Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

black screen mouse issue

Started by honnybee , Mar 10 2016 09:26 AM

Please log in to reply

#46
honnybee

Posted 12 March 2016 - 03:35 PM

Member

Topic Starter
Member
38 posts

On the hiren xp userinit was the same, but the shell was explorer.exe.

Edited by honnybee, 12 March 2016 - 03:36 PM.

#47
honnybee

Posted 12 March 2016 - 03:42 PM

Member

Topic Starter
Member
38 posts

No hiren had registry editor I followed what the link said to reset the values.

#48
RKinner

Posted 12 March 2016 - 03:56 PM

Malware Expert

Expert
24,624 posts

That's what we want it to be.

Now look at

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows

In the right pane will be

AppInit_DLLs

is there anything to the right of it?

Can you verify that the files

c:\windows\explorer.exe

and

c:\windows\system32\userinit.exe

are present?

#49
honnybee

Posted 12 March 2016 - 04:15 PM

Member

Topic Starter
Member
38 posts

App initial there's nothing for data section.

When I booted into hiren and looked at the registry editor through there it shows,shell Explorer, and userinit same thing only difference x:/i386 the rest was the same.

#50
RKinner

Posted 12 March 2016 - 04:36 PM

Malware Expert

Expert
24,624 posts

If it talks about x:\ then it is not looking at the real registry. Hiren has a Registry Editor PE but I think you get to it without booting into minXP.

#51
honnybee

Posted 12 March 2016 - 04:39 PM

Member

Topic Starter
Member
38 posts

I didn't really get how to work the registry editor people so I looked it up through the command prompt.

#52
honnybee

Posted 12 March 2016 - 04:40 PM

Member

Topic Starter
Member
38 posts

Is there an application built to resolve issues like this.

#53
RKinner

Posted 12 March 2016 - 04:43 PM

Malware Expert

Expert
24,624 posts

Run a FRST scan again and post the log so I can see if I missed something.

#54
honnybee

Posted 12 March 2016 - 05:09 PM

Member

Topic Starter
Member
38 posts

Heres the frst scan.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-03-2016 01

Ran by SYSTEM on MININT-H81COHG (12-03-2016 14:51:46)

Running from g:\

Platform: Windows 7 Home Premium (X64) Language: English (United States)

Internet Explorer Version 10

Boot Mode: Recovery

Default: ControlSet001

ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9636896 2009-12-15] (Realtek Semiconductor)

HKLM\...\Run: [Apoint] => C:\Program Files\Apoint\Apoint.exe [208384 2009-11-04] (Alps Electric Co., Ltd.)

HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284696 2009-11-20] (Intel Corporation)

HKLM-x32\...\Run: [ISBMgr.exe] => C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [320880 2009-08-26] (Sony Corporation)

HKLM-x32\...\Run: [PMBVolumeWatcher] => C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [597792 2009-10-24] (Sony Corporation)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7139768 2016-02-16] (AVAST Software)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1085656 2015-12-17] (Adobe Systems Incorporated)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKLM\...\Policies\Explorer: [AllowLegacyWebView] 1

HKLM\...\Policies\Explorer: [AllowUnhashedWebView] 1

HKU\Default\...\Policies\Explorer: [NoDesktopCleanupWizard] 1

HKU\Default User\...\Policies\Explorer: [NoDesktopCleanupWizard] 1

HKU\owner\...\Run: [pronto] => C:\Program Files (x86)\Blackboard\Blackboard IM\blackboardim.exe [23053400 2012-07-06] ()

HKU\owner\...\Policies\Explorer: [NoDesktopCleanupWizard] 1

HKU\TEMP\...\Policies\Explorer: [NoDesktopCleanupWizard] 1

Startup: C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk [2012-08-26]

ShortcutTarget: OneNote 2010 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

Startup: C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk [2010-04-17]

ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)

S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [237096 2016-02-10] (AVAST Software)

S3 Roxio UPnP Renderer 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [313840 2009-08-31] (Sonic Solutions)

S2 Roxio Upnp Server 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [362992 2009-08-31] (Sonic Solutions)

S2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [257936 2010-08-12] (Sony Corporation)

S3 SOHDBSvr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [70952 2009-10-15] (Sony Corporation)

S3 SOHPlMgr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [91432 2009-10-15] (Sony Corporation)

S2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)

S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [69632 2009-09-14] (Sony Corporation)

S2 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [642416 2009-09-14] (Sony Corporation)

S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-13] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)

S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-02-10] (AVAST Software)

S1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2016-02-10] (AVAST Software)

S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [107792 2016-02-10] (AVAST Software)

S1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-02-10] (AVAST Software)

S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-02-10] (AVAST Software)

S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1065720 2016-02-10] (AVAST Software)

S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [463744 2016-02-26] (AVAST Software)

S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [165344 2016-02-10] (AVAST Software)

S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [287016 2016-02-10] (AVAST Software)

S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)

S3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-11-12] ()

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-03-12 08:06 - 2016-03-12 08:06 - 00003288 ____N C:\bootsqm.dat

2016-03-12 01:26 - 2016-03-12 01:26 - 00012288 _____ C:\BCD_Backup

2016-03-10 09:17 - 2016-03-10 09:17 - 00000000 _____ C:\Windows\System32\config\SOFTWAREefd2cc49

2016-03-10 01:17 - 2016-03-10 01:17 - 00000000 ____D C:\Windows\Microsoft Antimalware

2016-03-09 22:30 - 2016-03-12 14:51 - 00000000 ____D C:\FRST

2016-03-08 01:05 - 2016-03-08 02:01 - 00000000 __RDC C:\Users\owner\Documents - Copy

2016-03-03 17:44 - 2016-03-03 17:44 - 00000000 __SHD C:\$$PendingFiles

2016-03-03 15:04 - 2016-03-03 15:04 - 00000000 __SHD C:\found.006

2016-03-01 06:28 - 2016-03-01 06:30 - 03530859 _____ C:\Users\owner\Downloads\BA 405 Ch 3 Slides V2(1).pptx

2016-03-01 06:28 - 2016-03-01 06:30 - 02782854 _____ C:\Users\owner\Downloads\BA405 Chapter 4 V2 Spring 2016(1).pptx

2016-03-01 06:28 - 2016-03-01 06:30 - 02600244 _____ C:\Users\owner\Downloads\Ch 5 Version 2(2)(2).pptx

2016-03-01 00:54 - 2016-03-01 00:55 - 02782854 _____ C:\Users\owner\Downloads\BA405 Chapter 4 V2 Spring 2016.pptx

2016-03-01 00:54 - 2016-03-01 00:54 - 02600244 _____ C:\Users\owner\Downloads\Ch 5 Version 2(2)(1).pptx

2016-02-28 04:35 - 2016-03-07 12:29 - 21131496 ____H C:\Users\owner\Documents\~WRL0043.tmp

2016-02-28 04:35 - 2016-03-07 12:29 - 17639868 ____H C:\Users\owner\Documents\~WRL2377.tmp

2016-02-28 03:06 - 2016-03-07 12:37 - 00001922 _____ C:\Users\Public\Desktop\Avast Free Antivirus.lnk

2016-02-28 03:06 - 2016-03-07 12:37 - 00001922 _____ C:\ProgramData\Desktop\Avast Free Antivirus.lnk

2016-02-28 03:04 - 2016-02-10 02:32 - 00398152 _____ (AVAST Software) C:\Windows\System32\aswBoot.exe

2016-02-19 04:39 - 2016-02-19 04:39 - 00024995 _____ C:\Windows\RGID673.tmp

2016-02-14 22:09 - 2016-02-14 22:09 - 03530859 _____ C:\Users\owner\Downloads\BA 405 Ch 3 Slides V2.pptx

2016-02-11 02:49 - 2016-03-07 12:37 - 00001037 _____ C:\Users\Public\Desktop\Avast SafeZone Browser.lnk

2016-02-11 02:49 - 2016-03-07 12:37 - 00001037 _____ C:\ProgramData\Desktop\Avast SafeZone Browser.lnk

2016-02-11 02:49 - 2016-02-28 03:06 - 00003052 _____ C:\Windows\System32\Tasks\SafeZone scheduled Autoupdate 1455187739

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-03-12 12:54 - 2010-06-27 14:12 - 06936058 _____ C:\Windows\ntbtlog.txt

2016-03-10 20:23 - 2010-01-14 05:35 - 00000000 ____D C:\Program Files\Best Buy Software Installer

2016-03-08 01:05 - 2010-04-10 15:10 - 00000000 ____D C:\users\owner

2016-03-07 12:41 - 2014-06-22 00:52 - 00018822 ____H C:\Users\owner\Documents\~WRL0505.tmp

2016-03-07 12:41 - 2014-02-13 00:12 - 00222453 ____H C:\Users\owner\Documents\~WRL0432.tmp

2016-03-07 12:41 - 2014-02-13 00:12 - 00196427 ____H C:\Users\owner\Documents\~WRL0553.tmp

2016-03-07 12:41 - 2014-02-13 00:12 - 00157215 ____H C:\Users\owner\Documents\~WRL0575.tmp

2016-03-07 12:41 - 2014-02-13 00:12 - 00125829 ____H C:\Users\owner\Documents\~WRL0515.tmp

2016-03-07 12:41 - 2014-02-13 00:12 - 00085427 ____H C:\Users\owner\Documents\~WRL0514.tmp

2016-03-07 12:41 - 2014-02-13 00:12 - 00026309 ____H C:\Users\owner\Documents\~WRL0564.tmp

2016-03-07 12:41 - 2012-12-12 00:21 - 00482371 _____ C:\Users\owner\Documents\Econ 101 Exam 3.pdf

2016-03-07 12:41 - 2012-12-12 00:21 - 00370519 _____ C:\Users\owner\Documents\Econ 101 Exam 2.pdf

2016-03-07 12:41 - 2012-10-29 19:08 - 00376832 _____ C:\Users\owner\Documents\Database2.accdb

2016-03-07 12:37 - 2015-09-24 05:58 - 00001964 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk

2016-03-07 12:37 - 2015-09-24 05:58 - 00001964 _____ C:\ProgramData\Desktop\McAfee Security Scan Plus.lnk

2016-03-07 12:37 - 2014-12-16 01:31 - 00002438 _____ C:\Users\Public\Desktop\TI NoteFolio Creator.lnk

2016-03-07 12:37 - 2014-12-16 01:31 - 00002438 _____ C:\ProgramData\Desktop\TI NoteFolio Creator.lnk

2016-03-07 12:37 - 2014-12-16 01:29 - 00001019 _____ C:\Users\Public\Desktop\TI Connect.lnk

2016-03-07 12:37 - 2014-12-16 01:29 - 00001019 _____ C:\ProgramData\Desktop\TI Connect.lnk

2016-03-07 12:37 - 2014-04-17 23:47 - 00002019 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk

2016-03-07 12:37 - 2014-04-17 23:47 - 00002019 _____ C:\ProgramData\Desktop\Adobe Reader XI.lnk

2016-03-07 12:37 - 2014-04-15 22:43 - 36818984 _____ (Dropbox, Inc.) C:\Users\Public\Desktop\DropboxInstallerAvast.exe

2016-03-07 12:37 - 2014-04-15 22:43 - 36818984 _____ (Dropbox, Inc.) C:\ProgramData\Desktop\DropboxInstallerAvast.exe

2016-03-07 12:37 - 2013-03-01 05:11 - 00001136 _____ C:\Users\Public\Desktop\NOOK Study.lnk

2016-03-07 12:37 - 2013-03-01 05:11 - 00001136 _____ C:\ProgramData\Desktop\NOOK Study.lnk

2016-03-07 12:37 - 2012-11-23 00:52 - 00000979 _____ C:\Users\Public\Desktop\WinSCP.lnk

2016-03-07 12:37 - 2012-11-23 00:52 - 00000979 _____ C:\ProgramData\Desktop\WinSCP.lnk

2016-03-07 12:37 - 2012-10-28 23:55 - 00001082 _____ C:\Users\Public\Desktop\KeyFinder.lnk

2016-03-07 12:37 - 2012-10-28 23:55 - 00001082 _____ C:\ProgramData\Desktop\KeyFinder.lnk

2016-03-07 12:37 - 2012-09-22 17:35 - 00002141 _____ C:\Users\Public\Desktop\VAIO Transfer Support.lnk

2016-03-07 12:37 - 2012-09-22 17:35 - 00002141 _____ C:\ProgramData\Desktop\VAIO Transfer Support.lnk

2016-03-07 12:37 - 2012-09-18 01:19 - 00001315 _____ C:\Users\Public\Desktop\HP Solution Center.lnk

2016-03-07 12:37 - 2012-09-18 01:19 - 00001315 _____ C:\ProgramData\Desktop\HP Solution Center.lnk

2016-03-07 12:37 - 2012-09-02 18:53 - 00002178 _____ C:\Users\Public\Desktop\Adobe Digital Editions.lnk

2016-03-07 12:37 - 2012-09-02 18:53 - 00002178 _____ C:\ProgramData\Desktop\Adobe Digital Editions.lnk

2016-03-07 12:37 - 2012-08-06 16:24 - 00001207 _____ C:\Users\Public\Desktop\Blackboard IM.lnk

2016-03-07 12:37 - 2012-08-06 16:24 - 00001207 _____ C:\ProgramData\Desktop\Blackboard IM.lnk

2016-03-07 12:37 - 2011-08-30 15:56 - 00001147 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2016-03-07 12:37 - 2011-08-30 15:56 - 00001147 _____ C:\ProgramData\Desktop\Mozilla Firefox.lnk

2016-03-07 12:37 - 2010-04-10 15:10 - 00000020 ___SH C:\Users\owner\ntuser.ini

2016-03-07 12:37 - 2010-01-14 05:35 - 00001031 _____ C:\Users\Public\Desktop\Best Buy Software Installer.lnk

2016-03-07 12:37 - 2010-01-14 05:35 - 00001031 _____ C:\ProgramData\Desktop\Best Buy Software Installer.lnk

2016-03-07 12:36 - 2012-11-17 18:44 - 00000009 _____ C:\END

2016-03-07 12:36 - 2011-08-11 19:52 - 00002688 _____ C:\{75A1F188-D10C-47C6-BC9B-90D81BBCE53C}

2016-03-07 12:36 - 2010-06-20 14:53 - 00302997 _____ C:\test.xml

2016-03-07 12:36 - 2009-12-15 11:53 - 00003872 ____H C:\version

2016-03-07 12:36 - 2009-01-21 21:40 - 00000073 ____H C:\splash.idx

2016-03-07 12:36 - 2007-11-07 07:53 - 00242176 _____ C:\VC_RED.MSI

2016-03-07 12:36 - 2007-11-07 07:50 - 01927956 _____ C:\VC_RED.cab

2016-03-07 12:36 - 2007-11-07 07:44 - 00855040 _____ (Microsoft Corporation) C:\install.exe

2016-03-07 12:36 - 2007-11-07 07:44 - 00096272 _____ (Microsoft Corporation) C:\install.res.1036.dll

2016-03-07 12:36 - 2007-11-07 07:44 - 00095248 _____ (Microsoft Corporation) C:\install.res.3082.dll

2016-03-07 12:36 - 2007-11-07 07:44 - 00095248 _____ (Microsoft Corporation) C:\install.res.1031.dll

2016-03-07 12:36 - 2007-11-07 07:44 - 00094224 _____ (Microsoft Corporation) C:\install.res.1040.dll

2016-03-07 12:36 - 2007-11-07 07:44 - 00090128 _____ (Microsoft Corporation) C:\install.res.1033.dll

2016-03-07 12:36 - 2007-11-07 07:44 - 00080400 _____ (Microsoft Corporation) C:\install.res.1041.dll

2016-03-07 12:36 - 2007-11-07 07:44 - 00078864 _____ (Microsoft Corporation) C:\install.res.1042.dll

2016-03-07 12:36 - 2007-11-07 07:44 - 00075280 _____ (Microsoft Corporation) C:\install.res.1028.dll

2016-03-07 12:36 - 2007-11-07 07:44 - 00074768 _____ (Microsoft Corporation) C:\install.res.2052.dll

2016-03-07 12:36 - 2007-11-07 07:00 - 00017734 _____ C:\eula.3082.txt

2016-03-07 12:36 - 2007-11-07 07:00 - 00017734 _____ C:\eula.2052.txt

2016-03-07 12:36 - 2007-11-07 07:00 - 00017734 _____ C:\eula.1042.txt

2016-03-07 12:36 - 2007-11-07 07:00 - 00017734 _____ C:\eula.1040.txt

2016-03-07 12:36 - 2007-11-07 07:00 - 00017734 _____ C:\eula.1036.txt

2016-03-07 12:36 - 2007-11-07 07:00 - 00017734 _____ C:\eula.1031.txt

2016-03-07 12:36 - 2007-11-07 07:00 - 00017734 _____ C:\eula.1028.txt

2016-03-07 12:36 - 2007-11-07 07:00 - 00010134 _____ C:\eula.1033.txt

2016-03-07 12:36 - 2007-11-07 07:00 - 00005686 _____ C:\vcredist.bmp

2016-03-07 12:36 - 2007-11-07 07:00 - 00001110 _____ C:\globdata.ini

2016-03-07 12:36 - 2007-11-07 07:00 - 00000843 _____ C:\install.ini

2016-03-07 12:36 - 2007-11-07 07:00 - 00000118 _____ C:\eula.1041.txt

2016-03-07 12:29 - 2015-11-17 06:17 - 01212562 ____H C:\Users\owner\Documents\~WRL3628.tmp

2016-03-07 12:29 - 2015-11-17 06:17 - 00165070 ____H C:\Users\owner\Documents\~WRL3439.tmp

2016-03-07 12:29 - 2015-11-17 06:17 - 00160839 ____H C:\Users\owner\Documents\~WRL3924.tmp

2016-03-07 12:29 - 2015-11-17 06:17 - 00157456 ____H C:\Users\owner\Documents\~WRL0990.tmp

2016-03-07 12:29 - 2015-11-17 06:17 - 00156993 ____H C:\Users\owner\Documents\~WRL0042.tmp

2016-03-07 12:29 - 2015-11-17 06:17 - 00144589 ____H C:\Users\owner\Documents\~WRL1530.tmp

2016-03-07 12:29 - 2015-11-17 06:17 - 00134821 ____H C:\Users\owner\Documents\~WRL2623.tmp

2016-03-07 12:29 - 2015-11-17 06:17 - 00127104 ____H C:\Users\owner\Documents\~WRL1688.tmp

2016-03-07 12:29 - 2015-11-12 18:39 - 00022008 ____H C:\Users\owner\Documents\~WRL1341.tmp

2016-03-07 12:29 - 2015-11-12 18:39 - 00019004 ____H C:\Users\owner\Documents\~WRL3420.tmp

2016-03-07 12:29 - 2015-11-12 18:39 - 00016532 ____H C:\Users\owner\Documents\~WRL1785.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 97154329 ____H C:\Users\owner\Documents\~WRL0404.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 91842221 ____H C:\Users\owner\Documents\~WRL3014.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 84396089 ____H C:\Users\owner\Documents\~WRL0628.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 84390854 ____H C:\Users\owner\Documents\~WRL1267.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 81452891 ____H C:\Users\owner\Documents\~WRL0738.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 76026127 ____H C:\Users\owner\Documents\~WRL2464.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 52004223 ____H C:\Users\owner\Documents\~WRL3524.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 355036824 ____H C:\Users\owner\Documents\~WRL3230.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 327574024 ____H C:\Users\owner\Documents\~WRL1324.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 312212081 ____H C:\Users\owner\Documents\~WRL2424.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 292484312 ____H C:\Users\owner\Documents\~WRL2684.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 288603136 ____H C:\Users\owner\Documents\~WRL1133.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 264440638 ____H C:\Users\owner\Documents\~WRL2625.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 250581497 ____H C:\Users\owner\Documents\~WRL3813.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 240275843 ____H C:\Users\owner\Documents\~WRL3068.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 236352138 ____H C:\Users\owner\Documents\~WRL0935.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 220168680 ____H C:\Users\owner\Documents\~WRL1862.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 196249435 ____H C:\Users\owner\Documents\~WRL3896.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 192695071 ____H C:\Users\owner\Documents\~WRL0625.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 182108765 ____H C:\Users\owner\Documents\~WRL2324.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 174174784 ____H C:\Users\owner\Documents\~WRL3048.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 167276833 ____H C:\Users\owner\Documents\~WRL1531.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 165942841 ____H C:\Users\owner\Documents\~WRL1403.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 161527162 ____H C:\Users\owner\Documents\~WRL2192.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 159912347 ____H C:\Users\owner\Documents\~WRL1229.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 154148769 ____H C:\Users\owner\Documents\~WRL3044.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 145518736 ____H C:\Users\owner\Documents\~WRL0614.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 127041482 ____H C:\Users\owner\Documents\~WRL1374.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 107908199 ____H C:\Users\owner\Documents\~WRL0361.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 06060213 ____H C:\Users\owner\Documents\~WRL0041.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 04651951 ____H C:\Users\owner\Documents\~WRL0742.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 01127213 ____H C:\Users\owner\Documents\~WRL1798.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 00033669 ____H C:\Users\owner\Documents\~WRL3876.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 00018371 ____H C:\Users\owner\Documents\~WRL1996.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 00014269 ____H C:\Users\owner\Documents\~WRL0114.tmp

2016-03-07 12:29 - 2015-10-01 20:14 - 00013499 ____H C:\Users\owner\Documents\~WRL1189.tmp

2016-03-07 12:29 - 2015-09-16 14:05 - 00014102 ____H C:\Users\owner\Documents\~WRL0040.tmp

2016-03-07 12:29 - 2015-09-15 13:15 - 00014119 ____H C:\Users\owner\Documents\~WRL2622.tmp

2016-03-07 12:29 - 2015-09-02 08:06 - 60282656 ____H C:\Users\owner\Documents\~WRL0646.tmp

2016-03-07 12:29 - 2015-09-02 08:06 - 420528936 ____H C:\Users\owner\Documents\~WRL1319.tmp

2016-03-07 12:29 - 2015-09-02 08:06 - 41071986 ____H C:\Users\owner\Documents\~WRL0035.tmp

2016-03-07 12:29 - 2015-09-02 08:06 - 405811698 ____H C:\Users\owner\Documents\~WRL1318.tmp

2016-03-07 12:29 - 2015-09-02 08:06 - 401256234 ____H C:\Users\owner\Documents\~WRL2020.tmp

2016-03-07 12:29 - 2015-09-02 08:06 - 386181969 ____H C:\Users\owner\Documents\~WRL3063.tmp

2016-03-07 12:29 - 2015-09-02 08:06 - 33198173 ____H C:\Users\owner\Documents\~WRL0096.tmp

2016-03-07 12:29 - 2015-09-02 08:06 - 315625603 ____H C:\Users\owner\Documents\~WRL0374.tmp

2016-03-07 12:29 - 2015-09-02 08:06 - 289031572 ____H C:\Users\owner\Documents\~WRL2339.tmp

2016-03-07 12:29 - 2015-09-02 08:06 - 251746660 ____H C:\Users\owner\Documents\~WRL2372.tmp

2016-03-07 12:29 - 2015-09-02 08:06 - 239095672 ____H C:\Users\owner\Documents\~WRL2963.tmp

2016-03-07 12:29 - 2015-09-02 08:06 - 232607439 ____H C:\Users\owner\Documents\~WRL2690.tmp

2016-03-07 12:29 - 2015-09-02 08:06 - 223298544 ____H C:\Users\owner\Documents\~WRL0039.tmp

2016-03-07 12:29 - 2015-09-02 08:06 - 216024945 ____H C:\Users\owner\Documents\~WRL3504.tmp

2016-03-07 12:29 - 2015-09-02 08:06 - 205418977 ____H C:\Users\owner\Documents\~WRL3539.tmp

2016-03-07 12:29 - 2015-09-02 08:06 - 199143445 ____H C:\Users\owner\Documents\~WRL3863.tmp

2016-03-07 12:29 - 2015-09-02 08:06 - 194821153 ____H C:\Users\owner\Documents\~WRL3454.tmp

2016-03-07 12:29 - 2015-09-02 08:06 - 189999685 ____H C:\Users\owner\Documents\~WRL0038.tmp

2016-03-07 12:29 - 2015-09-02 08:06 - 183940518 ____H C:\Users\owner\Documents\~WRL2903.tmp

2016-03-07 12:29 - 2015-09-02 08:06 - 180099642 ____H C:\Users\owner\Documents\~WRL1280.tmp

2016-03-07 12:29 - 2015-09-02 08:06 - 171936416 ____H C:\Users\owner\Documents\~WRL0100.tmp

2016-03-07 12:29 - 2015-09-02 08:06 - 141553421 ____H C:\Users\owner\Documents\~WRL0037.tmp

2016-03-07 12:29 - 2015-08-21 22:37 - 92413009 ____H C:\Users\owner\Documents\~WRL1602.tmp

2016-03-07 12:29 - 2015-08-21 22:37 - 58174903 ____H C:\Users\owner\Documents\~WRL1409.tmp

2016-03-07 12:29 - 2015-08-21 22:37 - 55095819 ____H C:\Users\owner\Documents\~WRL0033.tmp

2016-03-07 12:29 - 2015-08-21 22:37 - 52848157 ____H C:\Users\owner\Documents\~WRL2830.tmp

2016-03-07 12:29 - 2015-08-21 22:37 - 405403772 ____H C:\Users\owner\Documents\~WRL1880.tmp

2016-03-07 12:29 - 2015-08-21 22:37 - 403611655 ____H C:\Users\owner\Documents\~WRL1690.tmp

2016-03-07 12:29 - 2015-08-21 22:37 - 399298619 ____H C:\Users\owner\Documents\~WRL0660.tmp

2016-03-07 12:29 - 2015-08-21 22:37 - 39475324 ____H C:\Users\owner\Documents\~WRL3727.tmp

2016-03-07 12:29 - 2015-08-21 22:37 - 366721683 ____H C:\Users\owner\Documents\~WRL1098.tmp

2016-03-07 12:29 - 2015-08-21 22:37 - 353973570 ____H C:\Users\owner\Documents\~WRL1501.tmp

2016-03-07 12:29 - 2015-08-21 22:37 - 280863945 ____H C:\Users\owner\Documents\~WRL0034.tmp

2016-03-07 12:29 - 2015-08-21 22:37 - 275622522 ____H C:\Users\owner\Documents\~WRL0367.tmp

2016-03-07 12:29 - 2015-08-21 22:37 - 236517363 ____H C:\Users\owner\Documents\~WRL0783.tmp

2016-03-07 12:29 - 2015-08-21 22:37 - 203928185 ____H C:\Users\owner\Documents\~WRL0366.tmp

2016-03-07 12:29 - 2015-08-21 22:37 - 175384694 ____H C:\Users\owner\Documents\~WRL2981.tmp

2016-03-07 12:29 - 2015-08-21 22:37 - 16582416 ____H C:\Users\owner\Documents\~WRL2970.tmp

2016-03-07 12:29 - 2015-08-21 22:37 - 129626909 ____H C:\Users\owner\Documents\~WRL3966.tmp

2016-03-07 12:29 - 2015-08-21 22:37 - 06815727 ____H C:\Users\owner\Documents\~WRL0175.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 80396690 ____H C:\Users\owner\Documents\~WRL0031.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 78431972 ____H C:\Users\owner\Documents\~WRL2229.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 46457459 ____H C:\Users\owner\Documents\~WRL0272.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 454949850 ____H C:\Users\owner\Documents\~WRL3739.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 440805473 ____H C:\Users\owner\Documents\~WRL0624.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 440043117 ____H C:\Users\owner\Documents\~WRL1268.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 434765070 ____H C:\Users\owner\Documents\~WRL2126.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 434764135 ____H C:\Users\owner\Documents\~WRL3329.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 433782596 ____H C:\Users\owner\Documents\~WRL3237.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 433781837 ____H C:\Users\owner\Documents\~WRL0256.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 432800311 ____H C:\Users\owner\Documents\~WRL2099.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 431624251 ____H C:\Users\owner\Documents\~WRL2252.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 431622361 ____H C:\Users\owner\Documents\~WRL0223.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 431618871 ____H C:\Users\owner\Documents\~WRL3604.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 428656949 ____H C:\Users\owner\Documents\~WRL1945.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 428654916 ____H C:\Users\owner\Documents\~WRL3596.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 425963764 ____H C:\Users\owner\Documents\~WRL0772.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 425960181 ____H C:\Users\owner\Documents\~WRL0365.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 425955180 ____H C:\Users\owner\Documents\~WRL3649.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 424602258 ____H C:\Users\owner\Documents\~WRL1110.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 424595289 ____H C:\Users\owner\Documents\~WRL2990.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 424565365 ____H C:\Users\owner\Documents\~WRL3496.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 424230546 ____H C:\Users\owner\Documents\~WRL0284.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 424220445 ____H C:\Users\owner\Documents\~WRL2828.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 409307702 ____H C:\Users\owner\Documents\~WRL2994.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 409033711 ____H C:\Users\owner\Documents\~WRL2735.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 409006720 ____H C:\Users\owner\Documents\~WRL0649.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 406793167 ____H C:\Users\owner\Documents\~WRL2812.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 392674401 ____H C:\Users\owner\Documents\~WRL2550.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 378937337 ____H C:\Users\owner\Documents\~WRL1407.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 362320784 ____H C:\Users\owner\Documents\~WRL1266.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 326354623 ____H C:\Users\owner\Documents\~WRL4044.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 292836566 ____H C:\Users\owner\Documents\~WRL2567.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 268558324 ____H C:\Users\owner\Documents\~WRL3350.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 216391142 ____H C:\Users\owner\Documents\~WRL1237.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 209695167 ____H C:\Users\owner\Documents\~WRL0932.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 176861445 ____H C:\Users\owner\Documents\~WRL0032.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 166719070 ____H C:\Users\owner\Documents\~WRL0241.tmp

2016-03-07 12:29 - 2015-05-25 11:14 - 07199661 ____H C:\Users\owner\Documents\~WRL2221.tmp

2016-03-07 12:29 - 2015-05-01 05:48 - 00016714 ____H C:\Users\owner\Documents\~WRL0904.tmp

2016-03-07 12:29 - 2015-04-27 05:54 - 01234216 ____H C:\Users\owner\Documents\~WRL3723.tmp

2016-03-07 12:29 - 2015-04-22 21:32 - 00266752 _____ C:\Users\owner\Documents\spy sharpe.xls

2016-03-07 12:29 - 2015-04-22 21:30 - 00266752 _____ C:\Users\owner\Documents\spy sharpe.xla

2016-03-07 12:29 - 2015-04-08 18:20 - 70279339 ____H C:\Users\owner\Documents\~WRL0947.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 55511803 ____H C:\Users\owner\Documents\~WRL1272.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 45436391 ____H C:\Users\owner\Documents\~WRL1444.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 431757754 ____H C:\Users\owner\Documents\~WRL1521.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 414579362 ____H C:\Users\owner\Documents\~WRL0344.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 392283703 ____H C:\Users\owner\Documents\~WRL2731.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 392283579 ____H C:\Users\owner\Documents\~WRL2612.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 392283395 ____H C:\Users\owner\Documents\~WRL2587.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 389420252 ____H C:\Users\owner\Documents\~WRL3304.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 389038838 ____H C:\Users\owner\Documents\~WRL0718.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 388482903 ____H C:\Users\owner\Documents\~WRL3690.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 375736111 ____H C:\Users\owner\Documents\~WRL1579.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 371444979 ____H C:\Users\owner\Documents\~WRL0036.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 369563685 ____H C:\Users\owner\Documents\~WRL3787.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 356830005 ____H C:\Users\owner\Documents\~WRL3658.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 355365680 ____H C:\Users\owner\Documents\~WRL2449.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 355250824 ____H C:\Users\owner\Documents\~WRL0061.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 355167418 ____H C:\Users\owner\Documents\~WRL0960.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 34297268 ____H C:\Users\owner\Documents\~WRL1545.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 315901424 ____H C:\Users\owner\Documents\~WRL2952.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 315895686 ____H C:\Users\owner\Documents\~WRL1294.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 315895564 ____H C:\Users\owner\Documents\~WRL3708.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 295305495 ____H C:\Users\owner\Documents\~WRL0895.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 269010759 ____H C:\Users\owner\Documents\~WRL1484.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 269004305 ____H C:\Users\owner\Documents\~WRL0859.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 268999160 ____H C:\Users\owner\Documents\~WRL2783.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 268739207 ____H C:\Users\owner\Documents\~WRL0349.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 266722812 ____H C:\Users\owner\Documents\~WRL0130.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 266496318 ____H C:\Users\owner\Documents\~WRL2495.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 253431215 ____H C:\Users\owner\Documents\~WRL1911.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 23852505 ____H C:\Users\owner\Documents\~WRL3243.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 230467759 ____H C:\Users\owner\Documents\~WRL2703.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 223388246 ____H C:\Users\owner\Documents\~WRL1310.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 217885965 ____H C:\Users\owner\Documents\~WRL2239.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 207929731 ____H C:\Users\owner\Documents\~WRL2226.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 200459695 ____H C:\Users\owner\Documents\~WRL1522.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 200459672 ____H C:\Users\owner\Documents\~WRL3232.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 144216132 ____H C:\Users\owner\Documents\~WRL0225.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 144215170 ____H C:\Users\owner\Documents\~WRL1079.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 144198697 ____H C:\Users\owner\Documents\~WRL2419.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 144184531 ____H C:\Users\owner\Documents\~WRL3587.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 144184419 ____H C:\Users\owner\Documents\~WRL3227.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 138332296 ____H C:\Users\owner\Documents\~WRL0354.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 138332207 ____H C:\Users\owner\Documents\~WRL2349.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 126859397 ____H C:\Users\owner\Documents\~WRL2807.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 120090663 ____H C:\Users\owner\Documents\~WRL1983.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 113740577 ____H C:\Users\owner\Documents\~WRL2346.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 106824798 ____H C:\Users\owner\Documents\~WRL1430.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 106654583 ____H C:\Users\owner\Documents\~WRL0087.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 106650349 ____H C:\Users\owner\Documents\~WRL3497.tmp

2016-03-07 12:29 - 2015-04-08 18:20 - 100525040 ____H C:\Users\owner\Documents\~WRL3405.tmp

2016-03-07 12:29 - 2015-03-03 01:41 - 436201041 ____H C:\Users\owner\Documents\~WRL3873.tmp

2016-03-07 12:29 - 2015-03-03 01:41 - 410426249 ____H C:\Users\owner\Documents\~WRL1427.tmp

2016-03-07 12:29 - 2015-03-03 01:41 - 403466736 ____H C:\Users\owner\Documents\~WRL3396.tmp

2016-03-07 12:29 - 2015-03-03 01:41 - 385327593 ____H C:\Users\owner\Documents\~WRL1927.tmp

2016-03-07 12:29 - 2015-03-03 01:41 - 384271130 ____H C:\Users\owner\Documents\~WRL2469.tmp

2016-03-07 12:29 - 2015-03-03 01:41 - 382072931 ____H C:\Users\owner\Documents\~WRL2710.tmp

2016-03-07 12:29 - 2015-03-03 01:41 - 382072820 ____H C:\Users\owner\Documents\~WRL3169.tmp

2016-03-07 12:29 - 2015-03-03 01:41 - 382072757 ____H C:\Users\owner\Documents\~WRL2862.tmp

2016-03-07 12:29 - 2015-03-03 01:41 - 360753515 ____H C:\Users\owner\Documents\~WRL0568.tmp

2016-03-07 12:29 - 2015-03-03 01:41 - 334704316 ____H C:\Users\owner\Documents\~WRL0116.tmp

2016-03-07 12:29 - 2015-03-03 01:41 - 325463769 ____H C:\Users\owner\Documents\~WRL3895.tmp

2016-03-07 12:29 - 2015-03-03 01:41 - 315899542 ____H C:\Users\owner\Documents\~WRL1788.tmp

2016-03-07 12:29 - 2015-03-03 01:41 - 312005525 ____H C:\Users\owner\Documents\~WRL2598.tmp

2016-03-07 12:29 - 2015-03-03 01:41 - 311132517 ____H C:\Users\owner\Documents\~WRL0985.tmp

2016-03-07 12:29 - 2015-03-03 01:41 - 311094307 ____H C:\Users\owner\Documents\~WRL2319.tmp

2016-03-07 12:29 - 2015-03-03 01:41 - 304097082 ____H C:\Users\owner\Documents\~WRL2971.tmp

2016-03-07 12:29 - 2015-03-03 01:41 - 281207846 ____H C:\Users\owner\Documents\~WRL2752.tmp

2016-03-07 12:29 - 2015-03-03 01:41 - 259234240 ____H C:\Users\owner\Documents\~WRL2162.tmp

2016-03-07 12:29 - 2015-03-03 01:41 - 241414051 ____H C:\Users\owner\Documents\~WRL3607.tmp

2016-03-07 12:29 - 2015-03-03 01:41 - 234138763 ____H C:\Users\owner\Documents\~WRL0030.tmp

2016-03-07 12:29 - 2015-03-03 01:41 - 227270392 ____H C:\Users\owner\Documents\~WRL0029.tmp

2016-03-07 12:29 - 2015-03-03 01:41 - 221707397 ____H C:\Users\owner\Documents\~WRL0982.tmp

2016-03-07 12:29 - 2015-03-03 01:41 - 213715535 ____H C:\Users\owner\Documents\~WRL1965.tmp

2016-03-07 12:29 - 2014-10-19 00:05 - 00010912 _____ C:\Users\owner\Documents\Mortgage_1-1.xlsx

2016-03-07 12:29 - 2014-10-16 18:21 - 00050164 _____ C:\Users\owner\Documents\extra credit assignment song.xlsx

2016-03-07 12:29 - 2014-10-01 22:04 - 00095232 _____ C:\Users\owner\Documents\song homework 2.xls

2016-03-07 12:29 - 2014-09-18 10:46 - 00010245 _____ C:\Users\owner\Documents\Book1.xlsx

2016-03-07 12:29 - 2014-08-02 21:31 - 00104306 ____H C:\Users\owner\Documents\~WRL0301.tmp

2016-03-07 12:29 - 2014-08-02 21:31 - 00092440 ____H C:\Users\owner\Documents\~WRL3548.tmp

2016-03-07 12:29 - 2014-08-02 21:31 - 00088815 ____H C:\Users\owner\Documents\~WRL3578.tmp

2016-03-07 12:29 - 2014-08-02 17:39 - 00363987 _____ C:\Users\owner\Documents\Chapter 14.pdf

2016-03-07 12:29 - 2014-08-02 17:39 - 00181004 _____ C:\Users\owner\Documents\Chapter 12.pdf

2016-03-07 12:29 - 2014-08-02 17:38 - 00222632 _____ C:\Users\owner\Documents\Chapter 10.pdf

2016-03-07 12:29 - 2014-07-23 06:45 - 00272370 ____H C:\Users\owner\Documents\~WRL3431.tmp

2016-03-07 12:29 - 2014-07-22 18:30 - 00907181 _____ C:\Users\owner\Documents\Chapter 4.pdf

2016-03-07 12:29 - 2014-07-22 18:30 - 00433623 _____ C:\Users\owner\Documents\Chapter 2.pdf

2016-03-07 12:29 - 2014-07-22 18:30 - 00225441 _____ C:\Users\owner\Documents\Chapter 5.pdf

2016-03-07 12:29 - 2014-07-22 18:30 - 00168700 _____ C:\Users\owner\Documents\Chapter 3.pdf

2016-03-07 12:29 - 2014-07-22 18:29 - 00478369 _____ C:\Users\owner\Documents\Chapter 1.pdf

2016-03-07 12:29 - 2014-07-01 17:20 - 00335360 _____ C:\Users\owner\Documents\Chapter 19 Lecture Slides REV.ppt

2016-03-07 12:29 - 2014-07-01 17:19 - 00597504 _____ C:\Users\owner\Documents\Chapter 14 Lecture Slides REV-1.ppt

2016-03-07 12:29 - 2014-07-01 17:19 - 00499200 _____ C:\Users\owner\Documents\Chapter 11 Lecture Slides.ppt

2016-03-07 12:29 - 2014-07-01 17:19 - 00391168 _____ C:\Users\owner\Documents\Chapter 13 Lecture Slides.ppt

2016-03-07 12:29 - 2014-07-01 17:18 - 00692224 _____ C:\Users\owner\Documents\Chapter 6 CL Lecture Slides.ppt

2016-03-07 12:29 - 2014-07-01 17:17 - 00378025 _____ C:\Users\owner\Documents\Chapter 4 Lecture Slides(1).pptx

2016-03-07 12:29 - 2014-07-01 17:14 - 00635392 _____ C:\Users\owner\Documents\Chapter 5 Lecture Slides-1.ppt

2016-03-07 12:29 - 2014-06-30 00:43 - 00257843 ____H C:\Users\owner\Documents\~WRL3883.tmp

2016-03-07 12:29 - 2014-06-22 00:52 - 00017312 ____H C:\Users\owner\Documents\~WRL2427.tmp

2016-03-07 12:29 - 2014-06-22 00:52 - 00013015 ____H C:\Users\owner\Documents\~WRL3139.tmp

2016-03-07 12:29 - 2014-06-10 23:31 - 00017513 ____H C:\Users\owner\Documents\~WRL1981.tmp

2016-03-07 12:29 - 2014-06-10 23:31 - 00013505 ____H C:\Users\owner\Documents\~WRL3363.tmp

2016-03-07 12:29 - 2014-06-01 23:28 - 00032595 ____H C:\Users\owner\Documents\~WRL2499.tmp

2016-03-07 12:29 - 2014-06-01 23:28 - 00031007 ____H C:\Users\owner\Documents\~WRL3151.tmp

2016-03-07 12:29 - 2014-06-01 23:28 - 00023619 ____H C:\Users\owner\Documents\~WRL3498.tmp

2016-03-07 12:29 - 2014-06-01 23:28 - 00022849 ____H C:\Users\owner\Documents\~WRL2153.tmp

2016-03-07 12:29 - 2014-06-01 23:28 - 00019001 ____H C:\Users\owner\Documents\~WRL1269.tmp

2016-03-07 12:29 - 2014-05-18 21:30 - 00404942 ____H C:\Users\owner\Documents\~WRL1122.tmp

2016-03-07 12:29 - 2014-05-18 21:30 - 00402334 ____H C:\Users\owner\Documents\~WRL2604.tmp

2016-03-07 12:29 - 2014-05-18 21:30 - 00400955 ____H C:\Users\owner\Documents\~WRL1137.tmp

2016-03-07 12:29 - 2014-05-18 21:30 - 00399803 ____H C:\Users\owner\Documents\~WRL4017.tmp

2016-03-07 12:29 - 2014-05-18 21:30 - 00396305 ____H C:\Users\owner\Documents\~WRL0375.tmp

2016-03-07 12:29 - 2014-02-26 04:38 - 00019957 ____H C:\Users\owner\Documents\~WRL2394.tmp

2016-03-07 12:29 - 2014-02-26 04:38 - 00019234 ____H C:\Users\owner\Documents\~WRL0028.tmp

2016-03-07 12:29 - 2014-02-26 04:38 - 00018765 ____H C:\Users\owner\Documents\~WRL2212.tmp

2016-03-07 12:29 - 2014-02-26 04:38 - 00016391 ____H C:\Users\owner\Documents\~WRL1129.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00940520 ____H C:\Users\owner\Documents\~WRL0996.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00622134 ____H C:\Users\owner\Documents\~WRL0955.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00467486 ____H C:\Users\owner\Documents\~WRL2917.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00463811 ____H C:\Users\owner\Documents\~WRL3523.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00390337 ____H C:\Users\owner\Documents\~WRL3767.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00389761 ____H C:\Users\owner\Documents\~WRL3949.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00388859 ____H C:\Users\owner\Documents\~WRL1928.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00387032 ____H C:\Users\owner\Documents\~WRL2658.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00383159 ____H C:\Users\owner\Documents\~WRL1406.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00369210 ____H C:\Users\owner\Documents\~WRL3531.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00366948 ____H C:\Users\owner\Documents\~WRL4091.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00356715 ____H C:\Users\owner\Documents\~WRL1223.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00354573 ____H C:\Users\owner\Documents\~WRL3090.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00353289 ____H C:\Users\owner\Documents\~WRL0283.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00349177 ____H C:\Users\owner\Documents\~WRL1003.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00344388 ____H C:\Users\owner\Documents\~WRL2958.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00343686 ____H C:\Users\owner\Documents\~WRL1209.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00341014 ____H C:\Users\owner\Documents\~WRL0164.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00340995 ____H C:\Users\owner\Documents\~WRL0072.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00337766 ____H C:\Users\owner\Documents\~WRL3042.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00337534 ____H C:\Users\owner\Documents\~WRL1900.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00337128 ____H C:\Users\owner\Documents\~WRL1461.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00332668 ____H C:\Users\owner\Documents\~WRL1067.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00325080 ____H C:\Users\owner\Documents\~WRL3266.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00324189 ____H C:\Users\owner\Documents\~WRL3812.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00323644 ____H C:\Users\owner\Documents\~WRL1440.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00316836 ____H C:\Users\owner\Documents\~WRL3030.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00300590 ____H C:\Users\owner\Documents\~WRL3706.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00299843 ____H C:\Users\owner\Documents\~WRL2620.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00292299 ____H C:\Users\owner\Documents\~WRL2641.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00287539 ____H C:\Users\owner\Documents\~WRL3874.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00287261 ____H C:\Users\owner\Documents\~WRL3626.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00286411 ____H C:\Users\owner\Documents\~WRL2468.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00268512 ____H C:\Users\owner\Documents\~WRL2035.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00257466 ____H C:\Users\owner\Documents\~WRL1264.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00256753 ____H C:\Users\owner\Documents\~WRL3846.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00247882 ____H C:\Users\owner\Documents\~WRL2895.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00241153 ____H C:\Users\owner\Documents\~WRL3395.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00230990 ____H C:\Users\owner\Documents\~WRL0209.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00228119 ____H C:\Users\owner\Documents\~WRL3308.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00227646 ____H C:\Users\owner\Documents\~WRL4014.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00227104 ____H C:\Users\owner\Documents\~WRL3249.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00222267 ____H C:\Users\owner\Documents\~WRL3438.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00221345 ____H C:\Users\owner\Documents\~WRL1195.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00219942 ____H C:\Users\owner\Documents\~WRL0098.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00216094 ____H C:\Users\owner\Documents\~WRL3173.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00214540 ____H C:\Users\owner\Documents\~WRL0981.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00214488 ____H C:\Users\owner\Documents\~WRL3385.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00214216 ____H C:\Users\owner\Documents\~WRL3691.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00207481 ____H C:\Users\owner\Documents\~WRL3166.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00205756 ____H C:\Users\owner\Documents\~WRL1826.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00204620 ____H C:\Users\owner\Documents\~WRL2200.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00203859 ____H C:\Users\owner\Documents\~WRL2603.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00201382 ____H C:\Users\owner\Documents\~WRL0699.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00200954 ____H C:\Users\owner\Documents\~WRL0315.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00200475 ____H C:\Users\owner\Documents\~WRL1142.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00200269 ____H C:\Users\owner\Documents\~WRL0814.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00197765 ____H C:\Users\owner\Documents\~WRL2398.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00195397 ____H C:\Users\owner\Documents\~WRL3492.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00195017 ____H C:\Users\owner\Documents\~WRL0604.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00194186 ____H C:\Users\owner\Documents\~WRL3334.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00194169 ____H C:\Users\owner\Documents\~WRL0965.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00193037 ____H C:\Users\owner\Documents\~WRL3779.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00192914 ____H C:\Users\owner\Documents\~WRL0192.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00192221 ____H C:\Users\owner\Documents\~WRL1140.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00191453 ____H C:\Users\owner\Documents\~WRL3010.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00191371 ____H C:\Users\owner\Documents\~WRL1445.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00191325 ____H C:\Users\owner\Documents\~WRL2280.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00191121 ____H C:\Users\owner\Documents\~WRL1616.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00187151 ____H C:\Users\owner\Documents\~WRL1947.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00187079 ____H C:\Users\owner\Documents\~WRL3722.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00186864 ____H C:\Users\owner\Documents\~WRL3171.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00183223 ____H C:\Users\owner\Documents\~WRL3879.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00180716 ____H C:\Users\owner\Documents\~WRL1918.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00180636 ____H C:\Users\owner\Documents\~WRL2159.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00175868 ____H C:\Users\owner\Documents\~WRL3915.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00175418 ____H C:\Users\owner\Documents\~WRL0858.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00175244 ____H C:\Users\owner\Documents\~WRL0806.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00169017 ____H C:\Users\owner\Documents\~WRL0711.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00168850 ____H C:\Users\owner\Documents\~WRL2619.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00165906 ____H C:\Users\owner\Documents\~WRL2459.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00165496 ____H C:\Users\owner\Documents\~WRL3762.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00165337 ____H C:\Users\owner\Documents\~WRL0862.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00161992 ____H C:\Users\owner\Documents\~WRL0305.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00161833 ____H C:\Users\owner\Documents\~WRL3480.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00161667 ____H C:\Users\owner\Documents\~WRL0930.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00161490 ____H C:\Users\owner\Documents\~WRL3777.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00161331 ____H C:\Users\owner\Documents\~WRL4087.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00160442 ____H C:\Users\owner\Documents\~WRL1710.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00159607 ____H C:\Users\owner\Documents\~WRL0369.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00158042 ____H C:\Users\owner\Documents\~WRL2630.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00157138 ____H C:\Users\owner\Documents\~WRL2150.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00141245 ____H C:\Users\owner\Documents\~WRL1811.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00138342 ____H C:\Users\owner\Documents\~WRL2227.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00138223 ____H C:\Users\owner\Documents\~WRL1405.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00128038 ____H C:\Users\owner\Documents\~WRL1850.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00127960 ____H C:\Users\owner\Documents\~WRL0026.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00122742 ____H C:\Users\owner\Documents\~WRL2042.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00122299 ____H C:\Users\owner\Documents\~WRL0025.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00120462 ____H C:\Users\owner\Documents\~WRL0024.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00118940 ____H C:\Users\owner\Documents\~WRL2897.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00107580 ____H C:\Users\owner\Documents\~WRL2834.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00104906 ____H C:\Users\owner\Documents\~WRL0844.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00094129 ____H C:\Users\owner\Documents\~WRL1439.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00093964 ____H C:\Users\owner\Documents\~WRL0023.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00091990 ____H C:\Users\owner\Documents\~WRL1711.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00086225 ____H C:\Users\owner\Documents\~WRL2596.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00079108 ____H C:\Users\owner\Documents\~WRL1477.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00074475 ____H C:\Users\owner\Documents\~WRL3753.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00067983 ____H C:\Users\owner\Documents\~WRL3808.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00066717 ____H C:\Users\owner\Documents\~WRL0022.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00066357 ____H C:\Users\owner\Documents\~WRL0021.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00062649 ____H C:\Users\owner\Documents\~WRL0070.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00061924 ____H C:\Users\owner\Documents\~WRL1443.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00059428 ____H C:\Users\owner\Documents\~WRL1665.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00058739 ____H C:\Users\owner\Documents\~WRL0020.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00054680 ____H C:\Users\owner\Documents\~WRL0019.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00053140 ____H C:\Users\owner\Documents\~WRL2781.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00052172 ____H C:\Users\owner\Documents\~WRL1975.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00051257 ____H C:\Users\owner\Documents\~WRL0018.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00048912 ____H C:\Users\owner\Documents\~WRL0017.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00048743 ____H C:\Users\owner\Documents\~WRL3920.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00046412 ____H C:\Users\owner\Documents\~WRL0016.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00046004 ____H C:\Users\owner\Documents\~WRL0319.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00045871 ____H C:\Users\owner\Documents\~WRL2689.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00041032 ____H C:\Users\owner\Documents\~WRL2055.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00040339 ____H C:\Users\owner\Documents\~WRL0015.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00040314 ____H C:\Users\owner\Documents\~WRL0014.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00038557 ____H C:\Users\owner\Documents\~WRL3715.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00032733 ____H C:\Users\owner\Documents\~WRL1792.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00030539 ____H C:\Users\owner\Documents\~WRL3975.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00029824 ____H C:\Users\owner\Documents\~WRL1802.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00029513 ____H C:\Users\owner\Documents\~WRL0657.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00027992 ____H C:\Users\owner\Documents\~WRL0013.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00025807 ____H C:\Users\owner\Documents\~WRL1709.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00022330 ____H C:\Users\owner\Documents\~WRL0084.tmp

2016-03-07 12:29 - 2014-02-13 00:12 - 00020057 ____H C:\Users\owner\Documents\~WRL2546.tmp

2016-03-07 12:29 - 2013-10-28 01:36 - 00255658 ____H C:\Users\owner\Documents\~WRL0012.tmp

2016-03-07 12:29 - 2013-10-28 01:36 - 00255300 ____H C:\Users\owner\Documents\~WRL1944.tmp

2016-03-07 12:29 - 2013-10-28 01:36 - 00013813 ____H C:\Users\owner\Documents\~WRL3535.tmp

2016-03-07 12:29 - 2013-04-24 01:24 - 00012784 ____H C:\Users\owner\Documents\~WRL0011.tmp

2016-03-07 12:29 - 2013-03-18 21:26 - 00013704 ____H C:\Users\owner\Documents\~WRL0835.tmp

2016-03-07 12:29 - 2013-03-18 21:26 - 00013406 ____H C:\Users\owner\Documents\~WRL0010.tmp

2016-03-07 12:29 - 2013-02-05 03:57 - 00013173 ____H C:\Users\owner\Documents\~WRL1692.tmp

2016-03-07 12:29 - 2013-01-03 04:18 - 00021443 ____H C:\Users\owner\Documents\~WRL0282.tmp

2016-03-07 12:29 - 2012-12-02 06:26 - 00013907 ____H C:\Users\owner\Documents\~WRL2849.tmp

2016-03-07 12:29 - 2012-05-10 03:33 - 00181091 _____ C:\Users\owner\Documents\Chapter 11 Scrambled.pptx

2016-03-07 12:29 - 2012-05-10 03:33 - 00161121 _____ C:\Users\owner\Documents\Chapter 12 Scrambled.pptx

2016-03-07 12:29 - 2012-05-08 04:06 - 00028448 ____H C:\Users\owner\Documents\~WRL0008.tmp

2016-03-07 12:29 - 2012-05-06 03:32 - 00014040 ____H C:\Users\owner\Documents\~WRL3086.tmp

2016-03-07 12:29 - 2012-05-06 03:32 - 00013655 ____H C:\Users\owner\Documents\~WRL4058.tmp

2016-03-07 12:29 - 2012-04-30 02:24 - 00110188 _____ C:\Users\owner\Documents\Chapter 13 Scrambled-1.pptx

2016-03-07 12:29 - 2012-04-29 10:18 - 00013662 ____H C:\Users\owner\Documents\~WRL1995.tmp

2016-03-07 12:29 - 2012-04-29 10:18 - 00013403 ____H C:\Users\owner\Documents\~WRL0006.tmp

2016-03-07 12:29 - 2012-04-24 03:59 - 00013183 ____H C:\Users\owner\Documents\~WRL0424.tmp

2016-03-07 12:29 - 2012-04-14 20:39 - 00181557 _____ C:\Users\owner\Documents\Chapter 4 Scrambled.pptx

2016-03-07 12:29 - 2012-04-14 20:39 - 00157370 _____ C:\Users\owner\Documents\Chapter 5 Scrambled.pptx

2016-03-07 12:29 - 2012-04-14 20:38 - 00179933 _____ C:\Users\owner\Documents\Chapter 2 Scrambled.pptx

2016-03-07 12:29 - 2012-04-14 20:38 - 00111569 _____ C:\Users\owner\Documents\Chapter 3 Scrambled.pptx

2016-03-07 12:29 - 2012-04-14 20:37 - 00192955 _____ C:\Users\owner\Documents\Chapter 1 Scrambled.pptx

2016-03-07 12:29 - 2012-04-05 03:00 - 00026595 ____H C:\Users\owner\Documents\~WRL0005.tmp

2016-03-07 12:29 - 2012-04-05 03:00 - 00014704 ____H C:\Users\owner\Documents\~WRL0743.tmp

2016-03-07 12:29 - 2012-04-05 03:00 - 00013946 ____H C:\Users\owner\Documents\~WRL2164.tmp

2016-03-07 12:29 - 2012-04-05 00:22 - 00435564 _____ C:\Users\owner\Documents\epr.htm

2016-03-07 12:29 - 2012-03-25 05:58 - 00015342 ____H C:\Users\owner\Documents\~WRL0007.tmp

2016-03-07 12:29 - 2012-03-25 05:58 - 00014322 ____H C:\Users\owner\Documents\~WRL0004.tmp

2016-03-07 12:29 - 2011-12-08 22:02 - 02030048 _____ C:\Users\owner\Documents\exam1AH.pdf

2016-03-07 12:29 - 2011-12-08 22:02 - 01311222 _____ C:\Users\owner\Documents\exam2AH.pdf

2016-03-07 12:29 - 2011-12-08 22:01 - 00015891 _____ C:\Users\owner\Documents\listContent.htm

2016-03-07 12:29 - 2011-02-27 21:15 - 00027136 ____H C:\Users\owner\Documents\~WRL2523.tmp

2016-03-07 12:29 - 2011-02-21 01:55 - 00000519 _____ C:\Users\owner\Documents\Shortcut to rws 200 project 1 mo.lnk

2016-03-05 22:59 - 2009-07-13 20:45 - 00003072 _____ C:\Windows\System32\umstartup.etl

2016-03-03 17:50 - 2009-07-13 20:45 - 00003072 _____ C:\Windows\System32\umstartup000.etl

2016-03-03 14:55 - 2013-06-10 11:31 - 00000350 _____ C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job

2016-03-03 14:55 - 2013-06-03 03:20 - 00000350 _____ C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job

2016-03-03 14:55 - 2012-11-17 18:46 - 00000370 ____H C:\Windows\Tasks\VaudiXUpdaterTask{F2A09392-928B-4B6C-8529-C725BE4B293E}.job

2016-03-03 14:55 - 2010-01-14 04:27 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2016-03-03 14:55 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2016-03-03 14:54 - 2015-12-04 00:40 - 00000000 ____D C:\Windows\System32\Tasks\AVAST Software

2016-03-03 14:54 - 2012-08-30 21:19 - 00000000 ____D C:\Windows\System32\Tasks\Sony Corporation

2016-03-03 14:54 - 2012-05-08 04:27 - 00000000 ____D C:\ProgramData\McAfee Security Scan

2016-03-03 14:54 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\registration

2016-03-03 14:53 - 2010-01-14 04:36 - 00000000 __RHD C:\MSOCache

2016-03-03 14:50 - 2009-07-13 20:45 - 00014144 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2016-03-03 14:50 - 2009-07-13 20:45 - 00014144 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2016-02-28 19:47 - 2010-01-14 04:27 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2016-02-28 19:46 - 2014-02-01 13:33 - 00000908 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1798455190-986609235-2888039337-1001UA.job

2016-02-28 19:46 - 2012-05-08 04:26 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2016-02-28 18:32 - 2012-01-17 20:46 - 00129080 _____ C:\Windows\System32\GDIPFONTCACHEV1.DAT

2016-02-28 18:23 - 2014-04-15 22:45 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update

2016-02-28 03:07 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\inf

2016-02-26 16:03 - 2014-04-15 22:43 - 00463744 _____ (AVAST Software) C:\Windows\System32\Drivers\aswSP.sys

2016-02-21 22:04 - 2014-02-01 13:33 - 00000856 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1798455190-986609235-2888039337-1001Core.job

2016-02-19 01:04 - 2011-08-14 15:21 - 00000000 ___HD C:\Users\owner\AppData\Local\CrashDumps

2016-02-18 03:17 - 2011-11-23 16:27 - 00000064 _____ C:\Windows\SysWOW64\rp_stats.dat

2016-02-18 03:17 - 2011-11-23 16:27 - 00000044 _____ C:\Windows\SysWOW64\rp_rules.dat

2016-02-12 21:50 - 2015-11-12 05:30 - 00000000 ____D C:\Program Files\McAfee Security Scan

==================== Known DLLs (Whitelisted) =========================

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\dnsapi.dll => MD5 is legit

C:\Windows\SysWOW64\dnsapi.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE Association (Whitelisted) =============

==================== Restore Points =========================

==================== Memory info ===========================

Percentage of memory in use: 18%

Total physical RAM: 3758.1 MB

Available physical RAM: 3044.84 MB

Total Virtual: 3756.25 MB

Available Virtual: 3036.21 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:289.23 GB) (Free:119.32 GB) NTFS

Drive e: (Recovery) (Fixed) (Total:8.77 GB) (Free:0.82 GB) NTFS ==>[system with boot components (obtained from drive)]

Drive f: (ROS_SysRec7_64) (CDROM) (Total:0.16 GB) (Free:0 GB) UDF

Drive g: () (Removable) (Total:0.24 GB) (Free:0.22 GB) FAT

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.08 GB) NTFS ==>[system with boot components (obtained from drive)]

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 5BC53D8B)

Partition 1: (Not Active) - (Size=8.8 GB) - (Type=27)

Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=289.2 GB) - (Type=07 NTFS)

========================================================

Disk: 1 (Size: 249.3 MB) (Disk ID: 00102FCC)

Partition 1: (Active) - (Size=249 MB) - (Type=06)

LastRegBack: 2016-03-03 04:26

==================== End of FRST.txt ============================

Attached Files

FRST.txt 57.96KB 302 downloads

Edited by RKinner, 12 March 2016 - 05:21 PM.

#55
RKinner

Posted 12 March 2016 - 05:32 PM

Malware Expert

Expert
24,624 posts

Download the attached fixlist.txt to the same location as FRST

Run FRST and press Fix

A fix log will be generated please post that

We are reverting back to an older version of the registry that FRST found. Don't know if it predates your zero access infection or not so if it is able to boot after the fix, run a new FRST from normal mode and check the addition.txt box before hitting scan. You will get two logs. Post them both.

#56
honnybee

Posted 12 March 2016 - 05:41 PM

Member

Topic Starter
Member
38 posts

How do I get the addition txt, also I think on that date I first had the virus, is there away you can restore it to around February.

Edited by honnybee, 12 March 2016 - 05:44 PM.

#57
RKinner

Posted 12 March 2016 - 06:03 PM

Malware Expert

Expert
24,624 posts

Addition.txt is only available when Frst is run after a regular boot.

FRST only shows one registry backup so that's the only date we can go back to.

#58
honnybee

Posted 12 March 2016 - 06:22 PM

Member

Topic Starter
Member
38 posts

I did what you said, after doing fix from frst I tried boot normally, but still got the black screen, heres the fix log and frst scan.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-03-2016 01

Ran by SYSTEM on MININT-RHBMQ6J (12-03-2016 16:08:03)