Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected With: win32:Ramnit-B and VBS:Exedropper-gen


  • This topic is locked This topic is locked
8 replies to this topic

#1 Hooya

Hooya

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:03:19 AM

Posted 02 October 2010 - 04:37 PM

Hi

As the title suggests my laptop is infected with win32:Ramnit-B and VBS:Exedropper-gen. I noticed something wasn't right when AVG started flagging it up. Initially thought it was a load of false positives and so tried avast and sure enough they detected 'it' also. Ran a scan... 3000 files infected. Mostly htm. html and dlls.

I have be able to get a 'clean' scan with malwarebytes in safe mode after several scans a reboots but on restarting in normal mode with all the infected files it just comes back.

As of now the laptop is running fine though. No real problems with it.

Naturally I would like to remove this issue rather than reformatting. Or at least try before starting over.

Have a few questions:

Do we know in advance whether infected files can be save/repaired or not? I have read of people fixing the html files but what about the dll etcs? Or is it a case of; we maybe able to repaire the laptop but those files are done and will have to be deleted?

Re: Backing UP. Have backed up my latest files to a memory stick but I am guessing they will contain the infection too. Should I go through each file before backing it up to check for infection and back those up rather than just pulling the non-infected stuff off it later? i.e will that just reinfect a clean laptop/pc?

Can I be sure of what files it does not infect. i.e if its not in the Avast scan list can I assume that file type as a whole hasn't been infected.

If we do need to reformat later on. My Laptop is an Acer Aspire One with no CD drive (although I can get an external one) but I do not believe it came with any CDs anyway. Although I am sure I must have office MS registration numbers etc. How does this effect going about a re-format.


Had a little trouble with Gmer scan. It locked up abit at the end. I didn't get anything to tell me scan was done but it didnt' seem to be scanning anything else so I took the log then.

Thanks in advance for any help you may give.

Jason

Acer Aspire ONe
Windows XP Home edition Service Pack 3
Been running Internet Explorer and Firexfox


Attached Files



BC AdBot (Login to Remove)

 


#2 fireman4it

fireman4it

    Bleepin' Fireman


  • Malware Response Team
  • 13,512 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Greenup, Ill USA
  • Local time:03:19 AM

Posted 02 October 2010 - 05:41 PM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.

Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

We also need a new log from the GMER anti-rootkit scanner. Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice

Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:

How to create a GMER log

" Extinguishing Malware from the world"

The Virus, Trojan, Spyware, and Malware Removal forum is very busy. If I'm helping you and I've not posted back within 24 hrs., send a PM with your topic link. Thank you.

ALL OTHER HELP REQUESTS VIA THE PM SYSTEM WILL BE IGNORED. The Forums are there for a reason!
Thanks-


  userbar_eis_500.gif

If I have helped you, consider making a donation to help me continue the fight against Malware! Just click btn_donate_LG.gif


#3 Hooya

Hooya
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:03:19 AM

Posted 03 October 2010 - 10:16 AM

"If you have already posted a DDS log, please do so again, as your situation may have changed"


Here you go.

edit: Tried to upload the ark.txt. but won't let me: "Upload failed. The file was larger than the available space". Even though it is only 168kb???

Attached Files


Edited by Hooya, 03 October 2010 - 10:19 AM.


#4 fireman4it

fireman4it

    Bleepin' Fireman


  • Malware Response Team
  • 13,512 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Greenup, Ill USA
  • Local time:03:19 AM

Posted 03 October 2010 - 02:49 PM

Hello Hooya,
  • Welcome to Bleeping Computer.
  • My name is fireman4it and I will be helping you with your Malware problem.

    Please take note of some guidelines for this fix:
  • Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools.
  • If you do not understand any step(s) provided, please do not hesitate to ask before continuing.
  • Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean".
  • Finally, please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply, unless they do not fit into the post.

1.
Download and Run RKill
    Please download RKill by Grinler from one of the 4 links below and save it to your desktop.

    Link 1
    Link 2
    Link 3
    Link 4

  • Before we begin, you should disable your anti-malware softwares you have installed so they do not interfere RKill running as some anti-malware softwares detect RKill as malicious. Please refer to this page if you are not sure how.
  • Double-click on Rkill on your desktop to run it. (If you are using Windows Vista, please right-click on it and select Run As Administrator)
  • A black screen will appear and then disappear. Please do not worry, that is normal. This means that the tool has been successfully executed.
  • If nothing happens or if the tool does not run, please let me know in your next reply

2.
Download and Rename Combofix

This tool is not a toy. If used the wrong way you could trash your computer. Please use only under direction of a Helper. If you decide to do so anyway, please do not blame me or ComboFix.

Download Combofix from any of the links below. You must rename it 1234.scr before saving it to your desktop.

Link 1
Link 2






--------------------------------------------------------------------
  • Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix. Refer to this page if you are not sure how.
  • Close any open windows, including this one.
  • Double click on 1234.scr & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • If you did not have it installed, you will see the prompt below. Choose YES.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Note:The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you
should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.
  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

  • Click on Yes, to continue scanning for malware.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt so we can continue cleaning the system.

Things to include in your next reply::
Combofix.txt
How is your machine running now?

" Extinguishing Malware from the world"

The Virus, Trojan, Spyware, and Malware Removal forum is very busy. If I'm helping you and I've not posted back within 24 hrs., send a PM with your topic link. Thank you.

ALL OTHER HELP REQUESTS VIA THE PM SYSTEM WILL BE IGNORED. The Forums are there for a reason!
Thanks-


  userbar_eis_500.gif

If I have helped you, consider making a donation to help me continue the fight against Malware! Just click btn_donate_LG.gif


#5 Hooya

Hooya
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:03:19 AM

Posted 04 October 2010 - 04:06 PM

Rkill ran okay.

combo fix ran okay as well as far as I could tell., had to restart as it detected rootkit activity
but finished off okay.

ComboFix 10-10-03.03 - Jason 04/10/2010 21:38:58.5.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2038.1533 [GMT 1:00]
Running from: c:\documents and settings\Jason\Desktop\1234.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Jason\Application Data\Yhexi
c:\documents and settings\Jason\Application Data\Yhexi\egma.exe
c:\documents and settings\Jason\Local Settings\Application Data\{8B0CCD05-748B-4343-9156-6BE1588B9E94}
c:\documents and settings\Jason\Local Settings\Application Data\{8B0CCD05-748B-4343-9156-6BE1588B9E94}\chrome.manifest
c:\documents and settings\Jason\Local Settings\Application Data\{8B0CCD05-748B-4343-9156-6BE1588B9E94}\chrome\content\_cfg.js
c:\documents and settings\Jason\Local Settings\Application Data\{8B0CCD05-748B-4343-9156-6BE1588B9E94}\chrome\content\overlay.xul
c:\documents and settings\Jason\Local Settings\Application Data\{8B0CCD05-748B-4343-9156-6BE1588B9E94}\install.rdf
c:\program files\Internet Explorer\complete.dat
c:\program files\Internet Explorer\dmlconf.dat
c:\program files\Microsoft\DesktopLayer.exe
c:\windows\epiciyozoxu.dll
c:\windows\ExplorerSrv.exe
c:\windows\pieo80.dll

----- File Replicators -----

c:\acer\Preload\Autorun\DRV\ALPS Touchpad\INT15_Detect.exe
c:\acer\Preload\Autorun\DRV\Broadcom Bluetooth utility\INT15_Detect.exe
c:\acer\Preload\Autorun\DRV\Qualcomm 3G AP\INT15_Detect.exe
c:\acer\Preload\Autorun\DRV\Qualcomm 3G driver\INT15_Detect.exe
c:\acer\Preload\Autorun\DRV\Qualcomm 3G IMAGE\INT15_Detect.exe
c:\acer\Preload\Autorun\DRV\suyin ap Camera 0.3M LDV\INT15_Detect.exe
c:\acer\Preload\Autorun\DRV\Suyin Camera 0.3M LDV\INT15_Detect.exe
c:\acer\Preload\Autorun\DRV\Synaptics Touchpad\INT15_Detect.exe
c:\program files\Acer GameZone\Bejeweled 2 Deluxe\Launch.exe
c:\program files\Acer GameZone\Bejeweled 2 Deluxe\Uninstall.exe
c:\program files\Acer GameZone\Cake Mania 2\Launch.exe
c:\program files\Acer GameZone\Cake Mania 2\Uninstall.exe
c:\program files\Acer GameZone\Cooking Dash\Launch.exe
c:\program files\Acer GameZone\Cooking Dash\Uninstall.exe
c:\program files\Acer GameZone\Dream Day First Home\Launch.exe
c:\program files\Acer GameZone\Dream Day First Home\Uninstall.exe
c:\program files\Acer GameZone\Dream Day Wedding\Launch.exe
c:\program files\Acer GameZone\Dream Day Wedding\Uninstall.exe
c:\program files\Acer GameZone\Farm Frenzy\Launch.exe
c:\program files\Acer GameZone\Farm Frenzy\Uninstall.exe
c:\program files\Acer GameZone\Galapago\Launch.exe
c:\program files\Acer GameZone\Galapago\Uninstall.exe
c:\program files\Acer GameZone\Jewel Quest Solitaire\Launch.exe
c:\program files\Acer GameZone\Jewel Quest Solitaire\Uninstall.exe
c:\program files\Acer GameZone\Mahjong Escape Ancient China\Launch.exe
c:\program files\Acer GameZone\Mahjong Escape Ancient China\Uninstall.exe
c:\program files\Acer GameZone\Parking Dash\Launch.exe
c:\program files\Acer GameZone\Parking Dash\Uninstall.exe
c:\program files\Acer GameZone\Peggle\Launch.exe
c:\program files\Acer GameZone\Peggle\Uninstall.exe
c:\program files\Acer GameZone\Rainbow Web\Launch.exe
c:\program files\Acer GameZone\Rainbow Web\Uninstall.exe
c:\program files\Acer GameZone\Star Defender 4\Launch.exe
c:\program files\Acer GameZone\Star Defender 4\Uninstall.exe
c:\program files\Acer GameZone\Tradewinds 2\Launch.exe
c:\program files\Acer GameZone\Tradewinds 2\Uninstall.exe
c:\program files\Acer GameZone\Tri-Peaks Solitaire To Go\Launch.exe
c:\program files\Acer GameZone\Tri-Peaks Solitaire To Go\Uninstall.exe
c:\program files\Acer GameZone\Zuma Deluxe\Launch.exe
c:\program files\Acer GameZone\Zuma Deluxe\Uninstall.exe
c:\program files\Citrix\GoToMeeting\366\g2mchat.exe
c:\program files\Citrix\GoToMeeting\366\g2mcomm.exe
c:\program files\Citrix\GoToMeeting\366\g2mfeedback.exe
c:\program files\Citrix\GoToMeeting\366\g2mhost.exe
c:\program files\Citrix\GoToMeeting\366\G2MInstaller.exe
c:\program files\Citrix\GoToMeeting\366\g2mlauncher.exe
c:\program files\Citrix\GoToMeeting\366\g2mmatchmaking.exe
c:\program files\Citrix\GoToMeeting\366\g2mpolling.exe
c:\program files\Citrix\GoToMeeting\366\g2mQandA.exe
c:\program files\Citrix\GoToMeeting\366\g2mrecorder.exe
c:\program files\Citrix\GoToMeeting\366\g2msessioncontrol.exe
c:\program files\Citrix\GoToMeeting\366\g2mstart.exe
c:\program files\Citrix\GoToMeeting\366\g2mtranscoder.exe
c:\program files\Citrix\GoToMeeting\366\g2mui.exe
c:\program files\Citrix\GoToMeeting\366\g2mview.exe
c:\program files\Citrix\GoToMeeting\366\g2mvoip.exe
c:\program files\Citrix\GoToMeeting\452\g2mchat.exe
c:\program files\Citrix\GoToMeeting\452\g2mcomm.exe
c:\program files\Citrix\GoToMeeting\452\g2mfeedback.exe
c:\program files\Citrix\GoToMeeting\452\g2mhost.exe
c:\program files\Citrix\GoToMeeting\452\G2MInstaller.exe
c:\program files\Citrix\GoToMeeting\452\g2mlauncher.exe
c:\program files\Citrix\GoToMeeting\452\g2mmatchmaking.exe
c:\program files\Citrix\GoToMeeting\452\g2mmaterials.exe
c:\program files\Citrix\GoToMeeting\452\g2mpolling.exe
c:\program files\Citrix\GoToMeeting\452\g2mQandA.exe
c:\program files\Citrix\GoToMeeting\452\g2mrecorder.exe
c:\program files\Citrix\GoToMeeting\452\g2msessioncontrol.exe
c:\program files\Citrix\GoToMeeting\452\g2mstart.exe
c:\program files\Citrix\GoToMeeting\452\g2mtesting.exe
c:\program files\Citrix\GoToMeeting\452\g2mtranscoder.exe
c:\program files\Citrix\GoToMeeting\452\g2mui.exe
c:\program files\Citrix\GoToMeeting\452\g2mview.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0032926.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0033011.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0033281.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0033286.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0033294.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0033413.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0033416.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0033424.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0033979.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0033981.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0033986.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0033988.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0033992.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0033994.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0033999.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034004.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034009.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034013.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034018.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034021.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034026.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034031.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034039.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034049.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034056.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034060.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034063.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034066.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034071.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034074.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034078.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034081.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034085.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034089.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034094.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034097.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034100.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034104.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034108.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034110.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034299.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034300.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034301.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034302.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034304.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034306.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034307.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034310.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034311.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034312.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034314.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034315.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034316.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034317.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034319.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034320.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034324.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034325.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034326.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034327.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034329.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034331.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034332.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034333.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034337.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034338.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034339.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034341.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034342.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034343.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034344.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034345.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0034347.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0037912.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0037997.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0038270.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0038276.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0038286.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0038409.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0038413.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0038421.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0038997.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0038999.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039004.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039006.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039010.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039012.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039017.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039022.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039027.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039031.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039036.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039039.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039044.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039049.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039057.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039067.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039074.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039078.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039081.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039084.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039089.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039092.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039096.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039099.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039103.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039107.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039112.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039115.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039118.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039122.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039126.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039128.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039317.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039318.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039319.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039320.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039322.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039324.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039325.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039328.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039329.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039330.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039332.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039333.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039334.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039335.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039337.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039338.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039342.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039343.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039344.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039345.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039347.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039349.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039350.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039351.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039355.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039356.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039357.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039359.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039360.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039361.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039362.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039363.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0039365.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0042126.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0042211.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0042481.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0042486.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0042494.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0042619.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0042622.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0042630.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043202.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043204.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043209.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043211.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043215.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043217.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043222.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043227.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043232.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043236.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043241.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043244.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043249.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043254.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043262.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043272.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043279.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043283.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043286.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043289.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043294.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043297.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043301.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043304.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043308.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043312.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043317.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043320.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043323.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043327.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043331.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043333.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043522.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043523.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043524.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043525.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043527.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043529.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043530.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043533.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043534.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043535.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043537.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043538.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043539.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043540.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043542.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043543.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043547.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043548.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043549.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043550.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043552.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043554.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043555.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043556.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043560.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043561.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043562.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043564.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043565.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043566.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043567.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043568.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0043570.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0046490.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0046575.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0046853.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0046859.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0046921.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0047040.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0047043.exe
c:\system volume information\_restore{3EB6C52D-E7D6-4C86-927F-413FB20A1796}\RP2\A0047051.exe
.
.
((((((((((((((((((((((((( Files Created from 2010-09-04 to 2010-10-04 )))))))))))))))))))))))))))))))
.

2010-10-02 20:55 . 2010-10-03 10:45 -------- d-----w- c:\program files\sys
2010-10-01 15:22 . 2010-10-01 16:56 -------- d-----w- C:\Casino
2010-10-01 09:49 . 2010-10-01 09:49 32768 ----a-r- c:\documents and settings\Jason\Application Data\Microsoft\Installer\{E518C80C-C549-40E1-844C-669ED64195D3}\_2A43A261E660_4D89_9812_E0B6AEBBE4CE.exe
2010-09-30 15:38 . 2010-10-02 10:21 -------- d-----w- c:\program files\system
2010-09-30 13:21 . 2010-10-01 09:09 -------- d-----w- c:\program files\win
2010-09-27 15:34 . 2010-10-04 14:22 -------- d-----w- c:\program files\tmp
2010-09-25 13:59 . 2010-06-01 17:37 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-09-24 20:45 . 2010-09-24 20:45 -------- d--h--w- c:\windows\PIF
2010-09-24 19:56 . 2010-09-24 19:56 73216 ----a-w- c:\windows\system32\drivers\pxrts.sys
2010-09-24 19:56 . 2010-09-24 19:56 -------- d-----w- c:\program files\Prevx
2010-09-24 19:56 . 2010-09-24 20:08 -------- d-----w- c:\documents and settings\All Users\Application Data\PrevxCSI
2010-09-24 16:49 . 2010-09-24 16:49 -------- d-----w- c:\windows\system32\NtmsData
2010-09-24 16:00 . 2010-09-24 16:00 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-09-23 22:08 . 2010-09-23 22:08 -------- d-----w- c:\documents and settings\Jason\Application Data\Malwarebytes
2010-09-23 22:08 . 2010-04-29 14:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-23 22:08 . 2010-09-23 22:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-23 22:08 . 2010-09-23 22:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-09-23 22:08 . 2010-04-29 14:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-23 21:43 . 2010-09-27 08:27 103936 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2010-09-23 21:43 . 2010-09-27 08:27 81920 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\Installer\CommonCustomActions\Sleep.exe
2010-09-23 21:43 . 2010-09-27 08:27 137728 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\pcswpcsi.exe
2010-09-23 21:43 . 2010-09-27 08:27 393216 ----a-w- c:\documents and settings\Jason\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-57f98dbe-n\msvcr71.dll
2010-09-23 21:43 . 2010-09-27 08:26 700416 ----a-w- c:\documents and settings\Jason\Application Data\Spotify\Gracenote\gnsdk_sdkmanager.dll
2010-09-23 21:43 . 2010-09-27 08:26 327680 ----a-w- c:\documents and settings\Jason\Application Data\Spotify\Gracenote\gnsdk_musicid_file.dll
2010-09-23 21:43 . 2010-09-27 08:26 253952 ----a-w- c:\documents and settings\Jason\Application Data\Spotify\Gracenote\gnsdk_dsp.dll
2010-09-23 21:43 . 2010-09-27 08:26 617472 ----a-w- c:\documents and settings\Jason\Application Data\G-Lock Software\FDS\adtfix.exe
2010-09-23 20:50 . 2010-09-07 14:52 165584 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-09-23 20:50 . 2010-09-07 14:47 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-09-23 20:49 . 2010-09-07 14:47 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-09-23 20:49 . 2010-09-07 14:52 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-09-23 20:49 . 2010-09-07 14:47 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-09-23 20:49 . 2010-09-07 14:47 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-09-23 20:49 . 2010-09-07 14:46 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-09-23 20:49 . 2010-09-07 15:12 38848 ----a-w- c:\windows\avastSS.scr
2010-09-23 20:49 . 2010-09-07 15:11 167592 ----a-w- c:\windows\system32\aswBoot.exe
2010-09-23 20:49 . 2010-09-23 20:49 -------- d-----w- c:\program files\Alwil Software
2010-09-23 20:49 . 2010-09-23 20:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-09-23 19:29 . 2010-09-23 19:29 -------- d-----w- C:\$AVG
2010-09-23 19:28 . 2010-09-23 20:52 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-09-23 18:43 . 2010-09-23 19:13 -------- d-----w- C:\ComboFix
2010-09-23 18:27 . 2010-09-23 18:27 40960 ----a-w- c:\windows\system32\verclsidSrv.exe
2010-09-23 14:03 . 2010-09-28 07:19 -------- d-----w- c:\program files\temp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-04 20:50 . 2009-11-23 15:11 -------- d-----w- c:\program files\Microsoft
2010-10-04 20:20 . 2009-09-22 18:27 -------- d-----w- c:\documents and settings\Jason\Application Data\Skype
2010-10-04 19:59 . 2010-05-25 18:04 120 ----a-w- c:\windows\Kfurefixipugofor.dat
2010-10-04 18:26 . 2010-03-23 16:12 -------- d-----w- c:\documents and settings\Jason\Application Data\Keysin
2010-10-04 17:48 . 2009-08-19 21:24 -------- d-----w- c:\documents and settings\Jason\Application Data\vlc
2010-10-04 15:07 . 2009-08-10 10:40 -------- d-----w- c:\documents and settings\Jason\Application Data\skypePM
2010-10-04 14:43 . 2009-10-31 20:20 1 ----a-w- c:\documents and settings\Jason\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-10-04 08:49 . 2010-05-25 18:04 0 ----a-w- c:\windows\Nveseqod.bin
2010-09-24 19:23 . 2009-10-31 20:16 -------- d-----w- c:\program files\Java
2010-09-24 15:41 . 2010-04-04 18:20 -------- d-----w- c:\documents and settings\Jason\Application Data\Veetxi
2010-09-24 15:15 . 2009-11-09 14:21 -------- d-----w- c:\documents and settings\Jason\Application Data\Kycy
2010-09-24 10:07 . 2009-04-15 16:02 -------- d-----w- c:\program files\Microsoft Works
2010-09-23 22:25 . 2009-11-14 09:13 -------- d-----w- c:\documents and settings\Jason\Application Data\Ilab
2010-09-23 22:19 . 2010-08-01 15:12 -------- d-----w- c:\documents and settings\Jason\Application Data\Waihr
2010-09-23 22:10 . 2010-07-16 14:58 -------- d-----w- c:\program files\CS Desktop Notes
2010-09-23 19:28 . 2009-08-10 08:37 -------- d-----w- c:\program files\AVG
2010-09-23 18:37 . 2010-03-19 21:24 -------- d-----w- c:\documents and settings\Jason\Application Data\Urypy
2010-09-23 16:40 . 2009-11-16 09:14 -------- d-----w- c:\program files\QuickTime
2010-09-23 16:20 . 2009-08-13 15:00 -------- d-----w- c:\documents and settings\Jason\Application Data\Uzufvi
2010-09-08 17:08 . 2010-06-24 15:43 256 ----a-w- c:\windows\system32\pool.bin
2010-09-08 15:01 . 2010-01-04 13:28 -------- d-----w- c:\documents and settings\Jason\Application Data\Spotify
2010-09-02 11:09 . 2010-06-17 11:59 -------- d-----w- c:\documents and settings\Jason\Application Data\Qytoen
2010-09-02 10:53 . 2010-09-02 10:53 396 ----a-w- c:\program files\.js
2010-08-26 19:34 . 2009-08-10 11:41 6434 ----a-w- c:\documents and settings\Jason\Application Data\wklnhst.dat
2010-08-17 13:17 . 2009-04-15 23:33 58880 ----a-w- c:\windows\system32\spoolsv.exe
2010-08-12 11:29 . 2010-08-12 11:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Speedbit
2010-08-10 21:21 . 2010-02-21 19:23 -------- d-----w- c:\program files\MetaTrader - Alpari UK
2010-07-22 15:49 . 2009-04-15 23:32 590848 ----a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 05:57 . 2009-08-11 20:10 5120 ----a-w- c:\windows\system32\xpsp4res.dll
.

((((((((((((((((((((((((((((( SnapShot_2010-09-02_11.45.18 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-11 23:02 . 2009-07-11 23:02 51008 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_f0ccd4aa\vcomp90.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 59728 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90rus.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 42832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90kor.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 43344 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90jpn.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 61264 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90ita.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 62800 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90fra.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 61760 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esp.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 61776 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90esn.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 53568 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90enu.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 63296 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90deu.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 36688 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90cht.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 35648 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_15fc9313\mfc90chs.dll
+ 2009-07-11 23:05 . 2009-07-11 23:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90u.dll
+ 2009-07-11 23:05 . 2009-07-11 23:05 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfcm90.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 44544 c:\windows\system32\pngfilt.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 44544 c:\windows\system32\pngfilt.dll
+ 2009-04-15 23:32 . 2010-10-03 18:14 68386 c:\windows\system32\perfc009.dat
- 2009-04-15 23:32 . 2010-09-02 11:29 68386 c:\windows\system32\perfc009.dat
- 2007-08-13 17:54 . 2010-05-04 17:20 52224 c:\windows\system32\msfeedsbs.dll
+ 2007-08-13 17:54 . 2010-06-24 12:15 52224 c:\windows\system32\msfeedsbs.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 27648 c:\windows\system32\jsproxy.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 27648 c:\windows\system32\jsproxy.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 44544 c:\windows\system32\iernonce.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 44544 c:\windows\system32\iernonce.dll
+ 2009-10-20 17:22 . 2010-06-24 12:15 78336 c:\windows\system32\ieencode.dll
- 2009-10-20 17:22 . 2010-05-04 17:20 78336 c:\windows\system32\ieencode.dll
+ 2009-04-15 23:32 . 2010-06-23 12:06 70656 c:\windows\system32\ie4uinit.exe
- 2009-04-15 23:32 . 2010-05-04 12:39 70656 c:\windows\system32\ie4uinit.exe
- 2009-04-15 23:32 . 2008-04-14 12:00 80384 c:\windows\system32\iccvid.dll
+ 2009-04-15 23:32 . 2010-06-17 14:03 80384 c:\windows\system32\iccvid.dll
+ 2007-08-13 17:36 . 2010-06-24 12:15 63488 c:\windows\system32\icardie.dll
- 2007-08-13 17:36 . 2010-05-04 17:20 63488 c:\windows\system32\icardie.dll
+ 2009-04-15 23:33 . 2010-08-17 13:17 58880 c:\windows\system32\dllcache\spoolsv.exe
- 2009-04-15 23:32 . 2010-05-04 17:20 44544 c:\windows\system32\dllcache\pngfilt.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 44544 c:\windows\system32\dllcache\pngfilt.dll
+ 2009-06-29 16:12 . 2010-06-24 12:15 52224 c:\windows\system32\dllcache\msfeedsbs.dll
- 2009-06-29 16:12 . 2010-05-04 17:20 52224 c:\windows\system32\dllcache\msfeedsbs.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 27648 c:\windows\system32\dllcache\jsproxy.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 27648 c:\windows\system32\dllcache\jsproxy.dll
+ 2009-06-29 11:07 . 2010-06-23 12:06 13824 c:\windows\system32\dllcache\ieudinit.exe
- 2009-06-29 11:07 . 2010-05-04 12:39 13824 c:\windows\system32\dllcache\ieudinit.exe
- 2009-04-15 23:32 . 2010-05-04 17:20 44544 c:\windows\system32\dllcache\iernonce.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 44544 c:\windows\system32\dllcache\iernonce.dll
+ 2009-10-20 17:22 . 2010-06-24 12:15 78336 c:\windows\system32\dllcache\ieencode.dll
- 2009-10-20 17:22 . 2010-05-04 17:20 78336 c:\windows\system32\dllcache\ieencode.dll
+ 2009-04-15 23:32 . 2010-06-23 12:06 70656 c:\windows\system32\dllcache\ie4uinit.exe
- 2009-04-15 23:32 . 2010-05-04 12:39 70656 c:\windows\system32\dllcache\ie4uinit.exe
+ 2009-06-29 16:12 . 2010-06-24 12:15 63488 c:\windows\system32\dllcache\icardie.dll
- 2009-06-29 16:12 . 2010-05-04 17:20 63488 c:\windows\system32\dllcache\icardie.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 17408 c:\windows\system32\dllcache\corpol.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 17408 c:\windows\system32\dllcache\corpol.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 17408 c:\windows\system32\corpol.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 17408 c:\windows\system32\corpol.dll
- 2009-04-15 16:13 . 2009-08-12 07:20 26464 c:\windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WkBoLink.exe
+ 2009-04-15 16:13 . 2010-09-23 23:25 26464 c:\windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WkBoLink.exe
- 2009-04-15 16:13 . 2009-08-12 07:20 25214 c:\windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\MSWorks.exe
+ 2009-04-15 16:13 . 2010-09-23 23:25 25214 c:\windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\MSWorks.exe
+ 2010-09-23 23:26 . 2010-05-04 17:20 44544 c:\windows\ie7updates\KB2183461-IE7\pngfilt.dll
+ 2010-09-23 23:26 . 2010-05-04 17:20 52224 c:\windows\ie7updates\KB2183461-IE7\msfeedsbs.dll
+ 2010-09-23 23:26 . 2010-05-04 17:20 27648 c:\windows\ie7updates\KB2183461-IE7\jsproxy.dll
+ 2010-09-23 23:26 . 2010-05-04 12:39 13824 c:\windows\ie7updates\KB2183461-IE7\ieudinit.exe
+ 2010-09-23 23:26 . 2010-05-04 17:20 44544 c:\windows\ie7updates\KB2183461-IE7\iernonce.dll
+ 2010-09-23 23:26 . 2010-05-04 17:20 78336 c:\windows\ie7updates\KB2183461-IE7\ieencode.dll
+ 2010-09-23 23:26 . 2010-05-04 12:39 70656 c:\windows\ie7updates\KB2183461-IE7\ie4uinit.exe
+ 2010-09-23 23:26 . 2010-05-04 17:20 63488 c:\windows\ie7updates\KB2183461-IE7\icardie.dll
+ 2010-09-23 23:26 . 2010-05-04 17:20 17408 c:\windows\ie7updates\KB2183461-IE7\corpol.dll
+ 2010-09-24 09:59 . 2010-09-24 09:59 47616 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLiveWriter\dd5ce29ac227f3d0fd81b84621a57477\WindowsLiveWriter.ni.exe
+ 2010-09-24 10:00 . 2010-09-24 10:00 99840 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\67a565eaa748e11f0953953cbdcd4e72\WindowsLive.Writer.Api.ni.dll
+ 2010-09-24 09:43 . 2010-09-24 09:43 60928 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\5ec9dec678303ebff0ef018edb5ec595\UIAutomationProvider.ni.dll
+ 2010-09-24 12:28 . 2010-09-24 12:28 37888 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\46ef15b88ef577de4882c519329fc5d2\System.Windows.Presentation.ni.dll
+ 2010-09-24 12:27 . 2010-09-24 12:27 36864 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\aada360296a42e0413579a19c771ec2d\System.Web.DynamicData.Design.ni.dll
+ 2010-09-24 10:02 . 2010-09-24 10:02 94208 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ComponentMod#\648c65d604a1a281f18e49959192137b\System.ComponentModel.DataAnnotations.ni.dll
+ 2010-09-24 10:02 . 2010-09-24 10:02 82944 c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\6125ff5a4fcd93d70a246cbff3005d42\System.AddIn.Contract.ni.dll
+ 2010-09-23 23:26 . 2010-09-23 23:26 47104 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\de26af01222270c121788161496fcfe7\PresentationFontCache.ni.exe
+ 2010-09-23 23:25 . 2010-09-23 23:25 39424 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\3c5adeedb70e6e052a6556c6ab9b6918\PresentationCFFRasterizer.ni.dll
+ 2010-09-24 12:26 . 2010-09-24 12:26 55296 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Vsa\5e5176efbfeb803b7f217525beec6844\Microsoft.Vsa.ni.dll
+ 2010-09-24 09:58 . 2010-09-24 09:58 15872 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\272d51526813ea113970b8e890c92ee2\Microsoft.VisualC.ni.dll
+ 2010-09-24 10:01 . 2010-09-24 10:01 74752 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\e1d4e0b1f112000ab33bbaf88bd9ed99\Microsoft.Build.Framework.ni.dll
+ 2010-09-24 10:01 . 2010-09-24 10:01 65024 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\4200cf5b7f247ec1b997808c6d1ba7d1\Microsoft.Build.Framework.ni.dll
+ 2010-09-24 10:00 . 2010-09-24 10:00 14336 c:\windows\assembly\NativeImages_v2.0.50727_32\dfsvc\50b7fc7f36c76313cbb434b10923e4e9\dfsvc.ni.exe
+ 2010-09-24 09:55 . 2010-09-24 09:55 25600 c:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\5ffa548547613dbc5a92f2c5b7cad196\Accessibility.ni.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 77824 c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 77824 c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 81920 c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 81920 c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 81920 c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 81920 c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 32768 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 32768 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 12800 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 12800 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 77824 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 77824 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 77824 c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 77824 c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 13312 c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 13312 c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 10752 c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 10752 c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 72192 c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 72192 c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 69120 c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 69120 c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 8192 c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 8192 c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 7168 c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 7168 c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 5632 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 5632 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 6656 c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 6656 c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 8192 c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 8192 c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 113664 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 113664 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 258048 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 258048 c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 159032 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_353599c2\atl90.dll
- 2009-04-15 23:33 . 2008-04-14 12:00 293376 c:\windows\system32\winsrv.dll
+ 2009-04-15 23:33 . 2010-06-18 17:45 293376 c:\windows\system32\winsrv.dll
- 2009-04-15 23:33 . 2010-05-04 17:20 832512 c:\windows\system32\wininet.dll
+ 2009-04-15 23:33 . 2010-06-24 12:15 832512 c:\windows\system32\wininet.dll
+ 2009-04-15 23:33 . 2010-06-24 12:15 233472 c:\windows\system32\webcheck.dll
- 2009-04-15 23:33 . 2010-05-04 17:20 233472 c:\windows\system32\webcheck.dll
+ 2009-04-15 23:33 . 2010-04-16 15:36 406016 c:\windows\system32\usp10.dll
- 2009-04-15 23:33 . 2008-04-14 12:00 406016 c:\windows\system32\usp10.dll
- 2009-04-15 23:33 . 2010-05-04 17:20 105984 c:\windows\system32\url.dll
+ 2009-04-15 23:33 . 2010-06-24 12:15 105984 c:\windows\system32\url.dll
+ 2009-04-15 23:32 . 2010-06-30 12:31 149504 c:\windows\system32\schannel.dll
+ 2009-04-15 23:32 . 2010-10-03 18:14 434266 c:\windows\system32\perfh009.dat
- 2009-04-15 23:32 . 2010-09-02 11:29 434266 c:\windows\system32\perfh009.dat
- 2009-04-15 23:32 . 2010-05-04 17:20 102912 c:\windows\system32\occache.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 102912 c:\windows\system32\occache.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 671232 c:\windows\system32\mstime.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 671232 c:\windows\system32\mstime.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 193024 c:\windows\system32\msrating.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 193024 c:\windows\system32\msrating.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 477696 c:\windows\system32\mshtmled.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 477696 c:\windows\system32\mshtmled.dll
- 2007-08-13 17:54 . 2010-05-04 17:20 459264 c:\windows\system32\msfeeds.dll
+ 2007-08-13 17:54 . 2010-06-24 12:15 459264 c:\windows\system32\msfeeds.dll
- 2009-04-15 23:33 . 2008-04-14 12:00 384512 c:\windows\system32\mp4sdmod.dll
+ 2009-04-15 23:33 . 2010-04-05 10:54 384512 c:\windows\system32\mp4sdmod.dll
- 2009-10-31 20:16 . 2009-10-31 20:16 149280 c:\windows\system32\javaws.exe
+ 2009-10-31 20:16 . 2009-10-31 20:16 149280 c:\windows\system32\javaws.exe
- 2009-10-31 20:16 . 2009-10-31 20:16 145184 c:\windows\system32\javaw.exe
+ 2009-10-31 20:16 . 2009-10-31 20:16 145184 c:\windows\system32\javaw.exe
- 2009-10-31 20:16 . 2009-10-31 20:16 145184 c:\windows\system32\java.exe
+ 2009-10-31 20:16 . 2009-10-31 20:16 145184 c:\windows\system32\java.exe
+ 2009-04-15 14:52 . 2010-06-09 07:43 692736 c:\windows\system32\inetcomm.dll
- 2007-08-13 17:34 . 2010-05-04 17:20 268288 c:\windows\system32\iertutil.dll
+ 2007-08-13 17:34 . 2010-06-24 12:15 268288 c:\windows\system32\iertutil.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 192512 c:\windows\system32\iepeers.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 192512 c:\windows\system32\iepeers.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 385024 c:\windows\system32\iedkcs32.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 385024 c:\windows\system32\iedkcs32.dll
- 2007-07-11 11:27 . 2010-05-04 17:20 380928 c:\windows\system32\ieapfltr.dll
+ 2007-07-11 11:27 . 2010-06-24 12:15 380928 c:\windows\system32\ieapfltr.dll
- 2009-04-15 23:32 . 2010-04-16 11:43 161792 c:\windows\system32\ieakui.dll
+ 2009-04-15 23:32 . 2010-06-17 15:11 161792 c:\windows\system32\ieakui.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 230400 c:\windows\system32\ieaksie.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 230400 c:\windows\system32\ieaksie.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 153088 c:\windows\system32\ieakeng.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 153088 c:\windows\system32\ieakeng.dll
+ 2009-04-15 15:45 . 2010-09-24 09:35 311584 c:\windows\system32\FNTCACHE.DAT
- 2009-04-15 15:45 . 2010-07-16 06:39 311584 c:\windows\system32\FNTCACHE.DAT
+ 2009-04-15 23:32 . 2010-06-24 12:15 133120 c:\windows\system32\extmgr.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 133120 c:\windows\system32\extmgr.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 214528 c:\windows\system32\dxtrans.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 214528 c:\windows\system32\dxtrans.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 347136 c:\windows\system32\dxtmsft.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 347136 c:\windows\system32\dxtmsft.dll
+ 2009-04-15 23:33 . 2010-06-21 15:27 354304 c:\windows\system32\drivers\srv.sys
- 2009-04-15 23:33 . 2008-04-14 12:00 293376 c:\windows\system32\dllcache\winsrv.dll
+ 2009-04-15 23:33 . 2010-06-18 17:45 293376 c:\windows\system32\dllcache\winsrv.dll
+ 2009-04-15 23:33 . 2010-06-24 12:15 832512 c:\windows\system32\dllcache\wininet.dll
- 2009-04-15 23:33 . 2010-05-04 17:20 832512 c:\windows\system32\dllcache\wininet.dll
- 2009-04-15 23:33 . 2010-05-04 17:20 233472 c:\windows\system32\dllcache\webcheck.dll
+ 2009-04-15 23:33 . 2010-06-24 12:15 233472 c:\windows\system32\dllcache\webcheck.dll
- 2009-04-15 23:33 . 2008-04-14 12:00 406016 c:\windows\system32\dllcache\usp10.dll
+ 2009-04-15 23:33 . 2010-04-16 15:36 406016 c:\windows\system32\dllcache\usp10.dll
+ 2009-04-15 23:33 . 2010-06-24 12:15 105984 c:\windows\system32\dllcache\url.dll
- 2009-04-15 23:33 . 2010-05-04 17:20 105984 c:\windows\system32\dllcache\url.dll
+ 2009-04-15 23:33 . 2010-06-21 15:27 354304 c:\windows\system32\dllcache\srv.sys
+ 2009-04-15 23:32 . 2010-06-30 12:31 149504 c:\windows\system32\dllcache\schannel.dll
+ 2009-04-15 23:32 . 2010-07-22 15:49 590848 c:\windows\system32\dllcache\rpcrt4.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 102912 c:\windows\system32\dllcache\occache.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 102912 c:\windows\system32\dllcache\occache.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 671232 c:\windows\system32\dllcache\mstime.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 671232 c:\windows\system32\dllcache\mstime.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 193024 c:\windows\system32\dllcache\msrating.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 193024 c:\windows\system32\dllcache\msrating.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 477696 c:\windows\system32\dllcache\mshtmled.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 477696 c:\windows\system32\dllcache\mshtmled.dll
- 2009-06-29 16:12 . 2010-05-04 17:20 459264 c:\windows\system32\dllcache\msfeeds.dll
+ 2009-06-29 16:12 . 2010-06-24 12:15 459264 c:\windows\system32\dllcache\msfeeds.dll
+ 2009-04-15 23:33 . 2010-04-05 10:54 384512 c:\windows\system32\dllcache\mp4sdmod.dll
- 2009-04-15 23:33 . 2008-04-14 12:00 384512 c:\windows\system32\dllcache\mp4sdmod.dll
+ 2009-04-15 14:52 . 2010-06-09 07:43 692736 c:\windows\system32\dllcache\inetcomm.dll
+ 2009-04-15 14:52 . 2010-06-17 15:12 634656 c:\windows\system32\dllcache\iexplore.exe
- 2009-04-15 14:52 . 2010-04-16 11:43 634656 c:\windows\system32\dllcache\iexplore.exe
+ 2009-06-29 16:12 . 2010-06-24 12:15 268288 c:\windows\system32\dllcache\iertutil.dll
- 2009-06-29 16:12 . 2010-05-04 17:20 268288 c:\windows\system32\dllcache\iertutil.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 192512 c:\windows\system32\dllcache\iepeers.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 192512 c:\windows\system32\dllcache\iepeers.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 385024 c:\windows\system32\dllcache\iedkcs32.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 385024 c:\windows\system32\dllcache\iedkcs32.dll
- 2009-06-29 16:12 . 2010-05-04 17:20 380928 c:\windows\system32\dllcache\ieapfltr.dll
+ 2009-06-29 16:12 . 2010-06-24 12:15 380928 c:\windows\system32\dllcache\ieapfltr.dll
- 2009-04-15 23:32 . 2010-04-16 11:43 161792 c:\windows\system32\dllcache\ieakui.dll
+ 2009-04-15 23:32 . 2010-06-17 15:11 161792 c:\windows\system32\dllcache\ieakui.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 230400 c:\windows\system32\dllcache\ieaksie.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 230400 c:\windows\system32\dllcache\ieaksie.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 153088 c:\windows\system32\dllcache\ieakeng.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 153088 c:\windows\system32\dllcache\ieakeng.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 133120 c:\windows\system32\dllcache\extmgr.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 133120 c:\windows\system32\dllcache\extmgr.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 214528 c:\windows\system32\dllcache\dxtrans.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 214528 c:\windows\system32\dllcache\dxtrans.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 347136 c:\windows\system32\dllcache\dxtmsft.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 347136 c:\windows\system32\dllcache\dxtmsft.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 124928 c:\windows\system32\dllcache\advpack.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 124928 c:\windows\system32\dllcache\advpack.dll
- 2009-04-15 23:32 . 2010-05-04 17:20 124928 c:\windows\system32\advpack.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 124928 c:\windows\system32\advpack.dll
+ 2010-05-11 05:40 . 2010-05-11 05:40 388936 c:\windows\Microsoft.NET\Framework\v2.0.50727\SOS.dll
+ 2010-05-11 05:40 . 2010-05-11 05:40 989016 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
- 2009-08-07 22:51 . 2009-08-07 22:51 989016 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
+ 2010-09-23 20:49 . 2010-09-23 20:49 219648 c:\windows\Installer\ecc4a.msi
+ 2010-09-25 13:57 . 2010-09-25 13:57 301056 c:\windows\Installer\94e4d.msi
+ 2009-04-15 16:13 . 2010-09-23 23:25 709984 c:\windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksWP.exe
- 2009-04-15 16:13 . 2009-08-12 07:20 709984 c:\windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksWP.exe
+ 2009-04-15 16:13 . 2010-09-23 23:25 947552 c:\windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksss.exe
- 2009-04-15 16:13 . 2009-08-12 07:20 947552 c:\windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksss.exe
+ 2009-04-15 16:13 . 2010-09-23 23:25 722272 c:\windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksCal.exe
- 2009-04-15 16:13 . 2009-08-12 07:20 722272 c:\windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksCal.exe
+ 2007-06-20 21:04 . 2007-06-20 21:04 173408 c:\windows\Installer\$PatchCache$\Managed\97230E76307FF8044BFB645BCFD807DC\9.7.621\F378_WkProof.dll
+ 2007-06-21 21:48 . 2007-06-21 21:48 972128 c:\windows\Installer\$PatchCache$\Managed\97230E76307FF8044BFB645BCFD807DC\9.7.621\F20987_wkwpqd.dll
+ 2007-06-20 21:04 . 2007-06-20 21:04 161120 c:\windows\Installer\$PatchCache$\Managed\97230E76307FF8044BFB645BCFD807DC\9.7.621\F20985_wkwpqrtf.dll
+ 2010-09-23 23:26 . 2010-05-04 17:20 832512 c:\windows\ie7updates\KB2183461-IE7\wininet.dll
+ 2010-09-23 23:26 . 2010-05-04 17:20 233472 c:\windows\ie7updates\KB2183461-IE7\webcheck.dll
+ 2010-09-23 23:26 . 2010-05-04 17:20 105984 c:\windows\ie7updates\KB2183461-IE7\url.dll
+ 2010-09-23 23:26 . 2010-02-22 14:23 382840 c:\windows\ie7updates\KB2183461-IE7\spuninst\updspapi.dll
+ 2010-09-23 23:26 . 2010-02-22 14:23 231288 c:\windows\ie7updates\KB2183461-IE7\spuninst\spuninst.exe
+ 2010-09-23 23:26 . 2010-05-04 17:20 102912 c:\windows\ie7updates\KB2183461-IE7\occache.dll
+ 2010-09-23 23:26 . 2010-05-04 17:20 671232 c:\windows\ie7updates\KB2183461-IE7\mstime.dll
+ 2010-09-23 23:26 . 2010-05-04 17:20 193024 c:\windows\ie7updates\KB2183461-IE7\msrating.dll
+ 2010-09-23 23:26 . 2010-05-04 17:20 477696 c:\windows\ie7updates\KB2183461-IE7\mshtmled.dll
+ 2010-09-23 23:26 . 2010-05-04 17:20 459264 c:\windows\ie7updates\KB2183461-IE7\msfeeds.dll
+ 2010-09-23 23:26 . 2010-04-16 11:43 634656 c:\windows\ie7updates\KB2183461-IE7\iexplore.exe
+ 2010-09-23 23:26 . 2010-05-04 17:20 268288 c:\windows\ie7updates\KB2183461-IE7\iertutil.dll
+ 2010-09-23 23:26 . 2010-05-04 17:20 192512 c:\windows\ie7updates\KB2183461-IE7\iepeers.dll
+ 2010-09-23 23:26 . 2010-05-04 17:20 385024 c:\windows\ie7updates\KB2183461-IE7\iedkcs32.dll
+ 2010-09-23 23:26 . 2010-05-04 17:20 380928 c:\windows\ie7updates\KB2183461-IE7\ieapfltr.dll
+ 2010-09-23 23:26 . 2010-04-16 11:43 161792 c:\windows\ie7updates\KB2183461-IE7\ieakui.dll
+ 2010-09-23 23:26 . 2010-05-04 17:20 230400 c:\windows\ie7updates\KB2183461-IE7\ieaksie.dll
+ 2010-09-23 23:26 . 2010-05-04 17:20 153088 c:\windows\ie7updates\KB2183461-IE7\ieakeng.dll
+ 2010-09-23 23:26 . 2010-05-04 17:20 133120 c:\windows\ie7updates\KB2183461-IE7\extmgr.dll
+ 2010-09-23 23:26 . 2010-05-04 17:20 214528 c:\windows\ie7updates\KB2183461-IE7\dxtrans.dll
+ 2010-09-23 23:26 . 2010-05-04 17:20 347136 c:\windows\ie7updates\KB2183461-IE7\dxtmsft.dll
+ 2010-09-23 23:26 . 2010-05-04 17:20 124928 c:\windows\ie7updates\KB2183461-IE7\advpack.dll
+ 2010-09-24 10:01 . 2010-09-24 10:01 321536 c:\windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\a16b8bcca59515281688ec856c034698\WsatConfig.ni.exe
+ 2010-09-24 10:00 . 2010-09-24 10:00 633856 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLiveLocal.Wr#\556ae36dd8238b6157bc1e8a7cccd550\WindowsLiveLocal.WriterPlugin.ni.dll
+ 2010-09-24 10:00 . 2010-09-24 10:00 118784 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\f06626ccee27150b618f6ff8e4b83dba\WindowsLive.Writer.Extensibility.ni.dll
+ 2010-09-24 10:00 . 2010-09-24 10:00 108544 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\e0e45d40fad4c1b13c93dbd1268410f3\WindowsLive.Writer.Passport.ni.dll
+ 2010-09-24 10:00 . 2010-09-24 10:00 594944 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\df15c0083bdfbbe4b1c7e83034ecd5f6\WindowsLive.Writer.HtmlEditor.ni.dll
+ 2010-09-24 10:00 . 2010-09-24 10:00 313856 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\c46d84073499887c745801bda334c97f\WindowsLive.Writer.Interop.SHDocVw.ni.dll
+ 2010-09-24 10:00 . 2010-09-24 10:00 152064 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\b2d5a953edeb3357a489c44f9f9000b2\WindowsLive.Writer.HtmlParser.ni.dll
+ 2010-09-24 10:00 . 2010-09-24 10:00 322048 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\8f73472385b353ebd6010d02ad42b2b6\WindowsLive.Writer.SpellChecker.ni.dll
+ 2010-09-24 10:00 . 2010-09-24 10:00 851968 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\84c1ee11d86bed17949850c394f4581c\WindowsLive.Writer.BlogClient.ni.dll
+ 2010-09-24 10:00 . 2010-09-24 10:00 428032 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\56faab9a03f8863e76f75d8b6c70185b\WindowsLive.Writer.Localization.ni.dll
+ 2010-09-24 10:00 . 2010-09-24 10:00 174080 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\4844cd1fac89240407ab5e2a4fe9c518\WindowsLive.Writer.BrowserControl.ni.dll
+ 2010-09-24 10:00 . 2010-09-24 10:00 334848 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\482300ac4d48e5c77dc319ec489e6bfc\WindowsLive.Writer.Interop.Mshtml.ni.dll
+ 2010-09-24 10:00 . 2010-09-24 10:00 119296 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\436529704b6c85b97f68a5489dc82ab2\WindowsLive.Writer.FileDestinations.ni.dll
+ 2010-09-24 10:00 . 2010-09-24 10:00 319488 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\3dce78aa75f081de7ad7cd480e64167a\WindowsLive.Writer.Interop.ni.dll
+ 2010-09-24 09:59 . 2010-09-24 09:59 843776 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\1931e1807dc35a71bda7ce8b517c84ef\WindowsLive.Writer.Controls.ni.dll
+ 2010-09-24 10:00 . 2010-09-24 10:00 258048 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\18a657bcf90f1a3340e7e33ea4dad4c9\WindowsLive.Writer.Mshtml.ni.dll
+ 2010-09-24 10:00 . 2010-09-24 10:00 117760 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\088f2a6fd9107021e9b80ecc5c832334\WindowsLive.Writer.Instrumentation.ni.dll
+ 2010-09-24 10:00 . 2010-09-24 10:00 145920 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Client\4db92179406aa5a642aca6165defa8fe\WindowsLive.Client.ni.dll
+ 2010-09-24 09:43 . 2010-09-24 09:43 240128 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\672c4d8e3c33e309c1ed90fa4cb85aba\WindowsFormsIntegration.ni.dll
+ 2010-09-24 09:43 . 2010-09-24 09:43 187904 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\cd91a32f4e36ccb2981c72c0d333e928\UIAutomationTypes.ni.dll
+ 2010-09-24 09:43 . 2010-09-24 09:43 447488 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\9df760fdf8071c7b0de78f39de365e6a\UIAutomationClient.ni.dll
+ 2010-09-24 12:30 . 2010-09-24 12:30 400896 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml.Linq\14fe26c2dadca6d2b44d9b583e164a72\System.Xml.Linq.ni.dll
+ 2010-09-24 12:26 . 2010-09-24 12:26 129536 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Routing\ec3ef9267ffa281af4670915c13b4c06\System.Web.Routing.ni.dll
+ 2010-09-24 09:59 . 2010-09-24 09:59 202240 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\d0ae809162b55e2fa958739177476af8\System.Web.RegularExpressions.ni.dll
+ 2010-09-24 12:27 . 2010-09-24 12:27 859648 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\720b28d81e987b889180b291ea19b821\System.Web.Extensions.Design.ni.dll
+ 2010-09-24 12:27 . 2010-09-24 12:27 328704 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity\7437ad69490f16aa30a78b1710fedb77\System.Web.Entity.ni.dll
+ 2010-09-24 12:27 . 2010-09-24 12:27 301056 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Entity.D#\8db44b2dbb980a5694d25bc0a3c4564f\System.Web.Entity.Design.ni.dll
+ 2010-09-24 12:27 . 2010-09-24 12:27 547328 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.DynamicD#\f45426703cba98d0c4c763dffde147bd\System.Web.DynamicData.ni.dll
+ 2010-09-24 12:26 . 2010-09-24 12:26 141312 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Abstract#\95fab896ef2af14876e3e1524379773b\System.Web.Abstractions.ni.dll
+ 2010-09-24 09:59 . 2010-09-24 09:59 627200 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\26d5bf1f7e700c2c19aa9b1da5519b24\System.Transactions.ni.dll
+ 2010-09-24 09:59 . 2010-09-24 09:59 212992 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\8b000cc703c9d95593b516bf2c2ec316\System.ServiceProcess.ni.dll
+ 2010-09-24 09:57 . 2010-09-24 09:57 676352 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\ec2ed3d0de7cff4cbf50680f7d850e67\System.Security.ni.dll
+ 2010-09-24 09:57 . 2010-09-24 09:57 311296 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\dd7497aa089340600c8c5af8ab421ff7\System.Runtime.Serialization.Formatters.Soap.ni.dll
+ 2010-09-24 09:58 . 2010-09-24 09:58 771584 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\3de39eb60b9d32af46f32f6c7a88fc7f\System.Runtime.Remoting.ni.dll
+ 2010-09-24 12:26 . 2010-09-24 12:26 621056 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Net\2a080994f308f347b0497bb8804861cf\System.Net.ni.dll
+ 2010-09-24 12:25 . 2010-09-24 12:25 998400 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management\bc1cf48ba7dc00f45d0e949c49ab677a\System.Management.ni.dll
+ 2010-09-24 12:25 . 2010-09-24 12:25 330752 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Management.I#\f273475a65342f92263195187af4ebf2\System.Management.Instrumentation.ni.dll
+ 2010-09-24 09:55 . 2010-09-24 09:55 381440 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IO.Log\4490976887e2e5a3b594041edbdf5064\System.IO.Log.ni.dll
+ 2010-09-24 09:55 . 2010-09-24 09:55 212992 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\77b9f6f6671aaaeb84c6907d467e792c\System.IdentityModel.Selectors.ni.dll
+ 2010-09-24 09:59 . 2010-09-24 09:59 280064 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\15724a7517f939c9b300f341fb5620b8\System.EnterpriseServices.Wrapper.dll
+ 2010-09-24 09:59 . 2010-09-24 09:59 627712 c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\15724a7517f939c9b300f341fb5620b8\System.EnterpriseServices.ni.dll
+ 2010-09-24 09:42 . 2010-09-24 09:42 208384 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\90199b4aa63b1b9c8ed0c3de16eec824\System.Drawing.Design.ni.dll
+ 2010-09-24 12:25 . 2010-09-24 12:25 881152 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\849e98c9f428a12cb581320a23f69dbd\System.DirectoryServices.AccountManagement.ni.dll
+ 2010-09-24 09:59 . 2010-09-24 09:59 455680 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\7a823a4f61cf8c86aad02559f8fed07b\System.DirectoryServices.Protocols.ni.dll
+ 2010-09-24 12:25 . 2010-09-24 12:25 354816 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\b5b3e7192a12e7181daaa634056a2555\System.Data.Services.Design.ni.dll
+ 2010-09-24 12:25 . 2010-09-24 12:25 939008 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\9dfae65375e8ade16de4e1efb6056c73\System.Data.Services.Client.ni.dll
+ 2010-09-24 12:24 . 2010-09-24 12:24 756736 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity.#\84d3fd0eeb9c8659b0ad0e7d37c614ee\System.Data.Entity.Design.ni.dll
+ 2010-09-24 10:02 . 2010-09-24 10:02 135680 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.DataSet#\6c09662c9bd6ca509abe263c131561b3\System.Data.DataSetExtensions.ni.dll
+ 2010-09-24 09:57 . 2010-09-24 09:57 971264 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\8eb34a2f6d958e1f764911fac47cbc78\System.Configuration.ni.dll
+ 2010-09-24 09:59 . 2010-09-24 09:59 141312 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\b48677ab9aa7a6830785f67b8478b4da\System.Configuration.Install.ni.dll
+ 2010-09-24 10:02 . 2010-09-24 10:02 633856 c:\windows\assembly\NativeImages_v2.0.50727_32\System.AddIn\93a0958d5557e2b380647af0171ad354\System.AddIn.ni.dll
+ 2010-09-24 10:01 . 2010-09-24 10:01 366080 c:\windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\d0758f84e927e3f0a15a6cde1b96d835\SMSvcHost.ni.exe
+ 2010-09-24 10:01 . 2010-09-24 10:01 256000 c:\windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\8043a108e3bb2d3dcc84b547b8085e99\SMDiagnostics.ni.dll
+ 2010-09-24 10:01 . 2010-09-24 10:01 320512 c:\windows\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\5aeb40ff7128df2881fb03c01d070b20\ServiceModelReg.ni.exe
+ 2010-09-24 09:39 . 2010-09-24 09:39 368128 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\e7e7321956e6822b1bf3691c35c842f6\PresentationFramework.Aero.ni.dll
+ 2010-09-24 09:39 . 2010-09-24 09:39 258048 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\a14488afff027f0f2985e659449097f5\PresentationFramework.Royale.ni.dll
+ 2010-09-24 09:39 . 2010-09-24 09:39 224768 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\787e60c5dd562cb45887080095d2a3b7\PresentationFramework.Classic.ni.dll
+ 2010-09-24 09:39 . 2010-09-24 09:39 539648 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\2313ccc125dcb6a9800048ec1c51ec12\PresentationFramework.Luna.ni.dll
+ 2010-09-24 10:01 . 2010-09-24 10:01 133632 c:\windows\assembly\NativeImages_v2.0.50727_32\MSBuild\5db9c32d9f352162e6da220ca463db0d\MSBuild.ni.exe
+ 2010-09-24 10:01 . 2010-09-24 10:01 386560 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\fcf975f74bd134d8e0fa8f37c5bc6a8c\Microsoft.Transactions.Bridge.Dtc.ni.dll
+ 2010-09-24 09:57 . 2010-09-24 09:57 472064 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\e489793fb494ff9d467cb8620ce9e2b7\Microsoft.MapPoint.Rendering3D.Utility.ni.dll
+ 2010-09-24 09:57 . 2010-09-24 09:57 840192 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\deba555b5d848944c70d4c8ae297956e\Microsoft.MapPoint.Geometry.ni.dll
+ 2010-09-24 09:58 . 2010-09-24 09:58 411648 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\cc134b6f9a83b4fb2346869ffd99f613\Microsoft.MapPoint.Network.ni.dll
+ 2010-09-24 09:58 . 2010-09-24 09:58 766976 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\bfbb5a8378b21da0caf990708b6fc735\Microsoft.MapPoint.Data.VirtualEarthTileDataSource.ni.dll
+ 2010-09-24 09:57 . 2010-09-24 09:57 340992 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\9d666637bf64e132f3393db423707208\Microsoft.MapPoint.UtilityPartialTrust.ni.dll
+ 2010-09-24 09:56 . 2010-09-24 09:56 438272 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\73c82b0697aff6093ecb5a90713b8b36\Microsoft.MapPoint.MapControl3D.ni.dll
+ 2010-09-24 09:58 . 2010-09-24 09:58 344064 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\5813d9c981877fe41945bf3df4ae1b34\Microsoft.MapPoint.Utility.ni.dll
+ 2010-09-24 09:58 . 2010-09-24 09:58 434176 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\09579af13e9e1c226fba0a4e1291d59a\Microsoft.MapPoint.Data.CompactMapFile.ni.dll
+ 2010-09-24 10:01 . 2010-09-24 10:01 144384 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\d6b9038136600fbfbbbd7460dc19da19\Microsoft.Build.Utilities.ni.dll
+ 2010-09-24 10:01 . 2010-09-24 10:01 175104 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\585cc7218599e7806521d0e737ba5ffb\Microsoft.Build.Utilities.v3.5.ni.dll
+ 2010-09-24 10:01 . 2010-09-24 10:01 839680 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\3057ec53731286e69e389d103c32fa41\Microsoft.Build.Engine.ni.dll
+ 2010-09-24 10:01 . 2010-09-24 10:01 222720 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Con#\914e338ac6e92714f3e32ae5d89bf03b\Microsoft.Build.Conversion.v3.5.ni.dll
+ 2010-09-24 10:01 . 2010-09-24 10:01 220672 c:\windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\12ae6f3635448471fc9f7d8bfe39c67d\CustomMarshalers.ni.dll
+ 2010-09-24 10:00 . 2010-09-24 10:00 410112 c:\windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\daca3c9ad6d867d3fec70d14b4f20cf3\ComSvcConfig.ni.exe
+ 2010-09-24 09:55 . 2010-09-24 09:55 842240 c:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\56aec0938ef1bbdeca65b07a5fe8cd39\AspNetMMCExt.ni.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 839680 c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 839680 c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
- 2010-07-15 21:11 . 2010-07-15 21:11 835584 c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 835584 c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 114688 c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 114688 c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 258048 c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 258048 c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 131072 c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 131072 c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 303104 c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 303104 c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 258048 c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 258048 c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 372736 c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 372736 c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 626688 c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 626688 c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 401408 c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 401408 c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 188416 c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 188416 c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
+ 2010-09-23 23:23 . 2010-09-23 23:23 970752 c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 970752 c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 745472 c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
+ 2010-09-23 23:23 . 2010-09-23 23:23 745472 c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 425984 c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 425984 c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 110592 c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 110592 c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 659456 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 659456 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 372736 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 372736 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 110592 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 110592 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 749568 c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 749568 c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 655360 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 655360 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 348160 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 348160 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 507904 c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
- 2010-07-15 21:11 . 2010-07-15 21:11 507904 c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 261632 c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 261632 c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 113664 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 113664 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 258048 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 258048 c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 486400 c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 486400 c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 3780424 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90u.dll
+ 2009-07-11 23:02 . 2009-07-11 23:02 3765048 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_a57c1f53\mfc90.dll
+ 2009-04-15 23:33 . 2010-06-23 13:44 1851904 c:\windows\system32\win32k.sys
- 2009-04-15 23:33 . 2010-05-04 17:20 1168384 c:\windows\system32\urlmon.dll
+ 2009-04-15 23:33 . 2010-06-24 12:15 1168384 c:\windows\system32\urlmon.dll
- 2008-04-14 00:54 . 2010-02-16 14:08 2146304 c:\windows\system32\ntoskrnl.exe
+ 2008-04-14 00:54 . 2010-04-27 13:59 2146304 c:\windows\system32\ntoskrnl.exe
- 2008-04-14 00:01 . 2010-02-16 13:25 2024448 c:\windows\system32\ntkrnlpa.exe
+ 2008-04-14 00:01 . 2010-04-27 13:05 2024448 c:\windows\system32\ntkrnlpa.exe
+ 2009-04-15 23:32 . 2010-06-14 07:41 1172480 c:\windows\system32\msxml3.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 3600896 c:\windows\system32\mshtml.dll
+ 2007-08-13 17:54 . 2010-06-24 12:15 6067200 c:\windows\system32\ieframe.dll
- 2007-08-13 17:54 . 2010-05-04 17:20 6067200 c:\windows\system32\ieframe.dll
+ 2009-04-15 23:33 . 2010-06-23 13:44 1851904 c:\windows\system32\dllcache\win32k.sys
- 2009-04-15 23:33 . 2010-05-04 17:20 1168384 c:\windows\system32\dllcache\urlmon.dll
+ 2009-04-15 23:33 . 2010-06-24 12:15 1168384 c:\windows\system32\dllcache\urlmon.dll
+ 2009-04-15 15:32 . 2010-04-28 02:25 2189952 c:\windows\system32\dllcache\ntoskrnl.exe
- 2009-04-15 15:32 . 2010-02-17 08:10 2189952 c:\windows\system32\dllcache\ntoskrnl.exe
+ 2009-04-15 15:32 . 2010-04-27 13:05 2024448 c:\windows\system32\dllcache\ntkrpamp.exe
- 2009-04-15 15:32 . 2010-02-16 13:25 2024448 c:\windows\system32\dllcache\ntkrpamp.exe
- 2009-04-15 15:32 . 2010-02-16 13:25 2066816 c:\windows\system32\dllcache\ntkrnlpa.exe
+ 2009-04-15 15:32 . 2010-04-27 13:05 2066816 c:\windows\system32\dllcache\ntkrnlpa.exe
- 2009-04-15 15:32 . 2010-02-16 14:08 2146304 c:\windows\system32\dllcache\ntkrnlmp.exe
+ 2009-04-15 15:32 . 2010-04-27 13:59 2146304 c:\windows\system32\dllcache\ntkrnlmp.exe
+ 2009-04-15 23:32 . 2010-06-14 07:41 1172480 c:\windows\system32\dllcache\msxml3.dll
+ 2009-04-15 23:32 . 2010-06-24 12:15 3600896 c:\windows\system32\dllcache\mshtml.dll
- 2009-04-15 14:52 . 2009-10-23 15:28 3558912 c:\windows\system32\dllcache\moviemk.exe
+ 2009-04-15 14:52 . 2010-06-18 13:36 3558912 c:\windows\system32\dllcache\moviemk.exe
- 2009-07-19 13:32 . 2010-05-04 17:20 6067200 c:\windows\system32\dllcache\ieframe.dll
+ 2009-07-19 13:32 . 2010-06-24 12:15 6067200 c:\windows\system32\dllcache\ieframe.dll
+ 2010-05-11 05:40 . 2010-05-11 05:40 5812560 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
- 2009-08-07 22:51 . 2009-08-07 22:51 5812560 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
+ 2010-05-11 05:40 . 2010-05-11 05:40 4550656 c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
+ 2010-07-09 16:28 . 2010-07-09 16:28 2151424 c:\windows\Installer\16c063.msp
+ 2009-04-15 16:13 . 2010-09-23 23:25 1099104 c:\windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksSb.exe
- 2009-04-15 16:13 . 2009-08-12 07:20 1099104 c:\windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksSb.exe
- 2009-04-15 16:13 . 2009-08-12 07:20 1242464 c:\windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksdb.exe
+ 2009-04-15 16:13 . 2010-09-23 23:25 1242464 c:\windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\wksdb.exe
+ 2007-06-21 21:44 . 2007-06-21 21:44 2901344 c:\windows\Installer\$PatchCache$\Managed\97230E76307FF8044BFB645BCFD807DC\9.7.621\F22194_wksssdb.dll
+ 2010-09-23 23:26 . 2010-05-04 17:20 1168384 c:\windows\ie7updates\KB2183461-IE7\urlmon.dll
+ 2010-09-23 23:26 . 2010-05-04 17:20 3600384 c:\windows\ie7updates\KB2183461-IE7\mshtml.dll
+ 2010-09-23 23:26 . 2010-05-04 17:20 6067200 c:\windows\ie7updates\KB2183461-IE7\ieframe.dll
+ 2010-09-24 10:00 . 2010-09-24 10:00 1105920 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\ba732eb3a84c96e8bf60495395efbfac\WindowsLive.Writer.ApplicationFramework.ni.dll
+ 2010-09-24 10:00 . 2010-09-24 10:00 2002432 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\a5e5656fd5faa8715a4ae89077699383\WindowsLive.Writer.CoreServices.ni.dll
+ 2010-09-24 09:59 . 2010-09-24 09:59 6392832 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsLive.Writer.#\87825e26c8a5fd4e559b5e8d58faec21\WindowsLive.Writer.PostEditor.ni.dll
+ 2010-09-23 23:25 . 2010-09-23 23:25 3325440 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\dae023a1d246fa37ddd3426fc9bb3b70\WindowsBase.ni.dll
+ 2010-09-24 09:43 . 2010-09-24 09:43 1049600 c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\b7f6e7b265f9aae807ddc4284563e550\UIAutomationClientsideProviders.ni.dll
+ 2010-09-23 23:24 . 2010-09-23 23:24 7949824 c:\windows\assembly\NativeImages_v2.0.50727_32\System\08ffa4d388d5f007869aa7651c458e7c\System.ni.dll
+ 2010-09-24 09:43 . 2010-09-24 09:43 5450752 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\a6dbe24cbfe3ab6b318ed3095cc572d8\System.Xml.ni.dll
+ 2010-09-24 12:30 . 2010-09-24 12:30 1356288 c:\windows\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\60b3c9a63b2065a6952d16256545c25d\System.WorkflowServices.ni.dll
+ 2010-09-24 12:30 . 2010-09-24 12:30 1908224 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\5cc2a23ce8ac371c7a97b5e542ee27ed\System.Workflow.Runtime.ni.dll
+ 2010-09-24 12:29 . 2010-09-24 12:29 4514304 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\c0aabf67e7ef98dc10c3e174c136731b\System.Workflow.ComponentModel.ni.dll
+ 2010-09-24 12:29 . 2010-09-24 12:29 2992640 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\66682c8a064608ba4ffd0463cf09aef9\System.Workflow.Activities.ni.dll
+ 2010-09-24 09:59 . 2010-09-24 09:59 1840640 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\2d662564b8d9c57a34c588cc2970902b\System.Web.Services.ni.dll
+ 2010-09-24 12:28 . 2010-09-24 12:28 2209280 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\9b455702c9b7b02c5708406f87986751\System.Web.Mobile.ni.dll
+ 2010-09-24 12:27 . 2010-09-24 12:27 2403328 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Extensio#\8b0d75a6f047152c671351b6b7e61e78\System.Web.Extensions.ni.dll
+ 2010-09-24 09:42 . 2010-09-24 09:42 1917952 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Speech\5eb08849d17b272ed2a393420cb0305b\System.Speech.ni.dll
+ 2010-09-24 12:26 . 2010-09-24 12:26 1706496 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\f5790a1b7b41e7b8d05f01b549c80f39\System.ServiceModel.Web.ni.dll
+ 2010-09-24 09:55 . 2010-09-24 09:55 2345472 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\8061a0f5c1c2ee0549e19224352f67fa\System.Runtime.Serialization.ni.dll
+ 2010-09-24 09:42 . 2010-09-24 09:42 1035776 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Printing\99767d4df92b83fdfb06012512722ec1\System.Printing.ni.dll
+ 2010-09-24 09:55 . 2010-09-24 09:55 1070080 c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\6e2c33770d95fdad957196182e98620c\System.IdentityModel.ni.dll
+ 2010-09-24 09:42 . 2010-09-24 09:42 1587200 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dcc0244092fe52e6885b50be25ef3b31\System.Drawing.ni.dll
+ 2010-09-24 09:59 . 2010-09-24 09:59 1116672 c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\d20b7e58607ddb1ded9b687627ae8c21\System.DirectoryServices.ni.dll
+ 2010-09-24 09:57 . 2010-09-24 09:57 1801216 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\c7292ebc49efe7c84362de8db36b8d83\System.Deployment.ni.dll
+ 2010-09-24 09:40 . 2010-09-24 09:40 6616576 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\f04ef00e652a8655a717639e8aeb7b63\System.Data.ni.dll
+ 2010-09-24 09:57 . 2010-09-24 09:57 2510336 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\f0470c2be4e6bb1dadbeed43e4e8af5c\System.Data.SqlXml.ni.dll
+ 2010-09-24 12:25 . 2010-09-24 12:25 1328128 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Services\ede1126f82ad1cb7f8010cd91934cce4\System.Data.Services.ni.dll
+ 2010-09-24 09:59 . 2010-09-24 09:59 1115136 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\58202ed61096113d08815c0a78313b66\System.Data.OracleClient.ni.dll
+ 2010-09-24 09:41 . 2010-09-24 09:41 2516480 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Linq\6dd9e53924115ab78fc2aafd1b1e509a\System.Data.Linq.ni.dll
+ 2010-09-24 12:24 . 2010-09-24 12:24 9924096 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.Entity\a7bdc0a68c8b8f666c2f651f3d537a82\System.Data.Entity.ni.dll
+ 2010-09-24 09:40 . 2010-09-24 09:40 2295296 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Core\c0e367272fe6d3016fee2f523d8e22d9\System.Core.ni.dll
+ 2010-09-24 09:39 . 2010-09-24 09:39 2128896 c:\windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\b0889e7c22c9eb60392bb5b1e503f056\ReachFramework.ni.dll
+ 2010-09-24 09:39 . 2010-09-24 09:39 1657856 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\fc364e0a4b08b964393c9405c0a26585\PresentationUI.ni.dll
+ 2010-09-23 23:25 . 2010-09-23 23:25 1451008 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\835786d8a0caabae09ad440f6e3abfc6\PresentationBuildTasks.ni.dll
+ 2010-09-24 10:02 . 2010-09-24 10:02 1712128 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\9732a7c993055f82040642966db07ccf\Microsoft.VisualBasic.ni.dll
+ 2010-09-24 10:01 . 2010-09-24 10:01 1093120 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\773d7bf69a9a0c0556aa41f53e75ab05\Microsoft.Transactions.Bridge.ni.dll
+ 2010-09-24 09:58 . 2010-09-24 09:58 2766336 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\fe7296468a17db9cb46bed85ae931b0e\Microsoft.MapPoint.Graphics3D.ni.dll
+ 2010-09-24 09:58 . 2010-09-24 09:58 1949184 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\ecf4a3607505d76357ddf05f0191bd09\Microsoft.MapPoint.Modeling.ni.dll
+ 2010-09-24 09:57 . 2010-09-24 09:57 4094976 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\9db9b5f60b3ab9adbb155e2719fb622f\Microsoft.MapPoint.Rendering3D.ni.dll
+ 2010-09-24 09:57 . 2010-09-24 09:57 1217024 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\47857e354d635fd46499bd0d9c547b7b\Microsoft.MapPoint.Data.ni.dll
+ 2010-09-24 09:58 . 2010-09-24 09:58 1524224 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\1eeb37443afc3f5f60df69faf20b1895\Microsoft.MapPoint.GraphicsAPI.ni.dll
+ 2010-09-24 09:58 . 2010-09-24 09:58 1524736 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MapPoint.#\14b6f742980ace494855bc8db32417d5\Microsoft.MapPoint.Rendering3D.WorldMemoryDataSource.ni.dll
+ 2010-09-24 12:26 . 2010-09-24 12:26 2332160 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.JScript\16ff33f07efdb9da2a18e27585c604be\Microsoft.JScript.ni.dll
+ 2010-09-24 10:01 . 2010-09-24 10:01 1620992 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\30fac9f4560f7c41c2217272664b9c87\Microsoft.Build.Tasks.ni.dll
+ 2010-09-24 10:01 . 2010-09-24 10:01 1966080 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\1c035ef9dae63014bf2e8714cf633a63\Microsoft.Build.Tasks.v3.5.ni.dll
+ 2010-09-24 10:01 . 2010-09-24 10:01 1888768 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\d0beebd2c9045158cdcd4bd5987b717b\Microsoft.Build.Engine.ni.dll
+ 2010-09-23 23:23 . 2010-09-23 23:23 3182592 c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 3182592 c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 2048000 c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
+ 2010-09-23 23:23 . 2010-09-23 23:23 2048000 c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
- 2010-07-15 21:11 . 2010-07-15 21:11 5025792 c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 5025792 c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 5062656 c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
- 2010-07-15 21:11 . 2010-07-15 21:12 5062656 c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 5242880 c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
- 2010-07-15 21:11 . 2010-07-15 21:11 5242880 c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
- 2010-07-15 21:12 . 2010-07-15 21:12 2933248 c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
+ 2010-09-23 23:22 . 2010-09-23 23:23 2933248 c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
+ 2010-09-23 23:22 . 2010-09-23 23:22 4550656 c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2009-08-18 08:35 . 2010-09-10 13:34 35552200 c:\windows\system32\MRT.exe
+ 2010-05-19 12:08 . 2010-05-19 12:08 11408896 c:\windows\Installer\16c04f.msp
+ 2010-09-24 09:43 . 2010-09-24 09:43 12430848 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\33f8bec2a9ea02a0479577b3ef6f32f2\System.Windows.Forms.ni.dll
+ 2010-09-24 09:58 . 2010-09-24 09:58 11798016 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\411a627d6f5cb83509332253406988e5\System.Web.ni.dll
+ 2010-09-24 09:56 . 2010-09-24 09:56 17403904 c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\4f5c13a3ec5f2a7936ee96226b207555\System.ServiceModel.ni.dll
+ 2010-09-24 09:41 . 2010-09-24 09:41 10683392 c:\windows\assembly\NativeImages_v2.0.50727_32\System.Design\b307acf63075b997d02a97a7492d0d9c\System.Design.ni.dll
+ 2010-09-24 09:38 . 2010-09-24 09:38 14328320 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\d40a4759abd29132c3e830e5c7973eec\PresentationFramework.ni.dll
+ 2010-09-23 23:26 . 2010-09-23 23:26 12215808 c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\90b6244a82c46b806ddd5517fb1dfac6\PresentationCore.ni.dll
+ 2010-09-23 23:24 . 2010-09-23 23:24 11490816 c:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7bffd7ff2009f421fe5d229927588496\mscorlib.ni.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320]
"{7701A1A8-4198-82F6-F5EB-680537DA1946}"="c:\documents and settings\Jason\Application Data\Yhexi\egma.exe" [BU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-03-28 131072]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-03-28 348160]
"PersistenceThread"="c:\windows\system32\PersistenceThread.exe" [2009-03-28 86016]
"RTHDCPL"="RTHDCPL.EXE" [2009-03-24 17567744]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-02-27 1434920]
"PLFSetL"="c:\windows\PLFSetL.exe" [2008-07-03 94208]
"LManager"="c:\program files\Launch Manager\LManager.exe" [2009-02-20 817672]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-31 149280]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2010-03-10 648536]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2009-07-08 236016]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]
"Bqofapaqekojotoh"="c:\windows\epiciyozoxu.dll" [BU]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Jason\Start Menu\Programs\Startup\
Check for TWS Updates.lnk - c:\jts\WiseUpdt.exe [2009-8-10 194775]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\igdlogin]
2009-03-28 22:43 65536 ----a-w- c:\windows\system32\igdlogin.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
backup=c:\windows\pss\Bluetooth.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-02-27 16:10 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Acer\\Acer VCM\\VC.exe"=
"c:\\Program Files\\Huawei technologies\\Huawei UMTS Data Card\\3 USB Modem.exe"=
"c:\\WINDOWS\\system32\\javaw.exe"=
"c:\\Program Files\\NinjaTrader 6.5\\bin\\NinjaTrader.exe"=
"c:\\Program Files\\Whisper Technology\\FTP Surfer\\Surfer.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Spotify\\spotify.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Research In Motion\\BlackBerry Media Sync\\BlackBerry Media Sync.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [23/09/2010 21:50 165584]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [23/09/2010 21:50 17744]
R2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [15/04/2009 18:02 282624]
R2 VideoAcceleratorService;VideoAcceleratorService;c:\progra~1\SPEEDB~1\VideoAcceleratorService.exe -start -scm --> c:\progra~1\SPEEDB~1\VideoAcceleratorService.exe -start -scm [?]
R2 VMCService;Vodafone Mobile Connect Service;c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [04/11/2008 11:39 14336]
R3 igd;igd;c:\windows\system32\drivers\igxpmp32.sys [15/04/2009 16:53 5095360]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [15/04/2009 16:56 1684736]
S3 GTUHSBUS;GT UHS BUS;c:\windows\system32\drivers\gtuhsbus.sys [16/04/2009 00:33 62592]
S3 GTUHSNDISIPXP;GT UHS IP NDIS;c:\windows\system32\drivers\gtuhs51.sys [16/04/2009 00:33 105984]
S3 GTUHSSER;GT UHS SER;c:\windows\system32\drivers\gtuhsser.sys [16/04/2009 00:33 8064]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [18/12/2009 12:55 136704]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [18/12/2009 12:55 8320]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [15/04/2009 16:58 164864]
S3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2010-10-04 c:\windows\Tasks\User_Feed_Synchronization-{6DAD55C2-90DF-4D70-B3CB-6EF4EF414218}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 17:36]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.livecharts.co.uk/membersarea/threads.php
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=0&o=xph&d=0809&m=ao751h
uInternet Connection Wizard,ShellNext = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&s=0&o=xph&d=0809&m=ao751h
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google AdSense Preview Tool - http://pagead2.googlesyndication.com/pagea...en/preview.html
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
LSP: c:\progra~1\SPEEDB~1\sblsp.dll
Trusted Zone: facebook.com\www
Trusted Zone: three.co.uk\my3
FF - ProfilePath - c:\documents and settings\Jason\Application Data\Mozilla\Firefox\Profiles\p980oglj.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.livecharts.co.uk/membersarea/threads.php
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\program files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Qqazohuxew - c:\windows\pieo80.dll
MSConfigStartUp-avgnt - c:\program files\Avira\AntiVir Desktop\avgnt.exe
AddRemove-Windows Media Format Runtime - c:\program files\Windows Media Player\wmsetsdk.exe
AddRemove-{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110111700} - c:\program files\Acer GameZone\Zuma Deluxe\Uninstall.exe
AddRemove-{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110265407} - c:\program files\Acer GameZone\Bejeweled 2 Deluxe\Uninstall.exe
AddRemove-{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11037623} - c:\program files\Acer GameZone\Tradewinds 2\Uninstall.exe
AddRemove-{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111125700} - c:\program files\Acer GameZone\Rainbow Web\Uninstall.exe
AddRemove-{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111205743} - c:\program files\Acer GameZone\Tri-Peaks Solitaire To Go\Uninstall.exe
AddRemove-{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111252743} - c:\program files\Acer GameZone\Mahjong Escape Ancient China\Uninstall.exe
AddRemove-{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111307457} - c:\program files\Acer GameZone\Galapago\Uninstall.exe
AddRemove-{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111771833} - c:\program files\Acer GameZone\Jewel Quest Solitaire\Uninstall.exe
AddRemove-{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112270203} - c:\program files\Acer GameZone\Dream Day Wedding\Uninstall.exe
AddRemove-{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11231247} - c:\program files\Acer GameZone\Peggle\Uninstall.exe
AddRemove-{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113297350} - c:\program files\Acer GameZone\Cake Mania 2\Uninstall.exe
AddRemove-{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110} - c:\program files\Acer GameZone\Dream Day First Home\Uninstall.exe
AddRemove-{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11386547} - c:\program files\Acer GameZone\Farm Frenzy\Uninstall.exe
AddRemove-{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-114803710} - c:\program files\Acer GameZone\Star Defender 4\Uninstall.exe
AddRemove-{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115443300} - c:\program files\Acer GameZone\Cooking Dash\Uninstall.exe
AddRemove-{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11551977} - c:\program files\Acer GameZone\Parking Dash\Uninstall.exe


.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(788)
c:\progra~1\SPEEDB~1\sblsp.dll
c:\program files\SpeedBit Video Accelerator\ConfigDB.dll
c:\program files\SpeedBit Video Accelerator\Accelerator.dll
c:\windows\system32\WININET.dll
c:\program files\SpeedBit Video Accelerator\Collector.dll
.
Completion time: 2010-10-04 22:00:23
ComboFix-quarantined-files.txt 2010-10-04 21:00
ComboFix2.txt 2010-09-23 19:13
ComboFix3.txt 2010-09-23 16:51
ComboFix4.txt 2010-09-02 11:48
ComboFix5.txt 2010-10-04 20:25

Pre-Run: 112,117,702,656 bytes free
Post-Run: 112,683,462,656 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 82F269C79C96723E0CAA942AA562952B

Edited by Hooya, 04 October 2010 - 04:18 PM.


#6 fireman4it

fireman4it

    Bleepin' Fireman


  • Malware Response Team
  • 13,512 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Greenup, Ill USA
  • Local time:03:19 AM

Posted 04 October 2010 - 06:18 PM

Hello,

I'm afraid I have very bad news.

Win32/Ramnit.A is a file infector with IRCBot functionality which infects .exe, and .HTML/HTM files, and opens a back door that compromises your computer. Using this backdoor, a remote attacker can access and instruct the infected computer to download and execute more malicious files. The infected .HTML or .HTM files may be detected as Virus:VBS/Ramnit.A. Win32/Ramnit.A!dll is a related file infector often seen with this infection. It too has IRCBot functionality which infects .exe, .dll and .HTML/HTM files and opens a back door that compromises your computer. This component is injected into the default web browser by Worm:Win32/Ramnit.A which is dropped by a Ramnit infected executable file.

-- Note: As with most malware infections, the threat name may be different depending on the anti-virus or anti-malware program which detected it. Each security vendor uses their own naming conventions to identify various types of malware.
With this particular infection the safest solution and only sure way to remove it effectively is to reformat and reinstall the OS.

Why? The malware injects code in legitimate files similar to the Virut virus and in many cases the infected files (which could number in the thousands) cannot be disinfected properly by your anti-virus. When disinfection is attempted, the files often become corrupted and the system may become unstable or irreparable. The longer Ramnit.A remains on a computer, the more files it infects and corrupts so the degree of infection can vary.

Ramnit is commonly spread via a flash drive (usb, pen, thumb, jump) infection where it copies Worm:Win32/Ramnit.A with a random file name. The infection is often contracted by visiting remote, crack and keygen sites. These type of sites are infested with a smörgåsbord of malware and a major source of system infection.

In my opinion, Ramnit.A is not effectively disinfectable, so your best option is to perform a full reformat as there is no guarantee this infection can be completely removed. In most instances it may have caused so much damage to your system files that it cannot be completely cleaned or repaired. Further, your machine has likely been compromised by the backdoor Trojan and there is no way to be sure the computer can ever be trusted again. It is dangerous and incorrect to assume the computer is secure even if your anti-virus reports that the malware appears to have been removed.

Many experts in the security community believe that once infected with this type of malware, the best course of action is to wipe the drive clean, reformat and reinstall the OS. Please read:
QUOTE
Whenever a system has been compromised by a backdoor payload, it is impossible to know if or how much the backdoor has been used to affect your system...There are only a few ways to return a compromised system to a confident security configuration. These include:
• Reimaging the system
• Restoring the entire system using a full system backup from before the backdoor infection
• Reformatting and reinstalling the system
Backdoors and What They Mean to You

This is what Jesper M. Johansson at Microsoft TechNet has to say: Help: I Got Hacked. Now What Do I Do?.
QUOTE
The only way to clean a compromised system is to flatten and rebuild. That’s right. If you have a system that has been completely compromised, the only thing you can do is to flatten the system (reformat the system disk) and rebuild it from scratch (reinstall Windows and your applications).

" Extinguishing Malware from the world"

The Virus, Trojan, Spyware, and Malware Removal forum is very busy. If I'm helping you and I've not posted back within 24 hrs., send a PM with your topic link. Thank you.

ALL OTHER HELP REQUESTS VIA THE PM SYSTEM WILL BE IGNORED. The Forums are there for a reason!
Thanks-


  userbar_eis_500.gif

If I have helped you, consider making a donation to help me continue the fight against Malware! Just click btn_donate_LG.gif


#7 Hooya

Hooya
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:03:19 AM

Posted 05 October 2010 - 07:21 AM

I thought I had seen similar threads where they attempt to repair the pc. Is my case very different?


"infects .exe, .dll and .HTML/HTM files "

can I be sure that other files types are not infected though? i.e pictures/documents/text files? email files?

Thanks

Edited by Hooya, 05 October 2010 - 08:18 AM.


#8 Hooya

Hooya
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:03:19 AM

Posted 05 October 2010 - 03:06 PM

Decided to go ahead and reformat. Wil the Acer Aspire ONe it is nice and easy. Saved all non infected files to stick and scanned and all virus/trojan free.

There was one html file I needed but I copied the the source code but without the virsu script and created a new txt file which I will save as an html on clean laptop.

Thanks for your help.

To anyone who comes across this topic. Really is worth reformatting it. 3000 of my files were infected but on 170 were actual in personal files the rest were system files and program files. Nothing that you don't mind losing and reinstalling. The 170 odd I deleted/didn't back up contained dlls and exe and htmls files. Ultimately the htmls file were really the only thing I would have liked to keep. And from searches on google there are programs than can clean the scrpit out of them. But don't know how good/bad it is. But really....if I had done this last week I would have saved myself alot of hassle.

Thanks again fireman4it

Can close the thread now thanks.

#9 fireman4it

fireman4it

    Bleepin' Fireman


  • Malware Response Team
  • 13,512 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Greenup, Ill USA
  • Local time:03:19 AM

Posted 06 October 2010 - 05:59 PM

This thread will now be closed since the issue seems to be resolved.

If you need this topic reopened, please send a Private Message to any one of the moderating team member or myself. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

The fixes and advice in this thread are for this machine only. Do not apply the instructions from this thread to your own machine. Please start a new thread describing your issue and someone will be along to assist you.

" Extinguishing Malware from the world"

The Virus, Trojan, Spyware, and Malware Removal forum is very busy. If I'm helping you and I've not posted back within 24 hrs., send a PM with your topic link. Thank you.

ALL OTHER HELP REQUESTS VIA THE PM SYSTEM WILL BE IGNORED. The Forums are there for a reason!
Thanks-


  userbar_eis_500.gif

If I have helped you, consider making a donation to help me continue the fight against Malware! Just click btn_donate_LG.gif





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users