05:56 . 2009-05-07 15:44 344064 c:\windows\system32\localspl.dll
+ 2004-08-04 05:56 . 2009-06-25 08:44 298496 c:\windows\system32\kerberos.dll
+ 2004-08-04 05:56 . 2009-08-13 15:16 512000 c:\windows\system32\jscript.dll
+ 2007-08-14 02:34 . 2009-10-29 07:46 268288 c:\windows\system32\iertutil.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 385024 c:\windows\system32\iedkcs32.dll
+ 2007-07-11 20:27 . 2009-10-29 07:46 380928 c:\windows\system32\ieapfltr.dll
- 2001-08-23 18:00 . 2008-10-15 07:04 161792 c:\windows\system32\ieakui.dll
+ 2001-08-23 18:00 . 2009-10-28 06:52 161792 c:\windows\system32\ieakui.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 230400 c:\windows\system32\ieaksie.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 230400 c:\windows\system32\ieaksie.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 153088 c:\windows\system32\ieakeng.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 153088 c:\windows\system32\ieakeng.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 133120 c:\windows\system32\extmgr.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 133120 c:\windows\system32\extmgr.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 214528 c:\windows\system32\dxtrans.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 214528 c:\windows\system32\dxtrans.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 347136 c:\windows\system32\dxtmsft.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 347136 c:\windows\system32\dxtmsft.dll
+ 2007-12-10 00:30 . 2009-08-07 02:24 209632 c:\windows\system32\dllcache\wuweb.dll
+ 2007-12-10 00:30 . 2009-08-07 02:24 327896 c:\windows\system32\dllcache\wucltui.dll
+ 2007-12-10 00:30 . 2009-08-07 02:23 575704 c:\windows\system32\dllcache\wuapi.dll
+ 2007-12-10 00:28 . 2008-04-21 10:02 215552 c:\windows\system32\dllcache\wordpad.exe
+ 2004-08-04 05:56 . 2009-04-02 06:02 604160 c:\windows\system32\dllcache\wmspdmod.dll
+ 2004-08-04 05:56 . 2009-07-14 06:43 286208 c:\windows\system32\dllcache\wmpdxm.dll
+ 2007-12-10 00:28 . 2009-02-06 16:39 227840 c:\windows\system32\dllcache\wmiprvse.exe
+ 2007-12-10 00:28 . 2009-02-09 10:20 453120 c:\windows\system32\dllcache\wmiprvsd.dll
+ 2004-08-04 05:56 . 2009-06-10 06:32 132096 c:\windows\system32\dllcache\wkssvc.dll
- 2004-08-04 05:56 . 2006-08-17 12:28 132096 c:\windows\system32\dllcache\wkssvc.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 832512 c:\windows\system32\dllcache\wininet.dll
+ 2004-08-04 05:56 . 2009-08-25 09:47 352256 c:\windows\system32\dllcache\winhttp.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 233472 c:\windows\system32\dllcache\webcheck.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 233472 c:\windows\system32\dllcache\webcheck.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 105984 c:\windows\system32\dllcache\url.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 105984 c:\windows\system32\dllcache\url.dll
- 2007-12-10 00:30 . 2004-08-04 05:56 153088 c:\windows\system32\dllcache\triedit.dll
+ 2007-12-10 00:30 . 2009-06-21 22:04 153088 c:\windows\system32\dllcache\triedit.dll
+ 2004-08-04 05:56 . 2009-10-16 05:51 119808 c:\windows\system32\dllcache\t2embed.dll
- 2004-08-04 05:56 . 2008-10-03 10:15 247326 c:\windows\system32\dllcache\strmdll.dll
+ 2004-08-04 05:56 . 2009-08-26 08:16 247326 c:\windows\system32\dllcache\strmdll.dll
+ 2004-08-04 05:56 . 2009-02-06 17:14 110592 c:\windows\system32\dllcache\services.exe
+ 2004-08-04 05:56 . 2009-06-25 08:44 168448 c:\windows\system32\dllcache\schannel.dll
+ 2004-08-04 05:56 . 2009-02-09 10:20 399360 c:\windows\system32\dllcache\rpcss.dll
- 2004-08-04 05:56 . 2007-07-09 13:09 584192 c:\windows\system32\dllcache\rpcrt4.dll
+ 2004-08-04 05:56 . 2009-04-15 15:11 584192 c:\windows\system32\dllcache\rpcrt4.dll
- 2004-08-04 05:56 . 2004-08-04 05:56 112128 c:\windows\system32\dllcache\rastls.dll
+ 2004-08-04 05:56 . 2009-10-12 13:54 112128 c:\windows\system32\dllcache\rastls.dll
- 2004-08-04 05:56 . 2004-08-04 05:56 283648 c:\windows\system32\dllcache\pdh.dll
+ 2004-08-04 05:56 . 2009-03-06 14:44 283648 c:\windows\system32\dllcache\pdh.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 102912 c:\windows\system32\dllcache\occache.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 102912 c:\windows\system32\dllcache\occache.dll
+ 2004-08-04 05:56 . 2009-10-13 10:53 266752 c:\windows\system32\dllcache\oakley.dll
- 2004-08-04 05:56 . 2004-08-04 05:56 266752 c:\windows\system32\dllcache\oakley.dll
+ 2004-08-04 05:56 . 2009-02-09 10:20 714752 c:\windows\system32\dllcache\ntdll.dll
+ 2004-08-04 05:56 . 2009-08-05 09:11 204800 c:\windows\system32\dllcache\mswebdvd.dll
+ 2004-08-04 05:56 . 2009-09-11 14:33 133632 c:\windows\system32\dllcache\msv1_0.dll
+ 2007-12-10 00:28 . 2009-06-05 07:42 655872 c:\windows\system32\dllcache\mstscax.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 671232 c:\windows\system32\dllcache\mstime.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 671232 c:\windows\system32\dllcache\mstime.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 193024 c:\windows\system32\dllcache\msrating.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 193024 c:\windows\system32\dllcache\msrating.dll
+ 2004-08-04 05:56 . 2009-06-25 18:36 169472 c:\windows\system32\dllcache\msmqocm.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 477696 c:\windows\system32\dllcache\mshtmled.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 477696 c:\windows\system32\dllcache\mshtmled.dll
+ 2007-12-11 19:05 . 2009-10-29 07:46 459264 c:\windows\system32\dllcache\msfeeds.dll
- 2007-12-11 19:05 . 2008-10-16 20:38 459264 c:\windows\system32\dllcache\msfeeds.dll
+ 2007-12-10 00:28 . 2008-06-12 14:16 161792 c:\windows\system32\dllcache\msdtcuiu.dll
+ 2007-12-10 00:28 . 2008-06-12 14:16 956928 c:\windows\system32\dllcache\msdtctm.dll
+ 2007-12-10 00:28 . 2008-06-12 14:16 428032 c:\windows\system32\dllcache\msdtcprx.dll
- 2004-08-04 05:56 . 2007-07-06 12:46 471552 c:\windows\system32\dllcache\mqutil.dll
+ 2004-08-04 05:56 . 2009-06-25 18:36 471552 c:\windows\system32\dllcache\mqutil.dll
+ 2004-08-04 05:56 . 2009-06-25 18:36 186880 c:\windows\system32\dllcache\mqtrig.dll
- 2004-08-04 05:56 . 2004-08-04 05:56 186880 c:\windows\system32\dllcache\mqtrig.dll
- 2004-08-04 05:56 . 2004-08-04 05:56 117248 c:\windows\system32\dllcache\mqtgsvc.exe
+ 2004-08-04 05:56 . 2009-06-22 11:49 117248 c:\windows\system32\dllcache\mqtgsvc.exe
+ 2004-08-04 05:56 . 2009-06-25 18:36 517120 c:\windows\system32\dllcache\mqsnap.dll
+ 2004-08-04 05:56 . 2009-06-25 18:36 123392 c:\windows\system32\dllcache\mqrtdep.dll
- 2004-08-04 05:56 . 2004-08-04 05:56 123392 c:\windows\system32\dllcache\mqrtdep.dll
+ 2004-08-04 05:56 . 2009-06-25 18:36 177152 c:\windows\system32\dllcache\mqrt.dll
- 2004-08-04 05:56 . 2007-07-06 12:46 177152 c:\windows\system32\dllcache\mqrt.dll
+ 2004-08-04 05:56 . 2009-06-25 18:36 661504 c:\windows\system32\dllcache\mqqm.dll
- 2004-08-04 05:56 . 2004-08-04 05:56 225280 c:\windows\system32\dllcache\mqoa.dll
+ 2004-08-04 05:56 . 2009-06-25 18:36 225280 c:\windows\system32\dllcache\mqoa.dll
+ 2004-08-04 05:56 . 2009-06-25 18:36 138240 c:\windows\system32\dllcache\mqad.dll
- 2004-08-04 05:56 . 2007-07-06 12:46 138240 c:\windows\system32\dllcache\mqad.dll
+ 2004-08-04 05:56 . 2009-06-25 08:44 724480 c:\windows\system32\dllcache\lsasrv.dll
+ 2004-08-04 05:56 . 2009-05-07 15:44 344064 c:\windows\system32\dllcache\localspl.dll
+ 2004-08-04 05:56 . 2007-04-16 16:07 986112 c:\windows\system32\dllcache\kernel32.dll
+ 2004-08-04 05:56 . 2009-06-25 08:44 298496 c:\windows\system32\dllcache\kerberos.dll
+ 2004-08-04 05:56 . 2009-08-13 15:16 512000 c:\windows\system32\dllcache\jscript.dll
+ 2007-12-10 00:30 . 2009-10-28 06:54 634632 c:\windows\system32\dllcache\iexplore.exe
+ 2007-12-11 19:05 . 2009-10-29 07:46 268288 c:\windows\system32\dllcache\iertutil.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 385024 c:\windows\system32\dllcache\iedkcs32.dll
+ 2007-12-11 19:05 . 2009-10-29 07:46 380928 c:\windows\system32\dllcache\ieapfltr.dll
- 2001-08-23 18:00 . 2008-10-15 07:04 161792 c:\windows\system32\dllcache\ieakui.dll
+ 2001-08-23 18:00 . 2009-10-28 06:52 161792 c:\windows\system32\dllcache\ieakui.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 230400 c:\windows\system32\dllcache\ieaksie.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 230400 c:\windows\system32\dllcache\ieaksie.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 153088 c:\windows\system32\dllcache\ieakeng.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 153088 c:\windows\system32\dllcache\ieakeng.dll
+ 2009-10-20 14:58 . 2009-10-20 14:58 263552 c:\windows\system32\dllcache\http.sys
+ 2007-12-10 00:28 . 2009-02-09 10:20 473088 c:\windows\system32\dllcache\fastprox.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 133120 c:\windows\system32\dllcache\extmgr.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 133120 c:\windows\system32\dllcache\extmgr.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 214528 c:\windows\system32\dllcache\dxtrans.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 214528 c:\windows\system32\dllcache\dxtrans.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 347136 c:\windows\system32\dllcache\dxtmsft.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 347136 c:\windows\system32\dllcache\dxtmsft.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 124928 c:\windows\system32\dllcache\advpack.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 124928 c:\windows\system32\dllcache\advpack.dll
+ 2004-08-04 05:56 . 2009-02-09 10:20 616960 c:\windows\system32\dllcache\advapi32.dll
- 2004-08-04 05:56 . 2004-08-04 05:56 616960 c:\windows\system32\dllcache\advapi32.dll
+ 2004-08-04 05:56 . 2009-11-21 16:36 470528 c:\windows\system32\dllcache\aclayers.dll
- 2004-08-04 05:56 . 2008-10-16 20:38 124928 c:\windows\system32\advpack.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 124928 c:\windows\system32\advpack.dll
- 2004-08-04 05:56 . 2004-08-04 05:56 616960 c:\windows\system32\advapi32.dll
+ 2004-08-04 05:56 . 2009-02-09 10:20 616960 c:\windows\system32\advapi32.dll
+ 2009-08-08 09:35 . 2009-08-08 09:35 819016 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
- 2007-04-14 04:58 . 2007-04-14 04:58 102400 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorld.dll
+ 2008-05-28 07:49 . 2008-05-28 07:49 102400 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorld.dll
- 2007-04-14 04:56 . 2007-04-14 04:56 315392 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll
+ 2008-05-28 07:48 . 2008-05-28 07:48 315392 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll
- 2007-04-14 05:30 . 2007-04-14 05:30 258048 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
+ 2008-05-28 08:30 . 2008-05-28 08:30 258048 c:\windows\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
+ 2009-05-27 01:53 . 2009-05-27 01:53 579072 c:\windows\Installer\101b574.msp
+ 2010-01-13 04:49 . 2010-01-13 04:49 429568 c:\windows\Installer\101b507.msi
+ 2010-01-13 04:49 . 2010-01-13 04:49 248832 c:\windows\Installer\101b4ff.msi
- 2007-12-10 01:41 . 2009-01-15 07:57 888080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
+ 2007-12-10 01:41 . 2010-01-13 05:05 888080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
+ 2007-12-10 01:41 . 2010-01-13 05:05 272648 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
- 2007-12-10 01:41 . 2009-01-15 07:57 272648 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
+ 2007-12-10 01:41 . 2010-01-13 05:05 922384 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
- 2007-12-10 01:41 . 2009-01-15 07:57 922384 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
- 2007-12-10 01:41 . 2009-01-15 07:57 845584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
+ 2007-12-10 01:41 . 2010-01-13 05:05 845584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
- 2007-12-10 01:41 . 2009-01-15 07:57 217864 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
+ 2007-12-10 01:41 . 2010-01-13 05:05 217864 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
- 2007-12-10 01:41 . 2009-01-15 07:57 184080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
+ 2007-12-10 01:41 . 2010-01-13 05:05 184080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
- 2007-12-10 01:41 . 2009-01-15 07:57 159504 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
+ 2007-12-10 01:41 . 2010-01-13 05:05 159504 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
+ 2006-10-27 23:16 . 2006-10-27 23:16 408880 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\RTFHTML.DLL
+ 2006-10-27 23:16 . 2006-10-27 23:16 138512 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\OUTLCTL.DLL
+ 2006-10-27 04:55 . 2006-10-27 04:55 254776 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\OLKFSTUB.DLL
+ 2006-10-27 04:55 . 2006-10-27 04:55 154960 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\ENVELOPE.DLL
+ 2006-10-27 04:55 . 2006-10-27 04:55 116544 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.4518\EMABLT32.DLL
+ 2010-01-13 04:56 . 2008-12-20 23:15 826368 c:\windows\ie7updates\KB976325-IE7\wininet.dll
+ 2010-01-13 04:56 . 2008-12-20 23:15 233472 c:\windows\ie7updates\KB976325-IE7\webcheck.dll
+ 2010-01-13 04:56 . 2008-12-20 23:15 105984 c:\windows\ie7updates\KB976325-IE7\url.dll
+ 2010-01-13 04:56 . 2009-05-26 11:40 382840 c:\windows\ie7updates\KB976325-IE7\spuninst\updspapi.dll
+ 2010-01-13 04:56 . 2009-05-26 11:40 231288 c:\windows\ie7updates\KB976325-IE7\spuninst\spuninst.exe
+ 2010-01-13 04:56 . 2008-12-20 23:15 102912 c:\windows\ie7updates\KB976325-IE7\occache.dll
+ 2010-01-13 04:56 . 2008-12-20 23:15 671232 c:\windows\ie7updates\KB976325-IE7\mstime.dll
+ 2010-01-13 04:56 . 2008-12-20 23:15 193024 c:\windows\ie7updates\KB976325-IE7\msrating.dll
+ 2010-01-13 04:56 . 2008-12-20 23:15 477696 c:\windows\ie7updates\KB976325-IE7\mshtmled.dll
+ 2010-01-13 04:56 . 2008-12-20 23:15 459264 c:\windows\ie7updates\KB976325-IE7\msfeeds.dll
+ 2010-01-13 04:56 . 2008-12-19 05:25 634024 c:\windows\ie7updates\KB976325-IE7\iexplore.exe
+ 2010-01-13 04:56 . 2008-12-20 23:15 267776 c:\windows\ie7updates\KB976325-IE7\iertutil.dll
+ 2010-01-13 04:56 . 2008-12-20 23:15 384512 c:\windows\ie7updates\KB976325-IE7\iedkcs32.dll
+ 2010-01-13 04:56 . 2008-12-20 23:15 383488 c:\windows\ie7updates\KB976325-IE7\ieapfltr.dll
+ 2010-01-13 04:56 . 2008-12-19 05:23 161792 c:\windows\ie7updates\KB976325-IE7\ieakui.dll
+ 2010-01-13 04:56 . 2008-12-20 23:15 230400 c:\windows\ie7updates\KB976325-IE7\ieaksie.dll
+ 2010-01-13 04:56 . 2008-12-20 23:15 153088 c:\windows\ie7updates\KB976325-IE7\ieakeng.dll
+ 2010-01-13 04:56 . 2008-12-20 23:15 133120 c:\windows\ie7updates\KB976325-IE7\extmgr.dll
+ 2010-01-13 04:56 . 2008-12-20 23:15 214528 c:\windows\ie7updates\KB976325-IE7\dxtrans.dll
+ 2010-01-13 04:56 . 2008-12-20 23:15 347136 c:\windows\ie7updates\KB976325-IE7\dxtmsft.dll
+ 2010-01-13 04:56 . 2008-12-20 23:15 124928 c:\windows\ie7updates\KB976325-IE7\advpack.dll
+ 2010-01-13 00:11 . 2008-10-16 20:38 826368 c:\windows\ie7updates\KB961260-IE7\wininet.dll
+ 2010-01-13 00:11 . 2008-10-16 20:38 233472 c:\windows\ie7updates\KB961260-IE7\webcheck.dll
+ 2010-01-13 00:11 . 2008-10-16 20:38 105984 c:\windows\ie7updates\KB961260-IE7\url.dll
+ 2010-01-13 00:11 . 2007-03-06 01:23 371424 c:\windows\ie7updates\KB961260-IE7\spuninst\updspapi.dll
+ 2010-01-13 00:11 . 2007-03-06 01:22 213216 c:\windows\ie7updates\KB961260-IE7\spuninst\spuninst.exe
+ 2010-01-13 00:11 . 2008-10-16 20:38 102912 c:\windows\ie7updates\KB961260-IE7\occache.dll
+ 2010-01-13 00:11 . 2008-10-16 20:38 671232 c:\windows\ie7updates\KB961260-IE7\mstime.dll
+ 2010-01-13 00:11 . 2008-10-16 20:38 193024 c:\windows\ie7updates\KB961260-IE7\msrating.dll
+ 2010-01-13 00:11 . 2008-10-16 20:38 477696 c:\windows\ie7updates\KB961260-IE7\mshtmled.dll
+ 2010-01-13 00:11 . 2008-10-16 20:38 459264 c:\windows\ie7updates\KB961260-IE7\msfeeds.dll
+ 2010-01-13 00:11 . 2008-10-15 07:06 633632 c:\windows\ie7updates\KB961260-IE7\iexplore.exe
+ 2010-01-13 00:11 . 2008-10-16 20:38 267776 c:\windows\ie7updates\KB961260-IE7\iertutil.dll
+ 2010-01-13 00:11 . 2008-10-16 20:38 384512 c:\windows\ie7updates\KB961260-IE7\iedkcs32.dll
+ 2010-01-13 00:11 . 2008-10-16 20:38 383488 c:\windows\ie7updates\KB961260-IE7\ieapfltr.dll
+ 2010-01-13 00:11 . 2008-10-15 07:04 161792 c:\windows\ie7updates\KB961260-IE7\ieakui.dll
+ 2010-01-13 00:11 . 2008-10-16 20:38 230400 c:\windows\ie7updates\KB961260-IE7\ieaksie.dll
+ 2010-01-13 00:11 . 2008-10-16 20:38 153088 c:\windows\ie7updates\KB961260-IE7\ieakeng.dll
+ 2010-01-13 00:11 . 2008-10-16 20:38 133120 c:\windows\ie7updates\KB961260-IE7\extmgr.dll
+ 2010-01-13 00:11 . 2008-10-16 20:38 214528 c:\windows\ie7updates\KB961260-IE7\dxtrans.dll
+ 2010-01-13 00:11 . 2008-10-16 20:38 347136 c:\windows\ie7updates\KB961260-IE7\dxtmsft.dll
+ 2010-01-13 00:11 . 2008-10-16 20:38 124928 c:\windows\ie7updates\KB961260-IE7\advpack.dll
+ 2006-03-17 00:33 . 2009-10-20 14:58 263552 c:\windows\Driver Cache\i386\http.sys
+ 2010-01-13 04:52 . 2010-01-13 04:52 835584 c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_4d40f56b\System.Drawing.dll
+ 2010-01-13 04:52 . 2010-01-13 04:52 192512 c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_c4b9c29f\System.Drawing.Design.dll
+ 2010-01-13 04:52 . 2010-01-13 04:52 118784 c:\windows\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_44618498\CustomMarshalers.dll
+ 2010-01-13 04:59 . 2010-01-13 04:59 237568 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\6b8f2e778eba3931057217c2512b201c\System.Web.RegularExpressions.ni.dll
+ 2010-01-13 04:59 . 2010-01-13 04:59 684032 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\4bdd3ce8337c4619dfb09de5ab3f9b62\System.Transactions.ni.dll
+ 2010-01-13 04:59 . 2010-01-13 04:59 233472 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\47d862e0dc37c830cc3397decf6c0590\System.ServiceProcess.ni.dll
+ 2010-01-13 04:59 . 2010-01-13 04:59 733184 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\428a3be3d5be01f129e0effdc455d831\System.Security.ni.dll
+ 2010-01-13 04:59 . 2010-01-13 04:59 294912 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\ff85d9d54701c8cde7b513ff808fd5e3\System.EnterpriseServices.Wrapper.dll
+ 2010-01-13 04:59 . 2010-01-13 04:59 659456 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\ff85d9d54701c8cde7b513ff808fd5e3\System.EnterpriseServices.ni.dll
+ 2010-01-13 04:56 . 2010-01-13 04:56 229376 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\4593151ab44d4f61e4cafaf9e77a8d25\System.Drawing.Design.ni.dll
+ 2010-01-13 04:59 . 2010-01-13 04:59 512000 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\135aa2f31c01565700d44313b925a205\System.DirectoryServices.Protocols.ni.dll
+ 2010-01-13 04:58 . 2010-01-13 04:58 167936 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\ab1dd1079764acac4cbe55d6555f4ff7\Microsoft.Build.Utilities.ni.dll
+ 2010-01-13 04:58 . 2010-01-13 04:58 876544 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\9e2334dbe9e76dd6fc2bde86c9b515b9\Microsoft.Build.Engine.ni.dll
+ 2010-01-13 04:58 . 2010-01-13 04:58 237568 c:\windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\58ec7ce15fd463d65d3e45db4e0613cf\CustomMarshalers.ni.dll
+ 2010-01-13 04:58 . 2010-01-13 04:58 884736 c:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\2a66ea6b955eabdb437c6cfcac78c45e\AspNetMMCExt.ni.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 839680 c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 839680 c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 884736 c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 884736 c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 114688 c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 114688 c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 258048 c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 258048 c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 131072 c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 131072 c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 299008 c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 299008 c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 258048 c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 258048 c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 372736 c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 372736 c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 630784 c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 630784 c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 401408 c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 401408 c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 188416 c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 188416 c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 933888 c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 933888 c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 741376 c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 741376 c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 425984 c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 425984 c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 110592 c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 110592 c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 671744 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 671744 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 372736 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 372736 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 110592 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 110592 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 749568 c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 749568 c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 655360 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 655360 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 348160 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 348160 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 507904 c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 507904 c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 261120 c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 261120 c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 113664 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 113664 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 258048 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 258048 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 483840 c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 483840 c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2010-01-13 01:29 . 2009-08-13 13:55 1748992 c:\windows\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\GdiPlus.dll
+ 2009-07-21 07:03 . 2009-07-21 07:03 1348432 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9876.0_x-ww_a621d1d5\msxml4.dll
+ 2007-12-10 00:30 . 2009-08-07 02:23 1929952 c:\windows\system32\wuaueng.dll
- 2004-08-04 05:57 . 2008-06-18 12:03 2458112 c:\windows\system32\WMVCore.dll
+ 2004-08-04 05:57 . 2009-05-20 11:56 2458112 c:\windows\system32\WMVCore.dll
+ 2004-08-04 04:17 . 2009-08-14 12:19 1850112 c:\windows\system32\win32k.sys
+ 2004-08-04 05:56 . 2009-10-29 07:46 1168384 c:\windows\system32\urlmon.dll
+ 2004-08-04 05:56 . 2008-07-03 13:03 8460800 c:\windows\system32\shell32.dll
- 2004-08-04 05:56 . 2006-06-22 05:06 1435648 c:\windows\system32\query.dll
+ 2004-08-04 05:56 . 2009-07-17 16:27 1435648 c:\windows\system32\query.dll
+ 2004-08-04 05:56 . 2009-06-03 19:27 1290752 c:\windows\system32\quartz.dll
+ 2004-08-04 04:20 . 2009-08-04 13:58 2136064 c:\windows\system32\ntoskrnl.exe
- 2004-08-04 04:20 . 2008-08-14 09:58 2136064 c:\windows\system32\ntoskrnl.exe
- 2004-08-03 22:59 . 2008-08-14 09:22 2015744 c:\windows\system32\ntkrnlpa.exe
+ 2004-08-03 22:59 . 2009-08-04 13:13 2015744 c:\windows\system32\ntkrnlpa.exe
+ 2009-07-21 07:05 . 2009-07-21 07:05 1348432 c:\windows\system32\msxml4.dll
+ 2004-08-04 05:56 . 2009-07-31 04:57 1172480 c:\windows\system32\msxml3.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 3598336 c:\windows\system32\mshtml.dll
+ 2007-08-14 02:54 . 2009-10-29 07:46 6067200 c:\windows\system32\ieframe.dll
+ 2007-02-13 00:10 . 2009-06-29 08:33 2452872 c:\windows\system32\ieapfltr.dat
- 2007-12-09 16:18 . 2009-08-23 03:06 2472328 c:\windows\system32\FNTCACHE.DAT
+ 2007-12-09 16:18 . 2010-01-13 08:58 2472328 c:\windows\system32\FNTCACHE.DAT
+ 2009-08-18 06:33 . 2009-08-18 06:33 1193832 c:\windows\system32\FM20.DLL
+ 2007-12-10 00:30 . 2009-08-07 02:23 1929952 c:\windows\system32\dllcache\wuaueng.dll
+ 2004-08-04 05:57 . 2009-05-20 11:56 2458112 c:\windows\system32\dllcache\WMVCore.dll
- 2004-08-04 05:57 . 2008-06-18 12:03 2458112 c:\windows\system32\dllcache\WMVCore.dll
+ 2004-08-04 04:17 . 2009-08-14 12:19 1850112 c:\windows\system32\dllcache\win32k.sys
+ 2004-08-04 05:56 . 2009-10-29 07:46 1168384 c:\windows\system32\dllcache\urlmon.dll
+ 2004-08-04 05:56 . 2008-07-03 13:03 8460800 c:\windows\system32\dllcache\shell32.dll
+ 2004-08-04 05:56 . 2009-07-17 16:27 1435648 c:\windows\system32\dllcache\query.dll
- 2004-08-04 05:56 . 2006-06-22 05:06 1435648 c:\windows\system32\dllcache\query.dll
+ 2004-08-04 05:56 . 2009-06-03 19:27 1290752 c:\windows\system32\dllcache\quartz.dll
- 2007-02-28 09:10 . 2008-08-14 10:00 2180352 c:\windows\system32\dllcache\ntoskrnl.exe
+ 2007-02-28 09:10 . 2009-08-04 14:00 2180352 c:\windows\system32\dllcache\ntoskrnl.exe
+ 2007-02-28 08:38 . 2009-08-04 13:13 2015744 c:\windows\system32\dllcache\ntkrpamp.exe
- 2007-02-28 08:38 . 2008-08-14 09:22 2015744 c:\windows\system32\dllcache\ntkrpamp.exe
+ 2007-02-28 08:38 . 2009-08-04 13:13 2057728 c:\windows\system32\dllcache\ntkrnlpa.exe
- 2007-02-28 08:38 . 2008-08-14 09:22 2057728 c:\windows\system32\dllcache\ntkrnlpa.exe
+ 2007-02-28 09:08 . 2009-08-04 13:58 2136064 c:\windows\system32\dllcache\ntkrnlmp.exe
- 2007-02-28 09:08 . 2008-08-14 09:58 2136064 c:\windows\system32\dllcache\ntkrnlmp.exe
+ 2004-08-04 05:56 . 2009-07-31 04:57 1172480 c:\windows\system32\dllcache\msxml3.dll
+ 2007-12-10 00:30 . 2009-07-10 13:42 1315328 c:\windows\system32\dllcache\msoe.dll
+ 2004-08-04 05:56 . 2009-10-29 07:46 3598336 c:\windows\system32\dllcache\mshtml.dll
+ 2007-12-11 19:05 . 2009-10-29 07:46 6067200 c:\windows\system32\dllcache\ieframe.dll
+ 2007-12-11 19:05 . 2009-06-29 08:33 2452872 c:\windows\system32\dllcache\ieapfltr.dat
+ 2009-08-08 09:35 . 2009-08-08 09:35 5849920 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
+ 2009-08-08 09:35 . 2009-08-08 09:35 4345856 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
- 2007-04-14 05:35 . 2007-04-14 05:35 1265664 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Web.dll
+ 2008-05-28 08:35 . 2008-05-28 08:35 1265664 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.Web.dll
- 2007-04-14 05:35 . 2007-04-14 05:35 1232896 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.dll
+ 2008-05-28 08:35 . 2008-05-28 08:35 1232896 c:\windows\Microsoft.NET\Framework\v1.1.4322\System.dll
- 2007-04-14 04:57 . 2007-04-14 04:57 2514944 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
+ 2008-05-28 07:48 . 2008-05-28 07:48 2514944 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
- 2007-04-14 04:57 . 2007-04-14 04:57 2523136 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll
+ 2008-05-28 07:48 . 2008-05-28 07:48 2523136 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll
+ 2008-05-28 07:43 . 2008-05-28 07:43 2142208 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll
- 2007-04-14 04:50 . 2007-04-14 04:50 2142208 c:\windows\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll
+ 2009-01-08 03:25 . 2009-01-08 03:25 5046784 c:\windows\Installer\4e020.msp
+ 2009-12-03 21:15 . 2009-12-03 21:15 5004288 c:\windows\Installer\101b655.msp
+ 2009-05-27 01:54 . 2009-05-27 01:54 4192768 c:\windows\Installer\101b63f.msp
+ 2009-08-18 19:58 . 2009-08-18 19:58 8301056 c:\windows\Installer\101b624.msp
+ 2009-04-24 19:30 . 2009-04-24 19:30 2583552 c:\windows\Installer\101b60d.msp
+ 2009-02-26 02:08 . 2009-02-26 02:08 8311808 c:\windows\Installer\101b5f5.msp
+ 2009-08-05 14:49 . 2009-08-05 14:49 3457024 c:\windows\Installer\101b5e0.msp
+ 2009-04-24 19:28 . 2009-04-24 19:28 4450816 c:\windows\Installer\101b5c8.msp
+ 2009-07-27 11:31 . 2009-07-27 11:31 3738624 c:\windows\Installer\101b5b0.msp
+ 2009-08-18 19:57 . 2009-08-18 19:57 9122304 c:\windows\Installer\101b59a.msp
+ 2009-08-10 06:32 . 2009-08-10 06:32 5288960 c:\windows\Installer\101b583.msp
+ 2009-10-16 14:09 . 2009-10-16 14:09 2518016 c:\windows\Installer\101b55e.msp
+ 2009-08-18 20:08 . 2009-08-18 20:08 1373696 c:\windows\Installer\101b532.msp
+ 2009-04-24 19:29 . 2009-04-24 19:29 9013760 c:\windows\Installer\101b4be.msp
- 2007-12-10 01:41 . 2009-01-15 07:57 1172240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
+ 2007-12-10 01:41 . 2010-01-13 05:05 1172240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
- 2007-12-10 01:41 . 2009-01-15 07:57 1165584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
+ 2007-12-10 01:41 . 2010-01-13 05:05 1165584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
+ 2007-08-24 13:10 . 2007-08-24 13:10 3735424 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6215\VVIEWER.DLL
+ 2007-10-06 02:31 . 2007-10-06 02:31 5287984 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6215\IPEDITOR.DLL
+ 2007-08-23 07:03 . 2007-08-23 07:03 1195888 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6215\FM20.DLL
+ 2010-01-13 04:56 . 2008-12-20 23:15 1160192 c:\windows\ie7updates\KB976325-IE7\urlmon.dll
+ 2010-01-13 04:56 . 2009-01-17 04:35 3594752 c:\windows\ie7updates\KB976325-IE7\mshtml.dll
+ 2010-01-13 04:56 . 2008-12-20 23:15 6066688 c:\windows\ie7updates\KB976325-IE7\ieframe.dll
+ 2010-01-13 04:56 . 2007-07-01 03:31 2455488 c:\windows\ie7updates\KB976325-IE7\ieapfltr.dat
+ 2010-01-13 00:11 . 2008-10-16 20:38 1160192 c:\windows\ie7updates\KB961260-IE7\urlmon.dll
+ 2010-01-13 00:11 . 2008-12-13 06:40 3593216 c:\windows\ie7updates\KB961260-IE7\mshtml.dll
+ 2010-01-13 00:11 . 2008-10-16 20:38 6066176 c:\windows\ie7updates\KB961260-IE7\ieframe.dll
+ 2005-03-02 00:59 . 2009-08-04 14:00 2180352 c:\windows\Driver Cache\i386\ntoskrnl.exe
- 2005-03-02 00:59 . 2008-08-14 10:00 2180352 c:\windows\Driver Cache\i386\ntoskrnl.exe
+ 2005-03-02 00:34 . 2009-08-04 13:13 2015744 c:\windows\Driver Cache\i386\ntkrpamp.exe
- 2005-03-02 00:34 . 2008-08-14 09:22 2015744 c:\windows\Driver Cache\i386\ntkrpamp.exe
+ 2005-03-02 00:34 . 2009-08-04 13:13 2057728 c:\windows\Driver Cache\i386\ntkrnlpa.exe
- 2005-03-02 00:34 . 2008-08-14 09:22 2057728 c:\windows\Driver Cache\i386\ntkrnlpa.exe
- 2005-03-02 00:57 . 2008-08-14 09:58 2136064 c:\windows\Driver Cache\i386\ntkrnlmp.exe
+ 2005-03-02 00:57 . 2009-08-04 13:58 2136064 c:\windows\Driver Cache\i386\ntkrnlmp.exe
+ 2010-01-13 04:52 . 2010-01-13 04:52 4792320 c:\windows\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_40532300\System.dll
+ 2010-01-13 04:51 . 2010-01-13 04:51 1966080 c:\windows\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_2710b771\System.dll
+ 2010-01-13 04:52 . 2010-01-13 04:52 5513216 c:\windows\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_c4b18896\System.Xml.dll
+ 2010-01-13 04:52 . 2010-01-13 04:52 2088960 c:\windows\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_6efb99a9\System.Xml.dll
+ 2010-01-13 04:51 . 2010-01-13 04:51 3018752 c:\windows\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_ab2d4f69\System.Windows.Forms.dll
+ 2010-01-13 04:52 . 2010-01-13 04:52 7884800 c:\windows\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_0b4f75b0\System.Windows.Forms.dll
+ 2010-01-13 04:52 . 2010-01-13 04:52 2244608 c:\windows\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_524bf56e\System.Drawing.dll
+ 2010-01-13 04:52 . 2010-01-13 04:52 1470464 c:\windows\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_8a3a236f\System.Design.dll
+ 2010-01-13 04:52 . 2010-01-13 04:52 3395584 c:\windows\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_75ac370c\System.Design.dll
+ 2010-01-13 04:52 . 2010-01-13 04:52 3391488 c:\windows\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_38b44745\mscorlib.dll
+ 2010-01-13 04:52 . 2010-01-13 04:52 8908800 c:\windows\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_2779771e\mscorlib.dll
+ 2010-01-13 04:56 . 2010-01-13 04:56 8310784 c:\windows\assembly\NativeImages_v2.0.50727_32\System\ccfeb59f4a9b75909eb2d1121232a769\System.ni.dll
+ 2010-01-13 04:57 . 2010-01-13 04:57 5771264 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\717cce3690d643df19d6a4117283048e\System.Xml.ni.dll
+ 2010-01-13 04:59 . 2010-01-13 04:59 1986560 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\aa319d767042e97c692041f76f123f2f\System.Web.Services.ni.dll
+ 2010-01-13 04:59 . 2010-01-13 04:59 2342912 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\b7092e8403b56e3913488855e45a35ff\System.Web.Mobile.ni.dll
+ 2010-01-13 04:56 . 2010-01-13 04:56 1667072 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\e58e83951091f2616344c5d2a6787660\System.Drawing.ni.dll
+ 2010-01-13 04:59 . 2010-01-13 04:59 1224704 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\e96695c65a4104ee4687f3e5f0581d34\System.DirectoryServices.ni.dll
+ 2010-01-13 04:58 . 2010-01-13 04:58 1798144 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\f0a1895c7d475f156ed4cdd9f0bd2797\System.Deployment.ni.dll
+ 2010-01-13 04:56 . 2010-01-13 04:56 7102464 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\b39a611d2b2fc659d5472dd76b24d3b2\System.Data.ni.dll
+ 2010-01-13 04:58 . 2010-01-13 04:58 1011712 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e2de26078a8c3d29dbfcf408e23aa2b1\System.Configuration.ni.dll
+ 2010-01-13 04:58 . 2010-01-13 04:58 1740800 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\ed0cdc51d89bb41a9ab760ca3cf52bf9\Microsoft.VisualBasic.ni.dll
+ 2010-01-13 04:58 . 2010-01-13 04:58 1695744 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\b846f5c1b90e4222e79a420d92062f79\Microsoft.Build.Tasks.ni.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 3076096 c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 3076096 c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 2068480 c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 2068480 c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 5013504 c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 5013504 c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 5070848 c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 5070848 c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 5431296 c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 5431296 c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 3036160 c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
- 2008-01-24 09:02 . 2008-01-24 09:02 3036160 c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
+ 2010-01-13 04:54 . 2010-01-13 04:54 4345856 c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2010-01-13 04:51 . 2010-01-13 04:51 1232896 c:\windows\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
- 2007-12-15 09:25 . 2007-12-15 09:25 1232896 c:\windows\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll
- 2007-12-15 09:25 . 2007-12-15 09:25 1265664 c:\windows\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
+ 2010-01-13 04:51 . 2010-01-13 04:51 1265664 c:\windows\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll
+ 2004-08-04 05:56 . 2009-07-14 06:43 10841088 c:\windows\system32\wmp.dll
+ 2008-12-28 04:32 . 2010-01-04 23:17 29634504 c:\windows\system32\MRT.exe
+ 2004-08-04 05:56 . 2009-07-14 06:43 10841088 c:\windows\system32\dllcache\wmp.dll
+ 2009-08-11 04:08 . 2009-08-11 04:08 11315712 c:\windows\Microsoft.NET\Framework\v1.1.4322\Updates\M953297\M953297Uninstall.msp
+ 2010-01-13 04:52 . 2010-01-13 04:52 15709696 c:\windows\Installer\101b57b.msp
+ 2009-08-10 21:09 . 2009-08-10 21:09 17254912 c:\windows\Installer\101b549.msp
+ 2009-02-26 02:07 . 2009-02-26 02:07 11646464 c:\windows\Installer\101b51c.msp
+ 2009-08-18 19:50 . 2009-08-18 19:50 12022272 c:\windows\Installer\101b4f9.msp
+ 2010-01-13 04:57 . 2010-01-13 04:57 13193216 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\9d25b8eabd8203e4d0490363140c4526\System.Windows.Forms.ni.dll
+ 2010-01-13 04:59 . 2010-01-13 04:59 12517376 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\16a34a274ee877b4cf03d1a1bb57eb82\System.Web.ni.dll
+ 2010-01-13 04:56 . 2010-01-13 04:56 10936320 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Design\2aab58cae4d998cf867f483302e94c27\System.Design.ni.dll
+ 2010-01-13 04:55 . 2010-01-13 04:55 11436032 c:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\fee8c8ba9b84a7832274adcbfc9d5ca4\mscorlib.ni.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-10-23 2363392]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-08 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 2178832]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 563984]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-01 282624]
"RTHDCPL"="c:\windows\RTHDCPL.EXE" [2008-05-14 16862720]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-04 8523776]
"nwiz"="c:\windows\system32\nwiz.exe" [2007-12-04 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-04 81920]

c:\documents and settings\Gaming\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Event Reminder.lnk - c:\program files\The Print Shop 23\Remind.exe [2008-7-16 344064]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^tammy^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\tammy\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^tammy^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\tammy\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-11 03:51 39792 -c--a-w- c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-02-19 18:10 267048 -c--a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
2007-10-25 21:33 563984 ----a-w- c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2007-10-25 21:37 2178832 ----a-w- c:\program files\Logitech\QuickCam\Quickcam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2006-09-01 23:57 282624 ----a-w- c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2006-07-21 23:14 86016 -c----r- c:\windows\SoundMan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-10-08 23:13 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2008-06-09 08:36 185632 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USRobotics USB Internet Mini Phone]
2007-02-15 18:31 338944 -c--a-w- c:\program files\U.S. Robotics\USB Internet Mini Phone\USRobotics USB Internet Mini Phone.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USRobotics USB Internet Mini Phone Control Panel]
2007-02-15 18:29 2123264 -c--a-w- c:\program files\U.S. Robotics\USB Internet Mini Phone\USB Internet Mini Phone UI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
2007-08-30 23:43 4670704 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"FLEXnet Licensing Service"=3 (0x3)
"iPod Service"=3 (0x3)
"gusvc"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"aawservice"=2 (0x2)
"Symantec AntiVirus"=2 (0x2)
"StkASSrv"=2 (0x2)
"SPBBCSvc"=2 (0x2)
"DefWatch"=2 (0x2)
"ccSetMgr"=2 (0x2)
"ccEvtMgr"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\lxdecoms.exe"=
"c:\\Program Files\\Lexmark 4800 Series\\frun.exe"=
"c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\Scan\\ScanMan6.exe"=
"c:\\Program Files\\Lexmark Fax Solutions\\FaxCtr.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdepswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdetime.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdejswx.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Lexmark 4800 Series\\Wireless\\lxdewpss.exe"=
"c:\\WINDOWS\\system32\\lxdecfg.exe"=
"c:\\Program Files\\Logitech\\QuickCam\\Quickcam.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Lexmark 4800 Series\\lxdemon.exe"=

R0 ahcix86;ahcix86;c:\windows\system32\drivers\ahcix86.sys [10/3/2008 3:28 PM 176136]
R2 lxde_device;lxde_device;c:\windows\system32\lxdecoms.exe -service --> c:\windows\system32\lxdecoms.exe -service [?]
R2 LxrSII1d;Secure II Driver;c:\windows\system32\drivers\LxrSII1d.sys [4/5/2008 11:35 PM 70016]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [12/9/2007 6:29 PM 717296]
S1 de436477;de436477;c:\windows\system32\drivers\de436477.sys [2/13/2009 12:31 PM 0]
S2 lxdeCATSCustConnectService;lxdeCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdeserv.exe [12/12/2007 2:42 PM 99248]
S3 PsSdk30;PsSdk30;\??\c:\windows\system32\Drivers\PsSdk30.drv --> c:\windows\system32\Drivers\PsSdk30.drv [?]
S3 xbreader;MaxDrive XBox Driver (xbreader.sys);c:\windows\system32\drivers\xbreader.sys [1/2/2001 9:53 PM 19677]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-10-23 02:55 451872 -c--a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-01-14 c:\windows\Tasks\User_Feed_Synchronization-{59B3E264-20D2-4BFE-864F-F7C4E1F84BFC}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 02:36]

2010-01-14 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2010-01-14 05:18]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.sparkpeople.com/websearch/
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\tammy\Application Data\Mozilla\Firefox\Profiles\p04rj5jz.Default User\
FF - prefs.js: browser.startup.homepage - hxxp://www.sparkpeople.com/
FF - plugin: c:\documents and settings\tammy\Application Data\Mozilla\Firefox\Profiles\p04rj5jz.Default User\extensions\[email protected]\platform\WINNT_x86-msvc\plugins\npmnqmp071303000004.dll
FF - plugin: c:\documents and settings\tammy\Local Settings\Application Data\Yahoo!\BrowserPlus\2.4.21\Plugins\npybrowserplus_2.4.21.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npampx3.0.84.2.dll
FF - HiddenExtension: XUL Cache: {DB1C0118-51D0-472E-B776-5A9BC86F3A1E} - c:\documents and settings\tammy\Local Settings\Application Data\{DB1C0118-51D0-472E-B776-5A9BC86F3A1E}
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-14 16:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PsSdk30]
"ImagePath"="\??\c:\windows\system32\Drivers\PsSdk30.drv"
.
Completion time: 2010-01-14 16:16:42
ComboFix-quarantined-files.txt 2010-01-14 23:16
ComboFix2.txt 2010-01-11 21:44
ComboFix3.txt 2009-02-19 06:40
ComboFix4.txt 2009-02-16 02:09
ComboFix5.txt 2010-01-14 23:06

Pre-Run: 2,815,209,472 bytes free
Post-Run: 2,783,846,400 bytes free

- - End Of File - - 3DC3F3835744CC698F7545E8E2CE6116

[azarl]

Hi

• We'll look at the default browser later.
• We'll update Java when we've fixed this infection.
• You have a nasty rootkit infection which unfortunately infected or damage the Windows kernel, the kernel handles many of the key functions of the operating system. When we've cleared the rest of the rootkit, we'll have a better idea of what if anything is damaged.

ComboFix Script

• Close any open browsers.
• Close/disable all antivirus and anti malware programs so they do not interfere with the running of ComboFix.
• Open notepad and copy/paste the text in the quote box below into it:

Driver::
de436477
File::
c:\windows\system32\drivers\de436477.sys

Save this as CFScript.txt, in the same location as ComboFix.exe




Referring to the picture above, drag CFScript into ComboFix.exe

When finished, it will produce a log for you at C:\ComboFix.txt which I need you to include in your next reply.

[rklamer]

Sorry for the late reply...

ComboFix 10-01-16.04 - tammy 01/18/2010 4:04.10.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1021.653 [GMT -7:00]
Running from: c:\documents and settings\tammy\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\tammy\Desktop\CFScript.txt

FILE ::
"c:\windows\system32\drivers\de436477.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\de436477.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_de436477


((((((((((((((((((((((((( Files Created from 2009-12-18 to 2010-01-18 )))))))))))))))))))))))))))))))
.

2010-01-15 15:45 . 2010-01-15 15:45 -------- d-----w- c:\windows\system32\XPSViewer
2010-01-15 15:45 . 2010-01-15 15:45 -------- d-----w- c:\program files\Reference Assemblies
2010-01-15 15:44 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-01-15 15:44 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-01-15 15:44 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-01-15 15:44 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2010-01-15 15:44 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2010-01-15 15:44 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-01-15 15:44 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-01-15 15:44 . 2010-01-15 15:44 -------- d-----w- C:\17fa7fbb9aa743a2b4f61dd0f96e8747
2010-01-15 15:44 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2010-01-15 15:44 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2010-01-15 15:44 . 2010-01-15 16:09 -------- d-----w- c:\windows\SxsCaPendDel
2010-01-15 15:40 . 2010-01-15 15:40 -------- d-----w- c:\program files\MSXML 6.0
2010-01-14 05:21 . 2010-01-14 05:21 -------- d-----w- c:\windows\system32\KB905474
2010-01-14 05:21 . 2009-03-11 05:26 1403264 ----a-w- c:\windows\system32\KB905474\wganotifypackageinner.exe
2010-01-14 05:21 . 2009-03-11 05:18 453512 ----a-w- c:\windows\system32\KB905474\wgasetup.exe
2010-01-13 04:49 . 2010-01-13 04:49 -------- d-----w- c:\windows\ServicePackFiles
2010-01-11 22:18 . 2007-04-16 16:07 986112 ------w- C:\kernel32.dll
2010-01-07 22:35 . 2010-01-07 22:35 -------- d--h--w- c:\windows\PIF
2010-01-07 21:19 . 2010-01-07 21:19 -------- d-----w- c:\program files\ERUNT

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-16 10:19 . 2007-12-10 01:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-16 10:11 . 2007-12-10 01:40 -------- d-----w- c:\program files\Microsoft Works
2010-01-15 15:45 . 2007-12-10 01:40 -------- d-----w- c:\program files\MSBuild
2010-01-13 08:57 . 2008-11-14 22:09 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-11 02:43 . 2008-02-10 03:31 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-07 21:27 . 2008-10-25 20:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-07 21:27 . 2010-01-07 21:27 5061520 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-12-30 21:55 . 2008-10-25 20:45 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-30 21:54 . 2008-10-25 20:45 19160 -c--a-w- c:\windows\system32\drivers\mbam.sys
2009-12-18 04:44 . 2008-08-02 20:25 -------- d-----w- c:\documents and settings\All Users\Application Data\LxThumbs
2009-12-14 19:15 . 2009-12-14 19:15 2146304 ----a-w- c:\windows\system32\GPhotos.scr
2009-11-28 04:02 . 2007-12-12 05:05 -------- d-----w- c:\program files\Google
2009-11-21 16:36 . 2004-08-04 05:56 470528 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-10-29 07:46 . 2004-08-04 05:56 832512 ------w- c:\windows\system32\wininet.dll
2009-10-29 07:46 . 2004-08-04 05:56 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:46 . 2004-08-04 05:56 17408 ------w- c:\windows\system32\corpol.dll
2009-10-21 06:00 . 2004-08-04 05:56 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 06:00 . 2004-08-04 05:56 25088 ----a-w- c:\windows\system32\httpapi.dll
2007-12-12 17:38 . 2007-12-12 17:38 23405072 -c--a-w- c:\program files\AdbeRdr811_en_US.exe
2007-03-17 06:00 . 2008-03-13 21:53 35979 ----a-w- c:\program files\Photoshop CS3 Read Me.html
2009-03-01 09:24 . 2009-02-26 19:46 11649056 -csha-w- c:\windows\system32\drivers\fidbox.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-10-23 2363392]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-08 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 2178832]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 563984]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-01 282624]
"RTHDCPL"="c:\windows\RTHDCPL.EXE" [2008-05-14 16862720]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-04 8523776]
"nwiz"="c:\windows\system32\nwiz.exe" [2007-12-04 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-04 81920]

c:\documents and settings\Gaming\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Event Reminder.lnk - c:\program files\The Print Shop 23\Remind.exe [2008-7-16 344064]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^tammy^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\tammy\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^tammy^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\tammy\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-11 03:51 39792 -c--a-w- c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2008-02-19 18:10 267048 -c--a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechCommunicationsManager]
2007-10-25 21:33 563984 ----a-w- c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2007-10-25 21:37 2178832 ----a-w- c:\program files\Logitech\QuickCam\Quickcam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2006-09-01 23:57 282624 ----a-w- c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2006-07-21 23:14 86016 -c----r- c:\windows\SoundMan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-10-08 23:13 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2008-06-09 08:36 185632 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USRobotics USB Internet Mini Phone]
2007-02-15 18:31 338944 -c--a-w- c:\program files\U.S. Robotics\USB Internet Mini Phone\USRobotics USB Internet Mini Phone.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USRobotics USB Internet Mini Phone Control Panel]
2007-02-15 18:29 2123264 -c--a-w- c:\program files\U.S. Robotics\USB Internet Mini Phone\USB Internet Mini Phone UI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
2007-08-30 23:43 4670704 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"FLEXnet Licensing Service"=3 (0x3)
"iPod Service"=3 (0x3)
"gusvc"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"aawservice"=2 (0x2)
"Symantec AntiVirus"=2 (0x2)
"StkASSrv"=2 (0x2)
"SPBBCSvc"=2 (0x2)
"DefWatch"=2 (0x2)
"ccSetMgr"=2 (0x2)
"ccEvtMgr"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\lxdecoms.exe"=
"c:\\Program Files\\Lexmark 4800 Series\\frun.exe"=
"c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\Scan\\ScanMan6.exe"=
"c:\\Program Files\\Lexmark Fax Solutions\\FaxCtr.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdepswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdetime.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdejswx.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Lexmark 4800 Series\\Wireless\\lxdewpss.exe"=
"c:\\WINDOWS\\system32\\lxdecfg.exe"=
"c:\\Program Files\\Logitech\\QuickCam\\Quickcam.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Lexmark 4800 Series\\lxdemon.exe"=

R0 ahcix86;ahcix86;c:\windows\system32\drivers\ahcix86.sys [10/3/2008 3:28 PM 176136]
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [12/9/2007 6:29 PM 717296]
R2 lxde_device;lxde_device;c:\windows\system32\lxdecoms.exe -service --> c:\windows\system32\lxdecoms.exe -service [?]
R2 LxrSII1d;Secure II Driver;c:\windows\system32\drivers\LxrSII1d.sys [4/5/2008 11:35 PM 70016]
S2 lxdeCATSCustConnectService;lxdeCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdeserv.exe [12/12/2007 2:42 PM 99248]
S3 PsSdk30;PsSdk30;\??\c:\windows\system32\Drivers\PsSdk30.drv --> c:\windows\system32\Drivers\PsSdk30.drv [?]
S3 xbreader;MaxDrive XBox Driver (xbreader.sys);c:\windows\system32\drivers\xbreader.sys [1/2/2001 9:53 PM 19677]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-10-23 02:55 451872 -c--a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-01-18 c:\windows\Tasks\User_Feed_Synchronization-{59B3E264-20D2-4BFE-864F-F7C4E1F84BFC}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 02:36]

2010-01-18 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2010-01-14 05:18]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.sparkpeople.com/websearch/
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
FF - ProfilePath - c:\documents and settings\tammy\Application Data\Mozilla\Firefox\Profiles\p04rj5jz.Default User\
FF - prefs.js: browser.startup.homepage - hxxp://www.sparkpeople.com/
FF - plugin: c:\documents and settings\tammy\Application Data\Mozilla\Firefox\Profiles\p04rj5jz.Default User\extensions\[email protected]\platform\WINNT_x86-msvc\plugins\npmnqmp071303000004.dll
FF - plugin: c:\documents and settings\tammy\Local Settings\Application Data\Yahoo!\BrowserPlus\2.4.21\Plugins\npybrowserplus_2.4.21.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npampx3.0.84.2.dll
FF - HiddenExtension: XUL Cache: {DB1C0118-51D0-472E-B776-5A9BC86F3A1E} - c:\documents and settings\tammy\Local Settings\Application Data\{DB1C0118-51D0-472E-B776-5A9BC86F3A1E}
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-18 12:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x86F671F8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf76eafc3
\Driver\ACPI -> ACPI.sys @ 0xf7445cb8
\Driver\atapi -> 0x86f671f8
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058241c
ParseProcedure -> ntkrnlpa.exe @ 0x8058155c
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058241c
ParseProcedure -> ntkrnlpa.exe @ 0x8058155c
NDIS: Realtek RTL8168C(P)/8111C(P) PCI-E Gigabit Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xf728fba0
PacketIndicateHandler -> NDIS.sys @ 0xf729cb21
SendHandler -> NDIS.sys @ 0xf727a87b
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PsSdk30]
"ImagePath"="\??\c:\windows\system32\Drivers\PsSdk30.drv"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(7672)
c:\windows\system32\WININET.dll
c:\program files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\windows\system32\lxdecoms.exe
c:\windows\system32\LxrSII1s.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\Yahoo!\Messenger\ymsgr_tray.exe
c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
.
**************************************************************************
.
Completion time: 2010-01-18 12:47:54 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-18 19:47
ComboFix2.txt 2010-01-14 23:16
ComboFix3.txt 2010-01-11 21:44
ComboFix4.txt 2009-02-19 06:40
ComboFix5.txt 2010-01-18 11:03

Pre-Run: 992,382,976 bytes free
Post-Run: 926,892,032 bytes free

- - End Of File - - 0BEE38E6247CF8020233785B6B001C30

[azarl]

Let's try OTL again now - please download the latest version

OTL
OTL is currently our primary tool for searching key areas of the registry and other system locations for the telltale signs of malware. It generates a comprehensive log, and offers an initial diagnosis.

Important note: HijackThis has been replaced by OTL in this guide. Since being acquired by TrendMicro, HijackThis has not been regularly updated. Many infections are now able to hide partly, or completely from a HijackThis scan. OTL is authored by one of our staff members (OldTimer). It includes all the scan locations of HijackThis and more. It's not only a more comprehensive scan tool, but also offers more powerful removal features.

• Download OTL to your Desktop
• Double click on the OTL icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Under the Custom Scan box paste this in:
  

  netsvcs
  msconfig
  safebootminimal
  safebootnetwork
  activex
  drivers32
  %SYSTEMDRIVE%\*.exe
  /md5start
  hal.dll
  eventlog.dll
  scecli.dll
  netlogon.dll
  cngaudit.dll
  sceclt.dll
  ntelogon.dll
  logevent.dll
  iaStor.sys
  nvstor.sys
  atapi.sys
  IdeChnDr.sys
  viasraid.sys
  AGP440.sys
  vaxscsi.sys
  nvatabus.sys
  viamraid.sys
  nvata.sys
  nvgts.sys
  iastorv.sys
  ViPrt.sys
  eNetHook.dll
  ahcix86.sys
  KR10N.sys
  nvstor32.sys
  ahcix86s.sys
  nvrd32.sys
  /md5stop
  %systemroot%\system32\*.sys /s /md5
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
  CREATERESTOREPOINT
  

• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and paste them into your reply.

[rklamer]

Hey,

OTL worked this time; however, I did not receive an Extras.txt file. Only an OTL.Txt file. I double-checked the directory where OTL was downloaded to, as well -- all that was there was the OTL.Txt file.


OTL logfile created on: 1/19/2010 6:55:07 PM - Run 2
OTL by OldTimer - Version 3.1.25.2 Folder = C:\Documents and Settings\tammy\My Documents\Downloads
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,021.00 Mb Total Physical Memory | 538.00 Mb Available Physical Memory | 53.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 86.00% Paging File free
Paging file location(s): C:\pagefile.sys 1488 2976 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 76.68 Gb Total Space | 0.87 Gb Free Space | 1.13% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: GATEWAY
Current User Name: tammy
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/01/19 18:54:32 | 00,547,328 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\tammy\My Documents\Downloads\OTL.exe
PRC - [2010/01/19 07:59:31 | 00,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/10/08 16:13:19 | 00,039,408 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2008/10/25 11:44:34 | 00,031,072 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
PRC - [2008/10/22 20:03:52 | 00,073,728 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe
PRC - [2008/10/22 19:57:34 | 02,363,392 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
PRC - [2008/08/08 05:11:12 | 00,490,952 | ---- | M] (DT Soft Ltd) -- C:\Program Files\DAEMON Tools Lite\daemon.exe
PRC - [2008/06/09 15:59:31 | 00,066,872 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe
PRC - [2008/05/13 18:50:46 | 16,862,720 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RTHDCPL.exe
PRC - [2007/12/04 10:41:00 | 00,155,716 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe
PRC - [2007/10/25 14:37:32 | 02,178,832 | ---- | M] () -- C:\Program Files\Logitech\QuickCam\Quickcam.exe
PRC - [2007/10/25 14:33:22 | 00,563,984 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
PRC - [2007/10/25 14:32:58 | 00,407,824 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
PRC - [2007/10/19 11:19:22 | 00,141,848 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
PRC - [2007/10/19 11:17:28 | 00,186,904 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
PRC - [2007/08/30 16:43:18 | 00,103,664 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe
PRC - [2007/07/24 14:17:08 | 00,229,376 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2007/06/13 03:23:07 | 01,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/05/29 02:07:58 | 00,598,960 | ---- | M] ( ) -- C:\WINDOWS\system32\lxdecoms.exe
PRC - [2005/05/19 13:48:34 | 00,053,248 | ---- | M] () -- C:\WINDOWS\system32\LxrSII1s.exe


========== Modules (SafeList) ==========

MOD - [2010/01/19 18:54:32 | 00,547,328 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\tammy\My Documents\Downloads\OTL.exe
MOD - [2007/10/19 11:19:10 | 00,109,080 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcInj.dll
MOD - [2006/08/25 08:45:55 | 01,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - File not found [On_Demand | Stopped] -- -- (ALG)
SRV - [2009/10/08 16:13:18 | 00,182,768 | ---- | M] (Google) [On_Demand | Stopped] -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc)
SRV - [2008/11/04 01:06:28 | 00,441,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2008/10/25 11:44:08 | 00,065,888 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service)
SRV - [2008/10/22 20:03:52 | 00,073,728 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe -- (LightScribeService)
SRV - [2008/07/05 18:51:17 | 00,611,664 | ---- | M] (Lavasoft) [Disabled | Stopped] -- C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe -- (aawservice)
SRV - [2008/06/09 15:59:31 | 00,066,872 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\PnkBstrA.exe -- (PnkBstrA)
SRV - [2008/02/19 11:10:24 | 00,504,104 | ---- | M] (Apple Inc.) [On_Demand | Stopped] -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service)
SRV - [2007/12/04 10:41:00 | 00,155,716 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc)
SRV - [2007/10/19 11:21:16 | 00,141,848 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe -- (LVSrvLauncher)
SRV - [2007/10/19 11:19:22 | 00,141,848 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2007/10/19 11:17:28 | 00,186,904 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe -- (LVCOMSer)
SRV - [2007/08/28 17:04:25 | 02,999,664 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE -- (LiveUpdate)
SRV - [2007/07/24 14:17:08 | 00,229,376 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)
SRV - [2007/05/29 02:07:58 | 00,598,960 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\lxdecoms.exe -- (lxde_device)
SRV - [2007/05/29 02:06:43 | 00,099,248 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdeserv.exe -- (lxdeCATSCustConnectService)
SRV - [2006/10/26 15:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2006/05/24 00:49:14 | 00,024,576 | ---- | M] (Syntek America Inc.) [Disabled | Stopped] -- C:\WINDOWS\system32\StkASv2K.exe -- (StkASSrv)
SRV - [2005/05/19 13:48:34 | 00,053,248 | ---- | M] () [Auto | Running] -- C:\WINDOWS\System32\LxrSII1s.exe -- (LxrSII1s)
SRV - [2005/04/03 23:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.sparkpeople.com/websearch/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.sparkpeople.com/"
FF - prefs.js..extensions.enabledItems: [email protected]:1.0.0.071303000004
FF - prefs.js..extensions.enabledItems: {DB1C0118-51D0-472E-B776-5A9BC86F3A1E}:1.0

FF - HKLM\software\mozilla\Firefox\Extensions\\{DB1C0118-51D0-472E-B776-5A9BC86F3A1E}: C:\Documents and Settings\tammy\Local Settings\Application Data\{DB1C0118-51D0-472E-B776-5A9BC86F3A1E} [2009/02/13 12:43:38 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/19 07:59:48 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/19 07:59:48 | 00,000,000 | ---D | M]

[2008/12/16 21:53:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\tammy\Application Data\Mozilla\Extensions
[2008/12/15 23:32:30 | 00,000,000 | ---D | M] -- C:\Documents and Settings\tammy\Application Data\Mozilla\Firefox\Profiles\amfzlpu6.default\extensions
[2008/09/19 00:02:24 | 00,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\tammy\Application Data\Mozilla\Firefox\Profiles\amfzlpu6.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2008/09/19 00:02:10 | 00,000,000 | ---D | M] (DownThemAll!) -- C:\Documents and Settings\tammy\Application Data\Mozilla\Firefox\Profiles\amfzlpu6.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2008/04/13 20:39:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\tammy\Application Data\Mozilla\Firefox\Profiles\amfzlpu6.default\extensions\[email protected]
[2008/12/16 21:55:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\tammy\Application Data\Mozilla\Firefox\Profiles\ebap5qjt.Default User\extensions
[2010/01/19 18:45:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\tammy\Application Data\Mozilla\Firefox\Profiles\p04rj5jz.Default User\extensions
[2010/01/17 16:23:41 | 00,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\tammy\Application Data\Mozilla\Firefox\Profiles\p04rj5jz.Default User\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/04/22 20:53:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\tammy\Application Data\Mozilla\Firefox\Profiles\p04rj5jz.Default User\extensions\[email protected]
[2008/12/19 00:31:09 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2007/01/23 18:41:00 | 00,800,344 | ---- | M] (America Online, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npampx3.0.84.2.dll

O1 HOSTS File: ([2010/01/18 12:39:06 | 00,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [GrooveMonitor] C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe ()
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\system32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\system32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Computer, Inc.)
O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)
O4 - HKCU..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Event Reminder.lnk = C:\Program Files\The Print Shop 23\Remind.exe (Broderbund Properties LLC)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.micr...heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.mi...b?1197245513500 (MUWebControl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebo...oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.ma...t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} http://www.adobe.com...obat/nos/gp.cab (get_atlcom Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\tammy\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\tammy\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (\ATI Control Panel\ecurity Pack) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/12/09 17:32:59 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2007/12/09 17:32:28 | 00,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

MsConfig - Services: "FLEXnet Licensing Service"
MsConfig - Services: "iPod Service"
MsConfig - Services: "gusvc"
MsConfig - Services: "Ati HotKey Poller"
MsConfig - Services: "Apple Mobile Device"
MsConfig - Services: "aawservice"
MsConfig - Services: "Symantec AntiVirus"
MsConfig - Services: "StkASSrv"
MsConfig - Services: "SPBBCSvc"
MsConfig - Services: "DefWatch"
MsConfig - Services: "ccSetMgr"
MsConfig - Services: "ccEvtMgr"
MsConfig - StartUpFolder: C:^Documents and Settings^tammy^Start Menu^Programs^Startup^Kodak EasyShare software.lnk - C:\PROGRA~1\Kodak\KODAKE~1\bin\EASYSH~1.EXE - File not found
MsConfig - StartUpFolder: C:^Documents and Settings^tammy^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE - (Microsoft Corporation)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig - StartUpReg: LogitechCommunicationsManager - hkey= - key= - C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe ()
MsConfig - StartUpReg: LogitechQuickCamRibbon - hkey= - key= - C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\qttask.exe (Apple Computer, Inc.)
MsConfig - StartUpReg: SoundMan - hkey= - key= - C:\WINDOWS\SoundMan.exe (Realtek Semiconductor Corp.)
MsConfig - StartUpReg: swg - hkey= - key= - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
MsConfig - StartUpReg: TkBellExe - hkey= - key= - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
MsConfig - StartUpReg: USRobotics USB Internet Mini Phone - hkey= - key= - C:\Program Files\U.S. Robotics\USB Internet Mini Phone\USRobotics USB Internet Mini Phone.exe (U.S. Robotics Corporation)
MsConfig - StartUpReg: USRobotics USB Internet Mini Phone Control Panel - hkey= - key= - C:\Program Files\U.S. Robotics\USB Internet Mini Phone\USB Internet Mini Phone UI.exe (U.S. Robotics)
MsConfig - StartUpReg: Yahoo! Pager - hkey= - key= - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 2
MsConfig - State: "startup" - 2

SafeBootMin: aawservice - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: aawservice - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - Microsoft NetShow Player
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.4
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA851-CC51-11CF-AAFA-00AA00B6015C} - rundll32.exe advpack.dll,LaunchINFSection %SystemRoot%\INF\wpie4x86.inf,PerUserStub
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} - Microsoft .NET Framework 1.1 Security Update (KB953297)
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error.
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\WINDOWS\System32\LameACM.acm (http://www.mp3dev.org/)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.dmb1 - m3jpeg32.dll File not found
Drivers32: VIDC.HFYU - C:\WINDOWS\System32\HUFFYUV.DLL (Disappearing Inc.)
Drivers32: VIDC.I420 - C:\WINDOWS\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.MJPG - m3jpeg32.dll File not found
Drivers32: vidc.x264 - C:\WINDOWS\System32\x264vfw.dll ()
Drivers32: vidc.XVID - C:\WINDOWS\System32\xvidvfw.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (17736316556935168)

========== Files/Folders - Created Within 14 Days ==========

[2010/01/19 18:54:07 | 00,000,000 | ---D | C] -- C:\Documents and Settings\tammy\My Documents\Downloads
[2010/01/18 12:47:56 | 00,000,000 | ---D | C] -- C:\WINDOWS\temp
[2010/01/16 03:24:17 | 00,000,000 | ---D | C] -- C:\Config.Msi
[2010/01/15 08:45:22 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\XPSViewer
[2010/01/15 08:45:04 | 00,000,000 | ---D | C] -- C:\Program Files\Reference Assemblies
[2010/01/15 08:44:27 | 00,000,000 | ---D | C] -- C:\17fa7fbb9aa743a2b4f61dd0f96e8747
[2010/01/15 08:44:14 | 00,000,000 | ---D | C] -- C:\WINDOWS\SxsCaPendDel
[2010/01/15 08:40:52 | 00,000,000 | ---D | C] -- C:\Program Files\MSXML 6.0
[2010/01/13 22:21:16 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\KB905474
[2010/01/12 21:49:58 | 00,000,000 | ---D | C] -- C:\WINDOWS\ServicePackFiles
[2010/01/07 15:35:44 | 00,000,000 | -H-D | C] -- C:\WINDOWS\PIF
[2010/01/07 14:19:01 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2010/01/07 14:06:01 | 00,000,000 | ---D | C] -- C:\Documents and Settings\tammy\Desktop\Virus stuff
[2009/12/24 21:55:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2008/10/25 08:25:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple Computer
[2008/10/18 23:44:01 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2008/10/16 20:49:49 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Skype
[2008/10/12 15:54:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
[2008/10/12 12:01:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2008/10/12 12:00:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2008/10/12 12:00:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Google
[2008/10/12 12:00:46 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2008/02/25 13:42:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2008/02/08 12:03:03 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2008/02/08 12:02:58 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2008/02/08 12:02:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Google
[2007/12/12 14:35:56 | 00,434,176 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdehcp.dll
[2007/12/12 14:35:55 | 00,950,272 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeusb1.dll
[2007/12/12 14:35:55 | 00,356,352 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeinpa.dll
[2007/12/12 14:35:55 | 00,339,968 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeiesc.dll
[2007/12/12 14:35:54 | 01,200,128 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeserv.dll
[2007/12/12 14:35:54 | 00,647,168 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdepmui.dll
[2007/12/12 14:35:54 | 00,565,248 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdelmpm.dll
[2007/12/12 14:35:54 | 00,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeprox.dll
[2007/12/12 14:35:52 | 00,663,552 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdehbn3.dll
[2007/12/12 14:35:51 | 00,860,160 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdecomc.dll
[2007/12/12 14:35:51 | 00,364,544 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdecomm.dll
[2007/12/12 10:38:20 | 23,405,072 | ---- | C] ( ) -- C:\Program Files\AdbeRdr811_en_US.exe
[2007/12/09 17:37:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[10 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

========== Files - Modified Within 14 Days ==========

[2010/01/19 18:55:00 | 00,000,422 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{59B3E264-20D2-4BFE-864F-F7C4E1F84BFC}.job
[2010/01/19 18:40:38 | 00,035,142 | ---- | M] () -- C:\Documents and Settings\All Users\lxde
[2010/01/19 18:31:47 | 00,525,448 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/01/19 18:31:47 | 00,443,918 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/01/19 18:31:47 | 00,072,050 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/01/19 18:27:58 | 00,000,260 | ---- | M] () -- C:\WINDOWS\tasks\WGASetup.job
[2010/01/19 18:27:54 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/01/19 18:27:37 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/01/19 18:27:34 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/01/19 08:05:42 | 13,107,200 | -H-- | M] () -- C:\Documents and Settings\tammy\NTUSER.DAT
[2010/01/19 08:05:42 | 00,000,178 | -HS- | M] () -- C:\Documents and Settings\tammy\ntuser.ini
[2010/01/18 12:39:36 | 00,000,483 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/01/18 12:39:06 | 00,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/01/17 22:56:35 | 03,827,754 | R--- | M] () -- C:\Documents and Settings\tammy\Desktop\ComboFix.exe
[2010/01/17 20:20:07 | 00,080,896 | ---- | M] () -- C:\Documents and Settings\tammy\My Documents\Striped Binder Covers Format.pub
[2010/01/16 03:33:06 | 02,469,760 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/01/16 03:21:09 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/01/16 03:05:18 | 00,000,770 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/01/09 20:17:20 | 00,058,368 | ---- | M] () -- C:\Documents and Settings\tammy\My Documents\bowling trip.sig
[2010/01/07 15:36:00 | 00,000,100 | ---- | M] () -- C:\Documents and Settings\tammy\Desktop\setup_7.0.0.290_22.02.2009_07-28.rar
[10 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/01/17 20:20:06 | 00,080,896 | ---- | C] () -- C:\Documents and Settings\tammy\My Documents\Striped Binder Covers Format.pub
[2010/01/13 22:21:16 | 00,000,260 | ---- | C] () -- C:\WINDOWS\tasks\WGASetup.job
[2010/01/11 14:34:21 | 00,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/01/11 14:34:20 | 00,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/01/11 14:24:54 | 03,827,754 | R--- | C] () -- C:\Documents and Settings\tammy\Desktop\ComboFix.exe
[2010/01/09 20:17:19 | 00,058,368 | ---- | C] () -- C:\Documents and Settings\tammy\My Documents\bowling trip.sig
[2010/01/07 15:36:00 | 00,000,100 | ---- | C] () -- C:\Documents and Settings\tammy\Desktop\setup_7.0.0.290_22.02.2009_07-28.rar
[2009/03/06 14:27:26 | 00,000,021 | ---- | C] () -- C:\WINDOWS\EPEX90.ini
[2009/02/13 20:16:17 | 00,000,095 | ---- | C] () -- C:\WINDOWS\TOCR.ini
[2009/02/13 20:16:08 | 00,000,095 | ---- | C] () -- C:\WINDOWS\System32\TRSOCR.ini
[2008/12/06 23:52:58 | 00,870,128 | ---- | C] () -- C:\Documents and Settings\tammy\Application Data\mcs.rma
[2008/12/06 23:52:58 | 00,000,004 | ---- | C] () -- C:\Documents and Settings\tammy\Application Data\502AA2
[2008/09/26 12:55:25 | 00,001,869 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2008/06/27 03:57:35 | 00,000,031 | ---- | C] () -- C:\WINDOWS\GunzLauncher.INI
[2008/06/23 02:13:09 | 00,059,500 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2008/06/09 15:59:49 | 00,159,992 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2008/04/05 23:35:33 | 00,070,016 | ---- | C] () -- C:\WINDOWS\System32\drivers\LxrSII1d.sys
[2008/03/13 14:53:20 | 00,035,979 | ---- | C] () -- C:\Program Files\Photoshop CS3 Read Me.html
[2008/03/13 11:04:11 | 00,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2008/03/11 09:49:52 | 00,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2008/03/08 14:19:56 | 00,462,848 | ---- | C] () -- C:\WINDOWS\lame_enc.dll
[2008/03/03 17:27:40 | 02,065,408 | ---- | C] () -- C:\WINDOWS\System32\x264vfw.dll
[2008/02/09 11:08:48 | 00,000,000 | ---- | C] () -- C:\WINDOWS\vpc32.INI
[2008/01/05 17:06:24 | 00,176,235 | ---- | C] () -- C:\WINDOWS\System32\Primomonnt.dll
[2007/12/25 12:50:21 | 00,000,074 | ---- | C] () -- C:\WINDOWS\marscam.ini
[2007/12/25 12:43:11 | 00,036,864 | R--- | C] () -- C:\WINDOWS\System32\mr310exv.dll
[2007/12/25 12:43:11 | 00,028,672 | R--- | C] () -- C:\WINDOWS\System32\mr310exd.dll
[2007/12/25 12:43:11 | 00,015,164 | ---- | C] () -- C:\WINDOWS\mr310twc.ini
[2007/12/16 15:37:28 | 00,765,952 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2007/12/16 15:37:27 | 00,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2007/12/15 23:59:37 | 00,000,077 | ---- | C] () -- C:\WINDOWS\huffyuv.ini
[2007/12/15 21:45:23 | 00,000,128 | ---- | C] () -- C:\Documents and Settings\tammy\Local Settings\Application Data\fusioncache.dat
[2007/12/13 14:44:18 | 00,174,592 | ---- | C] () -- C:\Documents and Settings\tammy\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/12/12 14:42:29 | 00,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxdevs.dll
[2007/12/12 14:42:26 | 00,348,160 | ---- | C] () -- C:\WINDOWS\System32\lxdecoin.dll
[2007/12/12 14:41:46 | 00,692,224 | ---- | C] () -- C:\WINDOWS\System32\lxdedrs.dll
[2007/12/12 14:41:46 | 00,069,632 | ---- | C] () -- C:\WINDOWS\System32\lxdecnv4.dll
[2007/12/12 14:41:46 | 00,065,536 | ---- | C] () -- C:\WINDOWS\System32\lxdecaps.dll
[2007/12/12 14:41:25 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\LXF3PMON.DLL
[2007/12/12 14:41:25 | 00,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXF3FXPU.DLL
[2007/12/12 14:41:05 | 00,036,864 | ---- | C] () -- C:\WINDOWS\System32\lxf3oem.dll
[2007/12/12 14:41:05 | 00,012,288 | ---- | C] () -- C:\WINDOWS\System32\LXF3PMRC.DLL
[2007/12/12 14:36:12 | 00,000,060 | ---- | C] () -- C:\WINDOWS\System32\lxderwrd.ini
[2007/12/12 14:35:56 | 00,348,160 | ---- | C] () -- C:\WINDOWS\System32\lxdeinst.dll
[2007/12/12 14:35:52 | 00,208,896 | ---- | C] () -- C:\WINDOWS\System32\lxdegrd.dll
[2007/12/09 18:53:20 | 00,094,208 | ---- | C] () -- C:\WINDOWS\System32\GTW32N50.dll
[2007/12/09 18:29:05 | 00,717,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2007/12/04 10:41:00 | 01,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2007/12/04 10:41:00 | 01,474,560 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2007/12/04 10:41:00 | 01,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2007/12/04 10:41:00 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2007/12/04 10:41:00 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2007/10/11 16:59:24 | 00,025,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2006/11/06 15:49:36 | 00,000,310 | ---- | C] () -- C:\WINDOWS\primopdf.ini
[1996/04/03 12:33:26 | 00,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys

========== LOP Check ==========

[2008/12/03 13:21:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Avery
[2007/12/13 20:26:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Broderbund Software
[2008/12/06 00:06:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LightScribe
[2008/05/03 21:13:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ludia
[2009/12/17 21:44:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LxThumbs
[2008/05/31 15:48:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir
[2008/01/01 01:56:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PopCap
[2010/01/10 19:43:37 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2008/04/28 15:03:55 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ThumbnailCache4R
[2009/10/05 14:11:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\tammy\Application Data\Any Video Converter
[2008/02/23 23:24:16 | 00,000,000 | ---D | M] -- C:\Documents and Settings\tammy\Application Data\Binary Fortress Software
[2008/09/14 21:27:27 | 00,000,000 | ---D | M] -- C:\Documents and Settings\tammy\Application Data\DAEMON Tools
[2009/10/07 20:53:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\tammy\Application Data\Datel
[2008/01/17 21:26:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\tammy\Application Data\FlashFXP
[2008/04/13 20:40:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\tammy\Application Data\GarageGames
[2008/03/19 14:46:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\tammy\Application Data\gtk-2.0
[2009/01/22 20:30:25 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\tammy\Application Data\ijjigame
[2009/03/06 14:27:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\tammy\Application Data\Leadertech
[2008/01/15 19:08:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\tammy\Application Data\Lexmark Productivity Studio
[2008/05/03 21:13:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\tammy\Application Data\Ludia
[2008/06/23 01:44:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\tammy\Application Data\nCleaner
[2008/05/15 18:49:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\tammy\Application Data\OnReally
[2008/11/26 13:44:16 | 00,000,000 | ---D | M] -- C:\Documents and Settings\tammy\Application Data\Pogo Games
[2008/09/07 15:33:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\tammy\Application Data\Snapfish
[2010/01/19 18:55:00 | 00,000,422 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{59B3E264-20D2-4BFE-864F-F7C4E1F84BFC}.job
[2010/01/19 18:27:58 | 00,000,260 | ---- | M] () -- C:\WINDOWS\Tasks\WGASetup.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2004/08/03 23:05:44 | 18,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/04/13 11:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\agp440.sys

< MD5 for: AHCIX86.SYS >
[2008/03/07 06:24:52 | 00,176,136 | R--- | M] (AMD Technologies Inc.) MD5=B6E729A575F84938A08D367E8352EB86 -- C:\WINDOWS\system32\drivers\ahcix86.sys

< MD5 for: ATAPI.SYS >
[2004/08/03 23:05:44 | 18,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/04/13 11:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\atapi.sys
[2004/08/03 21:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\ERDNT\cache\atapi.sys
[2004/08/03 21:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2004/08/03 21:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 20:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 17:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\eventlog.dll
[2004/08/03 22:56:44 | 00,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\ERDNT\cache\eventlog.dll
[2004/08/03 22:56:44 | 00,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2004/08/03 22:56:44 | 00,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\system32\eventlog.dll

< MD5 for: HAL.DLL >
[2004/08/03 23:05:44 | 18,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:hal.dll
[2008/04/13 11:31:32 | 00,105,344 | ---- | M] (Microsoft Corporation) MD5=6DB1E72AD3B372DFC451B7F54BA08AA7 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\hal.dll
[2004/08/03 21:59:14 | 00,134,400 | ---- | M] (Microsoft Corporation) MD5=DFCE51FD96909D1B97D4A1A72D060D77 -- C:\WINDOWS\system32\hal.dll

< MD5 for: NETLOGON.DLL >
[2008/04/13 17:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\netlogon.dll
[2009/02/06 11:46:09 | 00,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[2009/02/06 11:46:09 | 00,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll
[2009/02/06 11:46:09 | 00,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\$NtUninstallKB975467$\netlogon.dll
[2009/02/06 11:46:09 | 00,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\ERDNT\cache\netlogon.dll
[2009/02/06 11:46:09 | 00,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\sp2qfe\netlogon.dll
[2009/02/06 11:46:09 | 00,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\sp2qfe\netlogon.dll
[2009/02/06 11:46:09 | 00,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2009/02/06 11:46:09 | 00,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\system32\netlogon.dll
[2004/08/03 22:56:46 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtUninstallKB968389$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/03 22:56:46 | 00,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\ERDNT\cache\scecli.dll
[2004/08/03 22:56:46 | 00,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\system32\dllcache\scecli.dll
[2004/08/03 22:56:46 | 00,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\system32\scecli.dll
[2008/04/13 17:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\scecli.dll

< %systemroot%\system32\*.sys /s /md5 >
[2001/08/23 11:00:00 | 00,009,029 | ---- | M] () MD5=8AAD333C876590293F72B315E162BCC7 -- C:\WINDOWS\system32\ansi.sys
[2005/02/01 19:18:38 | 00,017,992 | ---- | M] (Broadcom Corporation) MD5=438179ABE9B7A922A21B8D6369FF52FF -- C:\WINDOWS\system32\bcm42rly.sys
[2001/08/23 11:00:00 | 00,027,097 | ---- | M] () MD5=0FE9F16075C9ACB941C957B7C649176E -- C:\WINDOWS\system32\country.sys
[1996/04/03 12:33:26 | 00,005,248 | ---- | M] () MD5=77EBF3E9386DAA51551AF429052D88D0 -- C:\WINDOWS\system32\giveio.sys
[2003/09/25 23:15:32 | 00,015,872 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) MD5=FC80052194D5708254A346568F0E77C0 -- C:\WINDOWS\system32\GTNDIS5.sys
[2001/08/23 11:00:00 | 00,004,768 | ---- | M] () MD5=E6BC0F98FECEF245A0010D350C1A0B9B -- C:\WINDOWS\system32\himem.sys
[2001/08/23 11:00:00 | 00,042,809 | ---- | M] () MD5=582BCDD47CF4B68B5CB528F18E3CB808 -- C:\WINDOWS\system32\key01.sys
[2004/08/03 20:46:56 | 00,042,537 | ---- | M] () MD5=FBBCFEC1379C5C02D88A361993EDF1B8 -- C:\WINDOWS\system32\keyboard.sys
[2005/01/02 14:43:08 | 00,004,682 | ---- | M] (INCA Internet Co., Ltd.) MD5=9131FE60ADFAB595C8DA53AD6A06AA31 -- C:\WINDOWS\system32\npptNT2.sys
[2001/08/23 11:00:00 | 00,027,866 | ---- | M] () MD5=FFFF296A08DBF2AC0126C62E3778AC0D -- C:\WINDOWS\system32\ntdos.sys
[2001/08/23 11:00:00 | 00,029,146 | ---- | M] () MD5=CF9ED169FF86D935E47999E82359E898 -- C:\WINDOWS\system32\ntdos404.sys
[2001/08/23 11:00:00 | 00,029,370 | ---- | M] () MD5=03B945AC0481CD8BB161C3569D8ED1C3 -- C:\WINDOWS\system32\ntdos411.sys
[2001/08/23 11:00:00 | 00,029,274 | ---- | M] () MD5=BBC957DC18C17CC027EB80B7C77F2AEA -- C:\WINDOWS\system32\ntdos412.sys
[2001/08/23 11:00:00 | 00,029,146 | ---- | M] () MD5=3CFFAEFFF23B0D208214A6D3061A5B1B -- C:\WINDOWS\system32\ntdos804.sys
[2004/08/03 20:45:10 | 00,033,840 | ---- | M] () MD5=4FE09F868CE65B334B42862C372C69CC -- C:\WINDOWS\system32\ntio.sys
[2004/08/03 20:45:16 | 00,034,560 | ---- | M] () MD5=6F73F50162DEF60C84B725C18CD9140F -- C:\WINDOWS\system32\ntio404.sys
[2004/08/03 20:45:12 | 00,035,648 | ---- | M] () MD5=0FDD5E69C1FF3B58043D44F2CC743D45 -- C:\WINDOWS\system32\ntio411.sys
[2004/08/03 20:45:16 | 00,035,424 | ---- | M] () MD5=8842837C4D8311BF8E72BEE8CCC42217 -- C:\WINDOWS\system32\ntio412.sys
[2004/08/03 20:45:14 | 00,034,560 | ---- | M] () MD5=6B56CEB3C6F9D5CD7293DBD9FE23B311 -- C:\WINDOWS\system32\ntio804.sys
[2006/09/24 06:28:46 | 00,005,248 | ---- | M] (Windows ® 2000 DDK provider) MD5=5D6401DB90EC81B71F8E2C5C8F0FEF23 -- C:\WINDOWS\system32\speedfan.sys
[2004/08/03 21:07:34 | 00,017,664 | ---- | M] (Microsoft Corporation) MD5=C9BF2F12C4E6C12F8A85FBA4B6BC6208 -- C:\WINDOWS\system32\watchdog.sys
[2009/08/14 05:19:41 | 01,850,112 | ---- | M] (Microsoft Corporation) MD5=1EFBC43B33B83FD7376E63A71830CC69 -- C:\WINDOWS\system32\win32k.sys
[2004/08/03 21:10:08 | 00,053,248 | ---- | M] (Microsoft Corporation) MD5=009927DB8019C54477DABF6F9D795053 -- C:\WINDOWS\system32\dllcache\1394bus.sys
[2001/08/23 11:00:00 | 00,011,648 | ---- | M] (Microsoft Corporation) MD5=9859C0F6936E723E4892D7141B1327D5 -- C:\WINDOWS\system32\dllcache\acpiec.sys
[2006/02/14 17:22:26 | 00,142,464 | ---- | M] (Microsoft Corporation) MD5=1EE7B434BA961EF845DE136224C30FEC -- C:\WINDOWS\system32\dllcache\aec.sys
[2008/08/14 02:51:43 | 00,138,368 | ---- | M] (Microsoft Corporation) MD5=55E6E1C51B6D30E54335750955453702 -- C:\WINDOWS\system32\dllcache\afd.sys
[2004/08/03 23:05:44 | 00,036,992 | ---- | M] (Microsoft Corporation) MD5=DAD16A9D5C873E7219E6B43802ED316A -- C:\WINDOWS\system32\dllcache\amdk6.sys
[2004/08/03 23:05:44 | 00,037,376 | ---- | M] (Microsoft Corporation) MD5=680AD1C1BB16239E28D8F33A54A7A3C7 -- C:\WINDOWS\system32\dllcache\amdk7.sys
[2001/08/23 11:00:00 | 00,009,029 | ---- | M] () MD5=8AAD333C876590293F72B315E162BCC7 -- C:\WINDOWS\system32\dllcache\ansi.sys
[2004/08/03 21:05:04 | 00,014,336 | ---- | M] (Microsoft Corporation) MD5=02000ABF34AF4C218C35D257024807D6 -- C:\WINDOWS\system32\dllcache\asyncmac.sys
[2004/08/03 21:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2004/08/03 22:29:28 | 00,701,440 | ---- | M] (ATI Technologies Inc.) MD5=8759322FFC1A50569C1E5528EE8026B7 -- C:\WINDOWS\system32\dllcache\ati2mtag.sys
[2004/08/03 20:58:32 | 00,059,904 | ---- | M] (Microsoft Corporation) MD5=EC88DA854AB7D7752EC8BE11A741BB7F -- C:\WINDOWS\system32\dllcache\atmarpc.sys
[2001/08/23 11:00:00 | 00,031,360 | ---- | M] (Microsoft Corporation) MD5=39A0A59180F19946374275745B21AEBA -- C:\WINDOWS\system32\dllcache\atmepvc.sys
[2004/08/03 20:58:36 | 00,055,936 | ---- | M] (Microsoft Corporation) MD5=0128E78FE835F074E469F03DB681CA9E -- C:\WINDOWS\system32\dllcache\atmlane.sys
[2001/08/23 11:00:00 | 00,352,256 | ---- | M] (Microsoft Corporation) MD5=E7EF69B38D17BA01F914AE8F66216A38 -- C:\WINDOWS\system32\dllcache\atmuni.sys
[2001/08/23 11:00:00 | 00,004,224 | ---- | M] (Microsoft Corporation) MD5=DA1F27D85E0D1525F6621372E7B685E9 -- C:\WINDOWS\system32\dllcache\beep.sys
[2004/08/03 20:59:58 | 00,071,552 | ---- | M] (Microsoft Corporation) MD5=E4E6A0922E3D983728C9AD4E8D466954 -- C:\WINDOWS\system32\dllcache\bridge.sys
[2008/06/13 06:10:50 | 00,272,128 | ---- | M] (Microsoft Corporation) MD5=95EF6F3F386D93EE1E4D9CA45A50252A -- C:\WINDOWS\system32\dllcache\bthport.sys
[2001/08/23 11:00:00 | 00,054,528 | ---- | M] (Philips Semiconductors GmbH) MD5=D57D0F293E4C296F89C148DB40A089AC -- C:\WINDOWS\system32\dllcache\cap7146.sys
[2001/08/23 11:00:00 | 00,013,952 | ---- | M] (Microsoft Corporation) MD5=90A673FC8E12A79AFBED2576F6A7AAF9 -- C:\WINDOWS\system32\dllcache\cbidf2k.sys
[2004/08/04 00:10:18 | 00,017,024 | ---- | M] (Microsoft Corporation) MD5=6163ED60B684BAB19D3352AB22FC48B2 -- C:\WINDOWS\system32\dllcache\ccdecode.sys
[2004/08/03 21:14:12 | 00,063,744 | ---- | M] (Microsoft Corporation) MD5=CD7D5152DF32B47F4E36F710B35AAE02 -- C:\WINDOWS\system32\dllcache\cdfs.sys
[2009/08/23 14:00:38 | 00,062,592 | ---- | M] (Microsoft Corporation) MD5=7B53584D94E9D8716B2DE91D5F1CB42D -- C:\WINDOWS\system32\dllcache\cdrom.sys
[2001/08/23 11:00:00 | 00,262,528 | ---- | M] (RAVISENT Technologies Inc.) MD5=B562592B7F5759C99E179CA467ECFB4C -- C:\WINDOWS\system32\dllcache\cinemst2.sys
[2004/08/03 21:14:28 | 00,049,664 | ---- | M] (Microsoft Corporation) MD5=D86173B401470F06D9810F7962969DDF -- C:\WINDOWS\system32\dllcache\classpnp.sys
[2001/08/23 11:00:00 | 00,027,097 | ---- | M] () MD5=0FE9F16075C9ACB941C957B7C649176E -- C:\WINDOWS\system32\dllcache\country.sys
[2001/08/23 11:00:00 | 00,011,776 | ---- | M] (Compaq Computer Corporation) MD5=9624293E55AD405415862B504CA95B73 -- C:\WINDOWS\system32\dllcache\cpqdap01.sys
[2004/08/03 23:05:44 | 00,036,480 | ---- | M] (Microsoft Corporation) MD5=6AF1684CCAAC3F7EF4EE9BA65EB0677A -- C:\WINDOWS\system32\dllcache\crusoe.sys
[2004/08/03 20:59:56 | 00,036,352 | ---- | M] (Microsoft Corporation) MD5=00CA44E4534865F8A3B64F7C0984BFF0 -- C:\WINDOWS\system32\dllcache\disk.sys
[2004/08/03 20:59:54 | 00,014,208 | ---- | M] (Microsoft Corporation) MD5=D16C81677A9BE399C63CD2EA486472A5 -- C:\WINDOWS\system32\dllcache\diskdump.sys
[2004/08/03 21:07:18 | 00,799,744 | ---- | M] (Microsoft Corp., Veritas Software) MD5=C0FBB516E06E243F0CF31F597E7EBF7D -- C:\WINDOWS\system32\dllcache\dmboot.sys
[2004/08/03 21:07:18 | 00,153,344 | ---- | M] (Microsoft Corp., Veritas Software) MD5=F5E7B358A732D09F4BCF2824B88B9E28 -- C:\WINDOWS\system32\dllcache\dmio.sys
[2001/08/23 11:00:00 | 00,005,888 | ---- | M] (Microsoft Corp., Veritas Software.) MD5=E9317282A63CA4D188C0DF5E09C6AC5F -- C:\WINDOWS\system32\dllcache\dmload.sys
[2004/08/04 00:07:40 | 00,052,864 | ---- | M] (Microsoft Corporation) MD5=A6F881284AC1150E37D9AE47FF601267 -- C:\WINDOWS\system32\dllcache\dmusic.sys
[2004/08/03 22:08:00 | 00,060,288 | ---- | M] (Microsoft Corporation) MD5=FF86422268DE771D571E123EB7092C6A -- C:\WINDOWS\system32\dllcache\drmk.sys
[2004/08/04 00:07:58 | 00,002,944 | ---- | M] (Microsoft Corporation) MD5=1ED4DBBAE9F5D558DBBA4CC450E3EB2E -- C:\WINDOWS\system32\dllcache\drmkaud.sys
[2001/08/23 11:00:00 | 00,010,496 | ---- | M] (Microsoft Corporation) MD5=FE97D0343ACFDEBDD578FC67CC91FA87 -- C:\WINDOWS\system32\dllcache\dxapi.sys
[2001/08/23 11:00:00 | 00,003,328 | ---- | M] (Microsoft Corporation) MD5=A73F5D6705B1D820C19B18782E176EFD -- C:\WINDOWS\system32\dllcache\dxgthk.sys
[2001/08/17 06:46:40 | 00,006,400 | ---- | M] (Microsoft Corporation) MD5=80D1B490B60E74E002DC116EC5D41748 -- C:\WINDOWS\system32\dllcache\enum1394.sys
[2001/08/23 11:00:00 | 00,025,856 | ---- | M] (Microsoft Corporation) MD5=52016D76B6F9810186DFDD5CCD53FA79 -- C:\WINDOWS\system32\dllcache\et4000.sys
[2004/08/03 21:14:18 | 00,143,360 | ---- | M] (Microsoft Corporation) MD5=3117F595E9615E04F05A54FC15A03B20 -- C:\WINDOWS\system32\dllcache\fastfat.sys
[2001/08/23 11:00:00 | 00,034,944 | ---- | M] (Microsoft Corporation) MD5=E153AB8A11DE5452BCF5AC7652DBF3ED -- C:\WINDOWS\system32\dllcache\fips.sys
[2006/08/21 02:14:58 | 00,128,896 | ---- | M] (Microsoft Corporation) MD5=3D234FB6D6EE875EB009864A299BEA29 -- C:\WINDOWS\system32\dllcache\fltmgr.sys
[2001/08/23 11:00:00 | 00,012,160 | ---- | M] (Microsoft Corporation) MD5=455F778EE14368468560BD7CB8C854D0 -- C:\WINDOWS\system32\dllcache\fsvga.sys
[2001/08/23 11:00:00 | 00,007,936 | ---- | M] (Microsoft Corporation) MD5=3E1E2BD4F39B0E2B7DC4F4D2BCC2779A -- C:\WINDOWS\system32\dllcache\fs_rec.sys
[2001/08/23 11:00:00 | 00,125,056 | ---- | M] (Microsoft Corporation) MD5=6AC26732762483366C3969C9E4D2259D -- C:\WINDOWS\system32\dllcache\ftdisk.sys
[2001/08/23 11:00:00 | 00,004,768 | ---- | M] () MD5=E6BC0F98FECEF245A0010D350C1A0B9B -- C:\WINDOWS\system32\dllcache\himem.sys
[2009/10/20 07:58:48 | 00,263,552 | ---- | M] (Microsoft Corporation) MD5=9F8B0F4276F618964FD118BE4289B7CD -- C:\WINDOWS\system32\dllcache\http.sys
[2004/08/03 20:59:20 | 00,036,096 | ---- | M] (Microsoft Corporation) MD5=279FB78702454DFF2BB445F238C048D2 -- C:\WINDOWS\system32\dllcache\intelppm.sys
[2004/08/03 21:00:08 | 00,029,056 | ---- | M] (Microsoft Corporation) MD5=4448006B6BC60E6C027932CFC38D6855 -- C:\WINDOWS\system32\dllcache\ip6fw.sys
[2001/08/23 11:00:00 | 00,032,896 | ---- | M] (Microsoft Corporation) MD5=731F22BA402EE4B62748ADAF6363C182 -- C:\WINDOWS\system32\dllcache\ipfltdrv.sys
[2004/08/03 21:04:46 | 00,020,992 | ---- | M] (Microsoft Corporation) MD5=E1EC7F5DA720B640CD8FB8424F1B14BB -- C:\WINDOWS\system32\dllcache\ipinip.sys
[2004/09/29 15:28:37 | 00,134,912 | ---- | M] (Microsoft Corporation) MD5=E2168CBC7098FFE963C6F23F472A3593 -- C:\WINDOWS\system32\dllcache\ipnat.sys
[2004/08/03 21:14:30 | 00,074,752 | ---- | M] (Microsoft Corporation) MD5=64537AA5C003A6AFEEE1DF819062D0D1 -- C:\WINDOWS\system32\dllcache\ipsec.sys
[2004/08/03 21:00:48 | 00,011,264 | ---- | M] (Microsoft Corporation) MD5=50708DAA1B1CBB7D6AC1CF8F56A24410 -- C:\WINDOWS\system32\dllcache\irenum.sys
[2001/08/23 11:00:00 | 00,035,840 | ---- | M] (Microsoft Corporation) MD5=E504F706CCB699C2596E9A3DA1596E87 -- C:\WINDOWS\system32\dllcache\isapnp.sys
[2001/08/23 11:00:00 | 00,042,809 | ---- | M] () MD5=582BCDD47CF4B68B5CB528F18E3CB808 -- C:\WINDOWS\system32\dllcache\key01.sys
[2004/08/03 20:46:56 | 00,042,537 | ---- | M] () MD5=FBBCFEC1379C5C02D88A361993EDF1B8 -- C:\WINDOWS\system32\dllcache\keyboard.sys
[2006/06/14 01:47:45 | 00,172,416 | ---- | M] (Microsoft Corporation) MD5=BA5DEDA4D934E6288C2F66CAF58D2562 -- C:\WINDOWS\system32\dllcache\kmixer.sys
[2004/08/03 22:15:22 | 00,140,928 | ---- | M] (Microsoft Corporation) MD5=B9540E258F952650DE8DEC68719A5C97 -- C:\WINDOWS\system32\dllcache\ks.sys
[2009/06/22 04:35:44 | 00,092,544 | ---- | M] (Microsoft Corporation) MD5=1BE7CC2535D760AE4D481576EB789F24 -- C:\WINDOWS\system32\dllcache\ksecdd.sys
[2001/08/23 11:00:00 | 00,007,680 | ---- | M] (Microsoft Corporation) MD5=D1F8BE91ED4DDB671D42E473E3FE71AB -- C:\WINDOWS\system32\dllcache\mcd.sys
[2004/08/03 23:05:44 | 00,063,744 | ---- | M] (Microsoft Corporation) MD5=729D83E56C29C510258A6E9E79FFDDC3 -- C:\WINDOWS\system32\dllcache\mf.sys
[2001/08/23 11:00:00 | 00,092,416 | ---- | M] (Microsoft Corporation) MD5=4EF72AAAD5DF2FC276A8A0D84ED14218 -- C:\WINDOWS\system32\dllcache\mga.sys
[2001/08/23 11:00:00 | 00,004,224 | ---- | M] (Microsoft Corporation) MD5=4AE068242760A1FB6E1A44BF4E16AFA6 -- C:\WINDOWS\system32\dllcache\mnmdd.sys
[2004/08/03 23:05:44 | 00,030,080 | ---- | M] (Microsoft Corporation) MD5=6FC6F9D7ACC36DCA9B914565A3AEDA05 -- C:\WINDOWS\system32\dllcache\modem.sys
[2004/08/03 20:58:32 | 00,042,240 | ---- | M] (Microsoft Corporation) MD5=65653F3B4477F3C63E68A9659F85EE2E -- C:\WINDOWS\system32\dllcache\mountmgr.sys
[2009/06/22 04:48:44 | 00,091,776 | ---- | M] (Microsoft Corporation) MD5=EEE50BF24CAEEDB515A8F3B22756D3BB -- C:\WINDOWS\system32\dllcache\mqac.sys
[2007/12/18 02:51:35 | 00,179,584 | ---- | M] (Microsoft Corporation) MD5=29414447EB5BDE2F8397DC965DBB3156 -- C:\WINDOWS\system32\dllcache\mrxdav.sys
[2008/10/24 04:10:42 | 00,453,632 | ---- | M] (Microsoft Corporation) MD5=6F2D483B97B395544E59749C47963C6A -- C:\WINDOWS\system32\dllcache\mrxsmb.sys
[2004/08/03 21:00:42 | 00,019,072 | ---- | M] (Microsoft Corporation) MD5=561B3A4333CA2DBDBA28B5B956822519 -- C:\WINDOWS\system32\dllcache\msfs.sys
[2004/08/03 21:04:14 | 00,035,072 | ---- | M] (Microsoft Corporation) MD5=C0F1D4A21DE5A415DF8170616703DEBF -- C:\WINDOWS\system32\dllcache\msgpc.sys
[2004/08/03 23:58:42 | 00,007,552 | ---- | M] (Microsoft Corporation) MD5=AE431A8DD3C1D0D0610CDBAC16057AD0 -- C:\WINDOWS\system32\dllcache\mskssrv.sys
[2004/08/03 23:58:40 | 00,005,376 | ---- | M] (Microsoft Corporation) MD5=13E75FEF9DFEB08EEDED9D0246E1F448 -- C:\WINDOWS\system32\dllcache\mspclock.sys
[2004/08/03 23:58:42 | 00,004,992 | ---- | M] (Microsoft Corporation) MD5=1988A33FF19242576C3D0EF9CE785DA7 -- C:\WINDOWS\system32\dllcache\mspqm.sys
[2004/08/03 23:58:40 | 00,005,504 | ---- | M] (Microsoft Corporation) MD5=BF13612142995096AB084F2DB7F40F77 -- C:\WINDOWS\system32\dllcache\mstee.sys
[2004/08/03 21:15:22 | 00,107,904 | ---- | M] (Microsoft Corporation) MD5=82035E0F41C2DD05AE41D27FE6CF7DE1 -- C:\WINDOWS\system32\dllcache\mup.sys
[2004/08/04 00:10:30 | 00,085,376 | ---- | M] (Microsoft Corporation) MD5=5C8DC6429C43DC6177C1FA5B76290D1A -- C:\WINDOWS\system32\dllcache\nabtsfec.sys
[2004/08/03 21:14:30 | 00,182,912 | ---- | M] (Microsoft Corporation) MD5=558635D3AF1C7546D26067D5D9B6959E -- C:\WINDOWS\system32\dllcache\ndis.sys
[2004/08/04 00:10:14 | 00,010,880 | ---- | M] (Microsoft Corporation) MD5=520CE427A8B298F54112857BCF6BDE15 -- C:\WINDOWS\system32\dllcache\ndisip.sys
[2001/08/23 11:00:00 | 00,009,600 | ---- | M] (Microsoft Corporation) MD5=08D43BBDACDF23F34D79E44ED35C1B4C -- C:\WINDOWS\system32\dllcache\ndistapi.sys
[2004/08/03 21:14:32 | 00,091,776 | ---- | M] (Microsoft Corporation) MD5=0B90E255A9490166AB368CD55A529893 -- C:\WINDOWS\system32\dllcache\ndiswan.sys
[2001/08/23 11:00:00 | 00,038,016 | ---- | M] (Microsoft Corporation) MD5=59FC3FB44D2669BC144FD87826BB571F -- C:\WINDOWS\system32\dllcache\ndproxy.sys
[2004/08/03 21:03:22 | 00,034,560 | ---- | M] (Microsoft Corporation) MD5=3A2ACA8FC1D7786902CA434998D7CEB4 -- C:\WINDOWS\system32\dllcache\netbios.sys
[2004/08/03 21:14:38 | 00,162,816 | ---- | M] (Microsoft Corporation) MD5=0C80E410CD2F47134407EE7DD19CC86B -- C:\WINDOWS\system32\dllcache\netbt.sys
[2001/08/23 11:00:00 | 00,012,032 | ---- | M] (S3/Diamond Multimedia Systems) MD5=BE984D604D91C217355CDD3737AAD25D -- C:\WINDOWS\system32\dllcache\nikedrv.sys
[2004/08/03 20:59:52 | 00,040,320 | ---- | M] (Microsoft Corporation) MD5=60CF8C7192B3614F240838DDBAA4A245 -- C:\WINDOWS\system32\dllcache\nmnt.sys
[2004/08/03 21:00:44 | 00,030,848 | ---- | M] (Microsoft Corporation) MD5=4F601BCB8F64EA3AC0994F98FED03F8E -- C:\WINDOWS\system32\dllcache\npfs.sys
[2001/08/23 11:00:00 | 00,027,866 | ---- | M] () MD5=FFFF296A08DBF2AC0126C62E3778AC0D -- C:\WINDOWS\system32\dllcache\ntdos.sys
[2001/08/23 11:00:00 | 00,029,146 | ---- | M] () MD5=CF9ED169FF86D935E47999E82359E898 -- C:\WINDOWS\system32\dllcache\ntdos404.sys
[2001/08/23 11:00:00 | 00,029,370 | ---- | M] () MD5=03B945AC0481CD8BB161C3569D8ED1C3 -- C:\WINDOWS\system32\dllcache\ntdos411.sys
[2001/08/23 11:00:00 | 00,029,274 | ---- | M] () MD5=BBC957DC18C17CC027EB80B7C77F2AEA -- C:\WINDOWS\system32\dllcache\ntdos412.sys
[2001/08/23 11:00:00 | 00,029,146 | ---- | M] () MD5=3CFFAEFFF23B0D208214A6D3061A5B1B -- C:\WINDOWS\system32\dllcache\ntdos804.sys
[2007/02/09 04:10:35 | 00,574,464 | ---- | M] (Microsoft Corporation) MD5=19A811EF5F1ED5C926A028CE107FF1AF -- C:\WINDOWS\system32\dllcache\ntfs.sys
[2004/08/03 20:45:10 | 00,033,840 | ---- | M] () MD5=4FE09F868CE65B334B42862C372C69CC -- C:\WINDOWS\system32\dllcache\ntio.sys
[2004/08/03 20:45:16 | 00,034,560 | ---- | M] () MD5=6F73F50162DEF60C84B725C18CD9140F -- C:\WINDOWS\system32\dllcache\ntio404.sys
[2004/08/03 20:45:12 | 00,035,648 | ---- | M] () MD5=0FDD5E69C1FF3B58043D44F2CC743D45 -- C:\WINDOWS\system32\dllcache\ntio411.sys
[2004/08/03 20:45:16 | 00,035,424 | ---- | M] () MD5=8842837C4D8311BF8E72BEE8CCC42217 -- C:\WINDOWS\system32\dllcache\ntio412.sys
[2004/08/03 20:45:14 | 00,034,560 | ---- | M] () MD5=6B56CEB3C6F9D5CD7293DBD9FE23B311 -- C:\WINDOWS\system32\dllcache\ntio804.sys
[2001/08/23 11:00:00 | 00,002,944 | ---- | M] (Microsoft Corporation) MD5=73C1E1F395918BC2C6DD67AF7591A3AD -- C:\WINDOWS\system32\dllcache\null.sys
[2007/12/04 10:41:00 | 07,435,392 | ---- | M] (NVIDIA Corporation) MD5=8C0456001B6900114BBB1C548BD8AAF5 -- C:\WINDOWS\system32\dllcache\nv4_mini.sys
[2001/08/23 11:00:00 | 00,012,416 | ---- | M] (Microsoft Corporation) MD5=B305F3FAD35083837EF46A0BBCE2FC57 -- C:\WINDOWS\system32\dllcache\nwlnkflt.sys
[2001/08/23 11:00:00 | 00,032,512 | ---- | M] (Microsoft Corporation) MD5=C99B3415198D1AAB7227F2C88FD664B9 -- C:\WINDOWS\system32\dllcache\nwlnkfwd.sys
[2004/08/03 21:03:36 | 00,088,448 | ---- | M] (Microsoft Corporation) MD5=79EA3FCDA7067977625B3363A2657C80 -- C:\WINDOWS\system32\dllcache\nwlnkipx.sys
[2001/08/23 11:00:00 | 00,063,232 | ---- | M] (Microsoft Corporation) MD5=56D34A67C05E94E16377C60609741FF8 -- C:\WINDOWS\system32\dllcache\nwlnknb.sys
[2001/08/23 11:00:00 | 00,055,936 | ---- | M] (Microsoft Corporation) MD5=C0BB7D1615E1ACBDC99757F6CEAF8CF0 -- C:\WINDOWS\system32\dllcache\nwlnkspx.sys
[2006/10/13 03:23:15 | 00,163,584 | ---- | M] (Microsoft Corporation) MD5=3F18D9365BE71C7B2E43B7CF4A0C1A10 -- C:\WINDOWS\system32\dllcache\nwrdr.sys
[2001/08/23 11:00:00 | 00,003,456 | ---- | M] (Microsoft Corporation) MD5=4BB30DDC53EBC76895E38694580CDFE9 -- C:\WINDOWS\system32\dllcache\oprghdlr.sys
[2004/08/03 23:05:44 | 00,042,496 | ---- | M] (Microsoft Corporation) MD5=3E16EFF2A6FED2D8D7F5A66DFE65D183 -- C:\WINDOWS\system32\dllcache\p3.sys
[2001/08/23 11:00:00 | 00,018,688 | ---- | M] (Microsoft Corporation) MD5=3334430C29DC338092F79C38EF7B4CD0 -- C:\WINDOWS\system32\dllcache\partmgr.sys
[2001/08/23 11:00:00 | 00,006,784 | ---- | M] (Microsoft Corporation) MD5=70E98B3FD8E963A6A46A2E6247E0BEA1 -- C:\WINDOWS\system32\dllcache\parvdm.sys
[2004/08/03 21:07:48 | 00,068,224 | ---- | M] (Microsoft Corporation) MD5=8086D9979234B603AD5BC2F5D890B234 -- C:\WINDOWS\system32\dllcache\pci.sys
[2001/08/17 12:51:52 | 00,003,328 | ---- | M] (Microsoft Corporation) MD5=CCF5F451BB1A5A2A522A76E670000FF0 -- C:\WINDOWS\system32\dllcache\pciide.sys
[2004/08/03 21:59:42 | 00,025,088 | ---- | M] (Microsoft Corporation) MD5=520B91AB011456B940D9B05FC91108FF -- C:\WINDOWS\system32\dllcache\pciidex.sys
[2004/08/03 21:07:48 | 00,119,936 | ---- | M] (Microsoft Corporation) MD5=82A087207DECEC8456FBE8537947D579 -- C:\WINDOWS\system32\dllcache\pcmcia.sys
[2004/03/16 11:58:20 | 00,136,960 | ---- | M] (Microsoft Corporation) MD5=BC6B2BC69C1E009443E8B1FE2DB96101 -- C:\WINDOWS\system32\dllcache\portcls.sys
[2004/08/03 21:04:20 | 00,069,120 | ---- | M] (Microsoft Corporation) MD5=48671F327553DCF1D27F6197F622A668 -- C:\WINDOWS\system32\dllcache\psched.sys
[2001/08/23 11:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) MD5=80D317BD1C3DBC5D4FE7B1678C60CADD -- C:\WINDOWS\system32\dllcache\ptilink.sys
[2004/08/03 21:00:52 | 00,020,736 | ---- | M] (Microsoft Corporation) MD5=7F78371E0AF2609EA3A95D8843B076F8 -- C:\WINDOWS\system32\dllcache\ramdisk.sys
[2001/08/23 11:00:00 | 00,008,832 | ---- | M] (Microsoft Corporation) MD5=FE0D99D6F31E4FAD8159F690D68DED9C -- C:\WINDOWS\system32\dllcache\rasacd.sys
[2004/08/03 21:14:24 | 00,051,328 | ---- | M] (Microsoft Corporation) MD5=98FAEB4A4DCF812BA1C6FCA4AA3E115C -- C:\WINDOWS\system32\dllcache\rasl2tp.sys
[2004/08/03 21:05:08 | 00,041,472 | ---- | M] (Microsoft Corporation) MD5=7306EEED8895454CBED4669BE9F79FAA -- C:\WINDOWS\system32\dllcache\raspppoe.sys
[2004/08/03 21:14:28 | 00,048,384 | ---- | M] (Microsoft Corporation) MD5=1C5CC65AAC0783C344F16353E60B72AC -- C:\WINDOWS\system32\dllcache\raspptp.sys
[2001/08/23 11:00:00 | 00,016,512 | ---- | M] (Microsoft Corporation) MD5=FDBB1D60066FCFBB7452FD8F9829B242 -- C:\WINDOWS\system32\dllcache\raspti.sys
[2001/08/23 11:00:00 | 00,034,432 | ---- | M] (Microsoft Corporation) MD5=01524CD237223B18ADBB48F70083F101 -- C:\WINDOWS\system32\dllcache\rawwan.sys
[2006/05/05 02:47:57 | 00,174,592 | ---- | M] (Microsoft Corporation) MD5=03B965B1CA47F6EF60EB5E51CB50E0AF -- C:\WINDOWS\system32\dllcache\rdbss.sys
[2001/08/23 11:00:00 | 00,004,224 | ---- | M] (Microsoft Corporation) MD5=4912D5B403614CE99C28420F75353332 -- C:\WINDOWS\system32\dllcache\rdpcdd.sys
[2005/06/09 21:09:46 | 00,139,528 | ---- | M] (Microsoft Corporation) MD5=B54CD38A9EBFBF2B3561426E3FE26F62 -- C:\WINDOWS\system32\dllcache\rdpwd.sys
[2001/08/23 11:00:00 | 00,012,032 | ---- | M] (S3/Diamond Multimedia Systems) MD5=A56FE08EC7473E8580A390BB1081CDD7 -- C:\WINDOWS\system32\dllcache\rio8drv.sys
[2001/08/23 11:00:00 | 00,012,032 | ---- | M] (S3/Diamond Multimedia Systems) MD5=0A854DF84C77A0BE205BFEAB2AE4F0EC -- C:\WINDOWS\system32\dllcache\riodrv.sys
[2008/05/08 05:28:49 | 00,202,752 | ---- | M] (Microsoft Corporation) MD5=D18208ED6C768663B08C972EAA7A8B60 -- C:\WINDOWS\system32\dllcache\rmcast.sys
[2004/08/03 21:04:32 | 00,030,080 | ---- | M] (Microsoft Corporation) MD5=7CE8B277F3207EA82D7D22AD348BEFC6 -- C:\WINDOWS\system32\dllcache\rndismp.sys
[2001/08/23 11:00:00 | 00,005,888 | ---- | M] (Microsoft Corporation) MD5=D8B0B4ADE32574B2D9C5CC34DC0DBBE7 -- C:\WINDOWS\system32\dllcache\rootmdm.sys
[2004/08/03 15:31:34 | 00,020,992 | ---- | M] (Realtek Semiconductor Corporation) MD5=D507C1400284176573224903819FFDA3 -- C:\WINDOWS\system32\dllcache\rtl8139.sys
[2004/08/03 23:59:58 | 00,043,136 | ---- | M] (Microsoft Corporation) MD5=3E2C3B180872BE4120F246D85560B734 -- C:\WINDOWS\system32\dllcache\sbp2port.sys
[2004/08/03 20:59:42 | 00,096,256 | ---- | M] (Microsoft Corporation) MD5=D7FD0FF761E28AC0EA35AD71E0CD67E9 -- C:\WINDOWS\system32\dllcache\scsiport.sys
[2004/08/03 21:07:48 | 00,067,584 | ---- | M] (Microsoft Corporation) MD5=02FC71B020EC8700EE8A46C58BC6F276 -- C:\WINDOWS\system32\dllcache\sdbus.sys
[2004/08/03 20:59:56 | 00,011,136 | ---- | M] (Microsoft Corporation) MD5=1D9F1BEC651815741F088A8FB88E17EE -- C:\WINDOWS\system32\dllcache\sffdisk.sys
[2004/08/03 20:59:56 | 00,010,240 | ---- | M] (Microsoft Corporation) MD5=586499FD312FFD7F78553F408E71682E -- C:\WINDOWS\system32\dllcache\sffp_sd.sys
[2004/08/04 00:10:18 | 00,011,136 | ---- | M] (Microsoft Corporation) MD5=5CAEED86821FA2C6139E32E9E05CCDC9 -- C:\WINDOWS\system32\dllcache\slip.sys
[2001/08/23 11:00:00 | 00,014,592 | ---- | M] (Microsoft Corporation) MD5=017DAECF0ED3AA731313433601EC40FA -- C:\WINDOWS\system32\dllcache\smclib.sys
[2004/08/03 23:05:44 | 00,025,472 | ---- | M] (Microsoft Corporation) MD5=ADDC9E4757A68AB60562AD3CB9C288D6 -- C:\WINDOWS\system32\dllcache\sonydcam.sys
[2001/08/17 13:56:16 | 00,007,552 | ---- | M] (Sony Corporation) MD5=A1ECEEAA5C5E74B2499EB51D38185B84 -- C:\WINDOWS\system32\dllcache\sonypvu1.sys
[2006/06/14 01:47:46 | 00,006,400 | ---- | M] (Microsoft Corporation) MD5=0CE218578FFF5F4F7E4201539C45C78F -- C:\WINDOWS\system32\dllcache\splitter.sys
[2004/08/03 21:06:26 | 00,073,472 | ---- | M] (Microsoft Corporation) MD5=E41B6D037D6CD08461470AF04500DC24 -- C:\WINDOWS\system32\dllcache\sr.sys
[2008/12/11 04:57:21 | 00,333,184 | ---- | M] (Microsoft Corporation) MD5=AB9C79ED12D65E800AAAD3D72A04792F -- C:\WINDOWS\system32\dllcache\srv.sys
[2004/08/03 22:08:04 | 00,048,640 | ---- | M] (Microsoft Corporation) MD5=C43356072EB3E88CD62958DB10CEAD47 -- C:\WINDOWS\system32\dllcache\stream.sys
[2004/08/04 00:10:14 | 00,015,360 | ---- | M] (Microsoft Corporation) MD5=284C57DF5DC7ABCA656BC2B96A667AFB -- C:\WINDOWS\system32\dllcache\streamip.sys
[2001/08/17 15:00:52 | 00,054,272 | ---- | M] (Microsoft Corporation) MD5=94ABC808FC4B6D7D2BBF42B85E25BB4D -- C:\WINDOWS\system32\dllcache\swmidi.sys
[2004/08/04 00:15:56 | 00,060,800 | ---- | M] (Microsoft Corporation) MD5=650AD082D46BAC0E64C9C0E0928492FD -- C:\WINDOWS\system32\dllcache\sysaudio.sys
[2004/08/03 21:00:00 | 00,014,976 | ---- | M] (Microsoft Corporation) MD5=A2A9CA0D1A9AC1FF54220AA0789FE5CF -- C:\WINDOWS\system32\dllcache\tape.sys
[2008/06/20 03:45:13 | 00,360,320 | ---- | M] (Microsoft Corporation) MD5=2A5554FC5B1E04E131230E3CE035C3F9 -- C:\WINDOWS\system32\dllcache\tcpip.sys
[2008/06/20 02:52:06 | 00,225,920 | ---- | M] (Microsoft Corporation) MD5=00586ED87AB564B03870A2A3DCC84B55 -- C:\WINDOWS\system32\dllcache\tcpip6.sys
[2001/08/23 11:00:00 | 00,013,192 | ---- | M] (Microsoft Corporation) MD5=3FC234C9E20918CE856FFA42C421E678 -- C:\WINDOWS\system32\dllcache\tdasync.sys
[2004/08/03 21:07:50 | 00,018,560 | ---- | M] (Microsoft Corporation) MD5=6891B74AB9A016064E82A419388D0601 -- C:\WINDOWS\system32\dllcache\tdi.sys
[2001/08/23 11:00:00 | 00,021,896 | ---- | M] (Microsoft Corporation) MD5=182A77EECBDEA330472A9A7A6F1457CE -- C:\WINDOWS\system32\dllcache\tdipx.sys
[2004/08/03 23:01:08 | 00,012,040 | ---- | M] (Microsoft Corporation) MD5=38D437CF2D98965F239B0ABCD66DCB0F -- C:\WINDOWS\system32\dllcache\tdpipe.sys
[2001/08/23 11:00:00 | 00,019,464 | ---- | M] (Microsoft Corporation) MD5=5FB281F720939CBE9961D1808CC270E9 -- C:\WINDOWS\system32\dllcache\tdspx.sys
[2004/08/03 23:01:08 | 00,021,896 | ---- | M] (Microsoft Corporation) MD5=ED0580AF02502D00AD8C4C066B156BE9 -- C:\WINDOWS\system32\dllcache\tdtcp.sys
[2001/08/23 11:00:00 | 00,051,712 | ---- | M] (Microsoft Corporation) MD5=699450901C5CCFD82357CBC531CEDD23 -- C:\WINDOWS\system32\dllcache\tosdvd.sys
[2001/08/23 11:00:00 | 00,021,376 | ---- | M] (Toshiba Corporation) MD5=D74A8EC75305F1D3CFDE7C7FC1BD62A9 -- C:\WINDOWS\system32\dllcache\tsbvcap.sys
[2004/08/03 23:05:44 | 00,012,416 | ---- | M] (Microsoft Corporation) MD5=87A0E9E18C10A9E454238E3330E2A26D -- C:\WINDOWS\system32\dllcache\tunmp.sys
[2004/08/03 21:00:32 | 00,066,176 | ---- | M] (Microsoft Corporation) MD5=12F70256F140CD7D52C58C7048FDE657 -- C:\WINDOWS\system32\dllcache\udfs.sys
[2004/08/03 20:58:34 | 00,209,408 | ---- | M] (Microsoft Corporation) MD5=AFF2E5045961BBC0A602BB6F95EB1345 -- C:\WINDOWS\system32\dllcache\update.sys
[2004/08/03 21:04:34 | 00,012,672 | ---- | M] (Microsoft Corporation) MD5=AF090265EC388BAB320F1FF7E7A7D5EA -- C:\WINDOWS\system32\dllcache\usb8023.sys
[2004/08/04 00:07:56 | 00,059,264 | ---- | M] (Microsoft Corporation) MD5=45A0D14B26C35497AD93BCE7E15C9941 -- C:\WINDOWS\system32\dllcache\usbaudio.sys
[2001/08/23 11:00:00 | 00,023,808 | ---- | M] (Microsoft Corporation) MD5=2654EECC6FB13603EBDDCD5C8EA943D1 -- C:\WINDOWS\system32\dllcache\usbcamd.sys
[2001/08/23 11:00:00 | 00,023,936 | ---- | M] (Microsoft Corporation) MD5=61018BA9DF6B63E51D9753C980E73EC2 -- C:\WINDOWS\system32\dllcache\usbcamd2.sys
[2004/08/03 23:05:44 | 00,016,000 | ---- | M] (Microsoft Corporation) MD5=2853FD4C4489E0F8BFCF78EFCDB7E998 -- C:\WINDOWS\system32\dllcache\usbintel.sys
[2004/08/03 23:58:46 | 00,015,104 | ---- | M] (Microsoft Corporation) MD5=A6BC71402F4F7DD5B77FD7F4A8DDBA85 -- C:\WINDOWS\system32\dllcache\usbscan.sys
[2001/08/23 11:00:00 | 00,058,112 | ---- | M] (RAVISENT Technologies Inc.) MD5=55E01061C74A8CEFFF58DC36114A8D3F -- C:\WINDOWS\system32\dllcache\vdmindvd.sys
[2004/08/03 21:07:08 | 00,020,992 | ---- | M] (Microsoft Corporation) MD5=8A60EDD72B4EA5AEA8202DAF0E427925 -- C:\WINDOWS\system32\dllcache\vga.sys
[2004/08/03 21:07:06 | 00,079,744 | ---- | M] (Microsoft Corporation) MD5=D5A9D123F5ED7C9965A481BD20CF66D8 -- C:\WINDOWS\system32\dllcache\videoprt.sys
[2004/08/03 21:00:18 | 00,052,352 | ---- | M] (Microsoft Corporation) MD5=EE4660083DEBA849FF6C485D944B379B -- C:\WINDOWS\system32\dllcache\volsnap.sys
[2004/08/03 21:04:58 | 00,034,560 | ---- | M] (Microsoft Corporation) MD5=984EF0B9788ABF89974CFED4BFBAACBC -- C:\WINDOWS\system32\dllcache\wanarp.sys
[2004/08/03 21:07:34 | 00,017,664 | ---- | M] (Microsoft Corporation) MD5=C9BF2F12C4E6C12F8A85FBA4B6BC6208 -- C:\WINDOWS\system32\dllcache\watchdog.sys
[2006/06/14 02:00:45 | 00,082,944 | ---- | M] (Microsoft Corporation) MD5=EFD235CA22B57C81118C1AEB4798F1C1 -- C:\WINDOWS\system32\dllcache\wdmaud.sys
[2001/08/23 11:00:00 | 00,031,232 | ---- | M] (Microsoft Corporation) MD5=1EEBFF8F9B07174BE150A006E3B4B1BF -- C:\WINDOWS\system32\dllcache\weitekp9.sys
[2009/08/14 05:19:41 | 01,850,112 | ---- | M] (Microsoft Corporation) MD5=1EFBC43B33B83FD7376E63A71830CC69 -- C:\WINDOWS\system32\dllcache\win32k.sys
[2004/08/03 22:07:42 | 00,008,832 | ---- | M] (Microsoft Corporation) MD5=AE2C8544E747C20062DB27456EA2D67A -- C:\WINDOWS\system32\dllcache\wmiacpi.sys
[2001/08/23 11:00:00 | 00,004,352 | ---- | M] (Microsoft Corporation) MD5=2F31B7F954BED437F2C75026C65CAF7B -- C:\WINDOWS\system32\dllcache\wmilib.sys
[2001/08/23 11:00:00 | 00,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2004/08/04 00:10:22 | 00,019,328 | ---- | M] (Microsoft Corporation) MD5=D5842484F05E12121C511AA93F6439EC -- C:\WINDOWS\system32\dllcache\wstcodec.sys
[2004/08/03 21:10:08 | 00,053,248 | ---- | M] (Microsoft Corporation) MD5=009927DB8019C54477DABF6F9D795053 -- C:\WINDOWS\system32\drivers\1394bus.sys
[2004/08/03 21:07:38 | 00,187,776 | ---- | M] (Microsoft Corporation) MD5=A10C7534F7223F4A73A948967D00E69B -- C:\WINDOWS\system32\drivers\acpi.sys
[2001/08/23 11:00:00 | 00,011,648 | ---- | M] (Microsoft Corporation) MD5=9859C0F6936E723E4892D7141B1327D5 -- C:\WINDOWS\system32\drivers\acpiec.sys
[2006/02/14 17:22:26 | 00,142,464 | ---- | M] (Microsoft Corporation) MD5=1EE7B434BA961EF845DE136224C30FEC -- C:\WINDOWS\system32\drivers\aec.sys
[2008/08/14 02:51:43 | 00,138,368 | ---- | M] (Microsoft Corporation) MD5=55E6E1C51B6D30E54335750955453702 -- C:\WINDOWS\system32\drivers\afd.sys
[2004/10/07 18:16:04 | 00,035,840 | ---- | M] (Oak Technology Inc.) MD5=0EBB674888CBDEFD5773341C16DD6A07 -- C:\WINDOWS\system32\drivers\AFS2K.SYS
[2008/03/07 06:24:52 | 00,176,136 | R--- | M] (AMD Technologies Inc.) MD5=B6E729A575F84938A08D367E8352EB86 -- C:\WINDOWS\system32\drivers\ahcix86.sys
[2005/07/26 02:03:22 | 03,644,032 | R--- | M] (Realtek Semiconductor Corp.) MD5=2C6322E8FF56F624033E7642C49044F3 -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS
[2004/08/03 23:05:44 | 00,036,992 | ---- | M] (Microsoft Corporation) MD5=DAD16A9D5C873E7219E6B43802ED316A -- C:\WINDOWS\system32\drivers\amdk6.sys
[2004/08/03 23:05:44 | 00,037,376 | ---- | M] (Microsoft Corporation) MD5=680AD1C1BB16239E28D8F33A54A7A3C7 -- C:\WINDOWS\system32\drivers\amdk7.sys
[2006/07/01 21:39:40 | 00,036,864 | ---- | M] (Advanced Micro Devices) MD5=EFBB0956BAED786E137351B5CA272AEF -- C:\WINDOWS\system32\drivers\AmdK8.sys
[2004/08/03 23:05:44 | 00,060,800 | ---- | M] (Microsoft Corporation) MD5=F0D692B0BFFB46E30EB3CEA168BBC49F -- C:\WINDOWS\system32\drivers\arp1394.sys
[2004/08/03 21:05:04 | 00,014,336 | ---- | M] (Microsoft Corporation) MD5=02000ABF34AF4C218C35D257024807D6 -- C:\WINDOWS\system32\drivers\asyncmac.sys
[2004/08/03 21:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 22:29:28 | 00,701,440 | ---- | M] (ATI Technologies Inc.) MD5=8759322FFC1A50569C1E5528EE8026B7 -- C:\WINDOWS\system32\drivers\ati2mtag.sys
[2004/08/03 20:58:32 | 00,059,904 | ---- | M] (Microsoft Corporation) MD5=EC88DA854AB7D7752EC8BE11A741BB7F -- C:\WINDOWS\system32\drivers\atmarpc.sys
[2001/08/23 11:00:00 | 00,031,360 | ---- | M] (Microsoft Corporation) MD5=39A0A59180F19946374275745B21AEBA -- C:\WINDOWS\system32\drivers\atmepvc.sys
[2004/08/03 20:58:36 | 00,055,936 | ---- | M] (Microsoft Corporation) MD5=0128E78FE835F074E469F03DB681CA9E -- C:\WINDOWS\system32\drivers\atmlane.sys
[2001/08/23 11:00:00 | 00,352,256 | ---- | M] (Microsoft Corporation) MD5=E7EF69B38D17BA01F914AE8F66216A38 -- C:\WINDOWS\system32\drivers\atmuni.sys
[2001/08/17 06:59:44 | 00,003,072 | ---- | M] (Microsoft Corporation) MD5=D9F724AA26C010A217C97606B160ED68 -- C:\WINDOWS\system32\drivers\audstub.sys
[2008/04/29 09:19:50 | 00,012,960 | ---- | M] (Lavasoft AB) MD5=124E75B7C483E5D646F99EF5ACFD61B8 -- C:\WINDOWS\system32\drivers\Awrtpd.sys
[2008/04/29 09:19:54 | 00,015,648 | ---- | M] (Lavasoft AB) MD5=973E80FEB99243D150FA3CA490698EB0 -- C:\WINDOWS\system32\drivers\Awrtrd.sys
[2005/02/01 19:18:38 | 00,017,992 | ---- | M] (Broadcom Corporation) MD5=438179ABE9B7A922A21B8D6369FF52FF -- C:\WINDOWS\system32\drivers\bcm42rly.sys
[2001/08/23 11:00:00 | 00,004,224 | ---- | M] (Microsoft Corporation) MD5=DA1F27D85E0D1525F6621372E7B685E9 -- C:\WINDOWS\system32\drivers\beep.sys
[2004/08/03 20:59:58 | 00,071,552 | ---- | M] (Microsoft Corporation) MD5=E4E6A0922E3D983728C9AD4E8D466954 -- C:\WINDOWS\system32\drivers\bridge.sys
[2008/06/13 06:10:50 | 00,272,128 | ---- | M] (Microsoft Corporation) MD5=95EF6F3F386D93EE1E4D9CA45A50252A -- C:\WINDOWS\system32\drivers\bthport.sys
[2001/08/23 11:00:00 | 00,013,952 | ---- | M] (Microsoft Corporation) MD5=90A673FC8E12A79AFBED2576F6A7AAF9 -- C:\WINDOWS\system32\drivers\cbidf2k.sys
[2004/08/04 00:10:18 | 00,017,024 | ---- | M] (Microsoft Corporation) MD5=6163ED60B684BAB19D3352AB22FC48B2 -- C:\WINDOWS\system32\drivers\CCDECODE.sys
[2001/08/23 11:00:00 | 00,018,688 | ---- | M] (Microsoft Corporation) MD5=C1B486A7658353D33A10CC15211A873B -- C:\WINDOWS\system32\drivers\cdaudio.sys
[2004/08/03 21:14:12 | 00,063,744 | ---- | M] (Microsoft Corporation) MD5=CD7D5152DF32B47F4E36F710B35AAE02 -- C:\WINDOWS\system32\drivers\cdfs.sys
[2009/08/23 14:00:38 | 00,062,592 | ---- | M] (Microsoft Corporation) MD5=7B53584D94E9D8716B2DE91D5F1CB42D -- C:\WINDOWS\system32\drivers\cdrom.sys
[2001/08/23 11:00:00 | 00,262,528 | ---- | M] (RAVISENT Technologies Inc.) MD5=B562592B7F5759C99E179CA467ECFB4C -- C:\WINDOWS\system32\drivers\cinemst2.sys
[2004/08/03 21:14:28 | 00,049,664 | ---- | M] (Microsoft Corporation) MD5=D86173B401470F06D9810F7962969DDF -- C:\WINDOWS\system32\drivers\classpnp.sys
[2001/08/23 11:00:00 | 00,011,776 | ---- | M] (Compaq Computer Corporation) MD5=9624293E55AD405415862B504CA95B73 -- C:\WINDOWS\system32\drivers\cpqdap01.sys
[2004/08/03 23:05:44 | 00,036,480 | ---- | M] (Microsoft Corporation) MD5=6AF1684CCAAC3F7EF4EE9BA65EB0677A -- C:\WINDOWS\system32\drivers\crusoe.sys
[2004/08/03 20:59:56 | 00,036,352 | ---- | M] (Microsoft Corporation) MD5=00CA44E4534865F8A3B64F7C0984BFF0 -- C:\WINDOWS\system32\drivers\disk.sys
[2004/08/03 20:59:54 | 00,014,208 | ---- | M] (Microsoft Corporation) MD5=D16C81677A9BE399C63CD2EA486472A5 -- C:\WINDOWS\system32\drivers\diskdump.sys
[2004/08/03 21:07:18 | 00,799,744 | ---- | M] (Microsoft Corp., Veritas Software) MD5=C0FBB516E06E243F0CF31F597E7EBF7D -- C:\WINDOWS\system32\drivers\dmboot.sys
[2004/08/03 21:07:18 | 00,153,344 | ---- | M] (Microsoft Corp., Veritas Software) MD5=F5E7B358A732D09F4BCF2824B88B9E28 -- C:\WINDOWS\system32\drivers\dmio.sys
[2001/08/23 11:00:00 | 00,005,888 | ---- | M] (Microsoft Corp., Veritas Software.) MD5=E9317282A63CA4D188C0DF5E09C6AC5F -- C:\WINDOWS\system32\drivers\dmload.sys
[2004/08/04 00:07:40 | 00,052,864 | ---- | M] (Microsoft Corporation) MD5=A6F881284AC1150E37D9AE47FF601267 -- C:\WINDOWS\system32\drivers\DMusic.sys
[2004/08/03 22:08:00 | 00,060,288 | ---- | M] (Microsoft Corporation) MD5=FF86422268DE771D571E123EB7092C6A -- C:\WINDOWS\system32\drivers\drmk.sys
[2004/08/04 00:07:58 | 00,002,944 | ---- | M] (Microsoft Corporation) MD5=1ED4DBBAE9F5D558DBBA4CC450E3EB2E -- C:\WINDOWS\system32\drivers\drmkaud.sys
[2001/08/23 11:00:00 | 00,010,496 | ---- | M] (Microsoft Corporation) MD5=FE97D0343ACFDEBDD578FC67CC91FA87 -- C:\WINDOWS\system32\drivers\dxapi.sys
[2004/08/03 21:00:56 | 00,071,040 | ---- | M] (Microsoft Corporation) MD5=D3DAC8432110AAD0B02A58B4459AB835 -- C:\WINDOWS\system32\drivers\dxg.sys
[2001/08/23 11:00:00 | 00,003,328 | ---- | M] (Microsoft Corporation) MD5=A73F5D6705B1D820C19B18782E176EFD -- C:\WINDOWS\system32\drivers\dxgthk.sys
[2001/08/17 06:46:40 | 00,006,400 | ---- | M] (Microsoft Corporation) MD5=80D1B490B60E74E002DC116EC5D41748 -- C:\WINDOWS\system32\drivers\enum1394.sys
[2004/08/03 21:14:18 | 00,143,360 | ---- | M] (Microsoft Corporation) MD5=3117F595E9615E04F05A54FC15A03B20 -- C:\WINDOWS\system32\drivers\fastfat.sys
[2004/08/03 20:59:28 | 00,027,392 | ---- | M] (Microsoft Corporation) MD5=CED2E8396A8838E59D8FD529C680E02C -- C:\WINDOWS\system32\drivers\fdc.sys
[2001/08/23 11:00:00 | 00,034,944 | ---- | M] (Microsoft Corporation) MD5=E153AB8A11DE5452BCF5AC7652DBF3ED -- C:\WINDOWS\system32\drivers\fips.sys
[2004/08/03 20:59:28 | 00,020,480 | ---- | M] (Microsoft Corporation) MD5=0DD1DE43115B93F4D85E889D7A86F548 -- C:\WINDOWS\system32\drivers\flpydisk.sys
[2006/08/21 02:14:58 | 00,128,896 | ---- | M] (Microsoft Corporation) MD5=3D234FB6D6EE875EB009864A299BEA29 -- C:\WINDOWS\system32\drivers\fltmgr.sys
[2001/08/23 11:00:00 | 00,012,160 | ---- | M] (Microsoft Corporation) MD5=455F778EE14368468560BD7CB8C854D0 -- C:\WINDOWS\system32\drivers\fsvga.sys
[2001/08/23 11:00:00 | 00,007,936 | ---- | M] (Microsoft Corporation) MD5=3E1E2BD4F39B0E2B7DC4F4D2BCC2779A -- C:\WINDOWS\system32\drivers\fs_rec.sys
[2001/08/23 11:00:00 | 00,125,056 | ---- | M] (Microsoft Corporation) MD5=6AC26732762483366C3969C9E4D2259D -- C:\WINDOWS\system32\drivers\ftdisk.sys
[2006/09/19 13:44:04 | 00,015,664 | ---- | M] (GEAR Software Inc.) MD5=4AC51459805264AFFD5F6FDFB9D9235F -- C:\WINDOWS\system32\drivers\GEARAspiWDM.sys
[2005/01/07 18:07:18 | 00,138,752 | ---- | M] (Windows ® Server 2003 DDK provider) MD5=3FCC124B6E08EE0E9351F717DD136939 -- C:\WINDOWS\system32\drivers\Hdaudbus.sys
[2005/01/07 18:07:16 | 00,145,920 | ---- | M] (Windows ® Server 2003 DDK provider) MD5=2A013E7530BEAB6E569FAA83F517E836 -- C:\WINDOWS\system32\drivers\Hdaudio.sys
[2004/08/03 21:08:20 | 00,036,224 | ---- | M] (Microsoft Corporation) MD5=378055AB8DDA86228683C697C4E11685 -- C:\WINDOWS\system32\drivers\hidclass.sys
[2004/08/03 21:08:18 | 00,024,960 | ---- | M] (Microsoft Corporation) MD5=5FFF41CD5108E9051D255C37825AF697 -- C:\WINDOWS\system32\drivers\hidparse.sys
[2001/08/23 11:00:00 | 00,009,600 | ---- | M] (Microsoft Corporation) MD5=1DE6783B918F540149AA69943BDFEBA8 -- C:\WINDOWS\system32\drivers\hidusb.sys
[2009/10/20 07:58:48 | 00,263,552 | ---- | M] (Microsoft Corporation) MD5=9F8B0F4276F618964FD118BE4289B7CD -- C:\WINDOWS\system32\drivers\http.sys
[2004/08/03 21:14:38 | 00,052,736 | ---- | M] (Microsoft Corporation) MD5=5502B58EEF7486EE6F93F3F164DCB808 -- C:\WINDOWS\system32\drivers\i8042prt.sys
[2004/08/03 21:00:16 | 00,041,856 | ---- | M] (Microsoft Corporation) MD5=F8AA320C6A0409C0380E5D8A99D76EC6 -- C:\WINDOWS\system32\drivers\imapi.sys
[2004/08/03 20:59:20 | 00,036,096 | ---- | M] (Microsoft Corporation) MD5=279FB78702454DFF2BB445F238C048D2 -- C:\WINDOWS\system32\drivers\intelppm.sys
[2004/08/03 21:00:08 | 00,029,056 | ---- | M] (Microsoft Corporation) MD5=4448006B6BC60E6C027932CFC38D6855 -- C:\WINDOWS\system32\drivers\ip6fw.sys
[2001/08/23 11:00:00 | 00,032,896 | ---- | M] (Microsoft Corporation) MD5=731F22BA402EE4B62748ADAF6363C182 -- C:\WINDOWS\system32\drivers\ipfltdrv.sys
[2004/08/03 21:04:46 | 00,020,992 | ---- | M] (Microsoft Corporation) MD5=E1EC7F5DA720B640CD8FB8424F1B14BB -- C:\WINDOWS\system32\drivers\ipinip.sys
[2004/09/29 15:28:37 | 00,134,912 | ---- | M] (Microsoft Corporation) MD5=E2168CBC7098FFE963C6F23F472A3593 -- C:\WINDOWS\system32\drivers\ipnat.sys
[2004/08/03 21:14:30 | 00,074,752 | ---- | M] (Microsoft Corporation) MD5=64537AA5C003A6AFEEE1DF819062D0D1 -- C:\WINDOWS\system32\drivers\ipsec.sys
[2004/08/03 21:00:48 | 00,011,264 | ---- | M] (Microsoft Corporation) MD5=50708DAA1B1CBB7D6AC1CF8F56A24410 -- C:\WINDOWS\system32\drivers\irenum.sys
[2001/08/23 11:00:00 | 00,035,840 | ---- | M] (Microsoft Corporation) MD5=E504F706CCB699C2596E9A3DA1596E87 -- C:\WINDOWS\system32\drivers\isapnp.sys
[2004/08/03 20:58:34 | 00,024,576 | ---- | M] (Microsoft Corporation) MD5=EBDEE8A2EE5393890A1ACEE971C4C246 -- C:\WINDOWS\system32\drivers\kbdclass.sys
[2006/06/14 01:47:45 | 00,172,416 | ---- | M] (Microsoft Corporation) MD5=BA5DEDA4D934E6288C2F66CAF58D2562 -- C:\WINDOWS\system32\drivers\kmixer.sys
[2004/08/03 22:15:22 | 00,140,928 | ---- | M] (Microsoft Corporation) MD5=B9540E258F952650DE8DEC68719A5C97 -- C:\WINDOWS\system32\drivers\ks.sys
[2009/06/22 04:35:44 | 00,092,544 | ---- | M] (Microsoft Corporation) MD5=1BE7CC2535D760AE4D481576EB789F24 -- C:\WINDOWS\system32\drivers\ksecdd.sys
[2007/10/11 18:55:58 | 00,013,848 | ---- | M] (Logitech Inc.) MD5=0896002D1EFCD08859A41C9DB34AD84C -- C:\WINDOWS\system32\drivers\lv302af.sys
[2007/10/11 18:55:58 | 01,279,000 | ---- | M] (Logitech Inc.) MD5=A7598E897DA639E255AD4188FA398478 -- C:\WINDOWS\system32\drivers\LV302V32.SYS
[2007/10/19 11:16:30 | 02,109,976 | ---- | M] (Logitech Inc.) MD5=8113133EC42DD6C566908008CE913EDD -- C:\WINDOWS\system32\drivers\Lvckap.sys
[2007/10/11 16:59:02 | 02,142,488 | ---- | M] (Logitech Inc.) MD5=0DD5B8AF4917A2821047450195C511B3 -- C:\WINDOWS\system32\drivers\LVMVdrv.sys
[2007/10/11 16:59:24 | 00,025,624 | ---- | M] () MD5=406B1D186F75B4B4832D6237859E1B00 -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys
[2007/10/11 19:00:42 | 00,041,752 | ---- | M] (Logitech Inc.) MD5=BE5E104BE263921D6842C555DB6A5C23 -- C:\WINDOWS\system32\drivers\LVUSBSta.sys
[2005/05/19 13:48:24 | 00,070,016 | ---- | M] () MD5=DB7F488269290A8C1907602B7F4C213D -- C:\WINDOWS\system32\drivers\LxrSII1d.sys
[2009/12/30 14:54:58 | 00,019,160 | ---- | M] (Malwarebytes Corporation) MD5=1B051BE823DF7F37E1EB653A5EB93D93 -- C:\WINDOWS\system32\drivers\mbam.sys
[2009/12/30 14:55:24 | 00,038,224 | ---- | M] (Malwarebytes Corporation) MD5=81BE7762CB0134060D0743B8179E9016 -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
[2001/08/23 11:00:00 | 00,007,680 | ---- | M] (Microsoft Corporation) MD5=D1F8BE91ED4DDB671D42E473E3FE71AB -- C:\WINDOWS\system32\drivers\mcd.sys
[2004/08/03 23:05:44 | 00,063,744 | ---- | M] (Microsoft Corporation) MD5=729D83E56C29C510258A6E9E79FFDDC3 -- C:\WINDOWS\system32\drivers\mf.sys
[2001/08/23 11:00:00 | 00,004,224 | ---- | M] (Microsoft Corporation) MD5=4AE068242760A1FB6E1A44BF4E16AFA6 -- C:\WINDOWS\system32\drivers\mnmdd.sys
[2004/08/03 23:05:44 | 00,030,080 | ---- | M] (Microsoft Corporation) MD5=6FC6F9D7ACC36DCA9B914565A3AEDA05 -- C:\WINDOWS\system32\drivers\modem.sys
[2004/08/03 23:05:44 | 00,023,040 | ---- | M] (Microsoft Corporation) MD5=34E1F0031153E491910E12551400192C -- C:\WINDOWS\system32\drivers\mouclass.sys
[2001/08/23 11:00:00 | 00,012,160 | ---- | M] (Microsoft Corporation) MD5=B1C303E17FB9D46E87A98E4BA6769685 -- C:\WINDOWS\system32\drivers\mouhid.sys
[2004/08/03 20:58:32 | 00,042,240 | ---- | M] (Microsoft Corporation) MD5=65653F3B4477F3C63E68A9659F85EE2E -- C:\WINDOWS\system32\drivers\mountmgr.sys
[2009/06/22 04:48:44 | 00,091,776 | ---- | M] (Microsoft Corporation) MD5=EEE50BF24CAEEDB515A8F3B22756D3BB -- C:\WINDOWS\system32\drivers\mqac.sys
[2002/12/13 01:06:40 | 00,129,875 | R--- | M] (Mars Semiconductor Corp.) MD5=1AAE79A4176A957BF2BB679812F04655 -- C:\WINDOWS\system32\drivers\mr97310c.sys
[2007/12/18 02:51:35 | 00,179,584 | ---- | M] (Microsoft Corporation) MD5=29414447EB5BDE2F8397DC965DBB3156 -- C:\WINDOWS\system32\drivers\mrxdav.sys
[2008/10/24 04:10:42 | 00,453,632 | ---- | M] (Microsoft Corporation) MD5=6F2D483B97B395544E59749C47963C6A -- C:\WINDOWS\system32\drivers\mrxsmb.sys
[2004/08/03 21:00:42 | 00,019,072 | ---- | M] (Microsoft Corporation) MD5=561B3A4333CA2DBDBA28B5B956822519 -- C:\WINDOWS\system32\drivers\msfs.sys
[2004/08/03 21:04:14 | 00,035,072 | ---- | M] (Microsoft Corporation) MD5=C0F1D4A21DE5A415DF8170616703DEBF -- C:\WINDOWS\system32\drivers\msgpc.sys
[2004/08/03 23:58:42 | 00,007,552 | ---- | M] (Microsoft Corporation) MD5=AE431A8DD3C1D0D0610CDBAC16057AD0 -- C:\WINDOWS\system32\drivers\MSKSSRV.sys
[2004/08/03 23:58:40 | 00,005,376 | ---- | M] (Microsoft Corporation) MD5=13E75FEF9DFEB08EEDED9D0246E1F448 -- C:\WINDOWS\system32\drivers\MSPCLOCK.sys
[2004/08/03 23:58:42 | 00,004,992 | ---- | M] (Microsoft Corporation) MD5=1988A33FF19242576C3D0EF9CE785DA7 -- C:\WINDOWS\system32\drivers\MSPQM.sys
[2004/08/03 23:05:44 | 00,015,488 | ---- | M] (Microsoft Corporation) MD5=469541F8BFD2B32659D5D463A6714BCE -- C:\WINDOWS\system32\drivers\mssmbios.sys
[2004/08/03 23:58:40 | 00,005,504 | ---- | M] (Microsoft Corporation) MD5=BF13612142995096AB084F2DB7F40F77 -- C:\WINDOWS\system32\drivers\MSTEE.sys
[2004/08/03 21:15:22 | 00,107,904 | ---- | M] (Microsoft Corporation) MD5=82035E0F41C2DD05AE41D27FE6CF7DE1 -- C:\WINDOWS\system32\drivers\mup.sys
[2004/08/04 00:10:30 | 00,085,376 | ---- | M] (Microsoft Corporation) MD5=5C8DC6429C43DC6177C1FA5B76290D1A -- C:\WINDOWS\system32\drivers\NABTSFEC.sys
[2004/08/03 21:14:30 | 00,182,912 | ---- | M] (Microsoft Corporation) MD5=558635D3AF1C7546D26067D5D9B6959E -- C:\WINDOWS\system32\drivers\ndis.sys
[2004/08/04 00:10:14 | 00,010,880 | ---- | M] (Microsoft Corporation) MD5=520CE427A8B298F54112857BCF6BDE15 -- C:\WINDOWS\system32\drivers\NdisIP.sys
[2001/08/23 11:00:00 | 00,009,600 | ---- | M] (Microsoft Corporation) MD5=08D43BBDACDF23F34D79E44ED35C1B4C -- C:\WINDOWS\system32\drivers\ndistapi.sys
[2004/08/03 23:05:44 | 00,012,928 | ---- | M] (Microsoft Corporation) MD5=34D6CD56409DA9A7ED573E1C90A308BF -- C:\WINDOWS\system32\drivers\ndisuio.sys
[2004/08/03 21:14:32 | 00,091,776 | ---- | M] (Microsoft Corporation) MD5=0B90E255A9490166AB368CD55A529893 -- C:\WINDOWS\system32\drivers\ndiswan.sys
[2001/08/23 11:00:00 | 00,038,016 | ---- | M] (Microsoft Corporation) MD5=59FC3FB44D2669BC144FD87826BB571F -- C:\WINDOWS\system32\drivers\ndproxy.sys
[2004/08/03 21:03:22 | 00,034,560 | ---- | M] (Microsoft Corporation) MD5=3A2ACA8FC1D7786902CA434998D7CEB4 -- C:\WINDOWS\system32\drivers\netbios.sys
[2004/08/03 21:14:38 | 00,162,816 | ---- | M] (Microsoft Corporation) MD5=0C80E410CD2F47134407EE7DD19CC86B -- C:\WINDOWS\system32\drivers\netbt.sys
[2004/08/03 23:05:44 | 00,061,824 | ---- | M] (Microsoft Corporation) MD5=5C5C53DB4FEF16CF87B9911C7E8C6FBC -- C:\WINDOWS\system32\drivers\nic1394.sys
[2001/08/23 11:00:00 | 00,012,032 | ---- | M] (S3/Diamond Multimedia Systems) MD5=BE984D604D91C217355CDD3737AAD25D -- C:\WINDOWS\system32\drivers\nikedrv.sys
[2004/08/03 20:59:52 | 00,040,320 | ---- | M] (Microsoft Corporation) MD5=60CF8C7192B3614F240838DDBAA4A245 -- C:\WINDOWS\system32\drivers\nmnt.sys
[2004/08/03 21:00:44 | 00,030,848 | ---- | M] (Microsoft Corporation) MD5=4F601BCB8F64EA3AC0994F98FED03F8E -- C:\WINDOWS\system32\drivers\npfs.sys
[2008/04/29 09:20:00 | 00,015,648 | ---- | M] (Lavasoft AB) MD5=AC3E7DB45F04EBD40F4C1E0A0D774269 -- C:\WINDOWS\system32\drivers\NSDriver.sys
[2007/02/09 04:10:35 | 00,574,464 | ---- | M] (Microsoft Corporation) MD5=19A811EF5F1ED5C926A028CE107FF1AF -- C:\WINDOWS\system32\drivers\ntfs.sys
[2001/08/23 11:00:00 | 00,002,944 | ---- | M] (Microsoft Corporation) MD5=73C1E1F395918BC2C6DD67AF7591A3AD -- C:\WINDOWS\system32\drivers\null.sys
[2007/12/04 10:41:00 | 07,435,392 | ---- | M] (NVIDIA Corporation) MD5=8C0456001B6900114BBB1C548BD8AAF5 -- C:\WINDOWS\system32\drivers\nv4_mini.sys
[2001/08/23 11:00:00 | 00,012,416 | ---- | M] (Microsoft Corporation) MD5=B305F3FAD35083837EF46A0BBCE2FC57 -- C:\WINDOWS\system32\drivers\nwlnkflt.sys
[2001/08/23 11:00:00 | 00,032,512 | ---- | M] (Microsoft Corporation) MD5=C99B3415198D1AAB7227F2C88FD664B9 -- C:\WINDOWS\system32\drivers\nwlnkfwd.sys
[2004/08/03 21:03:36 | 00,088,448 | ---- | M] (Microsoft Corporation) MD5=79EA3FCDA7067977625B3363A2657C80 -- C:\WINDOWS\system32\drivers\nwlnkipx.sys
[2001/08/23 11:00:00 | 00,063,232 | ---- | M] (Microsoft Corporation) MD5=56D34A67C05E94E16377C60609741FF8 -- C:\WINDOWS\system32\drivers\nwlnknb.sys
[2001/08/23 11:00:00 | 00,055,936 | ---- | M] (Microsoft Corporation) MD5=C0BB7D1615E1ACBDC99757F6CEAF8CF0 -- C:\WINDOWS\system32\drivers\nwlnkspx.sys
[2006/10/13 03:23:15 | 00,163,584 | ---- | M] (Microsoft Corporation) MD5=3F18D9365BE71C7B2E43B7CF4A0C1A10 -- C:\WINDOWS\system32\drivers\nwrdr.sys
[2004/08/03 21:10:10 | 00,061,056 | ---- | M] (Microsoft Corporation) MD5=0951DB8E5823EA366B0E408D71E1BA2A -- C:\WINDOWS\system32\drivers\ohci1394.sys
[2001/08/23 11:00:00 | 00,003,456 | ---- | M] (Microsoft Corporation) MD5=4BB30DDC53EBC76895E38694580CDFE9 -- C:\WINDOWS\system32\drivers\oprghdlr.sys
[2004/08/03 23:05:44 | 00,042,496 | ---- | M] (Microsoft Corporation) MD5=3E16EFF2A6FED2D8D7F5A66DFE65D183 -- C:\WINDOWS\system32\drivers\p3.sys
[2004/08/03 23:05:44 | 00,080,128 | ---- | M] (Microsoft Corporation) MD5=29744EB4CE659DFE3B4122DEB45BC478 -- C:\WINDOWS\system32\drivers\parport.sys
[2001/08/23 11:00:00 | 00,018,688 | ---- | M] (Microsoft Corporation) MD5=3334430C29DC338092F79C38EF7B4CD0 -- C:\WINDOWS\system32\drivers\partmgr.sys
[2001/08/23 11:00:00 | 00,006,784 | ---- | M] (Microsoft Corporation) MD5=70E98B3FD8E963A6A46A2E6247E0BEA1 -- C:\WINDOWS\system32\drivers\parvdm.sys
[2004/08/03 21:07:48 | 00,068,224 | ---- | M] (Microsoft Corporation) MD5=8086D9979234B603AD5BC2F5D890B234 -- C:\WINDOWS\system32\drivers\pci.sys
[2001/08/17 12:51:52 | 00,003,328 | ---- | M] (Microsoft Corporation) MD5=CCF5F451BB1A5A2A522A76E670000FF0 -- C:\WINDOWS\system32\drivers\pciide.sys
[2004/08/03 21:59:42 | 00,025,088 | ---- | M] (Microsoft Corporation) MD5=520B91AB011456B940D9B05FC91108FF -- C:\WINDOWS\system32\drivers\pciidex.sys
[2004/08/03 21:07:48 | 00,119,936 | ---- | M] (Microsoft Corporation) MD5=82A087207DECEC8456FBE8537947D579 -- C:\WINDOWS\system32\drivers\pcmcia.sys
[2008/10/04 12:19:12 | 00,159,992 | ---- | M] () MD5=DF717C2F1551B121D2F459A993C33E34 -- C:\WINDOWS\system32\drivers\PnkBstrK.sys
[2004/03/16 11:58:20 | 00,136,960 | ---- | M] (Microsoft Corporation) MD5=BC6B2BC69C1E009443E8B1FE2DB96101 -- C:\WINDOWS\system32\drivers\portcls.sys
[2004/08/03 23:05:44 | 00,035,328 | ---- | M] (Microsoft Corporation) MD5=0D97D88720A4087EC93AF7DBB303B30A -- C:\WINDOWS\system32\drivers\processr.sys
[2004/08/03 21:04:20 | 00,069,120 | ---- | M] (Microsoft Corporation) MD5=48671F327553DCF1D27F6197F622A668 -- C:\WINDOWS\system32\drivers\psched.sys
[2001/08/23 11:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) MD5=80D317BD1C3DBC5D4FE7B1678C60CADD -- C:\WINDOWS\system32\drivers\ptilink.sys
[2001/08/23 11:00:00 | 00,008,832 | ---- | M] (Microsoft Corporation) MD5=FE0D99D6F31E4FAD8159F690D68DED9C -- C:\WINDOWS\system32\drivers\rasacd.sys
[2004/08/03 21:14:24 | 00,051,328 | ---- | M] (Microsoft Corporation) MD5=98FAEB4A4DCF812BA1C6FCA4AA3E115C -- C:\WINDOWS\system32\drivers\rasl2tp.sys
[2004/08/03 21:05:08 | 00,041,472 | ---- | M] (Microsoft Corporation) MD5=7306EEED8895454CBED4669BE9F79FAA -- C:\WINDOWS\system32\drivers\raspppoe.sys
[2004/08/03 21:14:28 | 00,048,384 | ---- | M] (Microsoft Corporation) MD5=1C5CC65AAC0783C344F16353E60B72AC -- C:\WINDOWS\system32\drivers\raspptp.sys
[2001/08/23 11:00:00 | 00,016,512 | ---- | M] (Microsoft Corporation) MD5=FDBB1D60066FCFBB7452FD8F9829B242 -- C:\WINDOWS\system32\drivers\raspti.sys
[2001/08/23 11:00:00 | 00,034,432 | ---- | M] (Microsoft Corporation) MD5=01524CD237223B18ADBB48F70083F101 -- C:\WINDOWS\system32\drivers\rawwan.sys
[2006/05/05 02:47:57 | 00,174,592 | ---- | M] (Microsoft Corporation) MD5=03B965B1CA47F6EF60EB5E51CB50E0AF -- C:\WINDOWS\system32\drivers\rdbss.sys
[2001/08/23 11:00:00 | 00,004,224 | ---- | M] (Microsoft Corporation) MD5=4912D5B403614CE99C28420F75353332 -- C:\WINDOWS\system32\drivers\rdpcdd.sys
[2004/08/04 00:01:16 | 00,196,864 | ---- | M] (Microsoft Corporation) MD5=A2CAE2C60BC37E0751EF9DDA7CEAF4AD -- C:\WINDOWS\system32\drivers\rdpdr.sys
[2005/06/09 21:09:46 | 00,139,528 | ---- | M] (Microsoft Corporation) MD5=B54CD38A9EBFBF2B3561426E3FE26F62 -- C:\WINDOWS\system32\drivers\rdpwd.sys
[2004/08/03 15:59:38 | 00,057,472 | ---- | M] (Microsoft Corporation) MD5=B31B4588E4086D8D84ADBF9845C2402B -- C:\WINDOWS\system32\drivers\redbook.sys
[2001/08/23 11:00:00 | 00,012,032 | ---- | M] (S3/Diamond Multimedia Systems) MD5=A56FE08EC7473E8580A390BB1081CDD7 -- C:\WINDOWS\system32\drivers\rio8drv.sys
[2001/08/23 11:00:00 | 00,012,032 | ---- | M] (S3/Diamond Multimedia Systems) MD5=0A854DF84C77A0BE205BFEAB2AE4F0EC -- C:\WINDOWS\system32\drivers\riodrv.sys
[2008/05/08 05:28:49 | 00,202,752 | ---- | M] (Microsoft Corporation) MD5=D18208ED6C768663B08C972EAA7A8B60 -- C:\WINDOWS\system32\drivers\rmcast.sys
[2004/08/03 21:04:32 | 00,030,080 | ---- | M] (Microsoft Corporation) MD5=7CE8B277F3207EA82D7D22AD348BEFC6 -- C:\WINDOWS\system32\drivers\rndismp.sys
[2001/08/23 11:00:00 | 00,005,888 | ---- | M] (Microsoft Corporation) MD5=D8B0B4ADE32574B2D9C5CC34DC0DBBE7 -- C:\WINDOWS\system32\drivers\rootmdm.sys
[2005/10/27 14:06:30 | 00,356,096 | ---- | M] (Ralink Technology Inc.) MD5=581E74880AEB1DBA1CB5AC8E6E6C0A69 -- C:\WINDOWS\system32\drivers\rt61.sys
[2008/01/03 23:10:16 | 00,105,856 | R--- | M] (Realtek Semiconductor Corporation ) MD5=89619EF503F949FAE09252A8B883EE11 -- C:\WINDOWS\system32\drivers\Rtenicxp.sys
[2008/04/29 02:48:00 | 03,688,960 | R--- | M] (Realtek Semiconductor Corp.) MD5=FFFDFA85CF01DEE5457F4EA41FD9ED04 -- C:\WINDOWS\system32\drivers\RtHDMI.sys
[2008/05/14 17:03:12 | 04,742,144 | R--- | M] (Realtek Semiconductor Corp.) MD5=7FFE2751AE9B3082CD55BFCC2E9BECDB -- C:\WINDOWS\system32\drivers\RtkHDAud.sys
[2004/08/03 15:31:34 | 00,020,992 | ---- | M] (Realtek Semiconductor Corporation) MD5=D507C1400284176573224903819FFDA3 -- C:\WINDOWS\system32\drivers\RTL8139.sys
[2004/08/03 23:59:58 | 00,043,136 | ---- | M] (Microsoft Corporation) MD5=3E2C3B180872BE4120F246D85560B734 -- C:\WINDOWS\system32\drivers\sbp2port.sys
[2004/08/03 20:59:42 | 00,096,256 | ---- | M] (Microsoft Corporation) MD5=D7FD0FF761E28AC0EA35AD71E0CD67E9 -- C:\WINDOWS\system32\drivers\scsiport.sys
[2004/08/03 21:07:48 | 00,067,584 | ---- | M] (Microsoft Corporation) MD5=02FC71B020EC8700EE8A46C58BC6F276 -- C:\WINDOWS\system32\drivers\sdbus.sys
[2007/11/13 03:25:53 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) MD5=90A3935D05B494A5A39D37E71F09A677 -- C:\WINDOWS\system32\drivers\secdrv.sys
[2004/08/03 20:59:08 | 00,015,488 | ---- | M] (Microsoft Corporation) MD5=A2D868AEEFF612E70E213C451A70CAFB -- C:\WINDOWS\system32\drivers\serenum.sys
[2004/08/03 21:15:54 | 00,064,896 | ---- | M] (Microsoft Corporation) MD5=CD9404D115A00D249F70A371B46D5A26 -- C:\WINDOWS\system32\drivers\serial.sys
[2004/08/03 20:59:56 | 00,011,136 | ---- | M] (Microsoft Corporation) MD5=1D9F1BEC651815741F088A8FB88E17EE -- C:\WINDOWS\system32\drivers\sffdisk.sys
[2004/08/03 20:59:56 | 00,010,240 | ---- | M] (Microsoft Corporation) MD5=586499FD312FFD7F78553F408E71682E -- C:\WINDOWS\system32\drivers\sffp_sd.sys
[2004/08/03 20:59:56 | 00,011,392 | ---- | M] (Microsoft Corporation) MD5=0D13B6DF6E9E101013A7AFB0CE629FE0 -- C:\WINDOWS\system32\drivers\sfloppy.sys
[2004/08/04 00:10:18 | 00,011,136 | ---- | M] (Microsoft Corporation) MD5=5CAEED86821FA2C6139E32E9E05CCDC9 -- C:\WINDOWS\system32\drivers\SLIP.sys
[2001/08/23 11:00:00 | 00,014,592 | ---- | M] (Microsoft Corporation) MD5=017DAECF0ED3AA731313433601EC40FA -- C:\WINDOWS\system32\drivers\smclib.sys
[2004/08/03 23:05:44 | 00,025,472 | ---- | M] (Microsoft Corporation) MD5=ADDC9E4757A68AB60562AD3CB9C288D6 -- C:\WINDOWS\system32\drivers\sonydcam.sys
[2001/08/17 13:56:16 | 00,007,552 | ---- | M] (Sony Corporation) MD5=A1ECEEAA5C5E74B2499EB51D38185B84 -- C:\WINDOWS\system32\drivers\SONYPVU1.SYS
[2006/06/14 01:47:46 | 00,006,400 | ---- | M] (Microsoft Corporation) MD5=0CE218578FFF5F4F7E4201539C45C78F -- C:\WINDOWS\system32\drivers\splitter.sys
[2008/09/14 21:27:44 | 00,717,296 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\sptd.sys
[2004/08/03 21:06:26 | 00,073,472 | ---- | M] (Microsoft Corporation) MD5=E41B6D037D6CD08461470AF04500DC24 -- C:\WINDOWS\system32\drivers\sr.sys
[2008/12/11 04:57:21 | 00,333,184 | ---- | M] (Microsoft Corporation) MD5=AB9C79ED12D65E800AAAD3D72A04792F -- C:\WINDOWS\system32\drivers\srv.sys
[2006/11/15 18:32:26 | 00,243,212 | ---- | M] (Syntek America Inc.) MD5=25802594D4C718D954C7CFC4C20EED8F -- C:\WINDOWS\system32\drivers\StkACamd.sys
[2006/11/15 18:32:44 | 00,242,139 | ---- | M] (Syntek America Inc.) MD5=36ED459E9130E6D07FA66FACA1E491D0 -- C:\WINDOWS\system32\drivers\StkAMini.sys
[2006/11/15 18:32:14 | 00,653,988 | ---- | M] (Syntek America Inc.) MD5=FCFBAC51501396FF4261F97991AF0BD6 -- C:\WINDOWS\system32\drivers\StkAPin.sys
[2006/02/09 19:07:12 | 10,479,603 | ---- | M] (Syntek America Inc.) MD5=8E53975AE990CC5D4FFB8D049E766BAE -- C:\WINDOWS\system32\drivers\StkAPipe.sys
[2006/11/15 18:31:50 | 00,018,754 | ---- | M] (Syntek America Inc.) MD5=CE8116ECE15A2C56F799520514CE4EB5 -- C:\WINDOWS\system32\drivers\StkASam.sys
[2006/06/27 19:27:18 | 00,004,772 | ---- | M] (Syntek America Inc.) MD5=DF29245097F6DE1CA9861C75DF7FBE42 -- C:\WINDOWS\system32\drivers\StkScan.sys
[2004/08/03 22:08:04 | 00,048,640 | ---- | M] (Microsoft Corporation) MD5=C43356072EB3E88CD62958DB10CEAD47 -- C:\WINDOWS\system32\drivers\stream.sys
[2004/08/04 00:10:14 | 00,015,360 | ---- | M] (Microsoft Corporation) MD5=284C57DF5DC7ABCA656BC2B96A667AFB -- C:\WINDOWS\system32\drivers\StreamIP.sys
[2004/08/03 23:05:44 | 00,004,352 | ---- | M] (Microsoft Corporation) MD5=03C1BAE4766E2450219D20B993D6E046 -- C:\WINDOWS\system32\drivers\swenum.sys
[2001/08/17 15:00:52 | 00,054,272 | ---- | M] (Microsoft Corporation) MD5=94ABC808FC4B6D7D2BBF42B85E25BB4D -- C:\WINDOWS\system32\drivers\swmidi.sys
[2004/08/04 00:15:56 | 00,060,800 | ---- | M] (Microsoft Corporation) MD5=650AD082D46BAC0E64C9C0E0928492FD -- C:\WINDOWS\system32\drivers\sysaudio.sys
[2004/08/03 21:00:00 | 00,014,976 | ---- | M] (Microsoft Corporation) MD5=A2A9CA0D1A9AC1FF54220AA0789FE5CF -- C:\WINDOWS\system32\drivers\tape.sys
[2008/06/20 03:45:13 | 00,360,320 | ---- | M] (Microsoft Corporation) MD5=2A5554FC5B1E04E131230E3CE035C3F9 -- C:\WINDOWS\system32\drivers\tcpip.sys
[2008/06/20 02:52:06 | 00,225,920 | ---- | M] (Microsoft Corporation) MD5=00586ED87AB564B03870A2A3DCC84B55 -- C:\WINDOWS\system32\drivers\tcpip6.sys
[2004/08/03 21:07:50 | 00,018,560 | ---- | M] (Microsoft Corporation) MD5=6891B74AB9A016064E82A419388D0601 -- C:\WINDOWS\system32\drivers\tdi.sys
[2004/08/03 23:01:08 | 00,012,040 | ---- | M] (Microsoft Corporation) MD5=38D437CF2D98965F239B0ABCD66DCB0F -- C:\WINDOWS\system32\drivers\tdpipe.sys
[2004/08/03 23:01:08 | 00,021,896 | ---- | M] (Microsoft Corporation) MD5=ED0580AF02502D00AD8C4C066B156BE9 -- C:\WINDOWS\system32\drivers\tdtcp.sys
[2004/08/04 02:01:08 | 00,040,840 | ---- | M] (Microsoft Corporation) MD5=A540A99C281D933F3D69D55E48727F47 -- C:\WINDOWS\system32\drivers\termdd.sys
[2001/08/23 11:00:00 | 00,051,712 | ---- | M] (Microsoft Corporation) MD5=699450901C5CCFD82357CBC531CEDD23 -- C:\WINDOWS\system32\drivers\tosdvd.sys
[2001/08/23 11:00:00 | 00,021,376 | ---- | M] (Toshiba Corporation) MD5=D74A8EC75305F1D3CFDE7C7FC1BD62A9 -- C:\WINDOWS\system32\drivers\tsbvcap.sys
[2004/08/03 23:05:44 | 00,012,416 | ---- | M] (Microsoft Corporation) MD5=87A0E9E18C10A9E454238E3330E2A26D -- C:\WINDOWS\system32\drivers\tunmp.sys
[2004/08/03 21:00:32 | 00,066,176 | ---- | M] (Microsoft Corporation) MD5=12F70256F140CD7D52C58C7048FDE657 -- C:\WINDOWS\system32\drivers\udfs.sys
[2004/08/03 20:58:34 | 00,209,408 | ---- | M] (Microsoft Corporation) MD5=AFF2E5045961BBC0A602BB6F95EB1345 -- C:\WINDOWS\system32\drivers\update.sys
[2004/08/03 21:04:34 | 00,012,672 | ---- | M] (Microsoft Corporation) MD5=AF090265EC388BAB320F1FF7E7A7D5EA -- C:\WINDOWS\system32\drivers\usb8023.sys
[2004/08/04 00:07:56 | 00,059,264 | ---- | M] (Microsoft Corporation) MD5=45A0D14B26C35497AD93BCE7E15C9941 -- C:\WINDOWS\system32\drivers\USBAUDIO.sys
[2001/08/23 11:00:00 | 00,023,808 | ---- | M] (Microsoft Corporation) MD5=2654EECC6FB13603EBDDCD5C8EA943D1 -- C:\WINDOWS\system32\drivers\usbcamd.sys
[2001/08/23 11:00:00 | 00,023,936 | ---- | M] (Microsoft Corporation) MD5=61018BA9DF6B63E51D9753C980E73EC2 -- C:\WINDOWS\system32\drivers\usbcamd2.sys
[2004/08/03 21:08:48 | 00,031,616 | ---- | M] (Microsoft Corporation) MD5=BFFD9F120CC63BCBAA3D840F3EEF9F79 -- C:\WINDOWS\system32\drivers\usbccgp.sys
[2001/08/23 11:00:00 | 00,004,736 | ---- | M] (Microsoft Corporation) MD5=596EB39B50D6EBD9B734DC4AE0544693 -- C:\WINDOWS\system32\drivers\usbd.sys
[2004/08/03 21:08:38 | 00,026,624 | ---- | M] (Microsoft Corporation) MD5=15E993BA2F6946B2BFBBFCD30398621E -- C:\WINDOWS\system32\drivers\usbehci.sys
[2004/08/03 21:08:44 | 00,057,600 | ---- | M] (Microsoft Corporation) MD5=C72F40947F92CEA56A8FB532EDF025F1 -- C:\WINDOWS\system32\drivers\usbhub.sys
[2004/08/03 23:05:44 | 00,016,000 | ---- | M] (Microsoft Corporation) MD5=2853FD4C4489E0F8BFCF78EFCDB7E998 -- C:\WINDOWS\system32\drivers\usbintel.sys
[2004/08/03 21:08:38 | 00,017,024 | ---- | M] (Microsoft Corporation) MD5=BDFE799A8531BAD8A5A985821FE78760 -- C:\WINDOWS\system32\drivers\usbohci.sys
[2004/08/03 21:08:44 | 00,142,976 | ---- | M] (Microsoft Corporation) MD5=2034CA78F9C6E787B4B76D81AC888351 -- C:\WINDOWS\system32\drivers\usbport.sys
[2004/08/03 16:01:26 | 00,025,856 | ---- | M] (Microsoft Corporation) MD5=A42369B7CD8886CD7C70F33DA6FCBCF5 -- C:\WINDOWS\system32\drivers\usbprint.sys
[2004/08/03 23:58:46 | 00,015,104 | ---- | M] (Microsoft Corporation) MD5=A6BC71402F4F7DD5B77FD7F4A8DDBA85 -- C:\WINDOWS\system32\drivers\usbscan.sys
[2004/08/03 16:08:48 | 00,026,496 | ---- | M] (Microsoft Corporation) MD5=6CD7B22193718F1D17A47A1CD6D37E75 -- C:\WINDOWS\system32\drivers\USBSTOR.SYS
[2001/08/23 11:00:00 | 00,058,112 | ---- | M] (RAVISENT Technologies Inc.) MD5=55E01061C74A8CEFFF58DC36114A8D3F -- C:\WINDOWS\system32\drivers\vdmindvd.sys
[2004/08/03 21:07:08 | 00,020,992 | ---- | M] (Microsoft Corporation) MD5=8A60EDD72B4EA5AEA8202DAF0E427925 -- C:\WINDOWS\system32\drivers\vga.sys
[2004/08/03 21:07:06 | 00,079,744 | ---- | M] (Microsoft Corporation) MD5=D5A9D123F5ED7C9965A481BD20CF66D8 -- C:\WINDOWS\system32\drivers\videoprt.sys
[2004/08/03 21:00:18 | 00,052,352 | ---- | M] (Microsoft Corporation) MD5=EE4660083DEBA849FF6C485D944B379B -- C:\WINDOWS\system32\drivers\volsnap.sys
[2004/08/03 21:04:58 | 00,034,560 | ---- | M] (Microsoft Corporation) MD5=984EF0B9788ABF89974CFED4BFBAACBC -- C:\WINDOWS\system32\drivers\wanarp.sys
[2006/06/14 02:00:45 | 00,082,944 | ---- | M] (Microsoft Corporation) MD5=EFD235CA22B57C81118C1AEB4798F1C1 -- C:\WINDOWS\system32\drivers\wdmaud.sys
[2004/08/03 22:07:42 | 00,008,832 | ---- | M] (Microsoft Corporation) MD5=AE2C8544E747C20062DB27456EA2D67A -- C:\WINDOWS\system32\drivers\wmiacpi.sys
[2001/08/23 11:00:00 | 00,004,352 | ---- | M] (Microsoft Corporation) MD5=2F31B7F954BED437F2C75026C65CAF7B -- C:\WINDOWS\system32\drivers\wmilib.sys
[2006/10/18 19:00:00 | 00,038,528 | ---- | M] (Microsoft Corporation) MD5=CF4DEF1BF66F06964DC0D91844239104 -- C:\WINDOWS\system32\drivers\wpdusb.sys
[2001/08/23 11:00:00 | 00,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
[2004/08/04 00:10:22 | 00,019,328 | ---- | M] (Microsoft Corporation) MD5=D5842484F05E12121C511AA93F6439EC -- C:\WINDOWS\system32\drivers\WSTCODEC.SYS
[2006/09/28 17:55:50 | 00,077,568 | ---- | M] (Microsoft Corporation) MD5=F15FEAFFFBB3644CCC80C5DA584E6311 -- C:\WINDOWS\system32\drivers\WudfPf.sys
[2006/09/28 18:00:34 | 00,082,944 | ---- | M] (Microsoft Corporation) MD5=28B524262BCE6DE1F7EF9F510BA3985B -- C:\WINDOWS\system32\drivers\WudfRd.sys
[2001/01/02 21:53:30 | 00,019,677 | ---- | M] (Thesycon GmbH, Germany) MD5=05A74D2BE6F493C65D7221D1D0E8A23C -- C:\WINDOWS\system32\drivers\xbreader.sys
[2006/07/01 21:39:40 | 00,036,864 | ---- | M] (Advanced Micro Devices) MD5=EFBB0956BAED786E137351B5CA272AEF -- C:\WINDOWS\system32\DRVSTORE\amdk8_C074F64CC74B03BC354BB5DC973CCF768D5A7194\AmdK8.sys
[2007/04/16 15:46:34 | 00,033,792 | ---- | M] (Advanced Micro Devices) MD5=033448D435E65C4BD72E70521FD05C76 -- C:\WINDOWS\system32\DRVSTORE\amdppm_C66586B319F61C772BA2DAB141D0FE08F299F411\AmdPPM.sys
[2007/04/16 15:46:38 | 00,044,544 | ---- | M] (Advanced Micro Devices) MD5=CCE290F816A286A6632530DA169F5545 -- C:\WINDOWS\system32\DRVSTORE\amdppm_C66586B319F61C772BA2DAB141D0FE08F299F411\AmdPPM64.sys
[2007/10/11 18:56:20 | 00,490,776 | ---- | M] (Logitech Inc.) MD5=3551190E9CF1EB4C0971BDEF4269CA25 -- C:\WINDOWS\system32\DRVSTORE\lvELCHv_BBE6DEA618C212D1D4C404825FD824D3C6FE5D57\LV561AV.sys
[2007/10/11 19:00:42 | 00,041,752 | ---- | M] (Logitech Inc.) MD5=BE5E104BE263921D6842C555DB6A5C23 -- C:\WINDOWS\system32\DRVSTORE\lvELCHv_BBE6DEA618C212D1D4C404825FD824D3C6FE5D57\LVUSBSta.sys
[2007/10/11 18:55:58 | 00,013,848 | ---- | M] (Logitech Inc.) MD5=0896002D1EFCD08859A41C9DB34AD84C -- C:\WINDOWS\system32\DRVSTORE\lvPEPI2s_62F19BA954DED83DBA6DF160C36D5918D3EEA33F\lv302af.sys
[2007/10/11 19:00:42 | 00,041,752 | ---- | M] (Logitech Inc.) MD5=BE5E104BE263921D6842C555DB6A5C23 -- C:\WINDOWS\system32\DRVSTORE\lvPEPI2s_62F19BA954DED83DBA6DF160C36D5918D3EEA33F\LVUSBSta.sys
[2007/10/11 18:55:58 | 01,279,000 | ---- | M] (Logitech Inc.) MD5=A7598E897DA639E255AD4188FA398478 -- C:\WINDOWS\system32\DRVSTORE\lvPEPI2v_19F47D0F20E353A86247DADE40C70EC0358A7AE9\LV302V32.SYS
[2007/10/11 19:00:42 | 00,041,752 | ---- | M] (Logitech Inc.) MD5=BE5E104BE263921D6842C555DB6A5C23 -- C:\WINDOWS\system32\DRVSTORE\lvPEPI2v_19F47D0F20E353A86247DADE40C70EC0358A7AE9\LVUSBSta.sys
[2007/10/11 19:01:06 | 00,023,832 | ---- | M] (Logitech Inc.) MD5=BCEF16E3AEDD1B44BCA45F748D975D73 -- C:\WINDOWS\system32\DRVSTORE\lvPRO5c_F4502E86C545666FAEEA2E5BC0ECF142B1B952DA\lvuvcflt.sys
[2007/10/11 18:59:12 | 01,920,920 | ---- | M] (Logitech Inc.) MD5=E1158B0CB852DB0573922C92E6E564DE -- C:\WINDOWS\system32\DRVSTORE\lvPRO5s_FF147DEF58280327E126F11A9918B00DAAF40F64\lvpopflt.sys
[2007/10/11 19:00:08 | 02,091,800 | ---- | M] (Logitech Inc.) MD5=26DC8EBCCE7D0E49680AF6FCA7B7AA38 -- C:\WINDOWS\system32\DRVSTORE\lvPRO5s_FF147DEF58280327E126F11A9918B00DAAF40F64\lvrs.sys
[2007/10/11 19:00:20 | 00,066,456 | ---- | M] (Logitech Inc.) MD5=3E0C7B317F2564CA8FC87B90E1D16E66 -- C:\WINDOWS\system32\DRVSTORE\lvPRO5s_FF147DEF58280327E126F11A9918B00DAAF40F64\lvselsus.sys
[2007/10/11 19:00:42 | 00,041,752 | ---- | M] (Logitech Inc.) MD5=BE5E104BE263921D6842C555DB6A5C23 -- C:\WINDOWS\system32\DRVSTORE\lvPRO5s_FF147DEF58280327E126F11A9918B00DAAF40F64\LVUSBSta.sys
[2007/10/11 19:00:42 | 00,041,752 | ---- | M] (Logitech Inc.) MD5=BE5E104BE263921D6842C555DB6A5C23 -- C:\WINDOWS\system32\DRVSTORE\lvPRO5v_D6FAB2B0793183BA050A90A5CC9D79EF71551623\LVUSBSta.sys
[2007/10/11 19:00:54 | 03,647,384 | ---- | M] (Logitech Inc.) MD5=EACD1EB2D82ED2ADC753AFEEE1D4D660 -- C:\WINDOWS\system32\DRVSTORE\lvPRO5v_D6FAB2B0793183BA050A90A5CC9D79EF71551623\lvuvc.sys
[2004/08/03 20:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386\atapi.sys
[2001/08/23 11:00:00 | 00,003,328 | ---- | M] (Microsoft Corporation) MD5=CCF5F451BB1A5A2A522A76E670000FF0 -- C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386\pciide.sys
[2004/08/03 20:59:42 | 00,025,088 | ---- | M] (Microsoft Corporation) MD5=520B91AB011456B940D9B05FC91108FF -- C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386\pciidex.sys
[2004/08/03 23:05:44 | 00,035,328 | ---- | M] (Microsoft Corporation) MD5=0D97D88720A4087EC93AF7DBB303B30A -- C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\processr.sys

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-01-16 10:28:05

========== Alternate Data Streams ==========

@Alternate Data Stream - 184 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9B7E8561
@Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5EC637CB
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5B85C37B
< End of report >