Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Stubborn Malware

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Re: Stubborn Malware

Unread postby fullbug » June 14th, 2010, 7:39 am

Any idea idea what the malware / trojan was? I'm just curious because I have never had such a hard time tracking it down and removing it before....
fullbug
Regular Member
 
Posts: 31
Joined: June 10th, 2010, 7:51 am
Advertisement
Register to Remove

Re: Stubborn Malware

Unread postby melboy » June 14th, 2010, 7:49 am

Hi

Your computer was infected with a ROOTKIT. In particular, the TDL3 rootkit, also known as Win32/Alureon. A rootkit is a set of software tools intended for concealing running processes, files or system data from the operating system.

Due to its rootkit functionality, it's impossible to tell what may have been done when the system was compromised.

Therefore it may be prudent to:

  1. Call all your banks, financial institutions, credit card companies and inform them that you may be a victim of identity theft and put a watch on your accounts.
  2. Change all your passwords (ISP login password, your email address(es) passwords, financial accounts, PayPal, eBay, Amazon, online groups and forums and any other online activities you carry out which require a username and password)

What are rootkits from Wikipedia

How do I respond to a possible identity theft and how do I prevent it

You also have what is known as the vundo file infector.



COMBOFIX-Script
A word of warning: Please do not run ComboFix on your own. This tool is not a toy and not for everyday use.


  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    Code: Select all
    File::
    c:\documents and settings\All Users\Application Data\x0D1am.dat
    
    RenV::
    c:\program files\ClipX\clipx .exe
    c:\program files\Common Files\Java\Java Update\jusched .exe
    c:\program files\HP\Digital Imaging\bin\hpqSRMon .exe
    c:\program files\HP\HP Software Update\HPWuSchd2 .exe
    c:\program files\KillProcess\KillProcess .exe
    c:\program files\Microsoft IntelliPoint\ipoint .exe
    c:\program files\Microsoft Office\Office12\GrooveMonitor .exe
    c:\program files\QuickTime\QTTask   .exe
    c:\windows\tsnpstd3 .exe
    
    

  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    Image
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • If you need help to disable your protection programs see here.
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.


After combofix has rebooted and finished and the logfile has been produced:


Again, make sure all external drives are plugged in when running the ESET scan.


ESET Online Scanner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.
  • Please go here then click on: Image
    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
  • Select the option YES, I accept the Terms of Use then click on: Image
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:

    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
    • Under "Current scan targets: Operating memory, Local drives" Click on Change...
    • Ensure ALL drives are checked under My Computer

  • Now click on: Image
  • The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: Image
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!
User avatar
melboy
MRU Expert
MRU Expert
 
Posts: 3670
Joined: July 25th, 2008, 4:25 pm
Location: UK

Re: Stubborn Malware

Unread postby fullbug » June 14th, 2010, 8:34 am

I cant seem to be able to open 'notepad', been having this problem for days now, I have been just emailing the logs I post here to my laptop because of that, will keep trying to open it....
Never mind, got it going....
fullbug
Regular Member
 
Posts: 31
Joined: June 10th, 2010, 7:51 am

Re: Stubborn Malware

Unread postby fullbug » June 14th, 2010, 3:12 pm

ComboFix 10-06-12.03 - Administrator 14/06/2010 14:51:47.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.510.177 [GMT -4:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
AV: BitDefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}

FILE ::
"c:\documents and settings\All Users\Application Data\x0D1am.dat"
.
The following files were disabled during the run:
c:\program files\AusLogics Visual Styler\ThemeHelper.dll


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\x0D1am.dat
H:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2010-05-14 to 2010-06-14 )))))))))))))))))))))))))))))))
.

2010-06-13 14:10 . 2010-06-13 14:09 388608 ----a-w- c:\windows\system32\CF23854.exe
2010-06-13 13:46 . 2010-06-13 13:46 -------- d-----w- C:\_OTL
2010-06-10 18:48 . 2010-06-11 13:07 -------- d-----w- c:\program files\Tibor - Tale of a Kind Vampire
2010-06-10 18:15 . 2010-06-10 18:15 0 ----a-w- C:\pcwords2.dat
2010-06-10 18:15 . 2010-06-10 18:15 0 ----a-w- C:\pcwords.dat
2010-06-10 17:16 . 2010-06-10 17:17 -------- d-----w- c:\documents and settings\Administrator\Application Data\BitDefender
2010-06-10 12:11 . 2010-06-10 12:11 388096 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-06-10 12:11 . 2010-06-10 12:11 -------- d-----w- c:\program files\Trend Micro
2010-06-10 02:43 . 2010-06-10 02:43 -------- d-----w- c:\program files\Tibor The Vampire Platform Game
2010-06-09 15:39 . 2009-01-23 21:22 2929528 ----a-w- c:\documents and settings\Administrator\Application Data\Simply Super Software\Trojan Remover\kfdA.exe
2010-06-02 21:51 . 2010-06-02 21:51 -------- d-----w- c:\windows\system32\wbem\Repository
2010-06-02 21:51 . 2010-06-02 21:51 -------- d-----w- c:\documents and settings\Administrator\Application Data\Gmail Notifier
2010-06-02 21:51 . 2010-06-02 21:51 -------- d-----w- c:\program files\Gmail Notifier
2010-05-31 23:53 . 2010-06-13 14:22 132 ----a-w- c:\windows\system32\rezumatenoi.dat
2010-05-31 23:29 . 2010-06-10 17:16 -------- d-----w- c:\documents and settings\All Users\Application Data\BitDefender
2010-05-31 23:29 . 2010-05-31 23:29 -------- d-----w- c:\program files\BitDefender
2010-05-31 23:27 . 2010-06-10 17:12 -------- d-----w- c:\program files\Common Files\BitDefender
2010-05-25 17:28 . 2010-05-25 17:28 348160 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-62e9256d-n\msvcr71.dll
2010-05-25 17:28 . 2010-05-25 17:28 503808 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-62e9256d-n\msvcp71.dll
2010-05-25 17:28 . 2010-05-25 17:28 499712 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-62e9256d-n\jmc.dll
2010-05-25 17:28 . 2010-05-25 17:28 61440 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-24c22a0e-n\decora-sse.dll
2010-05-25 17:28 . 2010-05-25 17:28 12800 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-24c22a0e-n\decora-d3d.dll
2010-05-22 13:35 . 2010-05-22 13:35 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-05-21 14:18 . 2010-05-21 14:18 -------- d-----w- c:\program files\Loaris
2010-05-20 02:15 . 2010-05-20 02:15 711168 ----a-w- c:\windows\is-DOGNN.exe
2010-05-19 17:30 . 2010-05-19 17:30 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\SnakyJake
2010-05-19 17:25 . 2010-05-19 17:25 -------- d-----w- c:\program files\BFG
2010-05-19 17:20 . 2010-05-19 17:20 -------- d-----w- c:\program files\Sean's Stuff
2010-05-17 01:52 . 2010-06-09 16:38 -------- d-----w- c:\program files\Pizza Chef 2
2010-05-16 22:24 . 2010-05-16 23:44 -------- d-----w- c:\program files\Vitys Rapid Downloader

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-14 18:51 . 2010-04-03 21:57 -------- d-----w- c:\program files\QuickTime
2010-06-14 18:51 . 2008-12-16 02:29 -------- d-----w- c:\program files\Microsoft IntelliPoint
2010-06-14 18:51 . 2008-08-23 03:34 -------- d-----w- c:\program files\ClipX
2010-06-14 18:51 . 2008-08-22 21:56 -------- d-----w- c:\program files\KillProcess
2010-06-14 17:35 . 2008-09-28 02:13 -------- d-----w- c:\program files\AusLogics Visual Styler
2010-06-13 21:44 . 2010-03-03 15:05 1 ----a-w- c:\documents and settings\Administrator\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-06-13 12:08 . 2008-08-22 20:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-06-13 11:46 . 2008-08-22 21:35 -------- d-----w- c:\program files\MagicISO
2010-06-11 23:26 . 2008-08-24 03:58 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-06-11 08:04 . 2008-11-12 16:16 -------- d-----w- c:\program files\Reshade
2010-06-10 17:33 . 2010-06-10 17:33 153448 ----a-w- c:\windows\system32\drivers\bdfm.sys.upd
2010-06-10 17:33 . 2010-06-10 17:33 106464 ----a-w- c:\windows\system32\drivers\bdhv.sys.upd
2010-06-10 17:33 . 2010-06-10 17:33 291352 ----a-w- c:\windows\system32\drivers\bdfsfltr.sys.upd
2010-06-10 14:24 . 2009-03-23 02:23 117760 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-06-10 02:57 . 2008-08-28 16:38 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-06-09 16:38 . 2009-01-26 16:04 -------- d-----w- c:\program files\HD Tune Pro
2010-05-31 15:18 . 2008-08-24 04:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2010-05-26 02:54 . 2009-01-23 22:51 -------- d-----w- c:\program files\McAfee
2010-05-22 13:30 . 2008-08-22 21:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-17 01:10 . 2010-01-09 22:28 -------- d-----w- c:\program files\RapidDownloader
2010-05-13 17:07 . 2010-05-13 17:07 16509622 ----a-w- c:\documents and settings\Administrator\Application Data\loaristrojanremover.exe
2010-05-13 17:07 . 2010-05-13 17:07 16509622 ----a-w- c:\documents and settings\Administrator\Application Data\loaristrojanremover.exe
2010-05-13 07:04 . 2008-08-26 20:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-29 19:39 . 2008-08-22 21:00 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 19:39 . 2008-08-22 21:00 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-25 03:44 . 2009-12-28 03:35 -------- d-----w- c:\documents and settings\Administrator\Application Data\GameHouse
2010-04-03 21:45 . 2010-04-03 21:45 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe
2010-03-25 20:35 . 2008-08-27 00:23 117640 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-19 20:22 . 2010-03-19 20:22 696832 ----a-w- c:\windows\is-OIGL0.exe
2010-03-16 21:50 . 2010-03-16 21:50 74692 ---ha-w- c:\windows\system32\mlfcache.dat
2009-09-21 14:48 . 2009-09-21 14:48 7741336 ----a-w- c:\program files\DivX521XP2K_1.exe
2009-09-20 20:15 . 2009-09-20 20:15 6431010 ----a-w- c:\program files\iPodVideoConverter.exe
2009-09-19 03:10 . 2009-09-19 03:10 10780566 ----a-w- c:\program files\videora-ipod-500-setup.exe
2009-09-15 23:53 . 2009-09-15 08:18 3866624 ----a-w- c:\program files\ZumasRevenge.exe
2009-09-14 18:18 . 2009-09-15 08:18 106476815 ----a-w- c:\program files\main.pak
2009-09-14 18:18 . 2009-09-15 08:18 98872 ----a-w- c:\program files\bass.dll
2009-09-14 18:18 . 2009-09-15 08:18 9661 ----a-w- c:\program files\eula.txt
2009-09-14 18:18 . 2009-09-15 08:18 94208 ----a-w- c:\program files\j2k-codec.dll
2009-09-14 18:18 . 2009-09-15 08:18 7066 ----a-w- c:\program files\compat.cfg
2009-09-14 18:18 . 2009-09-15 08:18 640000 ----a-w- c:\program files\dbghelp.dll
2008-08-22 23:38 . 2008-08-22 23:28 133227519 ----a-w- c:\program files\OOo_2.4.1_Win32Intel_install_wJRE_en-US.exe
2008-08-22 23:01 . 2008-08-22 23:00 18895728 ----a-w- c:\program files\Install_Messenger.exe
2009-10-19 22:59 . 2010-06-10 17:24 47104 ----a-w- c:\program files\mozilla firefox\components\FFComm.dll
.

((((((((((((((((((((((((((((( SnapShot_2010-06-13_14.40.45 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-22 23:07 . 2005-11-04 22:05 90112 c:\windows\tsnpstd3.exe
+ 2010-06-14 12:37 . 2010-06-14 12:37 16384 c:\windows\Temp\Perflib_Perfdata_528.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Eraser"="c:\program files\Eraser\Eraser.exe" [2007-12-22 916240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-02-10 155648]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2010\IEShow.exe" [2009-10-19 71152]
"BDAgent"="c:\program files\BitDefender\BitDefender 2010\bdagent.exe" [2009-10-23 1118144]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-02-28 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\documents and settings\All Users\Application Data\Visual Styler\Logon Screens\logonui.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 23:28 352256 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\ITUNES\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"20999:TCP"= 20999:TCP:spport
"20601:TCP"= 20601:TCP:spport
"15519:TCP"= 15519:TCP:spport
"16289:TCP"= 16289:TCP:spport
"6942:TCP"= 6942:TCP:spport
"20022:TCP"= 20022:TCP:spport

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [20/08/2008 2:34 AM 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [20/08/2008 2:34 AM 55024]
R2 ALThemeHelper;AusLogics Windows Themes Helper;c:\program files\AusLogics Visual Styler\themehelpersvc.exe [27/09/2008 10:13 PM 116336]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [01/05/2009 2:35 PM 181544]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [23/01/2009 6:53 PM 93320]
R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [10/11/2009 5:04 PM 152456]
S1 StarPortLite;StarPort Storage Controller (Lite);c:\windows\system32\DRIVERS\StarPortLite.sys --> c:\windows\system32\DRIVERS\StarPortLite.sys [?]
S2 0230321274842472mcinstcleanup;McAfee Application Installer Cleanup (0230321274842472);c:\windows\TEMP\023032~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service --> c:\windows\TEMP\023032~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
S2 0324051232751199mcinstcleanup;0324051232751199mcinstcleanup; [x]
S2 USBHSB;GeneLink File Transfer Driver;c:\windows\system32\Drivers\usbhsb.sys --> c:\windows\system32\Drivers\usbhsb.sys [?]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe [19/10/2009 4:06 PM 183880]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [20/08/2008 2:34 AM 7408]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [22/08/2008 4:22 PM 717296]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
bdx REG_MULTI_SZ scan
.
Contents of the 'Scheduled Tasks' folder

2010-06-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
IE: Add to AMV Convert Tool... - c:\program files\MP3 Player Utilities 3.81\AMVConverter\grab.html
IE: Add to Media Manager... - c:\program files\MP3 Player Utilities 3.81\MediaManager\grab.html
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\cs19zxyc.default\
FF - prefs.js: browser.startup.homepage - chrome://speeddial/content/speeddial.xul
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPAskSBr.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program files\VLC\npvlc.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-14 15:00
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-682003330-1336601894-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b7,22,2f,bb,df,ea,cc,41,90,54,55,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b7,22,2f,bb,df,ea,cc,41,90,54,55,\

[HKEY_USERS\S-1-5-21-682003330-1336601894-725345543-500\Software\SecuROM\License information*]
"datasecu"=hex:f5,19,ff,66,3a,32,fe,b8,d9,df,39,9a,5c,9b,f4,25,a7,d6,5c,79,53,
e6,b7,de,e1,ec,e8,cd,36,4a,25,0f,f7,81,6f,18,9a,bd,46,d6,b5,c4,b5,80,4b,83,\
"rkeysecu"=hex:9f,ca,16,75,83,0a,d6,fd,d2,a5,ab,cb,c1,0d,12,f7
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(720)
c:\program files\AusLogics Visual Styler\ThemeHelper.dll
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll

- - - - - - - > 'lsass.exe'(776)
c:\program files\AusLogics Visual Styler\ThemeHelper.dll

- - - - - - - > 'csrss.exe'(696)
c:\program files\AusLogics Visual Styler\ThemeHelper.dll
.
Completion time: 2010-06-14 15:04:53
ComboFix-quarantined-files.txt 2010-06-14 19:04
ComboFix2.txt 2010-06-13 14:45
ComboFix3.txt 2009-05-15 15:23

Pre-Run: 22,197,989,376 bytes free
Post-Run: 22,180,052,992 bytes free

- - End Of File - - 6411A9C5538AC7A17FDA9B0F4F98E21C
fullbug
Regular Member
 
Posts: 31
Joined: June 10th, 2010, 7:51 am

Re: Stubborn Malware

Unread postby fullbug » June 15th, 2010, 7:30 am

ETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=76dbf3fe2470434b9590c7ac19b0eb39
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-06-15 04:15:02
# local_time=2010-06-15 12:15:02 (-0500, Eastern Daylight Time)
# country="Canada"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=137036
# found=5
# cleaned=0
# scan_time=7060
C:\Documents and Settings\Administrator\Desktop\Assorted Shortcuts\keymaker.exe probably a variant of Win32/Agent trojan 00000000000000000000000000000000 I
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinAgentsvc.zip Win32/Bagle.gen.zip worm 00000000000000000000000000000000 I
C:\Program Files\AusLogics Visual Styler\themehelpersvc.exe probably a variant of Win32/Agent trojan 00000000000000000000000000000000 I
C:\Program Files\Unlocker\eBay_shortcuts_1016.exe a variant of Win32/Adware.ADON application 00000000000000000000000000000000 I
${Memory} probably a variant of Win32/Agent trojan 00000000000000000000000000000000 I
fullbug
Regular Member
 
Posts: 31
Joined: June 10th, 2010, 7:51 am

Re: Stubborn Malware

Unread postby melboy » June 15th, 2010, 7:52 am

Hi

Good - nearly done.

One question, are you familiar with these open ports in your firewall?

Code: Select all
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"20999:TCP"= 20999:TCP:spport
"20601:TCP"= 20601:TCP:spport
"15519:TCP"= 15519:TCP:spport
"16289:TCP"= 16289:TCP:spport
"6942:TCP"= 6942:TCP:spport
"20022:TCP"= 20022:TCP:spport
User avatar
melboy
MRU Expert
MRU Expert
 
Posts: 3670
Joined: July 25th, 2008, 4:25 pm
Location: UK

Re: Stubborn Malware

Unread postby fullbug » June 15th, 2010, 1:29 pm

No, wasnt aware of them....Would there be a good reason for them being open?
fullbug
Regular Member
 
Posts: 31
Joined: June 10th, 2010, 7:51 am

Re: Stubborn Malware

Unread postby melboy » June 15th, 2010, 1:59 pm

Hi

I can't see anything currently on your PC that would require them to be open - we'll close them up.

How are things running?


COMBOFIX-Script
A word of warning: Please do not run ComboFix on your own. This tool is not a toy and not for everyday use.


  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    Code: Select all
    File:: 
    C:\Documents and Settings\Administrator\Desktop\Assorted Shortcuts\keymaker.exe
    C:\Program Files\Unlocker\eBay_shortcuts_1016.exe
    
    Registry:: 
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "20999:TCP"=-
    "20601:TCP"=-
    "15519:TCP"=-
    "16289:TCP"=-
    "6942:TCP"=-
    "20022:TCP"=-
    
    

  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    Image
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • If you need help to disable your protection programs see here.
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
User avatar
melboy
MRU Expert
MRU Expert
 
Posts: 3670
Joined: July 25th, 2008, 4:25 pm
Location: UK

Re: Stubborn Malware

Unread postby fullbug » June 16th, 2010, 9:56 am

The computer seems to be running OK, although for some reason I have to reboot everytime I want to launch 'notepad'....

ComboFix 10-06-12.03 - Administrator 16/06/2010 9:38.4.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.510.171 [GMT -4:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
AV: BitDefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}

FILE ::
"c:\documents and settings\Administrator\Desktop\Assorted Shortcuts\keymaker.exe"
"c:\program files\Unlocker\eBay_shortcuts_1016.exe"
.
The following files were disabled during the run:
c:\program files\AusLogics Visual Styler\ThemeHelper.dll


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Administrator\Desktop\Assorted Shortcuts\keymaker.exe
c:\program files\Unlocker\eBay_shortcuts_1016.exe
H:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2010-05-16 to 2010-06-16 )))))))))))))))))))))))))))))))
.

2010-06-15 02:12 . 2010-06-15 02:12 -------- d-----w- c:\program files\ESET
2010-06-14 12:18 . 2010-05-06 10:41 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-06-13 14:10 . 2010-06-13 14:09 388608 ----a-w- c:\windows\system32\CF23854.exe
2010-06-13 13:46 . 2010-06-13 13:46 -------- d-----w- C:\_OTL
2010-06-10 18:48 . 2010-06-11 13:07 -------- d-----w- c:\program files\Tibor - Tale of a Kind Vampire
2010-06-10 18:15 . 2010-06-10 18:15 0 ----a-w- C:\pcwords2.dat
2010-06-10 18:15 . 2010-06-10 18:15 0 ----a-w- C:\pcwords.dat
2010-06-10 17:16 . 2010-06-10 17:17 -------- d-----w- c:\documents and settings\Administrator\Application Data\BitDefender
2010-06-10 12:11 . 2010-06-10 12:11 388096 ----a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-06-10 12:11 . 2010-06-10 12:11 -------- d-----w- c:\program files\Trend Micro
2010-06-10 02:43 . 2010-06-10 02:43 -------- d-----w- c:\program files\Tibor The Vampire Platform Game
2010-06-09 15:39 . 2009-01-23 21:22 2929528 ----a-w- c:\documents and settings\Administrator\Application Data\Simply Super Software\Trojan Remover\kfdA.exe
2010-06-02 21:51 . 2010-06-02 21:51 -------- d-----w- c:\windows\system32\wbem\Repository
2010-06-02 21:51 . 2010-06-02 21:51 -------- d-----w- c:\documents and settings\Administrator\Application Data\Gmail Notifier
2010-06-02 21:51 . 2010-06-02 21:51 -------- d-----w- c:\program files\Gmail Notifier
2010-05-31 23:53 . 2010-06-13 14:22 132 ----a-w- c:\windows\system32\rezumatenoi.dat
2010-05-31 23:29 . 2010-06-10 17:16 -------- d-----w- c:\documents and settings\All Users\Application Data\BitDefender
2010-05-31 23:29 . 2010-05-31 23:29 -------- d-----w- c:\program files\BitDefender
2010-05-31 23:27 . 2010-06-10 17:12 -------- d-----w- c:\program files\Common Files\BitDefender
2010-05-25 17:28 . 2010-05-25 17:28 348160 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-62e9256d-n\msvcr71.dll
2010-05-25 17:28 . 2010-05-25 17:28 503808 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-62e9256d-n\msvcp71.dll
2010-05-25 17:28 . 2010-05-25 17:28 499712 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-62e9256d-n\jmc.dll
2010-05-25 17:28 . 2010-05-25 17:28 61440 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-24c22a0e-n\decora-sse.dll
2010-05-25 17:28 . 2010-05-25 17:28 12800 ----a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-24c22a0e-n\decora-d3d.dll
2010-05-22 13:35 . 2010-05-22 13:35 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2010-05-21 14:18 . 2010-05-21 14:18 -------- d-----w- c:\program files\Loaris
2010-05-20 02:15 . 2010-05-20 02:15 711168 ----a-w- c:\windows\is-DOGNN.exe
2010-05-19 17:30 . 2010-05-19 17:30 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\SnakyJake
2010-05-19 17:25 . 2010-05-19 17:25 -------- d-----w- c:\program files\BFG
2010-05-19 17:20 . 2010-05-19 17:20 -------- d-----w- c:\program files\Sean's Stuff

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-16 13:46 . 2008-08-23 03:39 -------- d-----w- c:\program files\Unlocker
2010-06-16 13:36 . 2008-09-28 02:13 -------- d-----w- c:\program files\AusLogics Visual Styler
2010-06-15 08:23 . 2008-08-26 20:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-06-14 18:51 . 2010-04-03 21:57 -------- d-----w- c:\program files\QuickTime
2010-06-14 18:51 . 2008-12-16 02:29 -------- d-----w- c:\program files\Microsoft IntelliPoint
2010-06-14 18:51 . 2008-08-23 03:34 -------- d-----w- c:\program files\ClipX
2010-06-14 18:51 . 2008-08-22 21:56 -------- d-----w- c:\program files\KillProcess
2010-06-13 21:44 . 2010-03-03 15:05 1 ----a-w- c:\documents and settings\Administrator\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-06-13 12:08 . 2008-08-22 20:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-06-13 11:46 . 2008-08-22 21:35 -------- d-----w- c:\program files\MagicISO
2010-06-11 23:26 . 2008-08-24 03:58 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-06-11 08:04 . 2008-11-12 16:16 -------- d-----w- c:\program files\Reshade
2010-06-10 17:33 . 2010-06-10 17:33 153448 ----a-w- c:\windows\system32\drivers\bdfm.sys.upd
2010-06-10 17:33 . 2010-06-10 17:33 106464 ----a-w- c:\windows\system32\drivers\bdhv.sys.upd
2010-06-10 17:33 . 2010-06-10 17:33 291352 ----a-w- c:\windows\system32\drivers\bdfsfltr.sys.upd
2010-06-10 14:24 . 2009-03-23 02:23 117760 ----a-w- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-06-10 02:57 . 2008-08-28 16:38 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-06-09 16:38 . 2010-05-17 01:52 -------- d-----w- c:\program files\Pizza Chef 2
2010-06-09 16:38 . 2009-01-26 16:04 -------- d-----w- c:\program files\HD Tune Pro
2010-05-31 15:18 . 2008-08-24 04:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2010-05-26 02:54 . 2009-01-23 22:51 -------- d-----w- c:\program files\McAfee
2010-05-22 13:30 . 2008-08-22 21:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-17 01:10 . 2010-01-09 22:28 -------- d-----w- c:\program files\RapidDownloader
2010-05-16 23:44 . 2010-05-16 22:24 -------- d-----w- c:\program files\Vitys Rapid Downloader
2010-05-13 17:07 . 2010-05-13 17:07 16509622 ----a-w- c:\documents and settings\Administrator\Application Data\loaristrojanremover.exe
2010-05-13 17:07 . 2010-05-13 17:07 16509622 ----a-w- c:\documents and settings\Administrator\Application Data\loaristrojanremover.exe
2010-05-06 10:41 . 2006-02-28 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-02 05:56 . 2006-02-28 12:00 1850880 ----a-w- c:\windows\system32\win32k.sys
2010-04-29 19:39 . 2008-08-22 21:00 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 19:39 . 2008-08-22 21:00 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-25 03:44 . 2009-12-28 03:35 -------- d-----w- c:\documents and settings\Administrator\Application Data\GameHouse
2010-04-20 05:51 . 2006-02-28 12:00 285696 ----a-w- c:\windows\system32\atmfd.dll
2010-04-03 21:45 . 2010-04-03 21:45 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe
2010-03-25 20:35 . 2008-08-27 00:23 117640 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-19 20:22 . 2010-03-19 20:22 696832 ----a-w- c:\windows\is-OIGL0.exe
2009-09-21 14:48 . 2009-09-21 14:48 7741336 ----a-w- c:\program files\DivX521XP2K_1.exe
2009-09-20 20:15 . 2009-09-20 20:15 6431010 ----a-w- c:\program files\iPodVideoConverter.exe
2009-09-19 03:10 . 2009-09-19 03:10 10780566 ----a-w- c:\program files\videora-ipod-500-setup.exe
2009-09-15 23:53 . 2009-09-15 08:18 3866624 ----a-w- c:\program files\ZumasRevenge.exe
2009-09-14 18:18 . 2009-09-15 08:18 106476815 ----a-w- c:\program files\main.pak
2009-09-14 18:18 . 2009-09-15 08:18 98872 ----a-w- c:\program files\bass.dll
2009-09-14 18:18 . 2009-09-15 08:18 9661 ----a-w- c:\program files\eula.txt
2009-09-14 18:18 . 2009-09-15 08:18 94208 ----a-w- c:\program files\j2k-codec.dll
2009-09-14 18:18 . 2009-09-15 08:18 7066 ----a-w- c:\program files\compat.cfg
2009-09-14 18:18 . 2009-09-15 08:18 640000 ----a-w- c:\program files\dbghelp.dll
2008-08-22 23:38 . 2008-08-22 23:28 133227519 ----a-w- c:\program files\OOo_2.4.1_Win32Intel_install_wJRE_en-US.exe
2008-08-22 23:01 . 2008-08-22 23:00 18895728 ----a-w- c:\program files\Install_Messenger.exe
2009-10-19 22:59 . 2010-06-10 17:24 47104 ----a-w- c:\program files\mozilla firefox\components\FFComm.dll
.

((((((((((((((((((((((((((((( SnapShot_2010-06-13_14.40.45 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-22 23:07 . 2005-11-04 22:05 90112 c:\windows\tsnpstd3.exe
+ 2010-06-16 13:28 . 2010-06-16 13:28 16384 c:\windows\Temp\Perflib_Perfdata_494.dat
- 2006-02-28 12:00 . 2010-03-14 16:48 68156 c:\windows\system32\perfc009.dat
+ 2006-02-28 12:00 . 2010-06-15 07:30 68156 c:\windows\system32\perfc009.dat
- 2007-08-14 01:54 . 2010-02-25 06:24 55296 c:\windows\system32\msfeedsbs.dll
+ 2007-08-14 01:54 . 2010-05-06 10:41 55296 c:\windows\system32\msfeedsbs.dll
+ 2006-02-28 12:00 . 2010-05-06 10:41 25600 c:\windows\system32\jsproxy.dll
- 2006-02-28 12:00 . 2010-02-25 06:24 25600 c:\windows\system32\jsproxy.dll
- 2009-07-16 16:06 . 2010-02-25 06:24 12800 c:\windows\system32\dllcache\xpshims.dll
+ 2009-07-16 16:06 . 2010-05-06 10:41 12800 c:\windows\system32\dllcache\xpshims.dll
+ 2008-09-24 19:04 . 2010-05-06 10:41 55296 c:\windows\system32\dllcache\msfeedsbs.dll
- 2008-09-24 19:04 . 2010-02-25 06:24 55296 c:\windows\system32\dllcache\msfeedsbs.dll
- 2006-02-28 12:00 . 2010-02-25 06:24 25600 c:\windows\system32\dllcache\jsproxy.dll
+ 2006-02-28 12:00 . 2010-05-06 10:41 25600 c:\windows\system32\dllcache\jsproxy.dll
+ 2006-02-28 12:00 . 2010-03-05 14:57 65536 c:\windows\system32\dllcache\asycfilt.dll
+ 2006-02-28 12:00 . 2010-03-05 14:57 65536 c:\windows\system32\asycfilt.dll
- 2008-07-29 23:16 . 2008-07-29 23:16 32768 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.WasHosting.dll
+ 2010-04-08 03:48 . 2010-04-08 03:48 32768 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.WasHosting.dll
+ 2010-03-23 09:31 . 2010-03-23 09:31 30544 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
+ 2008-08-26 21:05 . 2010-06-15 08:23 35088 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
- 2008-08-26 21:05 . 2010-05-13 07:04 35088 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
- 2008-08-26 21:04 . 2010-05-13 07:04 18704 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
+ 2008-08-26 21:04 . 2010-06-15 08:23 18704 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
- 2008-08-26 21:04 . 2010-05-13 07:04 20240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
+ 2008-08-26 21:04 . 2010-06-15 08:23 20240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
+ 2010-06-15 08:11 . 2010-02-25 06:24 12800 c:\windows\ie8updates\KB982381-IE8\xpshims.dll
+ 2010-06-15 08:11 . 2010-02-25 06:24 55296 c:\windows\ie8updates\KB982381-IE8\msfeedsbs.dll
+ 2010-06-15 08:11 . 2010-02-25 06:24 25600 c:\windows\ie8updates\KB982381-IE8\jsproxy.dll
+ 2010-06-15 08:08 . 2010-06-15 08:08 37888 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\1c1629f536fa9874ef08d09fb19ab0f0\System.Windows.Presentation.ni.dll
+ 2010-06-15 08:07 . 2010-06-15 08:07 36864 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\1464c662c302ea6372a885161b983732\System.Web.DynamicData.Design.ni.dll
+ 2010-06-15 07:53 . 2010-06-15 07:53 94208 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\5d535ecadf77ac2d9278a1661beb2855\System.ComponentModel.DataAnnotations.ni.dll
+ 2010-06-15 07:34 . 2010-06-15 07:34 47104 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\e67992626a30603458b0df22841c2423\PresentationFontCache.ni.exe
+ 2010-06-15 07:32 . 2010-06-15 07:32 39424 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\6be27d744e6e2bfc4b0e25bd2998ef7c\PresentationCFFRasterizer.ni.dll
+ 2010-06-15 08:00 . 2010-06-15 08:00 55296 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\4a52287444c36c89310856b38ff52fe0\Microsoft.Vsa.ni.dll
+ 2010-06-15 07:27 . 2010-06-15 07:27 77824 c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
- 2009-10-15 07:21 . 2009-10-15 07:21 77824 c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2010-06-15 07:32 . 2010-06-15 07:32 32768 c:\windows\assembly\GAC_MSIL\System.ServiceModel.WasHosting\3.0.0.0__b77a5c561934e089\System.ServiceModel.WasHosting.dll
- 2009-08-08 07:17 . 2009-08-08 07:17 32768 c:\windows\assembly\GAC_MSIL\System.ServiceModel.WasHosting\3.0.0.0__b77a5c561934e089\System.ServiceModel.WasHosting.dll
+ 2010-06-15 07:27 . 2010-06-15 07:27 81920 c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
- 2009-10-15 07:21 . 2009-10-15 07:21 81920 c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 81920 c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 81920 c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 32768 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 32768 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 12800 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 12800 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 77824 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 77824 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 77824 c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 77824 c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
- 2009-10-15 07:21 . 2009-10-15 07:21 13312 c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2010-06-15 07:27 . 2010-06-15 07:27 13312 c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
- 2009-10-15 07:21 . 2009-10-15 07:21 10752 c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 10752 c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 72192 c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 72192 c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 69120 c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
- 2009-10-15 07:21 . 2009-10-15 07:21 69120 c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 8192 c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 8192 c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 7168 c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 7168 c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 5632 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
- 2009-10-15 07:22 . 2009-10-15 07:22 5632 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 6656 c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 6656 c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 8192 c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 8192 c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 113664 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 113664 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 258048 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 258048 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
- 2006-02-28 12:00 . 2010-03-14 16:48 435260 c:\windows\system32\perfh009.dat
+ 2006-02-28 12:00 . 2010-06-15 07:30 435260 c:\windows\system32\perfh009.dat
+ 2006-02-28 12:00 . 2010-05-06 10:41 206848 c:\windows\system32\occache.dll
- 2006-02-28 12:00 . 2010-02-25 06:24 206848 c:\windows\system32\occache.dll
+ 2006-02-28 12:00 . 2010-05-06 10:41 611840 c:\windows\system32\mstime.dll
- 2006-02-28 12:00 . 2010-02-25 06:24 611840 c:\windows\system32\mstime.dll
+ 2007-08-14 01:54 . 2010-05-06 10:41 599040 c:\windows\system32\msfeeds.dll
- 2006-02-28 12:00 . 2010-02-25 06:24 184320 c:\windows\system32\iepeers.dll
+ 2006-02-28 12:00 . 2010-05-06 10:41 184320 c:\windows\system32\iepeers.dll
- 2006-02-28 12:00 . 2010-02-25 06:24 387584 c:\windows\system32\iedkcs32.dll
+ 2006-02-28 12:00 . 2010-05-06 10:41 387584 c:\windows\system32\iedkcs32.dll
+ 2006-02-28 12:00 . 2010-05-05 13:30 173056 c:\windows\system32\ie4uinit.exe
- 2006-02-28 12:00 . 2010-02-24 09:54 173056 c:\windows\system32\ie4uinit.exe
+ 2008-08-22 11:38 . 2010-06-15 08:43 333072 c:\windows\system32\FNTCACHE.DAT
- 2008-08-22 11:38 . 2010-03-27 22:18 333072 c:\windows\system32\FNTCACHE.DAT
- 2006-02-28 12:00 . 2010-02-25 06:24 916480 c:\windows\system32\dllcache\wininet.dll
+ 2006-02-28 12:00 . 2010-05-06 10:41 916480 c:\windows\system32\dllcache\wininet.dll
+ 2006-02-28 12:00 . 2010-05-06 10:41 206848 c:\windows\system32\dllcache\occache.dll
- 2006-02-28 12:00 . 2010-02-25 06:24 206848 c:\windows\system32\dllcache\occache.dll
- 2006-02-28 12:00 . 2010-02-25 06:24 611840 c:\windows\system32\dllcache\mstime.dll
+ 2006-02-28 12:00 . 2010-05-06 10:41 611840 c:\windows\system32\dllcache\mstime.dll
+ 2008-09-24 19:04 . 2010-05-06 10:41 599040 c:\windows\system32\dllcache\msfeeds.dll
- 2009-07-16 16:06 . 2010-02-25 06:24 247808 c:\windows\system32\dllcache\ieproxy.dll
+ 2009-07-16 16:06 . 2010-05-06 10:41 247808 c:\windows\system32\dllcache\ieproxy.dll
- 2006-02-28 12:00 . 2010-02-25 06:24 184320 c:\windows\system32\dllcache\iepeers.dll
+ 2006-02-28 12:00 . 2010-05-06 10:41 184320 c:\windows\system32\dllcache\iepeers.dll
- 2006-02-28 12:00 . 2010-02-25 06:24 387584 c:\windows\system32\dllcache\iedkcs32.dll
+ 2006-02-28 12:00 . 2010-05-06 10:41 387584 c:\windows\system32\dllcache\iedkcs32.dll
+ 2006-02-28 12:00 . 2010-05-05 13:30 173056 c:\windows\system32\dllcache\ie4uinit.exe
- 2006-02-28 12:00 . 2010-02-24 09:54 173056 c:\windows\system32\dllcache\ie4uinit.exe
- 2006-02-28 12:00 . 2006-02-28 12:00 285696 c:\windows\system32\dllcache\atmfd.dll
+ 2006-02-28 12:00 . 2010-04-20 05:51 285696 c:\windows\system32\dllcache\atmfd.dll
+ 2010-04-08 03:48 . 2010-04-08 03:48 970752 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.Runtime.Serialization.dll
- 2008-07-29 23:16 . 2008-07-29 23:16 110592 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMdiagnostics.dll
+ 2010-04-08 03:48 . 2010-04-08 03:48 110592 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMdiagnostics.dll
+ 2010-03-23 09:31 . 2010-03-23 09:31 435024 c:\windows\Microsoft.NET\Framework\v2.0.50727\webengine.dll
+ 2010-02-09 16:22 . 2010-02-09 16:22 258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Security.dll
- 2008-07-25 15:17 . 2008-07-25 15:17 258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Security.dll
+ 2010-02-25 04:14 . 2010-02-25 04:14 543232 c:\windows\Installer\3f72cd6.msp
- 2008-08-26 21:04 . 2010-05-13 07:04 888080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
+ 2008-08-26 21:04 . 2010-06-15 08:23 888080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
+ 2008-08-26 21:04 . 2010-06-15 08:23 272648 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
- 2008-08-26 21:04 . 2010-05-13 07:04 272648 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
- 2008-08-26 21:04 . 2010-05-13 07:04 922384 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
+ 2008-08-26 21:04 . 2010-06-15 08:23 922384 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
- 2008-08-26 21:04 . 2010-05-13 07:04 845584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
+ 2008-08-26 21:04 . 2010-06-15 08:23 845584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
+ 2008-08-26 21:04 . 2010-06-15 08:23 217864 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
- 2008-08-26 21:04 . 2010-05-13 07:04 217864 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
- 2008-08-26 21:04 . 2010-05-13 07:04 184080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
+ 2008-08-26 21:04 . 2010-06-15 08:23 184080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
+ 2008-08-26 21:04 . 2010-06-15 08:23 159504 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
- 2008-08-26 21:04 . 2010-05-13 07:04 159504 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
+ 2009-03-06 08:26 . 2009-03-06 08:26 770464 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6425\REGFORM.EXE
+ 2008-10-25 13:27 . 2008-10-25 13:27 177040 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6425\IPOLK.DLL
+ 2010-06-15 08:11 . 2010-02-25 06:24 916480 c:\windows\ie8updates\KB982381-IE8\wininet.dll
+ 2010-06-15 08:11 . 2010-02-22 14:23 382840 c:\windows\ie8updates\KB982381-IE8\spuninst\updspapi.dll
+ 2010-06-15 08:11 . 2008-07-08 13:02 231288 c:\windows\ie8updates\KB982381-IE8\spuninst\spuninst.exe
+ 2010-06-15 08:11 . 2010-02-25 06:24 206848 c:\windows\ie8updates\KB982381-IE8\occache.dll
+ 2010-06-15 08:11 . 2010-02-25 06:24 611840 c:\windows\ie8updates\KB982381-IE8\mstime.dll
+ 2010-06-15 08:11 . 2010-02-25 06:24 594432 c:\windows\ie8updates\KB982381-IE8\msfeeds.dll
+ 2010-06-15 08:11 . 2010-02-25 06:24 247808 c:\windows\ie8updates\KB982381-IE8\ieproxy.dll
+ 2010-06-15 08:11 . 2010-02-25 06:24 184320 c:\windows\ie8updates\KB982381-IE8\iepeers.dll
+ 2010-06-15 08:11 . 2009-03-08 08:35 742912 c:\windows\ie8updates\KB982381-IE8\iedvtool.dll
+ 2010-06-15 08:11 . 2010-02-25 06:24 387584 c:\windows\ie8updates\KB982381-IE8\iedkcs32.dll
+ 2010-06-15 08:11 . 2010-02-24 09:54 173056 c:\windows\ie8updates\KB982381-IE8\ie4uinit.exe
+ 2010-06-15 07:47 . 2010-06-15 07:47 321536 c:\windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\4d07b1ccecca66f320c1a0971dd614d1\WsatConfig.ni.exe
+ 2010-06-15 07:41 . 2010-06-15 07:41 240128 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\a7c702f75d47bf841b9587e582c2d0b2\WindowsFormsIntegration.ni.dll
+ 2010-06-15 07:40 . 2010-06-15 07:40 447488 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\3a78043c85333d5af49a0d958912ae4a\UIAutomationClient.ni.dll
+ 2010-06-15 08:10 . 2010-06-15 08:10 400896 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\747e84d81d1de2041661f0f71b04734a\System.Xml.Linq.ni.dll
+ 2010-06-15 08:06 . 2010-06-15 08:06 129536 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\d51dfbd8d5431eb89181baaa24863e15\System.Web.Routing.ni.dll
+ 2010-06-15 08:07 . 2010-06-15 08:07 202240 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\436dde9611932489da3dc8a1be170843\System.Web.RegularExpressions.ni.dll
+ 2010-06-15 08:07 . 2010-06-15 08:07 859648 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\e8ef769b3e899e62b26daadee50b97ed\System.Web.Extensions.Design.ni.dll
+ 2010-06-15 08:07 . 2010-06-15 08:07 328704 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\ce3b446b7bee5c47949c994ec89b1649\System.Web.Entity.ni.dll
+ 2010-06-15 08:07 . 2010-06-15 08:07 301056 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\ad04fe1182e55e7c01066b62a4bee6b5\System.Web.Entity.Design.ni.dll
+ 2010-06-15 08:07 . 2010-06-15 08:07 547328 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\20ba0d4d182a1a9c1f54c00d3bc29a68\System.Web.DynamicData.ni.dll
+ 2010-06-15 08:06 . 2010-06-15 08:06 141312 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\c97ecf9250c2f0794262534f27f98b72\System.Web.Abstractions.ni.dll
+ 2010-06-15 08:02 . 2010-06-15 08:02 627200 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\9c56656c88979cf18de6cbcb6587ba8f\System.Transactions.ni.dll
+ 2010-06-15 08:02 . 2010-06-15 08:02 212992 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\5adb0f89d469632511aed9d88cfe05c4\System.ServiceProcess.ni.dll
+ 2010-06-15 07:50 . 2010-06-15 07:50 679936 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\42b2ffb594dbd5652a576a0dce28722c\System.Security.ni.dll
+ 2010-06-15 08:00 . 2010-06-15 08:00 311296 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\3231473e2ec4451c8f218930fda80d19\System.Runtime.Serialization.Formatters.Soap.ni.dll
+ 2010-06-15 08:00 . 2010-06-15 08:00 621056 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Net\f90965b9d9a6a6604c9a66f57c37c026\System.Net.ni.dll
+ 2010-06-15 08:00 . 2010-06-15 08:00 998400 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\16670b6870746e5a8dc4a73a76a90bed\System.Management.ni.dll
+ 2010-06-15 08:00 . 2010-06-15 08:00 330752 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\e6bd59fec415e273c173170c6508180a\System.Management.Instrumentation.ni.dll
+ 2010-06-15 07:44 . 2010-06-15 07:44 381440 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IO.Log\e3eb86170cba4c80e6e22ca33c63c218\System.IO.Log.ni.dll
+ 2010-06-15 07:48 . 2010-06-15 07:48 212992 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\cfa48936affc9a5fb89f0bf66cc52a47\System.IdentityModel.Selectors.ni.dll
+ 2010-06-15 07:59 . 2010-06-15 07:59 280064 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\e9edc5cd12ebb513b4a3c53cb4640771\System.EnterpriseServices.Wrapper.dll
+ 2010-06-15 07:59 . 2010-06-15 07:59 627712 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\e9edc5cd12ebb513b4a3c53cb4640771\System.EnterpriseServices.ni.dll
+ 2010-06-15 07:38 . 2010-06-15 07:38 208384 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\aeba6820f20655dec7fe0fe05aaeb818\System.Drawing.Design.ni.dll
+ 2010-06-15 07:59 . 2010-06-15 07:59 455680 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\9ef70079beca3a9982a3aa76ebc0ddd8\System.DirectoryServices.Protocols.ni.dll
+ 2010-06-15 07:59 . 2010-06-15 07:59 881152 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\277619716d9136216065bea970365c65\System.DirectoryServices.AccountManagement.ni.dll
+ 2010-06-15 07:58 . 2010-06-15 07:58 939008 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\90b67e13866b176ae6cbdb23144f724d\System.Data.Services.Client.ni.dll
+ 2010-06-15 07:58 . 2010-06-15 07:58 354816 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\131a477d41a8669b15696128b94c2636\System.Data.Services.Design.ni.dll
+ 2010-06-15 07:55 . 2010-06-15 07:55 756736 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\d4990681ce373d81a52b231ee4c4afea\System.Data.Entity.Design.ni.dll
+ 2010-06-15 07:53 . 2010-06-15 07:53 135680 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\9e9d66a3a0e16fceead505c25af569eb\System.Data.DataSetExtensions.ni.dll
+ 2010-06-15 07:49 . 2010-06-15 07:49 971264 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\631b3eba1ba5bd3c3f027f34011cadeb\System.Configuration.ni.dll
+ 2010-06-15 08:00 . 2010-06-15 08:00 141312 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\39e4f9a276fb12125d8a1444d8b65a84\System.Configuration.Install.ni.dll
+ 2010-06-15 07:53 . 2010-06-15 07:53 633856 c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn\849916c5cb3ff7763d15a3976766c2f6\System.AddIn.ni.dll
+ 2010-06-15 07:47 . 2010-06-15 07:47 366080 c:\windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\f38a426b90e6c526dcb2c435c7380450\SMSvcHost.ni.exe
+ 2010-06-15 07:47 . 2010-06-15 07:47 256000 c:\windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\6cabc7d1700c224e8b41ff2f96a3087c\SMDiagnostics.ni.dll
+ 2010-06-15 07:47 . 2010-06-15 07:47 320512 c:\windows\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\5c8f5ca36498f43980d64820d8186c8a\ServiceModelReg.ni.exe
+ 2010-06-15 07:35 . 2010-06-15 07:35 258048 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\ae733e4062edba3a33bb0a632bef66bf\PresentationFramework.Royale.ni.dll
+ 2010-06-15 07:35 . 2010-06-15 07:35 368128 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\3ffad524016f0aba7b11a8aa33301a65\PresentationFramework.Aero.ni.dll
+ 2010-06-15 07:35 . 2010-06-15 07:35 224768 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\201968d038a23a4688310fed1eeaddaa\PresentationFramework.Classic.ni.dll
+ 2010-06-15 07:35 . 2010-06-15 07:35 539648 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\1ead87ca8eb84c595c77c70e3b2df88d\PresentationFramework.Luna.ni.dll
+ 2010-06-15 07:48 . 2010-06-15 07:48 133632 c:\windows\assembly\NativeImages_v2.0.50727_32\MSBuild\7700963610c1af364aa934c3c824b7b4\MSBuild.ni.exe
+ 2010-06-15 07:47 . 2010-06-15 07:47 386560 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\c74d4c69c49992dfb23ba512081dc3de\Microsoft.Transactions.Bridge.Dtc.ni.dll
+ 2010-06-15 07:51 . 2010-06-15 07:51 144384 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\a6a9f24b1a8984eaafbabb1ee968e359\Microsoft.Build.Utilities.ni.dll
+ 2010-06-15 07:51 . 2010-06-15 07:51 175104 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\2fa81d363cb1496be2427d848a867409\Microsoft.Build.Utilities.v3.5.ni.dll
+ 2010-06-15 07:50 . 2010-06-15 07:50 839680 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\c4c360df9c1024ebc3f0de77f5cf8b1c\Microsoft.Build.Engine.ni.dll
+ 2010-06-15 07:50 . 2010-06-15 07:50 222720 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\c9386dcd89c2518a74115f3bfd861830\Microsoft.Build.Conversion.v3.5.ni.dll
+ 2010-06-15 07:46 . 2010-06-15 07:46 410112 c:\windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\abb62e3ed74c974f0282bc7ea5d3f1c1\ComSvcConfig.ni.exe
+ 2010-06-15 07:48 . 2010-06-15 07:48 842240 c:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\6d34f00b6a782d15bec70d6cdb00b5e8\AspNetMMCExt.ni.dll
- 2009-10-15 07:21 . 2009-10-15 07:21 839680 c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2010-06-15 07:27 . 2010-06-15 07:27 839680 c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
- 2009-10-15 07:21 . 2009-10-15 07:21 835584 c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2010-06-15 07:27 . 2010-06-15 07:27 835584 c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 114688 c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 114688 c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 258048 c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 258048 c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
+ 2010-06-15 07:32 . 2010-06-15 07:32 970752 c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 131072 c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 131072 c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 303104 c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 303104 c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 258048 c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 258048 c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 372736 c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 372736 c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2010-06-15 07:32 . 2010-06-15 07:32 438272 c:\windows\assembly\GAC_MSIL\System.IdentityModel\3.0.0.0__b77a5c561934e089\System.IdentityModel.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 626688 c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 626688 c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 401408 c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 401408 c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
- 2009-10-15 07:21 . 2009-10-15 07:21 188416 c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
+ 2010-06-15 07:27 . 2010-06-15 07:27 188416 c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 970752 c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 970752 c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 745472 c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 745472 c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 425984 c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 425984 c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 110592 c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 110592 c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
+ 2010-06-15 07:32 . 2010-06-15 07:32 110592 c:\windows\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\SMdiagnostics.dll
- 2009-08-08 07:16 . 2009-08-08 07:16 110592 c:\windows\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\SMdiagnostics.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 659456 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 659456 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 372736 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 372736 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 110592 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 110592 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 749568 c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 749568 c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 655360 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 655360 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 348160 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 348160 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
+ 2010-06-15 07:27 . 2010-06-15 07:27 507904 c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
- 2009-10-15 07:21 . 2009-10-15 07:21 507904 c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 261632 c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 261632 c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 113664 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 113664 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 258048 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 258048 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 486400 c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 486400 c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2006-02-28 12:00 . 2010-04-06 08:52 2462720 c:\windows\system32\WMVCore.dll
- 2006-02-28 12:00 . 2010-02-25 06:24 1209344 c:\windows\system32\urlmon.dll
+ 2006-02-28 12:00 . 2010-05-06 10:41 1209344 c:\windows\system32\urlmon.dll
+ 2006-02-28 12:00 . 2010-02-05 18:40 1291264 c:\windows\system32\quartz.dll
- 2006-02-28 12:00 . 2009-11-27 17:33 1291264 c:\windows\system32\quartz.dll
+ 2006-02-28 12:00 . 2010-05-06 10:41 5950976 c:\windows\system32\mshtml.dll
+ 2007-08-14 01:34 . 2010-05-06 10:41 1985536 c:\windows\system32\iertutil.dll
- 2007-08-14 01:34 . 2010-02-25 06:24 1985536 c:\windows\system32\iertutil.dll
+ 2006-02-28 12:00 . 2010-04-06 08:52 2462720 c:\windows\system32\dllcache\WMVCore.dll
+ 2006-02-28 12:00 . 2010-05-02 05:56 1850880 c:\windows\system32\dllcache\win32k.sys
- 2006-02-28 12:00 . 2010-02-25 06:24 1209344 c:\windows\system32\dllcache\urlmon.dll
+ 2006-02-28 12:00 . 2010-05-06 10:41 1209344 c:\windows\system32\dllcache\urlmon.dll
- 2006-02-28 12:00 . 2009-11-27 17:33 1291264 c:\windows\system32\dllcache\quartz.dll
+ 2006-02-28 12:00 . 2010-02-05 18:40 1291264 c:\windows\system32\dllcache\quartz.dll
+ 2006-02-28 12:00 . 2010-05-06 10:41 5950976 c:\windows\system32\dllcache\mshtml.dll
+ 2008-09-24 19:04 . 2010-05-06 10:41 1985536 c:\windows\system32\dllcache\iertutil.dll
- 2008-09-24 19:04 . 2010-02-25 06:24 1985536 c:\windows\system32\dllcache\iertutil.dll
+ 2010-04-08 03:48 . 2010-04-08 03:48 5967872 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.dll
+ 2010-03-23 09:32 . 2010-03-23 09:32 5242880 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
- 2008-11-25 08:59 . 2008-11-25 08:59 5242880 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
+ 2010-03-23 09:32 . 2010-03-23 09:32 3182592 c:\windows\Microsoft.NET\Framework\v2.0.50727\System.dll
+ 2010-04-24 21:08 . 2010-04-24 21:08 9129984 c:\windows\Installer\437be5a.msp
+ 2010-03-24 22:54 . 2010-03-24 22:54 3126272 c:\windows\Installer\437be42.msp
+ 2010-03-24 22:54 . 2010-03-24 22:54 2516992 c:\windows\Installer\437be41.msp
+ 2010-04-24 21:07 . 2010-04-24 21:07 4667392 c:\windows\Installer\437be25.msp
+ 2010-04-24 21:05 . 2010-04-24 21:05 4199424 c:\windows\Installer\3f72d38.msp
+ 2010-05-19 03:35 . 2010-05-19 03:35 5023744 c:\windows\Installer\3f72d21.msp
+ 2010-04-12 02:17 . 2010-04-12 02:17 2607104 c:\windows\Installer\3f72cfb.msp
+ 2010-04-12 02:17 . 2010-04-12 02:17 4210688 c:\windows\Installer\3f72cfa.msp
+ 2010-04-24 21:10 . 2010-04-24 21:10 8486400 c:\windows\Installer\3f72cc9.msp
+ 2008-08-26 21:04 . 2010-06-15 08:23 1172240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
- 2008-08-26 21:04 . 2010-05-13 07:04 1172240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
- 2008-08-26 21:04 . 2010-05-13 07:04 1165584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
+ 2008-08-26 21:04 . 2010-06-15 08:23 1165584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
+ 2009-03-06 08:26 . 2009-03-06 08:26 5466488 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6425\IPDESIGN.DLL
+ 2008-11-04 04:40 . 2008-11-04 04:40 1442160 c:\windows\Installer\$PatchCache$\Managed\00002109030000000000000000F01FEC\12.0.6425\INFOPATH.EXE
+ 2010-06-15 08:11 . 2010-02-25 06:24 1209344 c:\windows\ie8updates\KB982381-IE8\urlmon.dll
+ 2010-06-15 08:11 . 2010-02-25 06:24 5944832 c:\windows\ie8updates\KB982381-IE8\mshtml.dll
+ 2010-06-15 08:11 . 2010-02-25 06:24 1985536 c:\windows\ie8updates\KB982381-IE8\iertutil.dll
+ 2010-06-15 07:32 . 2010-06-15 07:32 3313664 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\f231461883859922a040002dddfb7b12\WindowsBase.ni.dll
+ 2010-06-15 07:40 . 2010-06-15 07:40 1049600 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\48b66876f72f472db62de48ae4369406\UIAutomationClientsideProviders.ni.dll
+ 2010-06-15 07:32 . 2010-06-15 07:32 7949824 c:\windows\assembly\NativeImages_v2.0.50727_32\System\37217abe2c5164e59aba251860f4c79e\System.ni.dll
+ 2010-06-15 07:40 . 2010-06-15 07:40 5450752 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\563a54b98adb70fae862974042298348\System.Xml.ni.dll
+ 2010-06-15 08:10 . 2010-06-15 08:10 1356288 c:\windows\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\016b75f60a18535c8d6b3e5d861ab559\System.WorkflowServices.ni.dll
+ 2010-06-15 08:09 . 2010-06-15 08:09 1908224 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\6dacae37d337004345518976fb57099e\System.Workflow.Runtime.ni.dll
+ 2010-06-15 08:09 . 2010-06-15 08:09 4514304 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\c7b832bbc5bb11c6c7f128c801ce90d7\System.Workflow.ComponentModel.ni.dll
+ 2010-06-15 08:08 . 2010-06-15 08:08 2992640 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\b9ea6ea910293cd6f13f765775867ebd\System.Workflow.Activities.ni.dll
+ 2010-06-15 08:08 . 2010-06-15 08:08 1840640 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\8ef8d556899a4a10b7f288a80925489f\System.Web.Services.ni.dll
+ 2010-06-15 08:07 . 2010-06-15 08:07 2209280 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\5dfda43f1991ee6ba345d62b2be4801c\System.Web.Mobile.ni.dll
+ 2010-06-15 08:07 . 2010-06-15 08:07 2403328 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\f08b3b8cdf548e3dfe61f342536175eb\System.Web.Extensions.ni.dll
+ 2010-06-15 07:38 . 2010-06-15 07:38 1917952 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Speech\2d6a5dbee4506bf643b853e41668afa3\System.Speech.ni.dll
+ 2010-06-15 08:01 . 2010-06-15 08:01 1706496 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\169fe0ad9d59982a2a6b89779c09885b\System.ServiceModel.Web.ni.dll
+ 2010-06-15 07:44 . 2010-06-15 07:44 2345472 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\8b2710a63ecd363315ef16b257588b95\System.Runtime.Serialization.ni.dll
+ 2010-06-15 07:38 . 2010-06-15 07:38 1035264 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Printing\161b423dc4e86e569af019e838d39de5\System.Printing.ni.dll
+ 2010-06-15 07:43 . 2010-06-15 07:43 1070080 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\ad4fb86064d7a1ebcb9ee997e7208ac1\System.IdentityModel.ni.dll
+ 2010-06-15 07:38 . 2010-06-15 07:38 1587200 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\f3440ea00eb3c40dc073b2fe03843638\System.Drawing.ni.dll
+ 2010-06-15 07:59 . 2010-06-15 07:59 1116672 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\7deab2494d53763cd83c567e71e0d8e0\System.DirectoryServices.ni.dll
+ 2010-06-15 07:59 . 2010-06-15 07:59 1801216 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\b81efadfee7702624b713c6d86f7e369\System.Deployment.ni.dll
+ 2010-06-15 07:36 . 2010-06-15 07:36 6616576 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\50130ef751b98a4a11bd4ab73af7cab5\System.Data.ni.dll
+ 2010-06-15 07:50 . 2010-06-15 07:50 2510336 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\f71abf392c5ca05a4e46a5d1c4c72856\System.Data.SqlXml.ni.dll
+ 2010-06-15 07:58 . 2010-06-15 07:58 1328128 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Services\5e6311aff5ada83d0f854922fa62faf6\System.Data.Services.ni.dll
+ 2010-06-15 07:36 . 2010-06-15 07:36 2516480 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\c3ba3367d03779ad6e76c5d4cdfe572a\System.Data.Linq.ni.dll
+ 2010-06-15 07:55 . 2010-06-15 07:55 9924096 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\6abf820d8ec57a0561c3367727d274df\System.Data.Entity.ni.dll
+ 2010-06-15 07:36 . 2010-06-15 07:36 2295296 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\e98726349766935ec0e9b980f19a046a\System.Core.ni.dll
+ 2010-06-15 07:36 . 2010-06-15 07:36 2128896 c:\windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\fc373f0a8dbd173c63b6b95551b1c673\ReachFramework.ni.dll
+ 2010-06-15 07:35 . 2010-06-15 07:35 1657856 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\ead93b6a4f0101cb99d09f3e3fc6491c\PresentationUI.ni.dll
+ 2010-06-15 07:32 . 2010-06-15 07:32 1451008 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\20ef773b20f6ce721ae60e5c2c2e8f80\PresentationBuildTasks.ni.dll
+ 2010-06-15 07:52 . 2010-06-15 07:52 1712128 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\935b855860088a86bb65d37a19f059cc\Microsoft.VisualBasic.ni.dll
+ 2010-06-15 07:46 . 2010-06-15 07:46 1093120 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\7a266de493d30eed21cb60ebe300be53\Microsoft.Transactions.Bridge.ni.dll
+ 2010-06-15 08:00 . 2010-06-15 08:00 2332160 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\9db8f9f7fe63ca4451bb5316a3ebb009\Microsoft.JScript.ni.dll
+ 2010-06-15 07:51 . 2010-06-15 07:51 1966080 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\c96be82d6cb00367db4e3553272165ef\Microsoft.Build.Tasks.v3.5.ni.dll
+ 2010-06-15 07:51 . 2010-06-15 07:51 1620992 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\3815de5b052187b5d9375681a6784255\Microsoft.Build.Tasks.ni.dll
+ 2010-06-15 07:49 . 2010-06-15 07:49 1888768 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\43fc6723d08e9ce88701c29653efd224\Microsoft.Build.Engine.ni.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 3182592 c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 2048000 c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
+ 2010-06-15 07:29 . 2010-06-15 07:29 2048000 c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
- 2009-10-15 07:21 . 2009-10-15 07:21 5025792 c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2010-06-15 07:27 . 2010-06-15 07:27 5025792 c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2010-06-15 07:32 . 2010-06-15 07:32 5967872 c:\windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll
- 2009-10-15 07:21 . 2009-10-15 07:21 5062656 c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2010-06-15 07:27 . 2010-06-15 07:27 5062656 c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2010-06-15 07:27 . 2010-06-15 07:27 5242880 c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
- 2009-10-15 07:21 . 2009-10-15 07:21 5242880 c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 2933248 c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 2933248 c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
- 2009-10-15 07:22 . 2009-10-15 07:22 4546560 c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2010-06-15 07:28 . 2010-06-15 07:28 4546560 c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2008-09-10 05:05 . 2010-05-28 19:37 32472008 c:\windows\system32\MRT.exe
+ 2007-08-14 01:54 . 2010-05-06 10:41 11076096 c:\windows\system32\ieframe.dll
+ 2008-09-24 19:04 . 2010-05-06 10:41 11076096 c:\windows\system32\dllcache\ieframe.dll
+ 2010-04-24 21:09 . 2010-04-24 21:09 11750912 c:\windows\Installer\437be71.msp
+ 2010-04-12 02:17 . 2010-04-12 02:17 14599680 c:\windows\Installer\3f72d0a.msp
+ 2010-04-24 21:07 . 2010-04-24 21:07 10118144 c:\windows\Installer\3f72cee.msp
+ 2010-06-15 08:11 . 2010-02-25 15:54 11070976 c:\windows\ie8updates\KB982381-IE8\ieframe.dll
+ 2010-06-15 07:39 . 2010-06-15 07:39 12430848 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\2dfe045e4b1577fdea9a2f456db0afc2\System.Windows.Forms.ni.dll
+ 2010-06-15 08:03 . 2010-06-15 08:04 11797504 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\d987cf1de4ba688da92e212a374232c2\System.Web.ni.dll
+ 2010-06-15 07:45 . 2010-06-15 07:46 17403904 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\8b74f2fe3f3632f95ff4ddb8c4839a1e\System.ServiceModel.ni.dll
+ 2010-06-15 07:37 . 2010-06-15 07:37 10683392 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Design\f352c5cb50bee105e4c873ca050f9f46\System.Design.ni.dll
+ 2010-06-15 07:35 . 2010-06-15 07:35 14327808 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\ca898d942e4d85af4c3d5f14a77c359a\PresentationFramework.ni.dll
+ 2010-06-15 07:33 . 2010-06-15 07:33 12216320 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\ba8f917fd89d7afa8885c2a326379f03\PresentationCore.ni.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Eraser"="c:\program files\Eraser\Eraser.exe" [2007-12-22 916240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-02-10 155648]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2010\IEShow.exe" [2009-10-19 71152]
"BDAgent"="c:\program files\BitDefender\BitDefender 2010\bdagent.exe" [2009-10-23 1118144]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-02-28 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\documents and settings\All Users\Application Data\Visual Styler\Logon Screens\logonui.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 23:28 352256 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\Common Files\\HP\\Digital Imaging\\bin\\hpqPhotoCrm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\ITUNES\\iTunes.exe"=

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [20/08/2008 2:34 AM 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [20/08/2008 2:34 AM 55024]
R2 ALThemeHelper;AusLogics Windows Themes Helper;c:\program files\AusLogics Visual Styler\themehelpersvc.exe [27/09/2008 10:13 PM 116336]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [01/05/2009 2:35 PM 181544]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [23/01/2009 6:53 PM 93320]
R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [10/11/2009 5:04 PM 152456]
S1 StarPortLite;StarPort Storage Controller (Lite);c:\windows\system32\DRIVERS\StarPortLite.sys --> c:\windows\system32\DRIVERS\StarPortLite.sys [?]
S2 0230321274842472mcinstcleanup;McAfee Application Installer Cleanup (0230321274842472);c:\windows\TEMP\023032~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service --> c:\windows\TEMP\023032~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]
S2 0324051232751199mcinstcleanup;0324051232751199mcinstcleanup; [x]
S2 USBHSB;GeneLink File Transfer Driver;c:\windows\system32\Drivers\usbhsb.sys --> c:\windows\system32\Drivers\usbhsb.sys [?]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe [19/10/2009 4:06 PM 183880]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [20/08/2008 2:34 AM 7408]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [22/08/2008 4:22 PM 717296]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
bdx REG_MULTI_SZ scan
.
Contents of the 'Scheduled Tasks' folder

2010-06-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
IE: Add to AMV Convert Tool... - c:\program files\MP3 Player Utilities 3.81\AMVConverter\grab.html
IE: Add to Media Manager... - c:\program files\MP3 Player Utilities 3.81\MediaManager\grab.html
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\cs19zxyc.default\
FF - prefs.js: browser.startup.homepage - chrome://speeddial/content/speeddial.xul
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPAskSBr.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program files\VLC\npvlc.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-16 09:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-682003330-1336601894-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b7,22,2f,bb,df,ea,cc,41,90,54,55,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b7,22,2f,bb,df,ea,cc,41,90,54,55,\

[HKEY_USERS\S-1-5-21-682003330-1336601894-725345543-500\Software\SecuROM\License information*]
"datasecu"=hex:f5,19,ff,66,3a,32,fe,b8,d9,df,39,9a,5c,9b,f4,25,a7,d6,5c,79,53,
e6,b7,de,e1,ec,e8,cd,36,4a,25,0f,f7,81,6f,18,9a,bd,46,d6,b5,c4,b5,80,4b,83,\
"rkeysecu"=hex:9f,ca,16,75,83,0a,d6,fd,d2,a5,ab,cb,c1,0d,12,f7
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(720)
c:\program files\AusLogics Visual Styler\ThemeHelper.dll
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll

- - - - - - - > 'lsass.exe'(776)
c:\program files\AusLogics Visual Styler\ThemeHelper.dll

- - - - - - - > 'csrss.exe'(696)
c:\program files\AusLogics Visual Styler\ThemeHelper.dll
.
Completion time: 2010-06-16 09:51:44
ComboFix-quarantined-files.txt 2010-06-16 13:51
ComboFix2.txt 2010-06-14 19:04
ComboFix3.txt 2010-06-13 14:45
ComboFix4.txt 2009-05-15 15:23

Pre-Run: 21,414,289,408 bytes free
Post-Run: 21,438,595,072 bytes free

- - End Of File - - 2ECBD51DE8F2AF59EC57A709E09DCFC0
fullbug
Regular Member
 
Posts: 31
Joined: June 10th, 2010, 7:51 am

Re: Stubborn Malware

Unread postby melboy » June 16th, 2010, 4:12 pm

Hi

Your logs are looking good.


At this stage your machine looks to be clean of malware, so the continued problems with notepad are not likely to be malware related. As this forum specializes in malware removal I think the best and fastest solution for you is to post on a general PC troubleshooting forum.
General techs are plentiful, malware fighters are few.

Below are some recommended sites that are better equipped to investigate and resolve these kinds of issues.

The Elder Geek on Windows
BleepingComputer.com
WhattheTech

=============

Registry Cleaners

Re. RegSupreme Pro

I don't personally recommend the use of ANY registry cleaners. Here is an excerpt from a discussion on reg cleaners
Most reg cleaners aren't bad as such, but they aren't perfect and even the best have been known to cause problems. The point we are trying to make is that the risk of using one far outweighs any benefit. If it does work perfectly you will not see any difference. If it doesn't work properly you may end up with an expensive doorstop.

This post by Bill Castner is very informative: WhatTheTech Forum



Update Adobe Reader

Your Adobe Reader is out of date.
Older versions may have vulnerabilities that malware can use to infect your system.
  • Using the internal updater update the software to the current increment 9.3.2
    • Open Adobe Reader go to > Help > Check for updates and allow the updater to check.
    • If updates are found click Show Details and check the boxes to click to download and install any necessary updates.



Update Java Runtime
You are using an old version of Java. Sun's Java is sometimes updated in order to eliminate the exploitation of vulnerabilities in an existing version. For this reason, it's extremely important that you keep the program up to date, and also remove the older more vulnerable versions from your system. The most current version of Sun Java is: Java Runtime Environment Version 6 Update 20.

  • Go to Sun Java
  • Scroll down to where it says "JDK 6 Update 20 (JDK or JRE)"
  • Click the orange Download JRE button to the right
  • In the Platform box choose Windows.
  • Check the box to Accept License Agreement and click Continue.
  • Click on Windows Offline Installation, click on the link under it which says "jre-6u20-windows-i586.exe" and save the downloaded file to your desktop.
  • Uninstall all old versions of Java via Start > Control Panel > Add/Remove Programs:
    Java(TM) 6 Update 18
    Java(TM) 6 Update 4
    Java(TM) 6 Update 7
  • Install the new version by running the newly-downloaded file with the java icon which will be at your desktop, and follow the on-screen instructions.
  • Reboot your computer


===========================================


Uninstall Combofix
We Need to Remove ComboFix
  1. Please go to Start -> Run
  2. Enter "ComboFix /uninstall" (without quotes). Note the space between "ComboFix" and "/uninstall", it needs to be there.
    Image
  3. Press OK (Or hit enter).
  4. Allow ComboFix to remove itself.



OTM by OldTimer

You should dtill have this on your Desktop.

  • Double-click OTM.exe
  • Click the CleanUp! button
  • Select Yes when the Begin cleanup Process? Prompt appears
  • If you are prompted to Reboot during the cleanup, select Yes
  • The tool will delete itself once it finishes, if not delete it by yourself


======================================================================


Windows XP Service Pack 3 is missing

You are running a version of Windows that will soon be unsupported. You should take care of this as soon as possible, since your computer will be very vulnerable without it.
It also contains many bug fixes and improvements.

Visit http://www.update.microsoft.com/ using Internet Explorer and install Service Pack 3.

what does end of support mean


======================================================================================


Your log now appears to be clean. Congratulations!
This is my general post for when your logs show no more signs of malware.

General Security and Computer Health
Below are some steps to follow in order to dramatically lower the chances of reinfection. You may have already implemented some of the steps below, however you should follow any steps that you have not already implemented.

  • Make sure that you keep your antivirus updated
    New viruses come out every minute, so it is essential that you have the latest signatures for your antivirus program to provide you with the best possible protection from malicious software.
    Note: You should only have one antivirus installed at a time. Having more than one antivirus program installed at once is likely to cause conflicts and may well decrease your overall protection as well as impairing the performance of your PC.
    Uninstall Tools for Major Antivirus Products
  • Security Updates for Windows, Internet Explorer & Microsoft Office
    Whenever a security problem in its software is found, Microsoft will usually create a patch so that after the patch is installed, attackers can't use the vulnerability to install malicious software on your PC. Keeping up with these patches will help to prevent malicious software being installed on your PC. Ensure you are registered for Windows updates via Start > right-click on My Computer > Properties > Automatic Updates tab or visit the Microsoft Update site on a regular basis.
    Note: The update process uses ActiveX, so you will need to use internet explorer for it and allow the ActiveX control to install.
  • Update Non-Microsoft Programs
    Microsoft isn't the only company whose products can contain security vulnerabilities. To check whether other programs running on your PC are in need of an update, you can use the Secunia Software Inspector - I suggest that you run it at least once a month.


Recommended Programs

I would recommend the download and installation of some or all of the following programs (if not already present), and the updating of them on a regular basis.

  • WinPatrol
    As a robust security monitor, WinPatrol will alert you to hijackings, malware attacks and critical changes made to your computer without your permission. WinPatrol takes snapshot of your critical system resources and alerts you to any changes that may occur without your knowledge. For more information, please visit HERE.
  • Malwarebytes' Anti-Malware
    As you already have Malwarebytes' Anti-Malware on board I would keep it regularly updated and run regular quick scans with it. (TIP: Cleaning out temp files can reduce scanning times.)
    Malwarebytes' Anti-Malware is an anti-malware application that can thoroughly remove even the most advanced malware. The Full version includes a number of features, including a built in protection monitor that blocks malicious processes before they even start.
  • Hosts File
    For added protection you may also like to add a host file. A simple explanation of what a Hosts file does is HERE and for more information regarding host files read HERE.


Finally I am trying to make one point very clear. It is absolutely essential to keep all of your security programs up to date.

Also please read this great article by Tony Klein So How Did I Get Infected In First Place

I'd be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can be closed.

Happy surfing and stay clean!
User avatar
melboy
MRU Expert
MRU Expert
 
Posts: 3670
Joined: July 25th, 2008, 4:25 pm
Location: UK

Re: Stubborn Malware

Unread postby fullbug » June 17th, 2010, 8:05 am

Great, thanx so much for all the help melboy.... 8)
fullbug
Regular Member
 
Posts: 31
Joined: June 10th, 2010, 7:51 am

Re: Stubborn Malware

Unread postby melboy » June 17th, 2010, 8:09 am

You're most welcome! :)
User avatar
melboy
MRU Expert
MRU Expert
 
Posts: 3670
Joined: July 25th, 2008, 4:25 pm
Location: UK

Re: Stubborn Malware

Unread postby NonSuch » June 17th, 2010, 5:17 pm

As this issue appears to be resolved, this topic is now closed.

We are pleased we could help you resolve your computer's malware issues.

If you would like to make a comment or leave a compliment regarding the help you have received, please see Feedback for Our Helpers - Say "Thanks" Here.
User avatar
NonSuch
Administrator
Administrator
 
Posts: 27301
Joined: February 23rd, 2005, 7:08 am
Location: California
Advertisement
Register to Remove

Previous

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 45 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware