ComboFix 08-11-27.01 - jeffrey 2008-11-27 11:38:57.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1715 [GMT -5:00] * Created a new restore point [COLOR=RED][B]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\jeffrey\cookies\votaporaf.dll c:\windows\ateqoflr.exe c:\windows\brastk.exe c:\windows\jestertb.dll c:\windows\karna.dat c:\windows\mesdxbrqmnx.dll c:\windows\system32\a.exe c:\windows\system32\brastk.exe c:\windows\system32\dllcache\beep.sys c:\windows\system32\drivers\TDSSmxwt.sys c:\windows\system32\karna.dat c:\windows\system32\TDSSarxx.dll c:\windows\system32\TDSSdxcp.dll c:\windows\system32\TDSSkkao.log c:\windows\system32\TDSSmtye.dat c:\windows\system32\TDSSnmxh.log c:\windows\system32\TDSSnvur.dll c:\windows\system32\TDSSoitu.dll c:\windows\system32\TDSSsahc.dll c:\windows\system32\TDSSvoqm.dll c:\windows\system32\TDSSxhyf.log c:\windows\system32\wini10895.exe c:\windows\tpabfelq.dll c:\windows\vwsrfton.dll H:\Autorun.inf [color=blue]Infected copy of c:\windows\system32\drivers\beep.sys was found and disinfected Restored copy from - c:\i386\BEEP.SYS [/COLOR] . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_TDSSSERV.SYS -------\Legacy_TDSSSERV.SYS ((((((((((((((((((((((((( Files Created from 2008-10-27 to 2008-11-27 ))))))))))))))))))))))))))))))) . 2008-11-14 14:16 . 2008-11-14 14:16 38 --a------ c:\windows\avisplitter.INI 2008-11-06 11:50 . 2003-06-12 04:56 98,304 -ra------ c:\windows\SYSTEM32\DRIVERS\vnet558x.sys 2008-11-02 14:39 . 2008-11-02 15:37 d-------- c:\documents and settings\All Users\Application Data\2Wire 2008-11-02 14:34 . 2008-11-02 14:34 d-------- c:\documents and settings\jeffrey\Application Data\2Wire 2008-11-02 14:28 . 2004-01-14 11:25 81,920 --a------ c:\windows\SYSTEM32\ZDPN50.DLL 2008-11-02 14:28 . 2004-03-23 16:38 28,672 --a------ c:\windows\SYSTEM32\InsDrvZD.dll 2008-11-02 14:28 . 2003-03-14 12:24 24,576 --a------ c:\windows\SYSTEM32\ZyDelReg.exe 2008-11-02 14:28 . 2004-01-14 11:30 17,151 --a------ c:\windows\SYSTEM32\ZDPNDIS5.SYS 2008-11-02 14:28 . 2005-07-12 14:44 15,872 --a------ c:\windows\SYSTEM32\InsDrvZD64.DLL . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-27 16:45 --------- d-----w c:\program files\PestPatrol 2008-11-25 18:04 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater 2008-11-20 17:08 149,912 --sha-w c:\windows\system32\drivers\fidbox.idx 2008-11-20 17:08 12,668,960 --sha-w c:\windows\system32\drivers\fidbox.dat 2008-11-02 20:35 --------- d--h--w c:\program files\InstallShield Installation Information 2008-07-02 17:23 142,288 ----a-w c:\documents and settings\jeffrey\Application Data\GDIPFONTCACHEV1.DAT 2008-05-26 03:53 17,066 ----a-w c:\documents and settings\jeffrey\Application Data\jale.pif 2008-05-26 03:53 15,999 ----a-w c:\program files\Common Files\casutapeti.inf 2008-05-26 03:53 12,978 ----a-w c:\documents and settings\All Users\Application Data\nimeto.reg 2008-05-26 03:53 12,658 ----a-w c:\documents and settings\All Users\Application Data\rorocesok.com 2008-05-26 03:53 12,363 ----a-w c:\documents and settings\jeffrey\Application Data\urime.pif 2008-05-26 03:53 10,161 ----a-w c:\documents and settings\jeffrey\Application Data\ulyqyt.sys 2006-04-30 20:16 156,181 ----a-w c:\program files\MpegDecoder012.zip 2005-11-14 00:52 8,668,528 -c--a-w c:\program files\Realplayer.exe 2005-11-14 00:03 3,723,776 -c--a-w c:\program files\Realplayer7.exe 2005-10-20 14:45 52 -c--a-w c:\program files\Backup1.BDF 2005-10-20 14:44 52 -c--a-w c:\program files\Save Windows and Programs (No Data or Documents).BDF 2005-10-20 14:44 52 -c--a-w c:\program files\Save Data and Documents Only.BDF 2005-10-20 14:31 3,736,160 -c--a-w c:\program files\Backup-Wizard.exe . ((((((((((((((((((((((((((((( snapshot@2008-05-28_18.07.32.82 ))))))))))))))))))))))))))))))))))))))))) . + 2007-11-30 12:39:22 17,272 ----a-w c:\windows\$hf_mig$\KB938464\spmsg.dll + 2007-11-30 12:39:22 231,288 ----a-w c:\windows\$hf_mig$\KB938464\spuninst.exe + 2007-11-30 12:39:22 26,488 ----a-w c:\windows\$hf_mig$\KB938464\update\spcustom.dll + 2007-11-30 11:20:44 755,576 ----a-w c:\windows\$hf_mig$\KB938464\update\update.exe + 2007-11-30 12:39:22 382,840 ----a-w c:\windows\$hf_mig$\KB938464\update\updspapi.dll + 2008-01-23 04:56:21 554,008 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\dao360.dll + 2007-12-10 12:41:11 518,944 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\msexch40.dll + 2007-12-10 12:41:11 326,432 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\msexcl40.dll + 2007-12-10 12:41:11 1,516,568 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\msjet40.dll + 2007-12-10 12:41:11 355,112 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\msjetol1.dll + 2008-03-27 07:39:13 151,583 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\msjint40.dll + 2007-12-10 12:41:12 60,192 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\msjter40.dll + 2007-12-10 12:41:12 248,608 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\msjtes40.dll + 2007-12-10 12:41:12 219,936 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\msltus40.dll + 2007-12-10 12:41:12 355,104 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\mspbde40.dll + 2007-12-10 12:41:13 432,928 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\msrd2x40.dll + 2007-12-10 12:41:13 322,336 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\msrd3x40.dll + 2007-12-10 12:41:13 559,904 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\msrepl40.dll + 2007-12-10 12:41:13 264,992 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\mstext40.dll + 2007-12-10 12:41:13 838,432 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\mswdat10.dll + 2007-12-10 12:41:14 621,344 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\mswstr10.dll + 2007-12-10 12:41:14 355,104 ----a-w c:\windows\$hf_mig$\KB950749\SP2QFE\msxbde40.dll + 2007-03-06 01:22:36 14,048 ----a-w c:\windows\$hf_mig$\KB950749\spmsg.dll + 2007-03-06 01:22:41 213,216 ----a-w c:\windows\$hf_mig$\KB950749\spuninst.exe + 2007-03-06 01:22:34 22,752 ----a-w c:\windows\$hf_mig$\KB950749\update\spcustom.dll + 2007-03-06 01:22:59 716,000 ----a-w c:\windows\$hf_mig$\KB950749\update\update.exe + 2007-03-06 01:23:51 371,424 ----a-w c:\windows\$hf_mig$\KB950749\update\updspapi.dll + 2008-04-21 06:56:54 1,024,000 ----a-w c:\windows\$hf_mig$\KB950759\SP2QFE\browseui.dll + 2008-04-21 06:56:54 151,040 ----a-w c:\windows\$hf_mig$\KB950759\SP2QFE\cdfview.dll + 2008-04-21 06:56:55 1,054,208 ----a-w c:\windows\$hf_mig$\KB950759\SP2QFE\danim.dll + 2008-04-21 06:56:55 357,888 ----a-w c:\windows\$hf_mig$\KB950759\SP2QFE\dxtmsft.dll + 2008-04-21 06:56:55 205,312 ----a-w c:\windows\$hf_mig$\KB950759\SP2QFE\dxtrans.dll + 2008-04-21 06:56:55 55,808 ----a-w c:\windows\$hf_mig$\KB950759\SP2QFE\extmgr.dll + 2008-04-17 10:46:59 18,432 ----a-w c:\windows\$hf_mig$\KB950759\SP2QFE\iedw.exe + 2008-04-21 06:56:56 251,904 ----a-w c:\windows\$hf_mig$\KB950759\SP2QFE\iepeers.dll + 2008-04-21 06:56:56 96,256 ----a-w c:\windows\$hf_mig$\KB950759\SP2QFE\inseng.dll + 2008-04-21 06:56:56 16,384 ----a-w c:\windows\$hf_mig$\KB950759\SP2QFE\jsproxy.dll + 2008-04-21 06:56:57 3,066,880 ----a-w c:\windows\$hf_mig$\KB950759\SP2QFE\mshtml.dll + 2008-04-21 06:56:57 449,024 ----a-w c:\windows\$hf_mig$\KB950759\SP2QFE\mshtmled.dll + 2008-04-21 06:56:57 146,432 ----a-w c:\windows\$hf_mig$\KB950759\SP2QFE\msrating.dll + 2008-04-21 06:56:58 532,480 ----a-w c:\windows\$hf_mig$\KB950759\SP2QFE\mstime.dll + 2008-04-21 06:56:58 39,424 ----a-w c:\windows\$hf_mig$\KB950759\SP2QFE\pngfilt.dll + 2008-04-21 06:56:58 1,499,136 ----a-w c:\windows\$hf_mig$\KB950759\SP2QFE\shdocvw.dll + 2008-04-21 06:56:58 474,112 ----a-w c:\windows\$hf_mig$\KB950759\SP2QFE\shlwapi.dll + 2008-04-21 06:56:58 618,496 ----a-w c:\windows\$hf_mig$\KB950759\SP2QFE\urlmon.dll + 2008-04-21 06:56:59 666,624 ----a-w c:\windows\$hf_mig$\KB950759\SP2QFE\wininet.dll + 2008-04-17 10:37:04 351,744 ----a-w c:\windows\$hf_mig$\KB950759\SP2QFE\xpsp3res.dll + 2008-04-21 06:44:29 3,066,880 ----a-w c:\windows\$hf_mig$\KB950759\SP3GDR\mshtml.dll + 2008-04-21 06:44:29 666,112 ----a-w c:\windows\$hf_mig$\KB950759\SP3GDR\wininet.dll + 2008-04-21 06:24:01 3,067,392 ----a-w c:\windows\$hf_mig$\KB950759\SP3QFE\mshtml.dll + 2008-04-21 06:24:02 666,624 ----a-w c:\windows\$hf_mig$\KB950759\SP3QFE\wininet.dll + 2007-11-30 12:39:22 17,272 ----a-w c:\windows\$hf_mig$\KB950759\spmsg.dll + 2007-11-30 12:39:22 231,288 ----a-w c:\windows\$hf_mig$\KB950759\spuninst.exe + 2007-11-30 12:39:22 26,488 ----a-w c:\windows\$hf_mig$\KB950759\update\spcustom.dll + 2007-11-30 12:39:22 755,576 ----a-w c:\windows\$hf_mig$\KB950759\update\update.exe + 2007-11-30 12:39:22 382,840 ----a-w c:\windows\$hf_mig$\KB950759\update\updspapi.dll + 2007-11-30 12:39:22 17,272 ----a-w c:\windows\$hf_mig$\KB950760\spmsg.dll + 2007-11-30 12:39:22 231,288 ----a-w c:\windows\$hf_mig$\KB950760\spuninst.exe + 2007-11-30 12:39:22 26,488 ----a-w c:\windows\$hf_mig$\KB950760\update\spcustom.dll + 2007-11-30 12:39:22 755,576 ----a-w c:\windows\$hf_mig$\KB950760\update\update.exe + 2007-11-30 12:39:22 382,840 ----a-w c:\windows\$hf_mig$\KB950760\update\updspapi.dll + 2008-05-08 12:14:51 203,008 ----a-w c:\windows\$hf_mig$\KB950762\SP2QFE\rmcast.sys + 2008-05-08 14:02:52 203,136 ----a-w c:\windows\$hf_mig$\KB950762\SP3GDR\rmcast.sys + 2008-05-08 13:58:17 203,136 ----a-w c:\windows\$hf_mig$\KB950762\SP3QFE\rmcast.sys + 2007-11-30 12:39:22 17,272 ----a-w c:\windows\$hf_mig$\KB950762\spmsg.dll + 2007-11-30 12:39:22 231,288 ----a-w c:\windows\$hf_mig$\KB950762\spuninst.exe + 2007-11-30 12:39:22 26,488 ----a-w c:\windows\$hf_mig$\KB950762\update\spcustom.dll + 2007-11-30 12:39:22 755,576 ----a-w c:\windows\$hf_mig$\KB950762\update\update.exe + 2007-11-30 12:39:22 382,840 ----a-w c:\windows\$hf_mig$\KB950762\update\updspapi.dll + 2008-04-11 18:39:39 683,520 ----a-w c:\windows\$hf_mig$\KB951066\SP2QFE\inetcomm.dll + 2008-04-11 19:04:26 691,712 ----a-w c:\windows\$hf_mig$\KB951066\SP3GDR\inetcomm.dll + 2008-04-12 04:22:26 691,712 ----a-w c:\windows\$hf_mig$\KB951066\SP3QFE\inetcomm.dll + 2007-11-30 12:39:22 17,272 ----a-w c:\windows\$hf_mig$\KB951066\spmsg.dll + 2007-11-30 12:39:22 231,288 ----a-w c:\windows\$hf_mig$\KB951066\spuninst.exe + 2007-11-30 12:39:22 26,488 ----a-w c:\windows\$hf_mig$\KB951066\update\spcustom.dll + 2007-12-03 15:25:31 755,576 ----a-w c:\windows\$hf_mig$\KB951066\update\update.exe + 2007-11-30 12:39:22 382,840 ----a-w c:\windows\$hf_mig$\KB951066\update\updspapi.dll + 2008-07-14 11:03:00 62,976 ----a-w c:\windows\$hf_mig$\KB951072-v2\SP2QFE\tzchange.exe + 2008-07-11 12:42:28 62,976 ----a-w c:\windows\$hf_mig$\KB951072-v2\SP3GDR\tzchange.exe + 2008-07-11 12:51:51 62,976 ----a-w c:\windows\$hf_mig$\KB951072-v2\SP3QFE\tzchange.exe + 2007-11-30 11:18:51 17,272 ----a-w c:\windows\$hf_mig$\KB951072-v2\spmsg.dll + 2007-11-30 11:18:51 231,288 ----a-w c:\windows\$hf_mig$\KB951072-v2\spuninst.exe + 2007-11-30 11:18:51 26,488 ----a-w c:\windows\$hf_mig$\KB951072-v2\update\spcustom.dll + 2007-11-30 12:39:22 755,576 ----a-w c:\windows\$hf_mig$\KB951072-v2\update\update.exe + 2007-11-30 12:39:22 382,840 ----a-w c:\windows\$hf_mig$\KB951072-v2\update\updspapi.dll + 2008-06-13 09:52:16 272,128 ----a-w c:\windows\$hf_mig$\KB951376-v2\SP2QFE\bthport.sys + 2008-06-13 11:05:51 272,128 ----a-w c:\windows\$hf_mig$\KB951376-v2\SP3GDR\bthport.sys + 2008-06-13 11:27:43 272,128 ----a-w c:\windows\$hf_mig$\KB951376-v2\SP3QFE\bthport.sys + 2007-11-30 11:18:51 17,272 ----a-w c:\windows\$hf_mig$\KB951376-v2\spmsg.dll + 2007-11-30 11:18:51 231,288 ----a-w c:\windows\$hf_mig$\KB951376-v2\spuninst.exe + 2007-11-30 11:18:51 26,488 ----a-w c:\windows\$hf_mig$\KB951376-v2\update\spcustom.dll + 2007-11-30 11:18:51 755,576 ----a-w c:\windows\$hf_mig$\KB951376-v2\update\update.exe + 2007-11-30 11:18:51 382,840 ----a-w c:\windows\$hf_mig$\KB951376-v2\update\updspapi.dll + 2008-05-07 04:55:40 1,288,192 ----a-w c:\windows\$hf_mig$\KB951698\SP2QFE\quartz.dll + 2008-05-07 05:12:40 1,288,192 ----a-w c:\windows\$hf_mig$\KB951698\SP3GDR\quartz.dll + 2008-05-07 05:04:15 1,288,192 ----a-w c:\windows\$hf_mig$\KB951698\SP3QFE\quartz.dll + 2007-11-30 11:18:51 17,272 ----a-w c:\windows\$hf_mig$\KB951698\spmsg.dll + 2007-11-30 11:18:51 231,288 ----a-w c:\windows\$hf_mig$\KB951698\spuninst.exe + 2007-11-30 11:18:51 26,488 ----a-w c:\windows\$hf_mig$\KB951698\update\spcustom.dll + 2007-11-30 12:39:22 755,576 ----a-w c:\windows\$hf_mig$\KB951698\update\update.exe + 2007-11-30 12:39:22 382,840 ----a-w c:\windows\$hf_mig$\KB951698\update\updspapi.dll + 2006-08-16 12:08:32 100,352 ----a-w c:\windows\$hf_mig$\KB951748\SP2QFE\6to4svc.dll + 2008-06-20 10:44:08 138,368 ----a-w c:\windows\$hf_mig$\KB951748\SP2QFE\afd.sys + 2008-06-20 17:36:11 147,968 ----a-w c:\windows\$hf_mig$\KB951748\SP2QFE\dnsapi.dll + 2008-06-20 17:36:11 245,248 ----a-w c:\windows\$hf_mig$\KB951748\SP2QFE\mswsock.dll + 2008-06-20 10:44:42 360,960 ----a-w c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys + 2008-06-20 09:32:39 225,920 ----a-w c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip6.sys + 2008-06-20 11:40:08 138,496 ----a-w c:\windows\$hf_mig$\KB951748\SP3GDR\afd.sys + 2008-06-20 17:46:57 147,968 ----a-w c:\windows\$hf_mig$\KB951748\SP3GDR\dnsapi.dll + 2008-06-20 17:46:57 245,248 ----a-w c:\windows\$hf_mig$\KB951748\SP3GDR\mswsock.dll + 2008-06-20 11:51:12 361,600 ----a-w c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys + 2008-06-20 11:08:27 225,856 ----a-w c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip6.sys + 2008-06-20 11:48:03 138,496 ----a-w c:\windows\$hf_mig$\KB951748\SP3QFE\afd.sys + 2008-06-20 17:43:05 147,968 ----a-w c:\windows\$hf_mig$\KB951748\SP3QFE\dnsapi.dll + 2008-06-20 17:43:05 245,248 ----a-w c:\windows\$hf_mig$\KB951748\SP3QFE\mswsock.dll + 2008-06-20 11:59:02 361,600 ----a-w c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys + 2008-06-20 11:16:44 225,856 ----a-w c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip6.sys + 2007-11-30 12:39:22 17,272 ----a-w c:\windows\$hf_mig$\KB951748\spmsg.dll + 2007-11-30 12:39:22 231,288 ----a-w c:\windows\$hf_mig$\KB951748\spuninst.exe + 2007-11-30 12:39:22 26,488 ----a-w c:\windows\$hf_mig$\KB951748\update\spcustom.dll + 2007-11-30 12:39:18 755,576 ----a-w c:\windows\$hf_mig$\KB951748\update\update.exe + 2007-11-30 12:39:19 382,840 ----a-w c:\windows\$hf_mig$\KB951748\update\updspapi.dll + 2008-05-01 15:04:00 331,776 ----a-w c:\windows\$hf_mig$\KB952287\SP2QFE\msadce.dll + 2008-05-01 14:33:02 331,776 ----a-w c:\windows\$hf_mig$\KB952287\SP3GDR\msadce.dll + 2008-05-01 14:38:05 331,776 ----a-w c:\windows\$hf_mig$\KB952287\SP3QFE\msadce.dll + 2007-11-30 11:18:51 17,272 ----a-w c:\windows\$hf_mig$\KB952287\spmsg.dll + 2007-11-30 11:18:51 231,288 ----a-w c:\windows\$hf_mig$\KB952287\spuninst.exe + 2007-11-30 11:18:51 26,488 ----a-w c:\windows\$hf_mig$\KB952287\update\spcustom.dll + 2007-11-30 11:18:51 755,576 ----a-w c:\windows\$hf_mig$\KB952287\update\update.exe + 2007-11-30 11:18:51 382,840 ----a-w c:\windows\$hf_mig$\KB952287\update\updspapi.dll + 2008-06-23 16:11:40 1,024,000 ----a-w c:\windows\$hf_mig$\KB953838\SP2QFE\browseui.dll + 2008-06-23 16:11:40 151,040 ----a-w c:\windows\$hf_mig$\KB953838\SP2QFE\cdfview.dll + 2008-06-23 16:11:42 1,054,208 ----a-w c:\windows\$hf_mig$\KB953838\SP2QFE\danim.dll + 2008-06-23 16:11:43 357,888 ----a-w c:\windows\$hf_mig$\KB953838\SP2QFE\dxtmsft.dll + 2008-06-23 16:11:43 205,312 ----a-w c:\windows\$hf_mig$\KB953838\SP2QFE\dxtrans.dll + 2008-06-23 16:11:43 55,808 ----a-w c:\windows\$hf_mig$\KB953838\SP2QFE\extmgr.dll + 2008-06-23 09:53:58 18,432 ----a-w c:\windows\$hf_mig$\KB953838\SP2QFE\iedw.exe + 2008-06-23 16:11:52 251,904 ----a-w c:\windows\$hf_mig$\KB953838\SP2QFE\iepeers.dll + 2008-06-23 16:11:52 96,256 ----a-w c:\windows\$hf_mig$\KB953838\SP2QFE\inseng.dll + 2008-06-23 16:11:52 16,384 ----a-w c:\windows\$hf_mig$\KB953838\SP2QFE\jsproxy.dll + 2008-06-23 16:11:58 3,067,392 ----a-w c:\windows\$hf_mig$\KB953838\SP2QFE\mshtml.dll + 2008-06-23 16:12:00 449,024 ----a-w c:\windows\$hf_mig$\KB953838\SP2QFE\mshtmled.dll + 2008-06-23 16:12:02 146,432 ----a-w c:\windows\$hf_mig$\KB953838\SP2QFE\msrating.dll + 2008-06-23 16:12:02 532,480 ----a-w c:\windows\$hf_mig$\KB953838\SP2QFE\mstime.dll + 2008-06-23 16:12:02 39,424 ----a-w c:\windows\$hf_mig$\KB953838\SP2QFE\pngfilt.dll + 2008-06-23 16:12:05 1,499,136 ----a-w c:\windows\$hf_mig$\KB953838\SP2QFE\shdocvw.dll + 2008-06-23 16:12:05 474,112 ----a-w c:\windows\$hf_mig$\KB953838\SP2QFE\shlwapi.dll + 2008-06-23 16:12:06 618,496 ----a-w c:\windows\$hf_mig$\KB953838\SP2QFE\urlmon.dll + 2008-06-23 16:12:08 667,136 ----a-w c:\windows\$hf_mig$\KB953838\SP2QFE\wininet.dll + 2008-07-03 09:14:02 351,744 ----a-w c:\windows\$hf_mig$\KB953838\SP2QFE\xpsp3res.dll + 2008-06-23 15:09:27 3,067,392 ----a-w c:\windows\$hf_mig$\KB953838\SP3GDR\mshtml.dll + 2008-06-26 08:15:29 1,499,136 ----a-w c:\windows\$hf_mig$\KB953838\SP3GDR\shdocvw.dll + 2008-06-26 08:15:30 619,520 ----a-w c:\windows\$hf_mig$\KB953838\SP3GDR\urlmon.dll + 2008-06-23 15:09:27 666,112 ----a-w c:\windows\$hf_mig$\KB953838\SP3GDR\wininet.dll + 2008-06-25 04:24:48 3,067,904 ----a-w c:\windows\$hf_mig$\KB953838\SP3QFE\mshtml.dll + 2008-06-26 08:00:52 1,499,136 ----a-w c:\windows\$hf_mig$\KB953838\SP3QFE\shdocvw.dll + 2008-06-26 08:00:52 619,520 ----a-w c:\windows\$hf_mig$\KB953838\SP3QFE\urlmon.dll + 2008-06-23 14:54:47 666,624 ----a-w c:\windows\$hf_mig$\KB953838\SP3QFE\wininet.dll + 2007-11-30 12:39:22 17,272 ----a-w c:\windows\$hf_mig$\KB953838\spmsg.dll + 2007-11-30 12:39:22 231,288 ----a-w c:\windows\$hf_mig$\KB953838\spuninst.exe + 2007-11-30 12:39:22 26,488 ----a-w c:\windows\$hf_mig$\KB953838\update\spcustom.dll + 2007-11-30 12:39:18 755,576 ----a-w c:\windows\$hf_mig$\KB953838\update\update.exe + 2007-11-30 12:39:19 382,840 ----a-w c:\windows\$hf_mig$\KB953838\update\updspapi.dll + 2007-11-30 12:39:22 231,288 -c----w c:\windows\$NtUninstallKB938464$\spuninst\spuninst.exe + 2007-11-30 12:39:22 382,840 -c----w c:\windows\$NtUninstallKB938464$\spuninst\updspapi.dll + 2004-08-04 11:00:00 561,179 -c----w c:\windows\$NtUninstallKB950749$\dao360.dll + 2004-08-04 11:00:00 512,029 -c----w c:\windows\$NtUninstallKB950749$\msexch40.dll + 2004-08-04 11:00:00 319,517 -c----w c:\windows\$NtUninstallKB950749$\msexcl40.dll + 2004-08-04 11:00:00 1,507,356 -c----w c:\windows\$NtUninstallKB950749$\msjet40.dll + 2004-08-04 11:00:00 358,976 -c----w c:\windows\$NtUninstallKB950749$\msjetoledb40.dll + 2004-08-04 11:00:00 151,583 -c----w c:\windows\$NtUninstallKB950749$\msjint40.dll + 2004-08-04 11:00:00 53,279 -c----w c:\windows\$NtUninstallKB950749$\msjter40.dll + 2004-08-04 11:00:00 241,693 -c----w c:\windows\$NtUninstallKB950749$\msjtes40.dll + 2004-08-04 11:00:00 213,023 -c----w c:\windows\$NtUninstallKB950749$\msltus40.dll + 2004-08-04 11:00:00 348,189 -c----w c:\windows\$NtUninstallKB950749$\mspbde40.dll + 2004-08-04 11:00:00 421,919 -c----w c:\windows\$NtUninstallKB950749$\msrd2x40.dll + 2004-08-04 11:00:00 315,423 -c----w c:\windows\$NtUninstallKB950749$\msrd3x40.dll + 2004-08-04 11:00:00 552,989 -c----w c:\windows\$NtUninstallKB950749$\msrepl40.dll + 2004-08-04 11:00:00 258,077 -c----w c:\windows\$NtUninstallKB950749$\mstext40.dll + 2004-08-04 11:00:00 831,519 -c----w c:\windows\$NtUninstallKB950749$\mswdat10.dll + 2004-08-04 11:00:00 614,429 -c----w c:\windows\$NtUninstallKB950749$\mswstr10.dll + 2004-08-04 11:00:00 348,189 -c----w c:\windows\$NtUninstallKB950749$\msxbde40.dll + 2007-03-06 01:22:41 213,216 -c----w c:\windows\$NtUninstallKB950749$\spuninst\spuninst.exe + 2007-03-06 01:23:51 371,424 -c----w c:\windows\$NtUninstallKB950749$\spuninst\updspapi.dll + 2007-12-07 01:07:12 1,023,488 -c----w c:\windows\$NtUninstallKB950759$\browseui.dll + 2007-12-07 01:07:12 151,040 -c----w c:\windows\$NtUninstallKB950759$\cdfview.dll + 2007-12-07 01:07:12 1,054,208 -c----w c:\windows\$NtUninstallKB950759$\danim.dll + 2007-12-07 01:07:12 357,888 -c----w c:\windows\$NtUninstallKB950759$\dxtmsft.dll + 2007-12-07 01:07:12 205,312 -c----w c:\windows\$NtUninstallKB950759$\dxtrans.dll + 2007-12-07 01:07:12 55,808 -c----w c:\windows\$NtUninstallKB950759$\extmgr.dll + 2007-12-06 13:07:07 18,432 -c----w c:\windows\$NtUninstallKB950759$\iedw.exe + 2007-12-07 01:07:12 251,392 -c----w c:\windows\$NtUninstallKB950759$\iepeers.dll + 2007-12-07 01:07:12 96,256 -c----w c:\windows\$NtUninstallKB950759$\inseng.dll + 2007-12-07 01:07:12 16,384 -c----w c:\windows\$NtUninstallKB950759$\jsproxy.dll + 2007-12-07 14:37:14 3,059,200 -c----w c:\windows\$NtUninstallKB950759$\mshtml.dll + 2007-12-07 01:07:13 449,024 -c----w c:\windows\$NtUninstallKB950759$\mshtmled.dll + 2007-12-07 01:07:13 146,432 -c----w c:\windows\$NtUninstallKB950759$\msrating.dll + 2007-12-07 01:07:13 532,480 -c----w c:\windows\$NtUninstallKB950759$\mstime.dll + 2007-12-07 01:07:13 39,424 -c----w c:\windows\$NtUninstallKB950759$\pngfilt.dll + 2007-12-07 01:07:13 1,494,528 -c----w c:\windows\$NtUninstallKB950759$\shdocvw.dll + 2007-12-07 01:07:13 474,112 -c----w c:\windows\$NtUninstallKB950759$\shlwapi.dll + 2007-11-30 12:39:22 231,288 -c----w c:\windows\$NtUninstallKB950759$\spuninst\spuninst.exe + 2007-11-30 12:39:22 382,840 -c----w c:\windows\$NtUninstallKB950759$\spuninst\updspapi.dll + 2007-12-07 01:07:14 615,424 -c----w c:\windows\$NtUninstallKB950759$\urlmon.dll + 2007-12-07 01:07:14 659,456 -c----w c:\windows\$NtUninstallKB950759$\wininet.dll + 2007-12-06 09:38:31 350,720 -c----w c:\windows\$NtUninstallKB950759$\xpsp3res.dll + 2007-11-30 12:39:22 231,288 -c----w c:\windows\$NtUninstallKB950760$\spuninst\spuninst.exe + 2007-11-30 12:39:22 382,840 -c----w c:\windows\$NtUninstallKB950760$\spuninst\updspapi.dll + 2006-07-13 08:48:58 202,240 -c----w c:\windows\$NtUninstallKB950762$\rmcast.sys + 2007-11-30 12:39:22 231,288 -c----w c:\windows\$NtUninstallKB950762$\spuninst\spuninst.exe + 2007-11-30 12:39:22 382,840 -c----w c:\windows\$NtUninstallKB950762$\spuninst\updspapi.dll + 2007-08-21 06:15:44 683,520 -c----w c:\windows\$NtUninstallKB951066$\inetcomm.dll + 2007-11-30 12:39:22 231,288 -c----w c:\windows\$NtUninstallKB951066$\spuninst\spuninst.exe + 2007-11-30 12:39:22 382,840 -c----w c:\windows\$NtUninstallKB951066$\spuninst\updspapi.dll + 2007-11-30 11:18:51 231,288 -c----w c:\windows\$NtUninstallKB951072-v2$\spuninst\spuninst.exe + 2007-11-30 12:39:22 382,840 -c----w c:\windows\$NtUninstallKB951072-v2$\spuninst\updspapi.dll + 2007-11-13 11:31:11 60,416 -c----w c:\windows\$NtUninstallKB951072-v2$\tzchange.exe + 2007-11-30 11:18:51 231,288 -c----w c:\windows\$NtUninstallKB951376-v2$\spuninst\spuninst.exe + 2007-11-30 11:18:51 382,840 -c----w c:\windows\$NtUninstallKB951376-v2$\spuninst\updspapi.dll + 2007-10-29 22:43:03 1,287,680 -c----w c:\windows\$NtUninstallKB951698$\quartz.dll + 2007-11-30 11:18:51 231,288 -c----w c:\windows\$NtUninstallKB951698$\spuninst\spuninst.exe + 2007-11-30 12:39:22 382,840 -c----w c:\windows\$NtUninstallKB951698$\spuninst\updspapi.dll + 2004-08-04 11:00:00 138,496 -c----w c:\windows\$NtUninstallKB951748$\afd.sys + 2008-02-20 05:32:43 148,992 -c----w c:\windows\$NtUninstallKB951748$\dnsapi.dll + 2004-08-04 11:00:00 245,248 -c----w c:\windows\$NtUninstallKB951748$\mswsock.dll + 2007-11-30 12:39:22 231,288 -c----w c:\windows\$NtUninstallKB951748$\spuninst\spuninst.exe + 2007-11-30 12:39:19 382,840 -c----w c:\windows\$NtUninstallKB951748$\spuninst\updspapi.dll + 2007-10-30 17:20:55 360,064 -c----w c:\windows\$NtUninstallKB951748$\tcpip.sys + 2006-08-16 09:37:30 225,664 -c----w c:\windows\$NtUninstallKB951748$\tcpip6.sys + 2004-08-04 11:00:00 331,776 -c----w c:\windows\$NtUninstallKB952287$\msadce.dll + 2007-11-30 11:18:51 231,288 -c----w c:\windows\$NtUninstallKB952287$\spuninst\spuninst.exe + 2007-11-30 11:18:51 382,840 -c----w c:\windows\$NtUninstallKB952287$\spuninst\updspapi.dll + 2008-04-21 07:03:56 1,023,488 -c----w c:\windows\$NtUninstallKB953838$\browseui.dll + 2008-04-21 07:03:56 151,040 -c----w c:\windows\$NtUninstallKB953838$\cdfview.dll + 2008-04-21 07:03:57 1,054,208 -c----w c:\windows\$NtUninstallKB953838$\danim.dll + 2008-04-21 07:03:57 357,888 -c----w c:\windows\$NtUninstallKB953838$\dxtmsft.dll + 2008-04-21 07:03:57 205,312 -c----w c:\windows\$NtUninstallKB953838$\dxtrans.dll + 2008-04-21 07:03:57 55,808 -c----w c:\windows\$NtUninstallKB953838$\extmgr.dll + 2008-04-17 10:52:54 18,432 -c----w c:\windows\$NtUninstallKB953838$\iedw.exe + 2008-04-21 07:03:58 251,392 -c----w c:\windows\$NtUninstallKB953838$\iepeers.dll + 2008-04-21 07:03:58 96,256 -c----w c:\windows\$NtUninstallKB953838$\inseng.dll + 2008-04-21 07:03:58 16,384 -c----w c:\windows\$NtUninstallKB953838$\jsproxy.dll + 2008-04-21 07:03:59 3,059,712 -c----w c:\windows\$NtUninstallKB953838$\mshtml.dll + 2008-04-21 07:03:59 449,024 -c----w c:\windows\$NtUninstallKB953838$\mshtmled.dll + 2008-04-21 07:03:59 146,432 -c----w c:\windows\$NtUninstallKB953838$\msrating.dll + 2008-04-21 07:03:59 532,480 -c----w c:\windows\$NtUninstallKB953838$\mstime.dll + 2008-04-21 07:03:59 39,424 -c----w c:\windows\$NtUninstallKB953838$\pngfilt.dll + 2008-04-21 07:04:00 1,494,528 -c----w c:\windows\$NtUninstallKB953838$\shdocvw.dll + 2008-04-21 07:04:00 474,112 -c----w c:\windows\$NtUninstallKB953838$\shlwapi.dll + 2007-11-30 12:39:22 231,288 -c----w c:\windows\$NtUninstallKB953838$\spuninst\spuninst.exe + 2007-11-30 12:39:19 382,840 -c----w c:\windows\$NtUninstallKB953838$\spuninst\updspapi.dll + 2008-04-21 07:04:00 615,936 -c----w c:\windows\$NtUninstallKB953838$\urlmon.dll + 2008-04-21 07:04:00 659,456 -c----w c:\windows\$NtUninstallKB953838$\wininet.dll + 2008-04-17 10:37:04 351,744 -c----w c:\windows\$NtUninstallKB953838$\xpsp3res.dll + 2008-06-13 13:10:50 272,128 ------w c:\windows\Driver Cache\I386\bthport.sys - 2005-10-21 00:02:28 163,328 ----a-w c:\windows\erdnt\Hiv-backup\ERDNT.EXE + 2005-10-21 01:02:28 163,328 ----a-w c:\windows\erdnt\Hiv-backup\ERDNT.EXE + 2005-10-21 01:02:28 163,328 ----a-w c:\windows\erdnt\subs\ERDNT.EXE + 2008-08-07 20:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE + 2008-08-16 03:46:35 7,716,864 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\ntuser.dat + 2008-08-16 03:46:35 307,200 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 20:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-08-16 03:46:32 7,716,864 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\ntuser.dat + 2008-08-16 03:46:32 307,200 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat - 2000-08-31 12:00:00 89,504 ----a-w c:\windows\fdsv.exe + 2000-08-31 13:00:00 89,504 ----a-w c:\windows\fdsv.exe - 2000-08-31 12:00:00 80,412 ----a-w c:\windows\grep.exe + 2000-08-31 13:00:00 80,412 ----a-w c:\windows\grep.exe + 2008-08-29 04:44:08 27,136 ----a-r c:\windows\Installer\{02DFF6B1-1654-411C-8D7B-FD6052EF016F}\AppleSoftwareUpdateIco.exe + 2008-06-20 03:08:23 55,808 ----a-r c:\windows\Installer\{E2B64929-B616-4235-B10E-D26D686296F9}\Icon8FD64119.exe + 2008-06-20 03:08:24 14,336 ----a-r c:\windows\Installer\{E2B64929-B616-4235-B10E-D26D686296F9}\Icon8FD641194.exe + 2008-06-20 03:08:24 14,336 ----a-r c:\windows\Installer\{E2B64929-B616-4235-B10E-D26D686296F9}\IconD233FA331.exe - 1998-10-29 21:45:06 306,688 ----a-w c:\windows\IsUninst.exe + 1998-10-29 20:45:06 306,688 ----a-w c:\windows\IsUninst.exe - 2000-08-31 12:00:00 28,160 ----a-w c:\windows\Nircmd.exe + 2000-08-31 13:00:00 28,672 ----a-w c:\windows\NIRCMD.exe - 2008-05-14 13:21:10 40,054 ----a-w c:\windows\nsreg.dat + 2008-11-25 18:10:09 40,054 ----a-w c:\windows\nsreg.dat - 2000-08-31 12:00:00 98,816 ----a-w c:\windows\sed.exe + 2000-08-31 13:00:00 98,816 ----a-w c:\windows\sed.exe - 2000-08-31 12:00:00 161,792 ----a-w c:\windows\swreg.exe + 2000-08-31 13:00:00 161,792 ----a-w c:\windows\SWREG.exe - 2000-08-31 12:00:00 136,704 ----a-w c:\windows\swsc.exe + 2000-08-31 13:00:00 136,704 ----a-w c:\windows\SWSC.exe - 2000-08-31 12:00:00 212,480 ----a-w c:\windows\swxcacls.exe + 2000-08-31 13:00:00 212,480 ----a-w c:\windows\SWXCACLS.exe - 2007-12-07 01:07:12 1,023,488 ----a-w c:\windows\SYSTEM32\browseui.dll + 2008-06-23 15:38:28 1,023,488 ----a-w c:\windows\SYSTEM32\browseui.dll - 2007-12-07 01:07:12 151,040 ----a-w c:\windows\SYSTEM32\cdfview.dll + 2008-06-23 15:38:29 151,040 ----a-w c:\windows\SYSTEM32\cdfview.dll - 2007-07-30 23:19:20 92,504 ----a-w c:\windows\SYSTEM32\cdm.dll + 2008-07-19 02:10:48 94,920 ----a-w c:\windows\SYSTEM32\cdm.dll + 2008-08-20 04:52:30 203,776 ----a-w c:\windows\SYSTEM32\clrviddc.dll - 2005-02-23 23:29:43 16,384 -c--a-w c:\windows\SYSTEM32\CONFIG\systemprofile\Cookies\index.dat + 2008-11-25 17:52:03 16,384 -c--a-w c:\windows\SYSTEM32\CONFIG\systemprofile\Cookies\index.dat - 2005-02-23 23:29:43 32,768 -c--a-w c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\index.dat + 2008-11-25 17:52:03 32,768 -c--a-w c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\index.dat + 2008-11-25 17:52:03 32,768 ----a-w c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2007-12-07 01:07:12 1,054,208 ----a-w c:\windows\SYSTEM32\danim.dll + 2008-06-23 15:38:30 1,054,208 ----a-w c:\windows\SYSTEM32\danim.dll - 2008-03-31 21:25:46 682,496 ----a-w c:\windows\SYSTEM32\DivX.dll + 2008-07-25 08:34:36 683,520 ----a-w c:\windows\SYSTEM32\DivX.dll - 2008-03-31 21:25:48 823,296 ----a-w c:\windows\SYSTEM32\divx_xx07.dll + 2008-07-25 08:34:42 823,296 ----a-w c:\windows\SYSTEM32\divx_xx07.dll - 2008-03-31 21:25:46 831,488 ----a-w c:\windows\SYSTEM32\divx_xx0a.dll + 2008-07-25 08:34:40 815,104 ----a-w c:\windows\SYSTEM32\divx_xx0a.dll - 2008-03-31 21:25:48 823,296 ----a-w c:\windows\SYSTEM32\divx_xx0c.dll + 2008-07-25 08:34:40 823,296 ----a-w c:\windows\SYSTEM32\divx_xx0c.dll - 2008-03-31 21:25:46 802,816 ----a-w c:\windows\SYSTEM32\divx_xx11.dll + 2008-07-25 08:34:40 802,816 ----a-w c:\windows\SYSTEM32\divx_xx11.dll - 2008-03-31 21:25:52 161,096 ----a-w c:\windows\SYSTEM32\DivXCodecVersionChecker.exe + 2008-07-25 08:34:30 161,096 ----a-w c:\windows\SYSTEM32\DivXCodecVersionChecker.exe - 2008-03-21 20:30:12 524,288 ----a-w c:\windows\SYSTEM32\DivXsm.exe + 2008-07-25 08:36:00 524,288 ----a-w c:\windows\SYSTEM32\DivXsm.exe - 2008-03-21 20:28:20 12,288 ----a-w c:\windows\SYSTEM32\DivXWMPExtType.dll + 2008-07-23 16:46:38 12,288 ----a-w c:\windows\SYSTEM32\DivXWMPExtType.dll + 2008-06-20 10:44:38 138,368 ------w c:\windows\SYSTEM32\DLLCACHE\afd.sys - 2007-12-07 01:07:12 1,023,488 ------w c:\windows\SYSTEM32\DLLCACHE\browseui.dll + 2008-06-23 15:38:28 1,023,488 ------w c:\windows\SYSTEM32\DLLCACHE\browseui.dll + 2008-06-13 13:10:50 272,128 ------w c:\windows\SYSTEM32\DLLCACHE\bthport.sys - 2007-12-07 01:07:12 151,040 ------w c:\windows\SYSTEM32\DLLCACHE\cdfview.dll + 2008-06-23 15:38:29 151,040 ------w c:\windows\SYSTEM32\DLLCACHE\cdfview.dll - 2007-07-30 23:19:20 92,504 -c--a-w c:\windows\SYSTEM32\DLLCACHE\cdm.dll + 2008-07-19 02:10:48 94,920 ----a-w c:\windows\SYSTEM32\DLLCACHE\cdm.dll - 2007-12-07 01:07:12 1,054,208 ------w c:\windows\SYSTEM32\DLLCACHE\danim.dll + 2008-06-23 15:38:30 1,054,208 ------w c:\windows\SYSTEM32\DLLCACHE\danim.dll + 2008-03-25 04:50:25 554,008 ------w c:\windows\SYSTEM32\DLLCACHE\dao360.dll - 2008-02-20 05:32:43 148,992 ------w c:\windows\SYSTEM32\DLLCACHE\dnsapi.dll + 2008-06-20 17:41:10 148,992 ----a-w c:\windows\SYSTEM32\DLLCACHE\dnsapi.dll - 2007-12-07 01:07:12 357,888 ------w c:\windows\SYSTEM32\DLLCACHE\dxtmsft.dll + 2008-06-23 15:38:30 357,888 ------w c:\windows\SYSTEM32\DLLCACHE\dxtmsft.dll - 2007-12-07 01:07:12 205,312 ------w c:\windows\SYSTEM32\DLLCACHE\dxtrans.dll + 2008-06-23 15:38:30 205,312 ------w c:\windows\SYSTEM32\DLLCACHE\dxtrans.dll - 2007-12-07 01:07:12 55,808 ------w c:\windows\SYSTEM32\DLLCACHE\extmgr.dll + 2008-06-23 15:38:30 55,808 ------w c:\windows\SYSTEM32\DLLCACHE\extmgr.dll - 2007-12-06 13:07:07 18,432 ------w c:\windows\SYSTEM32\DLLCACHE\iedw.exe + 2008-06-23 09:49:29 18,432 ------w c:\windows\SYSTEM32\DLLCACHE\iedw.exe - 2007-12-07 01:07:12 251,392 ------w c:\windows\SYSTEM32\DLLCACHE\iepeers.dll + 2008-06-23 15:38:31 251,392 ------w c:\windows\SYSTEM32\DLLCACHE\iepeers.dll - 2007-08-21 06:15:44 683,520 -c----w c:\windows\SYSTEM32\DLLCACHE\inetcomm.dll + 2008-04-11 18:50:43 683,520 ------w c:\windows\SYSTEM32\DLLCACHE\inetcomm.dll - 2007-12-07 01:07:12 96,256 ------w c:\windows\SYSTEM32\DLLCACHE\inseng.dll + 2008-06-23 15:38:31 96,256 ------w c:\windows\SYSTEM32\DLLCACHE\inseng.dll - 2007-12-07 01:07:12 16,384 ------w c:\windows\SYSTEM32\DLLCACHE\jsproxy.dll + 2008-06-23 15:38:31 16,384 ------w c:\windows\SYSTEM32\DLLCACHE\jsproxy.dll + 2008-05-01 14:30:33 331,776 ------w c:\windows\SYSTEM32\DLLCACHE\msadce.dll + 2008-03-25 04:50:28 518,944 ------w c:\windows\SYSTEM32\DLLCACHE\msexch40.dll + 2008-03-25 04:50:30 326,432 ------w c:\windows\SYSTEM32\DLLCACHE\msexcl40.dll - 2007-12-07 14:37:14 3,059,200 ------w c:\windows\SYSTEM32\DLLCACHE\mshtml.dll + 2008-06-23 15:38:33 3,059,712 ------w c:\windows\SYSTEM32\DLLCACHE\mshtml.dll - 2007-12-07 01:07:13 449,024 ------w c:\windows\SYSTEM32\DLLCACHE\mshtmled.dll + 2008-06-23 15:38:33 449,024 ------w c:\windows\SYSTEM32\DLLCACHE\mshtmled.dll + 2008-03-25 04:50:34 1,516,568 ------w c:\windows\SYSTEM32\DLLCACHE\msjet40.dll + 2008-03-25 04:50:40 355,112 ------w c:\windows\SYSTEM32\DLLCACHE\msjetol1.dll + 2008-03-27 08:12:54 151,583 ------w c:\windows\SYSTEM32\DLLCACHE\msjint40.dll + 2008-03-25 04:50:42 60,192 ------w c:\windows\SYSTEM32\DLLCACHE\msjter40.dll + 2008-03-25 04:50:42 248,608 ------w c:\windows\SYSTEM32\DLLCACHE\msjtes40.dll + 2008-03-25 04:50:44 219,936 ------w c:\windows\SYSTEM32\DLLCACHE\msltus40.dll + 2008-03-25 04:50:45 355,104 ------w c:\windows\SYSTEM32\DLLCACHE\mspbde40.dll - 2007-12-07 01:07:13 146,432 ------w c:\windows\SYSTEM32\DLLCACHE\msrating.dll + 2008-06-23 15:38:33 146,432 ------w c:\windows\SYSTEM32\DLLCACHE\msrating.dll + 2008-03-25 04:50:47 432,928 ------w c:\windows\SYSTEM32\DLLCACHE\msrd2x40.dll + 2008-03-25 04:50:49 322,336 ------w c:\windows\SYSTEM32\DLLCACHE\msrd3x40.dll + 2008-03-25 04:50:52 559,904 ------w c:\windows\SYSTEM32\DLLCACHE\msrepl40.dll + 2008-03-25 04:50:55 264,992 ------w c:\windows\SYSTEM32\DLLCACHE\mstext40.dll - 2007-12-07 01:07:13 532,480 ------w c:\windows\SYSTEM32\DLLCACHE\mstime.dll + 2008-06-23 15:38:33 532,480 ------w c:\windows\SYSTEM32\DLLCACHE\mstime.dll + 2008-03-25 04:50:57 838,432 ------w c:\windows\SYSTEM32\DLLCACHE\mswdat10.dll + 2008-06-20 17:41:10 245,248 ------w c:\windows\SYSTEM32\DLLCACHE\mswsock.dll + 2008-03-25 04:50:58 621,344 ------w c:\windows\SYSTEM32\DLLCACHE\mswstr10.dll + 2008-03-25 04:50:58 355,104 ------w c:\windows\SYSTEM32\DLLCACHE\msxbde40.dll - 2007-12-07 01:07:13 39,424 ------w c:\windows\SYSTEM32\DLLCACHE\pngfilt.dll + 2008-06-23 15:38:33 39,424 ------w c:\windows\SYSTEM32\DLLCACHE\pngfilt.dll - 2007-10-29 22:43:03 1,287,680 -c----w c:\windows\SYSTEM32\DLLCACHE\quartz.dll + 2008-05-07 05:18:48 1,287,680 ------w c:\windows\SYSTEM32\DLLCACHE\quartz.dll - 2006-07-13 08:48:58 202,240 ----a-w c:\windows\SYSTEM32\DLLCACHE\rmcast.sys + 2008-05-08 12:28:49 202,752 ----a-w c:\windows\SYSTEM32\DLLCACHE\rmcast.sys - 2007-12-07 01:07:13 1,494,528 ------w c:\windows\SYSTEM32\DLLCACHE\shdocvw.dll + 2008-06-23 15:38:34 1,494,528 ------w c:\windows\SYSTEM32\DLLCACHE\shdocvw.dll - 2007-12-07 01:07:13 474,112 ------w c:\windows\SYSTEM32\DLLCACHE\shlwapi.dll + 2008-06-23 15:38:34 474,112 ------w c:\windows\SYSTEM32\DLLCACHE\shlwapi.dll - 2007-10-30 17:20:55 360,064 ------w c:\windows\SYSTEM32\DLLCACHE\tcpip.sys + 2008-06-20 10:45:13 360,320 ----a-w c:\windows\SYSTEM32\DLLCACHE\tcpip.sys - 2006-08-16 09:37:30 225,664 ----a-w c:\windows\SYSTEM32\DLLCACHE\tcpip6.sys + 2008-06-20 09:52:06 225,920 ----a-w c:\windows\SYSTEM32\DLLCACHE\tcpip6.sys - 2007-12-07 01:07:14 615,424 ------w c:\windows\SYSTEM32\DLLCACHE\urlmon.dll + 2008-06-23 15:38:34 615,936 ------w c:\windows\SYSTEM32\DLLCACHE\urlmon.dll - 2007-12-07 01:07:14 659,456 ------w c:\windows\SYSTEM32\DLLCACHE\wininet.dll + 2008-06-23 15:38:34 659,456 ------w c:\windows\SYSTEM32\DLLCACHE\wininet.dll - 2007-07-30 23:19:36 549,720 -c--a-w c:\windows\SYSTEM32\DLLCACHE\wuapi.dll + 2008-07-19 02:09:44 563,912 ----a-w c:\windows\SYSTEM32\DLLCACHE\wuapi.dll - 2007-07-30 23:19:16 53,080 -c--a-w c:\windows\SYSTEM32\DLLCACHE\wuauclt.exe + 2008-07-19 02:10:42 53,448 ----a-w c:\windows\SYSTEM32\DLLCACHE\wuauclt.exe - 2007-07-30 23:19:42 1,712,984 -c--a-w c:\windows\SYSTEM32\DLLCACHE\wuaueng.dll + 2008-07-19 02:09:42 1,811,656 ----a-w c:\windows\SYSTEM32\DLLCACHE\wuaueng.dll - 2007-07-30 23:19:32 325,976 -c--a-w c:\windows\SYSTEM32\DLLCACHE\wucltui.dll + 2008-07-19 02:09:46 325,832 ----a-w c:\windows\SYSTEM32\DLLCACHE\wucltui.dll - 2007-07-30 23:18:40 33,624 -c--a-w c:\windows\SYSTEM32\DLLCACHE\wups.dll + 2008-07-19 02:10:20 36,552 ----a-w c:\windows\SYSTEM32\DLLCACHE\wups.dll - 2007-07-30 23:19:28 203,096 -c--a-w c:\windows\SYSTEM32\DLLCACHE\wuweb.dll + 2008-07-19 02:09:44 205,000 ----a-w c:\windows\SYSTEM32\DLLCACHE\wuweb.dll - 2008-02-20 05:32:43 148,992 ----a-w c:\windows\SYSTEM32\dnsapi.dll + 2008-06-20 17:41:10 148,992 ----a-w c:\windows\SYSTEM32\dnsapi.dll - 2008-03-21 20:28:54 81,920 ----a-w c:\windows\SYSTEM32\dpl100.dll + 2008-07-25 08:34:54 81,920 ----a-w c:\windows\SYSTEM32\dpl100.dll - 2008-03-21 20:28:50 294,912 ----a-w c:\windows\SYSTEM32\dpu10.dll + 2008-07-25 08:34:46 294,912 ----a-w c:\windows\SYSTEM32\dpu10.dll - 2008-03-21 20:28:50 294,912 ----a-w c:\windows\SYSTEM32\dpu11.dll + 2008-07-25 08:34:46 294,912 ----a-w c:\windows\SYSTEM32\dpu11.dll - 2008-03-21 20:28:52 53,248 ----a-w c:\windows\SYSTEM32\dpuGUI10.dll + 2008-07-25 08:34:50 53,248 ----a-w c:\windows\SYSTEM32\dpuGUI10.dll - 2008-03-21 20:28:50 593,920 ----a-w c:\windows\SYSTEM32\dpuGUI11.dll + 2008-07-25 08:34:46 593,920 ----a-w c:\windows\SYSTEM32\dpuGUI11.dll - 2008-03-21 20:28:50 344,064 ----a-w c:\windows\SYSTEM32\dpus11.dll + 2008-07-25 08:34:46 344,064 ----a-w c:\windows\SYSTEM32\dpus11.dll - 2008-03-21 20:28:50 57,344 ----a-w c:\windows\SYSTEM32\dpv11.dll + 2008-07-25 08:34:46 57,344 ----a-w c:\windows\SYSTEM32\dpv11.dll - 2004-08-04 11:00:00 138,496 ----a-w c:\windows\SYSTEM32\DRIVERS\AFD.SYS + 2008-06-20 10:44:38 138,368 ----a-w c:\windows\SYSTEM32\DRIVERS\afd.sys + 2008-06-13 13:10:50 272,128 ------w c:\windows\SYSTEM32\DRIVERS\bthport.sys - 2006-08-29 02:48:26 2,432 ----a-w c:\windows\SYSTEM32\DRIVERS\cdr4_xp.sys + 2008-07-23 16:50:48 9,336 ------w c:\windows\SYSTEM32\DRIVERS\cdr4_xp.sys - 2006-08-29 02:48:26 2,560 ----a-w c:\windows\SYSTEM32\DRIVERS\cdralw2k.sys + 2008-07-23 16:50:48 9,464 ------w c:\windows\SYSTEM32\DRIVERS\cdralw2k.sys + 2007-07-19 19:10:28 127,768 ----a-w c:\windows\SYSTEM32\DRIVERS\klif.sys + 2008-07-31 00:07:52 17,144 ----a-w c:\windows\SYSTEM32\DRIVERS\mbam.sys + 2008-07-31 00:07:56 38,472 ----a-w c:\windows\SYSTEM32\DRIVERS\mbamswissarmy.sys - 2006-07-13 08:48:58 202,240 -c--a-w c:\windows\SYSTEM32\DRIVERS\rmcast.sys + 2008-05-08 12:28:49 202,752 ----a-w c:\windows\SYSTEM32\DRIVERS\rmcast.sys - 2007-10-30 17:20:55 360,064 ----a-w c:\windows\SYSTEM32\DRIVERS\tcpip.sys + 2008-06-20 10:45:13 360,320 ----a-w c:\windows\SYSTEM32\DRIVERS\tcpip.sys - 2006-08-16 09:37:30 225,664 -c--a-w c:\windows\SYSTEM32\DRIVERS\tcpip6.sys + 2008-06-20 09:52:06 225,920 ----a-w c:\windows\SYSTEM32\DRIVERS\tcpip6.sys - 2008-03-21 20:28:54 196,608 ----a-w c:\windows\SYSTEM32\dtu100.dll + 2008-07-25 08:34:52 196,608 ----a-w c:\windows\SYSTEM32\dtu100.dll - 2007-12-07 01:07:12 357,888 ----a-w c:\windows\SYSTEM32\dxtmsft.dll + 2008-06-23 15:38:30 357,888 ----a-w c:\windows\SYSTEM32\dxtmsft.dll - 2007-12-07 01:07:12 205,312 ----a-w c:\windows\SYSTEM32\dxtrans.dll + 2008-06-23 15:38:30 205,312 ----a-w c:\windows\SYSTEM32\dxtrans.dll - 2007-12-07 01:07:12 55,808 ----a-w c:\windows\SYSTEM32\extmgr.dll + 2008-06-23 15:38:30 55,808 ----a-w c:\windows\SYSTEM32\extmgr.dll - 2008-05-04 22:47:27 499,440 ----a-w c:\windows\SYSTEM32\FNTCACHE.DAT + 2008-06-02 10:27:14 1,763,096 ----a-w c:\windows\SYSTEM32\FNTCACHE.DAT - 2007-12-07 01:07:12 251,392 ----a-w c:\windows\SYSTEM32\iepeers.dll + 2008-06-23 15:38:31 251,392 ----a-w c:\windows\SYSTEM32\iepeers.dll - 2007-08-21 06:15:44 683,520 ----a-w c:\windows\SYSTEM32\inetcomm.dll + 2008-04-11 18:50:43 683,520 ----a-w c:\windows\SYSTEM32\inetcomm.dll - 2007-12-07 01:07:12 96,256 ----a-w c:\windows\SYSTEM32\inseng.dll + 2008-06-23 15:38:31 96,256 ----a-w c:\windows\SYSTEM32\inseng.dll - 2007-12-07 01:07:12 16,384 ----a-w c:\windows\SYSTEM32\jsproxy.dll + 2008-06-23 15:38:31 16,384 ----a-w c:\windows\SYSTEM32\jsproxy.dll - 2008-03-21 20:30:00 1,044,480 ----a-w c:\windows\SYSTEM32\libdivx.dll + 2008-07-23 16:48:40 1,044,480 ----a-w c:\windows\SYSTEM32\libdivx.dll + 2008-07-09 13:05:08 796,048 ----a-w c:\windows\SYSTEM32\libeay32_0.9.6l.dll + 2003-03-19 01:12:12 1,047,552 ----a-w c:\windows\SYSTEM32\mfc71u.dll - 2008-04-06 05:56:20 19,836,024 ----a-w c:\windows\SYSTEM32\MRT.exe + 2008-06-25 13:15:48 17,972,344 ----a-w c:\windows\SYSTEM32\MRT.exe - 2004-08-04 11:00:00 512,029 ----a-w c:\windows\SYSTEM32\MSEXCH40.DLL + 2008-03-25 04:50:28 518,944 ----a-w c:\windows\SYSTEM32\msexch40.dll - 2004-08-04 11:00:00 319,517 ----a-w c:\windows\SYSTEM32\MSEXCL40.DLL + 2008-03-25 04:50:30 326,432 ----a-w c:\windows\SYSTEM32\msexcl40.dll - 2007-12-07 14:37:14 3,059,200 ----a-w c:\windows\SYSTEM32\mshtml.dll + 2008-06-23 15:38:33 3,059,712 ----a-w c:\windows\SYSTEM32\mshtml.dll - 2007-12-07 01:07:13 449,024 ----a-w c:\windows\SYSTEM32\mshtmled.dll + 2008-06-23 15:38:33 449,024 ----a-w c:\windows\SYSTEM32\mshtmled.dll - 2004-08-04 11:00:00 1,507,356 ----a-w c:\windows\SYSTEM32\MSJET40.DLL + 2008-03-25 04:50:34 1,516,568 ----a-w c:\windows\SYSTEM32\msjet40.dll - 2004-08-04 11:00:00 358,976 ----a-w c:\windows\SYSTEM32\msjetoledb40.dll + 2008-03-25 04:50:40 355,112 ----a-w c:\windows\SYSTEM32\msjetoledb40.dll - 2004-08-04 11:00:00 151,583 ----a-w c:\windows\SYSTEM32\MSJINT40.DLL + 2008-03-27 08:12:54 151,583 ----a-w c:\windows\SYSTEM32\msjint40.dll - 2004-08-04 11:00:00 53,279 ----a-w c:\windows\SYSTEM32\MSJTER40.DLL + 2008-03-25 04:50:42 60,192 ----a-w c:\windows\SYSTEM32\msjter40.dll - 2004-08-04 11:00:00 241,693 ----a-w c:\windows\SYSTEM32\MSJTES40.DLL + 2008-03-25 04:50:42 248,608 ----a-w c:\windows\SYSTEM32\msjtes40.dll - 2004-08-04 11:00:00 213,023 ----a-w c:\windows\SYSTEM32\MSLTUS40.DLL + 2008-03-25 04:50:44 219,936 ----a-w c:\windows\SYSTEM32\msltus40.dll - 2004-08-04 11:00:00 348,189 ----a-w c:\windows\SYSTEM32\MSPBDE40.DLL + 2008-03-25 04:50:45 355,104 ----a-w c:\windows\SYSTEM32\mspbde40.dll - 2007-12-07 01:07:13 146,432 ----a-w c:\windows\SYSTEM32\msrating.dll + 2008-06-23 15:38:33 146,432 ----a-w c:\windows\SYSTEM32\msrating.dll - 2004-08-04 11:00:00 421,919 ----a-w c:\windows\SYSTEM32\MSRD2X40.DLL + 2008-03-25 04:50:47 432,928 ----a-w c:\windows\SYSTEM32\msrd2x40.dll - 2004-08-04 11:00:00 315,423 ----a-w c:\windows\SYSTEM32\MSRD3X40.DLL + 2008-03-25 04:50:49 322,336 ----a-w c:\windows\SYSTEM32\msrd3x40.dll - 2004-08-04 11:00:00 552,989 ----a-w c:\windows\SYSTEM32\MSREPL40.DLL + 2008-03-25 04:50:52 559,904 ----a-w c:\windows\SYSTEM32\msrepl40.dll - 2004-08-04 11:00:00 258,077 ----a-w c:\windows\SYSTEM32\MSTEXT40.DLL + 2008-03-25 04:50:55 264,992 ----a-w c:\windows\SYSTEM32\mstext40.dll - 2007-12-07 01:07:13 532,480 ----a-w c:\windows\SYSTEM32\mstime.dll + 2008-06-23 15:38:33 532,480 ----a-w c:\windows\SYSTEM32\mstime.dll - 2007-09-13 22:51:30 499,712 ----a-w c:\windows\SYSTEM32\msvcp71.dll + 2008-08-14 05:56:02 499,712 ----a-w c:\windows\SYSTEM32\msvcp71.dll - 2007-09-13 22:51:30 348,160 ----a-w c:\windows\SYSTEM32\msvcr71.dll + 2008-08-14 05:56:09 348,160 ----a-w c:\windows\SYSTEM32\msvcr71.dll - 2004-08-04 11:00:00 831,519 ----a-w c:\windows\SYSTEM32\MSWDAT10.DLL + 2008-03-25 04:50:57 838,432 ----a-w c:\windows\SYSTEM32\mswdat10.dll - 2004-08-04 11:00:00 245,248 ----a-w c:\windows\SYSTEM32\MSWSOCK.DLL + 2008-06-20 17:41:10 245,248 ----a-w c:\windows\SYSTEM32\mswsock.dll - 2004-08-04 11:00:00 614,429 ----a-w c:\windows\SYSTEM32\MSWSTR10.DLL + 2008-03-25 04:50:58 621,344 ----a-w c:\windows\SYSTEM32\mswstr10.dll - 2004-08-04 11:00:00 348,189 ----a-w c:\windows\SYSTEM32\MSXBDE40.DLL + 2008-03-25 04:50:58 355,104 ----a-w c:\windows\SYSTEM32\msxbde40.dll - 2008-05-26 04:06:57 53,436 ----a-w c:\windows\SYSTEM32\PERFC009.DAT + 2008-11-08 20:49:21 53,436 ----a-w c:\windows\SYSTEM32\PERFC009.DAT - 2008-05-26 04:06:58 381,692 ----a-w c:\windows\SYSTEM32\PERFH009.DAT + 2008-11-08 20:49:21 381,692 ----a-w c:\windows\SYSTEM32\PERFH009.DAT - 2007-09-20 10:31:46 278,528 ----a-w c:\windows\SYSTEM32\pncrt.dll + 2008-08-14 05:55:55 278,528 ----a-w c:\windows\SYSTEM32\pncrt.dll - 2007-09-22 18:49:01 6,656 ----a-w c:\windows\SYSTEM32\pndx5016.dll + 2008-08-14 06:00:27 6,656 ----a-w c:\windows\SYSTEM32\pndx5016.dll - 2007-09-22 18:49:01 5,632 ----a-w c:\windows\SYSTEM32\pndx5032.dll + 2008-08-14 06:00:32 5,632 ----a-w c:\windows\SYSTEM32\pndx5032.dll - 2007-12-07 01:07:13 39,424 ----a-w c:\windows\SYSTEM32\pngfilt.dll + 2008-06-23 15:38:33 39,424 ----a-w c:\windows\SYSTEM32\pngfilt.dll - 2008-03-21 20:30:04 129,784 ------w c:\windows\SYSTEM32\pxafs.dll + 2008-07-23 16:50:46 129,784 ------w c:\windows\SYSTEM32\pxafs.dll - 2008-03-21 20:30:08 3,596,288 ----a-w c:\windows\SYSTEM32\qt-dx331.dll + 2008-07-23 16:50:52 3,596,288 ----a-w c:\windows\SYSTEM32\qt-dx331.dll - 2007-10-29 22:43:03 1,287,680 ----a-w c:\windows\SYSTEM32\quartz.dll + 2008-05-07 05:18:48 1,287,680 ----a-w c:\windows\SYSTEM32\quartz.dll - 2007-09-22 18:49:50 176,167 ----a-w c:\windows\SYSTEM32\rmoc3260.dll + 2008-08-14 07:14:33 185,944 ----a-w c:\windows\SYSTEM32\rmoc3260.dll - 2007-12-07 01:07:13 1,494,528 ----a-w c:\windows\SYSTEM32\shdocvw.dll + 2008-06-23 15:38:34 1,494,528 ----a-w c:\windows\SYSTEM32\shdocvw.dll - 2007-12-07 01:07:13 474,112 ----a-w c:\windows\SYSTEM32\shlwapi.dll + 2008-06-23 15:38:34 474,112 ----a-w c:\windows\SYSTEM32\shlwapi.dll + 2008-07-19 02:10:20 36,552 ----a-w c:\windows\SYSTEM32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.2.6001.784\wups.dll + 2008-07-19 02:10:40 45,768 ----a-w c:\windows\SYSTEM32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.2.6001.784\wups2.dll - 2006-12-10 18:10:02 14,640 ------w c:\windows\SYSTEM32\spmsg.dll + 2007-11-30 11:18:51 17,272 ------w c:\windows\SYSTEM32\spmsg.dll - 2008-03-21 20:30:00 200,704 ----a-w c:\windows\SYSTEM32\ssldivx.dll + 2008-07-23 16:48:40 200,704 ----a-w c:\windows\SYSTEM32\ssldivx.dll + 2007-03-22 00:54:16 77,312 ----a-w c:\windows\SYSTEM32\TWAIN_32.DLL + 2007-03-22 00:54:16 48,560 ----a-w c:\windows\SYSTEM32\TWUNK_16.EXE + 2007-03-22 00:54:16 69,632 ----a-w c:\windows\SYSTEM32\TWUNK_32.EXE - 2007-11-13 11:31:11 60,416 ------w c:\windows\SYSTEM32\tzchange.exe + 2008-07-14 11:09:18 62,976 ------w c:\windows\SYSTEM32\tzchange.exe + 2007-10-01 21:20:40 245,408 ----a-w c:\windows\SYSTEM32\unicows.dll + 2007-09-04 16:56:10 164,352 ----a-w c:\windows\SYSTEM32\unrar.dll - 2007-12-07 01:07:14 615,424 ----a-w c:\windows\SYSTEM32\urlmon.dll + 2008-06-23 15:38:34 615,936 ----a-w c:\windows\SYSTEM32\urlmon.dll + 2006-09-28 16:42:52 5,451,776 ----a-r c:\windows\SYSTEM32\V2iDiskLib.dll + 2008-05-16 03:32:22 219,696 ----a-w c:\windows\SYSTEM32\vmnc.dll + 2008-07-09 13:05:10 83,432 ----a-w c:\windows\SYSTEM32\vsdata.dll + 2008-07-09 13:05:22 394,952 ----a-w c:\windows\SYSTEM32\vsdatant.sys + 2008-07-09 13:05:10 157,160 ----a-w c:\windows\SYSTEM32\vsinit.dll + 2008-07-09 13:05:10 103,912 ----a-w c:\windows\SYSTEM32\vsmonapi.dll + 2008-07-09 13:05:10 275,944 ----a-w c:\windows\SYSTEM32\vspubapi.dll + 2008-07-09 13:05:10 71,144 ----a-w c:\windows\SYSTEM32\vsregexp.dll + 2008-07-09 13:05:12 472,552 ----a-w c:\windows\SYSTEM32\vsutil.dll + 2008-07-09 13:05:12 46,568 ----a-w c:\windows\SYSTEM32\vswmi.dll + 2008-07-09 13:05:12 99,816 ----a-w c:\windows\SYSTEM32\vsxml.dll - 2007-12-07 01:07:14 659,456 ----a-w c:\windows\SYSTEM32\wininet.dll + 2008-06-23 15:38:34 659,456 ----a-w c:\windows\SYSTEM32\wininet.dll - 2007-07-30 23:19:36 549,720 ----a-w c:\windows\SYSTEM32\wuapi.dll + 2008-07-19 02:09:44 563,912 ----a-w c:\windows\SYSTEM32\wuapi.dll - 2007-07-30 23:19:16 53,080 ----a-w c:\windows\SYSTEM32\wuauclt.exe + 2008-07-19 02:10:42 53,448 ----a-w c:\windows\SYSTEM32\wuauclt.exe - 2007-07-30 23:19:42 1,712,984 ----a-w c:\windows\SYSTEM32\wuaueng.dll + 2008-07-19 02:09:42 1,811,656 ----a-w c:\windows\SYSTEM32\wuaueng.dll - 2007-07-30 23:19:32 325,976 ----a-w c:\windows\SYSTEM32\wucltui.dll + 2008-07-19 02:09:46 325,832 ----a-w c:\windows\SYSTEM32\wucltui.dll - 2007-07-30 23:18:40 33,624 ----a-w c:\windows\SYSTEM32\wups.dll + 2008-07-19 02:10:20 36,552 ----a-w c:\windows\SYSTEM32\wups.dll - 2007-07-30 23:19:12 43,352 ----a-w c:\windows\SYSTEM32\wups2.dll + 2008-07-19 02:10:40 45,768 ----a-w c:\windows\SYSTEM32\wups2.dll - 2007-07-30 23:19:28 203,096 ----a-w c:\windows\SYSTEM32\wuweb.dll + 2008-07-19 02:09:44 205,000 ----a-w c:\windows\SYSTEM32\wuweb.dll - 2007-12-06 09:38:31 350,720 ----a-w c:\windows\SYSTEM32\xpsp3res.dll + 2008-07-03 09:14:02 351,744 ----a-w c:\windows\SYSTEM32\xpsp3res.dll + 2008-07-09 13:05:12 83,432 ----a-w c:\windows\SYSTEM32\zlcomm.dll + 2008-07-09 13:05:12 71,144 ----a-w c:\windows\SYSTEM32\zlcommdb.dll + 2008-08-13 20:11:14 4,212 ---h--w c:\windows\SYSTEM32\zllictbl.dat + 2008-07-09 13:05:06 370,208 ----a-w c:\windows\SYSTEM32\ZoneLabs\av.dll + 2007-05-31 04:03:30 65,248 ----a-w c:\windows\SYSTEM32\ZoneLabs\avsys\bases\aphish.dat + 2006-06-30 18:47:36 21,568 ----a-w c:\windows\SYSTEM32\ZoneLabs\avsys\bases\avcmhk4.dll + 2007-05-31 04:03:30 1,628 ----a-w c:\windows\SYSTEM32\ZoneLabs\avsys\bases\pdmkl.dat + 2007-05-31 04:03:16 77,824 ----a-w c:\windows\SYSTEM32\ZoneLabs\avsys\CKAHComm.dll + 2007-05-31 04:03:16 110,592 ----a-w c:\windows\SYSTEM32\ZoneLabs\avsys\CKAHrule.dll + 2007-05-31 04:03:16 331,776 ----a-w c:\windows\SYSTEM32\ZoneLabs\avsys\CKAHUM.dll + 2007-05-31 04:03:16 38,400 ----a-w c:\windows\SYSTEM32\ZoneLabs\avsys\FSSync.dll + 2006-09-20 03:12:14 208,960 ----a-w c:\windows\SYSTEM32\ZoneLabs\avsys\inv.dll + 2007-12-03 18:53:58 282,624 ----a-w c:\windows\SYSTEM32\ZoneLabs\avsys\kave.dll + 2006-12-19 22:13:52 1,093,632 ----a-w c:\windows\SYSTEM32\ZoneLabs\avsys\libeay32.dll + 2007-05-31 04:03:20 548,864 ----a-w c:\windows\SYSTEM32\ZoneLabs\avsys\msvcp80.dll + 2007-05-31 04:03:20 626,688 ----a-w c:\windows\SYSTEM32\ZoneLabs\avsys\msvcr80.dll + 2007-05-31 04:03:18 184,320 ----a-w c:\windows\SYSTEM32\ZoneLabs\avsys\prloader.dll + 2007-05-31 04:03:22 90,112 ----a-w c:\windows\SYSTEM32\ZoneLabs\avsys\prremote.dll + 2007-12-03 18:53:58 139,264 ----a-w c:\windows\SYSTEM32\ZoneLabs\avsys\ScanningProcess.exe + 2006-12-19 22:13:52 200,704 ----a-w c:\windows\SYSTEM32\ZoneLabs\avsys\ssleay32.dll + 2008-07-09 13:05:06 99,816 ----a-w c:\windows\SYSTEM32\ZoneLabs\camupd.dll + 2004-01-30 16:35:08 813,568 ----a-w c:\windows\SYSTEM32\ZoneLabs\dbghelp.dll + 2008-07-09 13:05:08 128,480 ----a-w c:\windows\SYSTEM32\ZoneLabs\fbl.dll + 2008-07-09 13:05:08 38,376 ----a-w c:\windows\SYSTEM32\ZoneLabs\featuremap.dll + 2008-07-09 13:05:08 321,016 ----a-w c:\windows\SYSTEM32\ZoneLabs\imsecure.dll + 2008-07-09 13:05:24 288,144 ----a-w c:\windows\SYSTEM32\ZoneLabs\lib\ConfigWizard.zip.dll + 2008-08-13 22:38:14 152,976 ----a-w c:\windows\SYSTEM32\ZoneLabs\lib\licenseui.zip.dll + 2008-07-09 13:05:24 26,000 ----a-w c:\windows\SYSTEM32\ZoneLabs\lib\zlsvc.zip.dll + 2008-07-09 13:05:24 1,361,296 ----a-w c:\windows\SYSTEM32\ZoneLabs\lib\zpy.zip.dll + 2008-07-09 13:05:24 71,056 ----a-w c:\windows\SYSTEM32\ZoneLabs\lib\zui.zip.dll + 2008-07-09 13:06:26 30,184 ----a-w c:\windows\SYSTEM32\ZoneLabs\plugins\rpc_server\rpc_server.dll + 2008-07-09 13:06:26 30,216 ----a-w c:\windows\SYSTEM32\ZoneLabs\plugins\vsmon_plugin\vsmon_plugin.dll + 2008-02-27 07:10:26 714,208 ----a-w c:\windows\SYSTEM32\ZoneLabs\qrbase.dll + 2008-02-27 07:10:28 792,032 ----a-w c:\windows\SYSTEM32\ZoneLabs\qrsrecl.dll + 2008-07-09 13:05:08 173,544 ----a-w c:\windows\SYSTEM32\ZoneLabs\scheduler.dll + 2008-01-21 12:34:36 7,603,688 ----a-w c:\windows\SYSTEM32\ZoneLabs\spyware.dat + 2008-02-27 07:10:32 1,504,736 ----a-w c:\windows\SYSTEM32\ZoneLabs\srescan.dll + 2008-02-27 07:10:44 51,176 ----a-w c:\windows\SYSTEM32\ZoneLabs\srescan.sys + 2008-07-09 13:05:10 456,168 ----a-w c:\windows\SYSTEM32\ZoneLabs\ssleay32.dll + 2008-07-09 13:06:26 214,528 ----a-w c:\windows\SYSTEM32\ZoneLabs\streamapi\httpblocker\httpblocker.dll + 2008-07-09 13:06:30 3,266,040 ----a-w c:\windows\SYSTEM32\ZoneLabs\streamapi\imslsp\imslsp.dll + 2006-09-05 00:59:14 503,875 ----a-w c:\windows\SYSTEM32\ZoneLabs\upd_core.dll + 2007-10-11 20:50:32 832,984 ----a-w c:\windows\SYSTEM32\ZoneLabs\updating.dll + 2008-07-09 13:05:18 144,936 ----a-w c:\windows\SYSTEM32\ZoneLabs\updclient.exe + 2007-01-11 21:31:06 286,787 ----a-w c:\windows\SYSTEM32\ZoneLabs\updtrsdk.dll + 2008-07-09 13:05:10 108,008 ----a-w c:\windows\SYSTEM32\ZoneLabs\vsavpro.dll + 2008-07-09 13:05:10 83,432 ----a-w c:\windows\SYSTEM32\ZoneLabs\vsdb.dll + 2008-07-09 13:05:18 75,304 ----a-w c:\windows\SYSTEM32\ZoneLabs\vsmon.exe + 2008-07-09 13:05:10 2,029,032 ----a-w c:\windows\SYSTEM32\ZoneLabs\vsmondll.dll + 2008-07-09 13:05:12 1,361,384 ----a-w c:\windows\SYSTEM32\ZoneLabs\vsruledb.dll + 2008-07-09 13:05:12 239,080 ----a-w c:\windows\SYSTEM32\ZoneLabs\vsvault.dll + 2008-01-21 12:34:36 7,603,688 ----a-w c:\windows\SYSTEM32\ZoneLabs\zlasdbup.dat + 2008-07-09 13:05:12 177,640 ----a-w c:\windows\SYSTEM32\ZoneLabs\zlparser.dll + 2008-07-09 13:05:12 79,344 ----a-w c:\windows\SYSTEM32\ZoneLabs\zlquarantine.dll + 2008-07-09 13:05:14 382,440 ----a-w c:\windows\SYSTEM32\ZoneLabs\zlsre.dll + 2008-07-09 13:05:14 120,296 ----a-w c:\windows\SYSTEM32\ZoneLabs\zlupdate.dll + 2008-07-09 13:05:16 1,086,952 ----a-w c:\windows\SYSTEM32\zpeng24.dll - 2000-08-31 12:00:00 49,152 ----a-w c:\windows\VFind.exe + 2000-08-31 13:00:00 49,152 ----a-w c:\windows\VFIND.exe + 2006-06-05 18:14:28 479,232 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcm80.dll + 2006-06-05 18:14:28 548,864 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcp80.dll + 2006-06-05 18:14:28 626,688 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcr80.dll + 2006-12-02 03:54:32 479,232 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll + 2006-12-02 03:54:34 548,864 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll + 2006-12-02 03:54:32 626,688 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll + 2006-12-02 05:25:52 1,101,824 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll + 2006-12-02 05:25:56 1,093,120 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll + 2006-12-02 05:25:58 69,632 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll + 2006-12-02 05:26:00 57,856 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll + 2008-04-15 17:54:19 1,724,416 ----a-w c:\windows\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll - 2000-08-31 12:00:00 68,096 ----a-w c:\windows\zip.exe + 2000-08-31 13:00:00 68,096 ----a-w c:\windows\zip.exe + 2008-07-09 13:05:20 75,248 ----a-w c:\windows\zllsputility.exe . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 221184] "Creative WebCam Tray"="c:\program files\Creative\Shared Files\CAMTRAY.EXE" [2004-07-30 245760] "SunJavaUpdateSched"="c:\program files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 32881] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-06-21 155648] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-06-21 126976] "PPMemCheck"="c:\progra~1\PESTPA~1\PPMemCheck.exe" [2003-04-19 148480] "CookiePatrol"="c:\progra~1\PESTPA~1\CookiePatrol.exe" [2003-05-29 69632] "ZoneAlarm Client"="c:\program files\ZoneAlarm\zlclient.exe" [2008-07-09 919016] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-14 185896] c:\documents and settings\jeffrey\Start Menu\Programs\Startup\ HotSync Manager.lnk - c:\program files\palmOne\HOTSYNC.EXE [2004-04-13 299008] Introducing Media Manager.lnk - c:\program files\Common Files\Microsoft Shared\Media Manager\SPLASHA.EXE [1997-07-15 156160] Picture Motion Browser Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2008-02-25 344064] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-02-23 113664] FlashPath Monitor.lnk - c:\program files\SmartDisk\FlashPath\sdstat.exe [2005-02-27 184320] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "New Value #1"= 0 (0x0) [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Forget Me Not.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Forget Me Not.lnk backup=c:\windows\pss\Forget Me Not.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher] --a--c--- 2004-09-15 02:01 86016 c:\program files\Dell\Media Experience\DMXLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2004-10-13 11:24 1694208 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP] --a--c--- 2004-10-14 16:42 1404928 c:\program files\Analog Devices\Core\smax4pnp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2008-08-14 00:48 185896 c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] --a------ 2006-03-30 16:45 313472 c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\FTP Explorer\\ftpx.exe"= R2 FlashNT;FlashNT;c:\windows\system32\drivers\FlashNT.sys [2005-02-27 72784] R2 ScFBPNT;CanoScan FBP Port Driver;\??\c:\windows\system32\drivers\ScFBPNT.SYS [2005-06-23 16288] R2 Sdselect;Sdselect;c:\windows\system32\drivers\Sdselect.sys [2005-02-27 73296] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a99825ec-dd0d-11dc-84d8-000f1f5ec351}] \Shell\AutoRun\command - G:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a99825ed-dd0d-11dc-84d8-000f1f5ec351}] \Shell\AutoRun\command - PortableApps\PortableAppsMenu\PortableAppsMenu.exe . Contents of the 'Scheduled Tasks' folder 2008-11-27 c:\windows\Tasks\ErrorSmart Scheduled Scan.job - c:\program files\ErrorSmart\ErrorSmart.exe [] 2008-11-27 c:\windows\Tasks\ErrorSmart Scheduled Scan.job - c:\program files\ErrorSmart [] 2008-11-27 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20] . - - - - ORPHANS REMOVED - - - - HKCU-Run-mount.exe - F:\mount.exe HKCU-Run-hlpsrvgen - c:\windows\system32\bwvkhwjq.exe HKCU-Run-brastk - c:\windows\system32\brastk.exe MSConfigStartUp-EasyLinkAdvisor - c:\program files\Linksys EasyLink Advisor\LinksysAgent.exe MSConfigStartUp-mmtask - c:\program files\Musicmatch\Musicmatch Jukebox\mmtask.exe MSConfigStartUp-MMTray - c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe MSConfigStartUp-QuickTime Task - c:\program files\QuickTime\qttask.exe MSConfigStartUp-UpdateManager - c:\program files\Common Files\Sonic\Update Manager\sgtray.exe . ------- Supplementary Scan ------- . FireFox -: Profile - c:\documents and settings\jeffrey\Application Data\Mozilla\Firefox\Profiles\e1xvrmtw.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - www.yahoo.com FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF -: plugin - c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll FF -: plugin - c:\program files\Java\jre1.5.0_03\bin\NPJava11.dll FF -: plugin - c:\program files\Java\jre1.5.0_03\bin\NPJava12.dll FF -: plugin - c:\program files\Java\jre1.5.0_03\bin\NPJava13.dll FF -: plugin - c:\program files\Java\jre1.5.0_03\bin\NPJava14.dll FF -: plugin - c:\program files\Java\jre1.5.0_03\bin\NPJava32.dll FF -: plugin - c:\program files\Java\jre1.5.0_03\bin\NPJPI150_03.dll FF -: plugin - c:\program files\Java\jre1.5.0_03\bin\NPOJI610.dll FF -: plugin - c:\program files\Netscape\Communicator\Program\Plugins\np32dsw.dll FF -: plugin - c:\program files\Netscape\Communicator\Program\Plugins\npaudio.dll FF -: plugin - c:\program files\Netscape\Communicator\Program\Plugins\npavi32.dll FF -: plugin - c:\program files\Netscape\Communicator\Program\Plugins\npbeatnk.dll FF -: plugin - c:\program files\Netscape\Communicator\Program\Plugins\npdrmv2.dll FF -: plugin - c:\program files\Netscape\Communicator\Program\Plugins\npdsplay.dll FF -: plugin - c:\program files\Netscape\Communicator\Program\Plugins\NPEvery.dll FF -: plugin - c:\program files\Netscape\Communicator\Program\Plugins\NPExpFTP.dll FF -: plugin - c:\program files\Netscape\Communicator\Program\Plugins\npnul32.dll FF -: plugin - c:\program files\Netscape\Communicator\Program\Plugins\nppl3260.dll FF -: plugin - c:\program files\Netscape\Communicator\Program\Plugins\nprfxins.dll FF -: plugin - c:\program files\Netscape\Communicator\Program\Plugins\nprjplug.dll FF -: plugin - c:\program files\Netscape\Communicator\Program\Plugins\nprpjplug.dll FF -: plugin - c:\program files\Netscape\Communicator\Program\Plugins\npswf32.dll FF -: plugin - c:\program files\Netscape\Communicator\Program\Plugins\npwmsdrm.dll FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-27 11:45:26 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . c:\program files\Windows Defender\MsMpEng.exe c:\windows\SYSTEM32\ZoneLabs\vsmon.exe c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe c:\program files\PestPatrol\PPMemCheck.exe c:\program files\PestPatrol\CookiePatrol.exe . ************************************************************************** . Completion time: 2008-11-27 11:50:58 - machine was rebooted ComboFix-quarantined-files.txt 2008-11-27 16:50:31 ComboFix2.txt 2008-05-31 22:04:59 ComboFix3.txt 2008-05-28 22:08:12 Pre-Run: 741,056,512 bytes free Post-Run: 754,388,992 bytes free 860