Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected with some kind of rootkit/virus, Firewall Service Missing


  • This topic is locked This topic is locked
12 replies to this topic

#1 roycegwapo

roycegwapo

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:24 AM

Posted 17 December 2011 - 11:24 PM

I'm certainly infected, my Windows 7 firewall service is missing on the task manager and an error coded 0x80070424 keeps appearing when I try to restore windows firewall to it's original settings. My antivirus (MSE) always reports an infection and my usual action is to remove the virus. I don't what is causing the infection. Me myself knows what to download and what's not.

OS: Windows 7 Ultimate 32 bit
AV: Microsoft Security Essentials



DDS LOGS:
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421
Run by Royce Borja at 10:46:18 on 2011-12-18
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.1964.1062 [GMT 8:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
C:\Program Files\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\atieclxx.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe
C:\Program Files\TeamViewer\Version5\TeamViewer.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Program Files\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Elantech\ETDCtrl.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\Globe Broadband\Globe Broadband.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Users\Royce Borja\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\ASUS\ATK Package\ATK Hotkey\HControl.exe
C:\Program Files\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
C:\Program Files\ASUS\ATK Package\ATK Hotkey\WDC.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\Windows\system32\WUDFHost.exe
C:\Users\Royce Borja\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Royce Borja\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://home.sweetim.com
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mURLSearchHooks: 4shared.com Toolbar: {09ec805c-cb2e-4d53-b0d3-a75a428b81c7} - c:\program files\4shared.com\prxtb4sha.dll
BHO: 4shared.com Toolbar: {09ec805c-cb2e-4d53-b0d3-a75a428b81c7} - c:\program files\4shared.com\prxtb4sha.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~3\office14\GROOVEEX.DLL
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~3\office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: 4shared.com Toolbar: {09ec805c-cb2e-4d53-b0d3-a75a428b81c7} - c:\program files\4shared.com\prxtb4sha.dll
TB: SweetIM Toolbar for Internet Explorer: {eee6c35b-6118-11dc-9c72-001320c79847} - c:\program files\sweetim\toolbars\internet explorer\mgToolbarIE.dll
uRun: [Mobile Partner] "c:\program files\globe broadband\Globe Broadband.exe"
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [ATKOSD2] c:\program files\asus\atk package\atkosd2\ATKOSD2.exe
mRun: [ATKMEDIA] c:\program files\asus\atk package\atk media\DMedia.exe
mRun: [HControlUser] c:\program files\asus\atk package\atk hotkey\HControlUser.exe
mRun: [UnlockerAssistant] "c:\program files\unlocker\UnlockerAssistant.exe"
mRun: [BCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices
mRun: [ETDWare] c:\program files\elantech\ETDCtrl.exe
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [SweetIM] c:\program files\sweetim\messenger\SweetIM.exe
StartupFolder: c:\users\royceb~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\users\royce borja\appdata\roaming\dropbox\bin\Dropbox.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\micros~3\office14\ONBttnIE.dll/105
IE: Search the Web - c:\program files\sweetim\toolbars\internet explorer\resources\menuext.html
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
TCP: Interfaces\{11857566-048C-44BC-ACE8-AFBDE390DF7D} : DhcpNameServer = 10.4.1.182 10.4.1.180
TCP: Interfaces\{B98DEAB5-D78B-4B3A-B638-6E9A12AC083A}\45F6C6964737F57637D626F697 : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{B98DEAB5-D78B-4B3A-B638-6E9A12AC083A}\7637D626F697 : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{BC3D1062-D796-4FC7-8E48-4801F05E987E} : NameServer = 202.126.40.5 222.127.143.5
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~3\office14\GROOVEEX.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath -
.
============= SERVICES / DRIVERS ===============
.
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165648]
R1 MpKslb57df29c;MpKslb57df29c;c:\programdata\microsoft\microsoft antimalware\definition updates\{a6739378-53dc-4009-a934-064a6be6b6da}\MpKslb57df29c.sys [2011-12-18 29904]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-8-18 176128]
R2 TeamViewer5;TeamViewer 5;c:\program files\teamviewer\version5\TeamViewer_Service.exe [2010-4-16 173352]
R2 UNS;Intel® Management & Security Application User Notification Service;c:\program files\intel\intel® management engine components\uns\UNS.exe [2010-10-30 2314240]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-4-14 45736]
R3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\drivers\ETD.sys [2009-10-15 94208]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys [2010-12-22 101120]
R3 JMCR;JMCR;c:\windows\system32\drivers\jmcr.sys [2009-8-19 119408]
R3 JME;JMicron Ethernet Adapter NDIS6 Driver;c:\windows\system32\drivers\JME.sys [2009-8-15 87152]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-14 14336]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2009-4-6 13224]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2011-6-12 31125880]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-10-24 43392]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 65024]
S3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2011-4-27 208944]
S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2011-5-29 15872]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-5-29 52224]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-11-2 1343400]
.
=============== Created Last 30 ================
.
2011-12-17 23:19:04 29904 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{a6739378-53dc-4009-a934-064a6be6b6da}\MpKslb57df29c.sys
2011-12-17 23:18:50 56200 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{a6739378-53dc-4009-a934-064a6be6b6da}\offreg.dll
2011-12-17 23:18:47 6823496 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{a6739378-53dc-4009-a934-064a6be6b6da}\mpengine.dll
2011-12-15 21:26:19 -------- d-sh--w- C:\$RECYCLE.BIN
2011-12-15 21:21:37 -------- d-----w- C:\ComboFix
2011-12-14 05:19:58 2342912 ----a-w- c:\windows\system32\win32k.sys
2011-12-14 05:19:53 2048 ----a-w- c:\windows\system32\tzres.dll
2011-12-14 05:19:47 534528 ----a-w- c:\windows\system32\EncDec.dll
2011-12-14 05:19:46 38912 ----a-w- c:\windows\system32\csrsrv.dll
2011-12-14 05:19:43 3912560 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-12-14 05:19:42 3967856 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-12-14 00:19:52 4448256 ----a-w- c:\windows\system32\GPhotos.scr
2011-12-13 07:16:16 -------- d-----w- c:\users\royce borja\appdata\local\Adobe
2011-12-13 03:26:31 -------- d-----w- c:\users\royce borja\appdata\local\Microsoft Help
2011-12-12 06:37:04 -------- d-----w- c:\users\royce borja\appdata\local\ElevatedDiagnostics
2011-12-09 09:19:12 -------- d-----w- c:\users\royce borja\appdata\local\Microsoft Games
2011-12-08 09:31:22 -------- d-----w- c:\users\royce borja\appdata\local\temp
2011-12-08 09:17:19 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2011-12-08 09:13:20 98816 ----a-w- c:\windows\sed.exe
2011-12-08 09:13:20 518144 ----a-w- c:\windows\SWREG.exe
2011-12-08 09:13:20 256000 ----a-w- c:\windows\PEV.exe
2011-12-08 09:13:20 208896 ----a-w- c:\windows\MBR.exe
2011-12-07 05:44:37 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-12-07 03:58:20 -------- d-----w- c:\users\royce borja\appdata\local\SanctionedMedia
2011-12-05 21:46:21 -------- d--h--w- c:\windows\msdownld.tmp
2011-12-05 03:02:22 -------- d-----w- c:\program files\uTorrent
2011-12-05 03:01:49 -------- d-----w- c:\users\royce borja\appdata\roaming\uTorrent
2011-12-05 03:01:49 -------- d-----w- c:\users\royce borja\appdata\local\uTorrent
2011-12-04 01:47:11 25984 ----a-w- c:\windows\system32\drivers\tap0901.sys
2011-12-04 01:47:04 -------- d-----w- c:\program files\Hypernet
2011-12-03 02:42:11 -------- d-----w- c:\users\royce borja\appdata\local\Diagnostics
2011-12-01 02:56:42 -------- d-----w- c:\program files\VirtualDJ
2011-12-01 02:42:30 -------- dc-h--w- c:\programdata\{4A818508-3355-4FBC-B302-D53B599DD9D5}
2011-12-01 02:41:21 -------- d-----w- c:\program files\common files\Native Instruments
2011-12-01 02:41:20 -------- d-----w- c:\programdata\Native Instruments
2011-12-01 02:41:20 -------- d-----w- c:\program files\Native Instruments
2011-12-01 02:17:27 -------- d-----w- c:\users\royce borja\appdata\roaming\Dropbox
2011-12-01 02:01:14 -------- d-----w- c:\users\royce borja\appdata\local\Google
2011-12-01 02:00:48 -------- d-----w- c:\users\royce borja\appdata\local\Deployment
2011-12-01 02:00:48 -------- d-----w- c:\users\royce borja\appdata\local\Apps
2011-12-01 01:56:17 -------- d-----w- c:\users\royce borja\appdata\local\Apple Computer
2011-11-25 13:28:01 1290608 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-11-25 13:27:57 708608 ----a-w- c:\program files\common files\system\wab32.dll
.
==================== Find3M ====================
.
2011-11-03 22:47:42 1798144 ----a-w- c:\windows\system32\jscript9.dll
2011-11-03 22:40:21 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2011-11-03 22:39:47 1127424 ----a-w- c:\windows\system32\wininet.dll
2011-11-03 22:31:57 2382848 ----a-w- c:\windows\system32\mshtml.tlb
.
============= FINISH: 10:47:07.70 ===============

DDS attachment:
Attached File  Attach.txt   37.13KB   2 downloads

Gmer attachment:
Attached File  gmer.log   10.69KB   2 downloads

BC AdBot (Login to Remove)

 


#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:24 AM

Posted 18 December 2011 - 06:16 PM

Hello and Welcome to the forums!

My name is Gringo and I'll be glad to help you with your computer problems.

Somethings to remember while we are working together.

  • Do not run any other tool untill instructed to do so!
  • please Do not Attach logs or put in code boxes.
  • Tell me about any problems that have occurred during the fix.
  • Tell me of any other symptoms you may be having as these can help also.
  • Do not run anything while running a fix.
  • Do not run any other tool untill instructed to do so!


Click on the Watch Topic Button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links.
Link 1
Link 2
Link 3
1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 roycegwapo

roycegwapo
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:24 AM

Posted 19 December 2011 - 12:33 AM

Hello,

Thanks for your reply.

My computer seems to not show any problems except fot the Windows 7 Firewall service being missing. When I try to restore recommended settings on the firewall it gives me an error with the code 0x80070424. I have been infected with ping.exe in the past and I removed it using combofix.

ComboFix 11-12-18.02 - Royce Borja 12/19/2011 13:05:31.3.4 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.1964.1147 [GMT 8:00]
Running from: c:\users\Royce Borja\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2011-11-19 to 2011-12-19 )))))))))))))))))))))))))))))))
.
.
2011-12-19 05:13 . 2011-12-19 05:13 -------- d-----w- c:\users\royth\AppData\Local\temp
2011-12-19 05:13 . 2011-12-19 05:13 -------- d-----w- c:\users\Guest\AppData\Local\temp
2011-12-19 05:13 . 2011-12-19 05:13 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-12-19 05:13 . 2011-12-19 05:13 -------- d-----w- c:\users\BORJiNGS only\AppData\Local\temp
2011-12-14 05:19 . 2011-11-24 04:25 2342912 ----a-w- c:\windows\system32\win32k.sys
2011-12-14 05:19 . 2011-11-05 04:26 2048 ----a-w- c:\windows\system32\tzres.dll
2011-12-14 05:19 . 2011-10-15 05:38 534528 ----a-w- c:\windows\system32\EncDec.dll
2011-12-14 05:19 . 2011-10-26 04:28 38912 ----a-w- c:\windows\system32\csrsrv.dll
2011-12-14 05:19 . 2011-10-26 04:47 3912560 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-12-14 05:19 . 2011-10-26 04:47 3967856 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-12-14 00:19 . 2011-12-14 00:19 4448256 ----a-w- c:\windows\system32\GPhotos.scr
2011-12-11 08:08 . 2011-12-11 08:08 -------- d-----w- c:\program files\Google
2011-12-08 09:17 . 2011-04-25 02:18 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2011-12-07 05:44 . 2011-12-07 05:44 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-12-06 00:20 . 2011-12-06 00:20 -------- d-----w- c:\program files\FileZilla FTP Client
2011-12-05 21:46 . 2011-12-05 21:46 -------- d--h--w- c:\windows\msdownld.tmp
2011-12-05 03:02 . 2011-12-05 03:02 -------- d-----w- c:\program files\uTorrent
2011-12-04 04:52 . 2011-12-04 04:52 -------- d-----w- c:\users\Ryan Gwapo
2011-12-04 01:47 . 2009-07-16 09:20 25984 ----a-w- c:\windows\system32\drivers\tap0901.sys
2011-12-04 01:47 . 2011-12-04 01:50 -------- d-----w- c:\program files\Hypernet
2011-12-01 02:56 . 2011-12-01 02:56 -------- d-----w- c:\program files\VirtualDJ
2011-12-01 02:42 . 2011-12-01 02:42 -------- dc-h--w- c:\programdata\{4A818508-3355-4FBC-B302-D53B599DD9D5}
2011-12-01 02:41 . 2011-12-01 02:41 -------- d-----w- c:\program files\Common Files\Native Instruments
2011-12-01 02:41 . 2011-12-01 02:41 -------- d-----w- c:\programdata\Native Instruments
2011-12-01 02:41 . 2011-12-01 02:41 -------- d-----w- c:\program files\Native Instruments
2011-12-01 01:55 . 2011-12-01 01:56 -------- d-----w- c:\users\Royce Borja
2011-11-25 13:28 . 2011-09-29 16:03 1290608 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-11-25 13:27 . 2011-10-01 04:37 708608 ----a-w- c:\program files\Common Files\System\wab32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-17 11:06 . 2011-01-24 13:12 539984 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-12-16 00:54 . 2011-05-10 07:02 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-2\Microsoft.MediaCenter.Sports.UI.dll
2011-12-16 00:53 . 2011-03-27 10:20 4283672 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2011-12-16 00:50 . 2011-01-24 13:12 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2011-12-14 01:08 . 2011-02-12 05:01 539984 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2011-12-11 08:00 . 2011-04-03 04:57 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2011-12-11 07:59 . 2011-03-27 08:53 4283672 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2011-12-11 07:58 . 2011-01-29 13:02 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-12-08_09.44.52 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-12-14 06:51 . 2011-11-03 23:01 72704 c:\windows\winsxs\x86_microsoft-windows-ie-htmlediting_31bf3856ad364e35_9.4.8112.20544_none_611f89f676d63a1a\mshtmled.dll
+ 2011-12-14 06:51 . 2011-11-03 22:32 72704 c:\windows\winsxs\x86_microsoft-windows-ie-htmlediting_31bf3856ad364e35_9.4.8112.16440_none_6091ec035dbc34f4\mshtmled.dll
+ 2011-12-14 06:51 . 2011-11-03 23:05 66048 c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20544_none_1adf940cd544870c\WininetPlugin.dll
+ 2011-12-14 06:51 . 2011-11-03 23:04 65024 c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20544_none_1adf940cd544870c\jsproxy.dll
+ 2011-12-14 06:51 . 2011-11-03 22:37 66048 c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16440_none_1a51f619bc2a81e6\WininetPlugin.dll
+ 2011-12-14 06:51 . 2011-11-03 22:37 65024 c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16440_none_1a51f619bc2a81e6\jsproxy.dll
+ 2011-05-29 07:04 . 2010-11-20 12:17 40448 c:\windows\winsxs\x86_microsoft-windows-i..rnational-timezones_31bf3856ad364e35_6.1.7601.21855_none_17ae219281114d21\tzupd.exe
+ 2011-08-26 11:26 . 2011-07-09 04:32 40448 c:\windows\winsxs\x86_microsoft-windows-i..rnational-timezones_31bf3856ad364e35_6.1.7601.17720_none_173ff31967dfdad1\tzupd.exe
+ 2011-12-14 05:19 . 2011-11-05 04:31 40448 c:\windows\winsxs\x86_microsoft-windows-i..rnational-timezones_31bf3856ad364e35_6.1.7600.21085_none_15a72b0484036b23\tzupd.exe
+ 2011-08-26 11:26 . 2011-07-09 04:33 40448 c:\windows\winsxs\x86_microsoft-windows-i..rnational-timezones_31bf3856ad364e35_6.1.7600.16912_none_156666936aaf85a2\tzupd.exe
+ 2011-12-14 05:19 . 2011-10-26 06:13 38912 c:\windows\winsxs\x86_microsoft-windows-csrsrv_31bf3856ad364e35_6.1.7601.21847_none_cbfad2a21cd2f4c4\csrsrv.dll
+ 2011-12-14 05:19 . 2011-10-26 04:28 38912 c:\windows\winsxs\x86_microsoft-windows-csrsrv_31bf3856ad364e35_6.1.7601.17713_none_cb8da47303a09bcb\csrsrv.dll
+ 2011-12-14 05:19 . 2011-10-26 04:29 38912 c:\windows\winsxs\x86_microsoft-windows-csrsrv_31bf3856ad364e35_6.1.7600.21077_none_c9f3dc141fc512c6\csrsrv.dll
+ 2011-12-14 05:19 . 2011-10-26 04:25 38912 c:\windows\winsxs\x86_microsoft-windows-csrsrv_31bf3856ad364e35_6.1.7600.16905_none_c9b417ed0670469c\csrsrv.dll
+ 2010-10-30 10:54 . 2011-12-19 04:15 44986 c:\windows\System32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 04:55 . 2011-12-19 04:15 37838 c:\windows\System32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-10-30 10:34 . 2011-12-19 00:55 11674 c:\windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2997370033-3740561985-2119248922-1000_UserData.bin
+ 2011-12-14 06:51 . 2011-11-03 22:32 72704 c:\windows\System32\mshtmled.dll
- 2011-12-05 21:45 . 2011-12-05 21:45 72704 c:\windows\System32\mshtmled.dll
- 2011-12-05 21:45 . 2011-12-05 21:45 66048 c:\windows\System32\migration\WininetPlugin.dll
+ 2011-12-14 06:51 . 2011-11-03 22:37 66048 c:\windows\System32\migration\WininetPlugin.dll
+ 2011-12-14 06:51 . 2011-11-03 22:37 65024 c:\windows\System32\jsproxy.dll
- 2011-12-05 21:45 . 2011-12-05 21:45 65024 c:\windows\System32\jsproxy.dll
+ 2009-07-14 04:50 . 2011-12-17 00:55 86016 c:\windows\System32\DriverStore\infpub.dat
- 2009-07-14 04:50 . 2011-12-08 08:34 86016 c:\windows\System32\DriverStore\infpub.dat
+ 2009-07-14 04:34 . 2011-12-18 05:22 88528 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
+ 2010-10-31 01:18 . 2011-12-19 03:49 24633 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Bluetooth\bthservsdp.dat
+ 2011-12-13 03:28 . 2011-12-13 03:28 76200 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.ContainerControl\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Office.ContainerControl.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 79776 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Runtime.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 15208 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Office.Tools\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.Office.Tools.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 27528 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Office.Tools.v4.0.Framework\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.Office.Tools.v4.0.Framework.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 56184 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Office.Tools.Outlook\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.Office.Tools.Outlook.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 91512 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Office.Tools.Common\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.Office.Tools.Common.dll
+ 2010-10-30 11:13 . 2011-12-15 06:47 34144 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\oisicon.exe
- 2010-10-30 11:13 . 2011-11-26 14:00 34144 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\oisicon.exe
- 2010-10-30 11:13 . 2011-11-26 14:00 42848 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\msouc.exe
+ 2010-10-30 11:13 . 2011-12-15 06:47 42848 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\msouc.exe
- 2010-10-30 11:13 . 2011-11-26 14:00 19296 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\cagicon.exe
+ 2010-10-30 11:13 . 2011-12-15 06:47 19296 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\cagicon.exe
+ 2010-02-25 03:07 . 2010-02-25 03:07 49488 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\VBAJET32.DLL
+ 2010-01-09 13:47 . 2010-01-09 13:47 29528 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\THOCRAPI.DLL
+ 2010-03-22 12:36 . 2010-03-22 12:36 82848 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\PEOPLEDATAHANDLER.DLL
+ 2010-03-22 12:36 . 2010-03-22 12:36 45984 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\OSETUPPS.DLL
+ 2010-03-22 12:36 . 2010-03-22 12:36 15776 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\OMUOPTINPS.DLL
+ 2010-02-27 18:13 . 2010-02-27 18:13 20880 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\MUOPTIN.DLL
+ 2010-02-28 21:17 . 2010-02-28 21:17 14736 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\MSOCFUIU.DLL
+ 2010-01-10 11:48 . 2010-01-10 11:48 18832 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\MSOCFU.DLL
+ 2010-02-28 21:09 . 2010-02-28 21:09 61832 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\MSAEXP30.DLL
+ 2010-03-12 16:59 . 2010-03-12 16:59 14208 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\LOBICUI.DLL
+ 2010-03-22 12:36 . 2010-03-22 12:36 58232 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\EXP_XPS.DLL
+ 2010-03-22 12:51 . 2010-03-22 12:51 44480 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACERCLR.DLL
+ 2010-03-22 12:51 . 2010-03-22 12:51 14776 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACEODTXT.DLL
+ 2010-03-22 12:51 . 2010-03-22 12:51 14776 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACEODEXL.DLL
+ 2010-03-22 12:51 . 2010-03-22 12:51 14776 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACEODDBS.DLL
+ 2010-03-23 02:54 . 2010-03-23 02:54 37776 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACEERR.DLL
+ 2010-02-27 20:33 . 2010-02-27 20:33 93576 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACCOLK.DLL
+ 2010-10-30 11:11 . 2010-10-30 11:11 11656 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACCESSPL.DLL
+ 2010-10-30 11:11 . 2010-10-30 11:11 11656 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACC12PL.DLL
+ 2011-12-14 04:17 . 2011-12-14 04:17 21504 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Office.To#\f01fa762f59ae32d37fb4b0c9e331c98\Microsoft.Office.Tools.ni.dll
+ 2011-12-14 04:17 . 2011-12-14 04:17 45056 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Office.To#\ac1e4a1b83bdb8c1ad39a54d0cb38bc4\Microsoft.Office.Tools.v4.0.Framework.ni.dll
+ 2011-12-14 04:16 . 2011-12-14 04:16 66560 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f49ab7f96c66031f641e2390ff85b71b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll
+ 2011-12-14 04:15 . 2011-12-14 04:15 86016 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\eeb0ae26d5cec8a3a78762acf4fe5f60\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
+ 2011-12-14 04:15 . 2011-12-14 04:15 28160 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\cd2766ef74cee07c420507db80aed932\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
+ 2011-12-14 04:15 . 2011-12-14 04:15 58368 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\b97304651681e8187cb08b85ee71af27\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
+ 2011-12-14 04:15 . 2011-12-14 04:15 51712 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\723bdb36a46e387e81a1326318f096fc\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
+ 2011-12-14 04:15 . 2011-12-14 04:15 28160 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\560af98e8232dfaa8f745112ed6b8be1\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 11656 c:\windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.Access.dll
- 2010-10-30 11:11 . 2010-10-30 11:11 11656 c:\windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.Access.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 11656 c:\windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Access.dll
- 2010-10-30 11:11 . 2010-10-30 11:11 11656 c:\windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Access.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 83896 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 41408 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll
+ 2011-12-13 03:29 . 2011-12-13 03:29 63408 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 77752 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 23976 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll
+ 2011-12-13 03:29 . 2011-12-13 03:29 62392 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.dll
+ 2011-12-13 03:29 . 2011-12-13 03:29 32688 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll
+ 2011-12-13 03:29 . 2011-12-13 03:29 35256 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 24496 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 41408 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll
+ 2011-12-14 05:19 . 2011-11-05 04:26 2048 c:\windows\winsxs\x86_microsoft-windows-i..rnational-timezones_31bf3856ad364e35_6.1.7601.21855_none_17ae219281114d21\tzres.dll
+ 2011-12-14 05:19 . 2011-11-05 04:26 2048 c:\windows\winsxs\x86_microsoft-windows-i..rnational-timezones_31bf3856ad364e35_6.1.7601.17720_none_173ff31967dfdad1\tzres.dll
+ 2011-12-14 05:19 . 2011-11-05 04:29 2048 c:\windows\winsxs\x86_microsoft-windows-i..rnational-timezones_31bf3856ad364e35_6.1.7600.21085_none_15a72b0484036b23\tzres.dll
+ 2011-12-14 05:19 . 2011-11-05 04:30 2048 c:\windows\winsxs\x86_microsoft-windows-i..rnational-timezones_31bf3856ad364e35_6.1.7600.16912_none_156666936aaf85a2\tzres.dll
+ 2011-12-04 10:44 . 2011-12-17 10:59 2384 c:\windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2997370033-3740561985-2119248922-1004_UserData.bin
+ 2011-12-01 04:32 . 2011-12-18 09:36 6088 c:\windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2997370033-3740561985-2119248922-1003_UserData.bin
+ 2011-02-10 11:21 . 2011-12-18 08:59 7438 c:\windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2997370033-3740561985-2119248922-1001_UserData.bin
+ 2011-12-19 04:12 . 2011-12-19 04:12 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-12-08 09:19 . 2011-12-08 09:33 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-12-08 09:19 . 2011-12-08 09:33 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-12-19 04:12 . 2011-12-19 04:12 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-12-14 05:19 . 2011-10-15 07:17 534528 c:\windows\winsxs\x86_microsoft-windows-tvencdec_31bf3856ad364e35_6.1.7601.21840_none_e2e4b00705e2426c\EncDec.dll
+ 2011-12-14 05:19 . 2011-10-15 05:38 534528 c:\windows\winsxs\x86_microsoft-windows-tvencdec_31bf3856ad364e35_6.1.7601.17708_none_e28e553bec9cfd96\EncDec.dll
+ 2011-12-14 05:19 . 2011-10-15 05:33 534528 c:\windows\winsxs\x86_microsoft-windows-tvencdec_31bf3856ad364e35_6.1.7600.21070_none_e0ddb97908d4606e\EncDec.dll
+ 2011-12-14 05:19 . 2011-10-15 05:48 534528 c:\windows\winsxs\x86_microsoft-windows-tvencdec_31bf3856ad364e35_6.1.7600.16899_none_e047a74defbea953\EncDec.dll
+ 2011-12-14 06:51 . 2011-11-03 23:03 716800 c:\windows\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_9.4.8112.20544_none_9bd689262a95cc33\jscript.dll
+ 2011-12-14 06:51 . 2011-11-03 22:34 716800 c:\windows\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_9.4.8112.16440_none_9b48eb33117bc70d\jscript.dll
+ 2011-12-14 06:51 . 2011-11-03 22:58 176640 c:\windows\winsxs\x86_microsoft-windows-ieframe_31bf3856ad364e35_9.4.8112.20544_none_7d990d2ee1907e6f\ieui.dll
+ 2011-12-14 06:51 . 2011-11-03 22:28 176640 c:\windows\winsxs\x86_microsoft-windows-ieframe_31bf3856ad364e35_9.4.8112.16440_none_7d0b6f3bc8767949\ieui.dll
+ 2011-12-14 06:51 . 2011-11-03 23:06 231936 c:\windows\winsxs\x86_microsoft-windows-ie-winsockautodialstub_31bf3856ad364e35_9.4.8112.20544_none_092171d5913bd5b6\url.dll
+ 2011-12-14 06:51 . 2011-11-03 22:38 231936 c:\windows\winsxs\x86_microsoft-windows-ie-winsockautodialstub_31bf3856ad364e35_9.4.8112.16440_none_0893d3e27821d090\url.dll
+ 2011-12-14 06:51 . 2011-11-03 23:37 141112 c:\windows\winsxs\x86_microsoft-windows-ie-runtimeutilities_31bf3856ad364e35_9.4.8112.20544_none_609a4ae8bff5a569\sqmapi.dll
+ 2011-12-14 06:51 . 2011-11-03 23:16 141112 c:\windows\winsxs\x86_microsoft-windows-ie-runtimeutilities_31bf3856ad364e35_9.4.8112.16440_none_600cacf5a6dba043\sqmapi.dll
+ 2011-12-14 06:51 . 2011-11-03 23:05 194048 c:\windows\winsxs\x86_microsoft-windows-ie-ieshims_31bf3856ad364e35_9.4.8112.20544_none_6083d084cdaa77f9\IEShims.dll
+ 2011-12-14 06:51 . 2011-11-03 22:37 194048 c:\windows\winsxs\x86_microsoft-windows-ie-ieshims_31bf3856ad364e35_9.4.8112.16440_none_5ff63291b49072d3\IEShims.dll
+ 2011-12-14 06:51 . 2011-11-03 23:09 678912 c:\windows\winsxs\x86_microsoft-windows-ie-devtools_31bf3856ad364e35_9.4.8112.20544_none_549bad5f7347d34d\iedvtool.dll
+ 2011-12-14 06:51 . 2011-11-03 22:42 678912 c:\windows\winsxs\x86_microsoft-windows-ie-devtools_31bf3856ad364e35_9.4.8112.16440_none_540e0f6c5a2dce27\iedvtool.dll
+ 2010-11-03 12:10 . 2011-12-17 23:07 309820 c:\windows\System32\wdi\SuspendPerformanceDiagnostics_SystemData_S4.bin
+ 2010-11-03 14:27 . 2011-12-16 00:14 354774 c:\windows\System32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
- 2011-12-05 21:45 . 2011-12-05 21:45 231936 c:\windows\System32\url.dll
+ 2011-12-14 06:51 . 2011-11-03 22:38 231936 c:\windows\System32\url.dll
+ 2009-07-14 02:05 . 2011-12-19 05:00 624178 c:\windows\System32\perfh009.dat
+ 2009-07-14 02:05 . 2011-12-19 05:00 106522 c:\windows\System32\perfc009.dat
+ 2011-12-14 06:51 . 2011-11-03 22:34 716800 c:\windows\System32\jscript.dll
- 2011-12-05 21:45 . 2011-12-05 21:45 716800 c:\windows\System32\jscript.dll
+ 2011-12-14 06:51 . 2011-11-03 22:28 176640 c:\windows\System32\ieui.dll
- 2011-12-05 21:45 . 2011-12-05 21:45 176640 c:\windows\System32\ieui.dll
- 2009-07-14 04:33 . 2011-12-01 04:29 440752 c:\windows\System32\FNTCACHE.DAT
+ 2009-07-14 04:33 . 2011-12-14 07:54 440752 c:\windows\System32\FNTCACHE.DAT
- 2009-07-14 04:50 . 2011-12-08 08:34 143360 c:\windows\System32\DriverStore\infstrng.dat
+ 2009-07-14 04:50 . 2011-12-17 00:55 143360 c:\windows\System32\DriverStore\infstrng.dat
- 2009-07-14 04:50 . 2011-12-08 08:34 143360 c:\windows\System32\DriverStore\infstor.dat
+ 2009-07-14 04:50 . 2011-12-13 03:24 143360 c:\windows\System32\DriverStore\infstor.dat
+ 2010-10-31 01:20 . 2011-12-19 04:12 147456 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-10-31 01:20 . 2011-12-08 09:34 147456 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:47 . 2011-12-19 03:49 424120 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 04:47 . 2011-12-08 09:18 424120 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2011-12-07 22:59 . 2011-12-08 04:23 424888 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2997370033-3740561985-2119248922-1004-8192.dat
+ 2011-12-07 22:59 . 2011-12-17 14:01 424888 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2997370033-3740561985-2119248922-1004-8192.dat
+ 2011-12-08 08:36 . 2011-12-13 03:45 424888 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2997370033-3740561985-2119248922-1003-12288.dat
- 2011-12-08 08:36 . 2011-12-08 08:36 424888 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2997370033-3740561985-2119248922-1003-12288.dat
+ 2011-12-16 02:01 . 2011-12-16 02:01 677974 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2997370033-3740561985-2119248922-1001-8192.dat
+ 2011-12-10 12:28 . 2011-12-19 03:49 546416 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2997370033-3740561985-2119248922-1000-8192.dat
+ 2011-12-13 03:28 . 2011-12-13 03:28 397208 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Office.Runtime.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 133544 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.Internal\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 201648 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.ServerDocument.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 163744 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Hosting.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 141688 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Office.Tools.Word\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.Office.Tools.Word.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 341392 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Office.Tools.Word.Implementation\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.Office.Tools.Word.Implementation.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 139672 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Office.Tools.Outlook.Implementation\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.Office.Tools.Outlook.Implementation.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 171384 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.Office.Tools.Excel.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 465304 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Office.Tools.Excel.Implementation\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.Office.Tools.Excel.Implementation.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 357272 c:\windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.Implementation\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.Office.Tools.Common.Implementation.dll
+ 2011-10-26 14:46 . 2011-10-26 14:46 794112 c:\windows\Installer\94a43a.msp
+ 2011-04-28 12:27 . 2011-04-28 12:27 608768 c:\windows\Installer\50d4b3.msp
- 2011-11-25 14:21 . 2011-11-25 14:21 571232 c:\windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\misc.exe
+ 2011-12-13 03:26 . 2011-12-13 03:26 571232 c:\windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\misc.exe
- 2010-10-30 11:13 . 2011-11-26 14:00 415584 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\pubs.exe
+ 2010-10-30 11:13 . 2011-12-15 06:47 415584 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\pubs.exe
- 2010-10-30 11:13 . 2011-11-26 14:00 303456 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\outicon.exe
+ 2010-10-30 11:13 . 2011-12-15 06:47 303456 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\outicon.exe
+ 2010-10-30 11:13 . 2011-12-15 06:47 571232 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\misc.exe
- 2010-10-30 11:13 . 2011-11-26 14:00 571232 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\misc.exe
- 2010-10-30 11:13 . 2011-11-26 14:00 326496 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\joticon.exe
+ 2010-10-30 11:13 . 2011-12-15 06:47 326496 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\joticon.exe
+ 2010-10-30 11:13 . 2011-12-15 06:47 469856 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\inficon.exe
- 2010-10-30 11:13 . 2011-11-26 14:00 469856 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\inficon.exe
+ 2010-10-30 11:13 . 2011-12-15 06:47 178528 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\grvicons.exe
- 2010-10-30 11:13 . 2011-11-26 14:00 178528 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\grvicons.exe
+ 2010-02-12 22:25 . 2010-02-12 22:25 128384 c:\windows\Installer\$PatchCache$\Managed\00004109E60090400000000000F01FEC\14.0.4763\FPLACE.DLL
+ 2010-12-20 17:30 . 2010-12-20 17:30 579968 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.6029\VPREVIEW.EXE
+ 2009-09-04 01:02 . 2009-09-04 01:02 591680 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.6029\MSLID.DLL
+ 2010-02-27 19:13 . 2010-02-27 19:13 579968 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\VPREVIEW.EXE
+ 2010-01-09 13:47 . 2010-01-09 13:47 133512 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\TWCUTCHR.DLL
+ 2010-02-28 21:09 . 2010-02-28 21:09 524176 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\SOA.DLL
+ 2010-03-25 02:23 . 2010-03-25 02:23 203632 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\SHAREPOINTPROVIDER.DLL
+ 2010-02-27 18:13 . 2010-02-27 18:13 521616 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\SELFCERT.EXE
+ 2010-02-28 20:56 . 2010-02-28 20:56 647552 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\PTXT9.DLL
+ 2010-02-27 18:22 . 2010-02-27 18:22 139136 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\PRTF9.DLL
+ 2010-02-27 18:21 . 2010-02-27 18:21 259960 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\OISGRAPH.DLL
+ 2010-02-27 18:21 . 2010-02-27 18:21 886640 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\OISAPP.DLL
+ 2010-02-27 18:21 . 2010-02-27 18:21 274280 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\OIS.EXE
+ 2010-02-27 18:09 . 2010-02-27 18:09 401784 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\OFFXML.DLL
+ 2010-03-10 16:44 . 2010-03-10 16:44 510904 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ODEPLOY.EXE
+ 2010-01-09 13:23 . 2010-01-09 13:23 169352 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\OARPMANY.EXE
+ 2010-02-27 18:15 . 2010-02-27 18:15 702312 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\MSTORDB.EXE
+ 2010-03-29 13:47 . 2010-03-29 13:47 218464 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\MSPROOF6.DLL
+ 2010-03-24 12:28 . 2010-03-24 12:28 473952 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\MSOICONS.EXE
+ 2010-03-05 21:29 . 2010-03-05 21:29 501088 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\MSODCW.DLL
+ 2010-02-28 21:17 . 2010-02-28 21:17 152952 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\MSOCF.DLL
+ 2009-09-04 01:02 . 2009-09-04 01:02 591680 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\MSLID.DLL
+ 2010-03-29 13:47 . 2010-03-29 13:47 787864 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\MSET7TKJP.DLL
+ 2010-03-29 13:47 . 2010-03-29 13:47 512392 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\MSET7TK.DLL
+ 2010-03-29 13:47 . 2010-03-29 13:47 543144 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\MSET7.DLL
+ 2010-03-24 12:28 . 2010-03-24 12:28 571232 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\MISC.EXE
+ 2010-02-27 18:15 . 2010-02-27 18:15 698216 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\MEDCAT.DLL
+ 2010-10-30 11:12 . 2010-10-30 11:12 427904 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\LOBITOOL.DLL
+ 2010-10-30 11:12 . 2010-10-30 11:12 169856 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\LOBITOIN.DLL
+ 2010-03-12 16:58 . 2010-03-12 16:58 960384 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\LOBIOBDR.DLL
+ 2010-10-30 11:12 . 2010-10-30 11:12 960384 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\LOBIOBDA.DLL
+ 2010-10-30 11:12 . 2010-10-30 11:12 567168 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\LOBICLNT.DLL
+ 2010-03-12 16:58 . 2010-03-12 16:58 567168 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\LOBICLNR.DLL
+ 2010-03-13 06:54 . 2010-03-13 06:54 447872 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\LOBICLI.DLL
+ 2010-03-12 16:58 . 2010-03-12 16:58 518016 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\LOBIBDCR.DLL
+ 2010-10-30 11:12 . 2010-10-30 11:12 518016 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\LOBIBDCA.DLL
+ 2010-03-29 12:45 . 2010-03-29 12:45 169352 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\IPOLK.DLL
+ 2010-03-22 12:36 . 2010-03-22 12:36 178560 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\IETAG.DLL
+ 2010-03-24 13:17 . 2010-03-24 13:17 944008 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\GROOVEMN.EXE
+ 2010-02-03 20:41 . 2010-02-03 20:41 120160 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\FLTLDR.EXE
+ 2010-02-25 03:07 . 2010-02-25 03:07 452936 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\EXPSRV.DLL
+ 2010-03-23 03:03 . 2010-03-23 03:03 104824 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\EXP_PDF.DLL
+ 2010-03-22 13:30 . 2010-03-22 13:30 115584 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\EMABLT32.DLL
+ 2010-02-27 18:09 . 2010-02-27 18:09 519584 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\DWTRIG20.EXE
+ 2010-02-28 21:18 . 2010-02-28 21:18 397656 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\CDLMSO.DLL
+ 2010-01-18 12:59 . 2010-01-18 12:59 998776 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ASMAIN.DLL
+ 2010-01-18 12:59 . 2010-01-18 12:59 100280 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ASLTS.DLL
+ 2010-03-23 02:55 . 2010-03-23 02:55 362904 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACEXBE.DLL
+ 2010-02-28 21:19 . 2010-02-28 21:19 247200 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACEWSS.DLL
+ 2010-03-23 02:54 . 2010-03-23 02:54 220560 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACETXT.DLL
+ 2010-03-23 02:55 . 2010-03-23 02:55 527776 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACEREP.DLL
+ 2010-03-22 12:51 . 2010-03-22 12:51 329624 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACER3X.DLL
+ 2010-03-23 02:55 . 2010-03-23 02:55 383904 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACEOLEDB.DLL
+ 2010-03-22 12:51 . 2010-03-22 12:51 278448 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACEODBC.DLL
+ 2010-03-23 02:55 . 2010-03-23 02:55 643992 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACEEXCL.DLL
+ 2010-03-23 02:54 . 2010-03-23 02:54 334752 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACEEXCH.DLL
+ 2010-03-23 02:55 . 2010-03-23 02:55 686504 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACEES.DLL
+ 2010-03-23 02:55 . 2010-03-23 02:55 548792 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACEDAO.DLL
+ 2010-02-27 20:33 . 2010-02-27 20:33 164224 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACCWIZ.DLL
+ 2010-03-23 02:55 . 2010-03-23 02:55 548792 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACACEDAO.DLL
+ 2011-12-14 04:17 . 2011-12-14 04:17 177152 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualStu#\e425a2bfd8281ff959f0f4b7884a9bdf\Microsoft.VisualStudio.Tools.Office.ContainerControl.ni.dll
+ 2011-12-14 04:17 . 2011-12-14 04:17 708096 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualStu#\bac77175ca598fa44c64861a18b182ec\Microsoft.VisualStudio.Tools.Office.Runtime.ni.dll
+ 2011-12-14 04:17 . 2011-12-14 04:17 364544 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualStu#\b508c1a8715fa22d8a1a25c8bc4366bd\Microsoft.VisualStudio.Tools.Applications.Hosting.ni.dll
+ 2011-12-14 04:17 . 2011-12-14 04:17 738304 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualStu#\8fc3954eda901e8c39e4731af5d6426e\Microsoft.VisualStudio.Tools.Applications.ServerDocument.ni.dll
+ 2011-12-14 04:17 . 2011-12-14 04:17 210432 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualStu#\8efedc192ad140d96b00a9edf76951e6\Microsoft.VisualStudio.Tools.Office.Runtime.Internal.ni.dll
+ 2011-12-14 04:17 . 2011-12-14 04:17 135680 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualStu#\755ed0463f475a65ec459d2f4f67391a\Microsoft.VisualStudio.Tools.Applications.Runtime.ni.dll
+ 2011-12-14 04:17 . 2011-12-14 04:17 336384 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Office.To#\f8c5c0de2a2bd3c0569d384d4d757660\Microsoft.Office.Tools.Common.ni.dll
+ 2011-12-14 04:17 . 2011-12-14 04:17 864768 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Office.To#\b4128a477f244d3b4fbcdf6c539a0226\Microsoft.Office.Tools.Common.Implementation.ni.dll
+ 2011-12-14 04:17 . 2011-12-14 04:17 676864 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Office.To#\a58b1c7c833e65136ad5ec1cf51b7c3c\Microsoft.Office.Tools.Word.ni.dll
+ 2011-12-14 04:17 . 2011-12-14 04:17 312320 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Office.To#\9d54a219847ee27cd3ca0232d700b94d\Microsoft.Office.Tools.Outlook.Implementation.ni.dll
+ 2011-12-14 04:17 . 2011-12-14 04:17 152064 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Office.To#\1d01c36fea73905edcd30231fd50de91\Microsoft.Office.Tools.Outlook.ni.dll
+ 2011-12-14 04:17 . 2011-12-14 04:17 730624 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Office.To#\0fef4345375db0c723a1bb8be585c0d1\Microsoft.Office.Tools.Excel.ni.dll
+ 2011-12-14 04:15 . 2011-12-14 04:15 134144 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e29fcbc5cb55983d0f0e7deaba15d1fe\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
+ 2011-12-14 04:16 . 2011-12-14 04:16 617472 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\96c9f4776983ce5117071c54957ca686\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll
+ 2011-12-14 04:16 . 2011-12-14 04:16 363008 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\6aed22875a2d7f279fe80f6eba524b7e\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll
+ 2011-12-14 04:15 . 2011-12-14 04:15 179200 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\5f505ff0d0ff6a160f06c053f0316e9d\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
+ 2011-12-14 04:16 . 2011-12-14 04:16 650752 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\193931d8a264d135001ea449464b9383\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll
+ 2011-12-14 04:16 . 2011-12-14 04:16 145920 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\14c004acbf02bd8f341bb1328d56e270\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll
+ 2011-12-14 04:15 . 2011-12-14 04:15 196608 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\13633f21a57a9d93b479fc262957b36e\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 363936 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 193472 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0\10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 153008 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll
- 2010-10-30 11:12 . 2010-10-30 11:12 427904 c:\windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools\14.0.0.0__71e9bce111e9429c\Microsoft.Office.BusinessApplications.Tools.dll
+ 2011-12-13 03:29 . 2011-12-13 03:29 427904 c:\windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools\14.0.0.0__71e9bce111e9429c\Microsoft.Office.BusinessApplications.Tools.dll
- 2010-10-30 11:12 . 2010-10-30 11:12 169856 c:\windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.Intl\14.0.0.0__71e9bce111e9429c\Microsoft.Office.BusinessApplications.Tools.Intl.dll
+ 2011-12-13 03:29 . 2011-12-13 03:29 169856 c:\windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.Intl\14.0.0.0__71e9bce111e9429c\Microsoft.Office.BusinessApplications.Tools.Intl.dll
- 2010-10-30 11:12 . 2010-10-30 11:12 567168 c:\windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\14.0.0.0__71e9bce111e9429c\Microsoft.Office.BusinessApplications.Runtime.dll
+ 2011-12-13 03:29 . 2011-12-13 03:29 567168 c:\windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime\14.0.0.0__71e9bce111e9429c\Microsoft.Office.BusinessApplications.Runtime.dll
+ 2011-12-13 03:29 . 2011-12-13 03:29 518016 c:\windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\14.0.0.0__71e9bce111e9429c\Microsoft.SharePoint.BusinessData.Administration.Client.dll
- 2010-10-30 11:12 . 2010-10-30 11:12 518016 c:\windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\14.0.0.0__71e9bce111e9429c\Microsoft.SharePoint.BusinessData.Administration.Client.dll
+ 2011-12-13 03:29 . 2011-12-13 03:29 964480 c:\windows\assembly\GAC_32\Microsoft.Office.BusinessData\14.0.0.0__71e9bce111e9429c\microsoft.office.businessdata.dll
+ 2011-12-14 05:19 . 2011-11-24 04:21 2350080 c:\windows\winsxs\x86_microsoft-windows-win32k_31bf3856ad364e35_6.1.7601.21866_none_bb507535120d3b46\win32k.sys
+ 2011-12-14 05:19 . 2011-11-24 04:25 2342912 c:\windows\winsxs\x86_microsoft-windows-win32k_31bf3856ad364e35_6.1.7601.17730_none_bae14671f8dcaf9f\win32k.sys
+ 2011-12-14 05:19 . 2011-11-24 04:26 2349568 c:\windows\winsxs\x86_microsoft-windows-win32k_31bf3856ad364e35_6.1.7600.21097_none_b94a7ef114fe729f\win32k.sys
+ 2011-12-14 05:19 . 2011-11-24 04:23 2340352 c:\windows\winsxs\x86_microsoft-windows-win32k_31bf3856ad364e35_6.1.7600.16920_none_b905b957fbae27c2\win32k.sys
+ 2011-12-14 06:51 . 2011-11-03 23:14 1798144 c:\windows\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_9.4.8112.20544_none_9bd689262a95cc33\jscript9.dll
+ 2011-12-14 06:51 . 2011-11-03 22:47 1798144 c:\windows\winsxs\x86_microsoft-windows-scripting-jscript_31bf3856ad364e35_9.4.8112.16440_none_9b48eb33117bc70d\jscript9.dll
+ 2011-12-14 05:19 . 2011-10-26 07:01 3915120 c:\windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.21847_none_6ea3fd3d2b986563\ntoskrnl.exe
+ 2011-12-14 05:19 . 2011-10-26 07:01 3970928 c:\windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.21847_none_6ea3fd3d2b986563\ntkrnlpa.exe
+ 2011-12-14 05:19 . 2011-10-26 04:47 3912560 c:\windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17713_none_6e36cf0e12660c6a\ntoskrnl.exe
+ 2011-12-14 05:19 . 2011-10-26 04:47 3967856 c:\windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.17713_none_6e36cf0e12660c6a\ntkrnlpa.exe
+ 2011-12-14 05:19 . 2011-10-26 04:51 3915120 c:\windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7600.21077_none_6c9d06af2e8a8365\ntoskrnl.exe
+ 2011-12-14 05:19 . 2011-10-26 04:51 3970416 c:\windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7600.21077_none_6c9d06af2e8a8365\ntkrnlpa.exe
+ 2011-12-14 05:19 . 2011-10-26 04:42 3901808 c:\windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7600.16905_none_6c5d42881535b73b\ntoskrnl.exe
+ 2011-12-14 05:19 . 2011-10-26 04:42 3957104 c:\windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7600.16905_none_6c5d42881535b73b\ntkrnlpa.exe
+ 2011-12-14 06:51 . 2011-11-03 23:16 9705472 c:\windows\winsxs\x86_microsoft-windows-ieframe_31bf3856ad364e35_9.4.8112.20544_none_7d990d2ee1907e6f\ieframe.dll
+ 2011-12-14 06:51 . 2011-11-03 22:46 9705472 c:\windows\winsxs\x86_microsoft-windows-ieframe_31bf3856ad364e35_9.4.8112.16440_none_7d0b6f3bc8767949\ieframe.dll
+ 2011-12-14 06:51 . 2011-11-03 23:01 1792000 c:\windows\winsxs\x86_microsoft-windows-ie-runtimeutilities_31bf3856ad364e35_9.4.8112.20544_none_609a4ae8bff5a569\iertutil.dll
+ 2011-12-14 06:51 . 2011-11-03 22:32 1792000 c:\windows\winsxs\x86_microsoft-windows-ie-runtimeutilities_31bf3856ad364e35_9.4.8112.16440_none_600cacf5a6dba043\iertutil.dll
+ 2011-12-14 06:51 . 2011-11-03 23:07 1127424 c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.20544_none_1adf940cd544870c\wininet.dll
+ 2011-12-14 06:51 . 2011-11-03 22:39 1127424 c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_9.4.8112.16440_none_1a51f619bc2a81e6\wininet.dll
+ 2011-12-14 06:51 . 2011-11-03 23:08 1103360 c:\windows\winsxs\x86_microsoft-windows-i..ersandsecurityzones_31bf3856ad364e35_9.4.8112.20544_none_cdd9b86b0a3b6079\urlmon.dll
+ 2011-12-14 06:51 . 2011-11-03 22:40 1103360 c:\windows\winsxs\x86_microsoft-windows-i..ersandsecurityzones_31bf3856ad364e35_9.4.8112.16440_none_cd4c1a77f1215b53\urlmon.dll
+ 2011-12-14 06:51 . 2011-11-03 22:39 1127424 c:\windows\System32\wininet.dll
+ 2011-12-14 06:51 . 2011-11-03 22:40 1103360 c:\windows\System32\urlmon.dll
+ 2009-07-14 02:03 . 2011-12-14 07:53 7602176 c:\windows\System32\SMI\Store\Machine\schema.dat
+ 2011-12-14 06:51 . 2011-11-03 22:47 1798144 c:\windows\System32\jscript9.dll
- 2011-12-05 21:45 . 2011-12-05 21:45 1798144 c:\windows\System32\jscript9.dll
+ 2011-12-14 06:51 . 2011-11-03 22:32 1792000 c:\windows\System32\iertutil.dll
+ 2011-12-14 06:51 . 2011-11-03 22:46 9705472 c:\windows\System32\ieframe.dll
+ 2010-10-20 04:44 . 2010-10-20 04:44 1207656 c:\windows\System32\FM20.DLL
+ 2011-06-26 17:37 . 2011-06-26 17:37 2191872 c:\windows\System32\DriverStore\FileRepository\netathr.inf_x86_neutral_d426f0fe11aaa849\athr.sys
+ 2011-06-26 17:37 . 2011-06-26 17:37 2191872 c:\windows\System32\drivers\athr.sys
+ 2010-10-31 01:20 . 2011-12-19 04:12 2342912 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-10-31 01:20 . 2011-12-08 09:34 2342912 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:41 . 2011-12-19 04:12 2457600 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:41 . 2011-12-08 09:34 2457600 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:34 . 2011-12-05 21:51 5980439 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
+ 2009-07-14 04:34 . 2011-12-14 07:57 5980439 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
+ 2011-12-06 06:58 . 2011-12-19 00:28 1237016 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2997370033-3740561985-2119248922-1003-8192.dat
+ 2011-10-16 06:45 . 2011-10-16 06:45 4966912 c:\windows\Installer\94a47f.msp
+ 2011-10-16 06:28 . 2011-10-16 06:28 1138688 c:\windows\Installer\94a468.msp
+ 2011-12-01 08:16 . 2011-12-01 08:16 3464704 c:\windows\Installer\94a451.msp
+ 2011-10-26 14:46 . 2011-10-26 14:46 1833472 c:\windows\Installer\94a423.msp
+ 2011-04-28 12:26 . 2011-04-28 12:26 3994624 c:\windows\Installer\50d316.msp
- 2010-10-30 11:13 . 2011-11-26 14:00 1479520 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\xlicons.exe
+ 2010-10-30 11:13 . 2011-12-15 06:47 1479520 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\xlicons.exe
+ 2010-10-30 11:13 . 2011-12-15 06:47 1858400 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\wordicon.exe
- 2010-10-30 11:13 . 2011-11-26 14:00 1858400 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\wordicon.exe
- 2010-10-30 11:13 . 2011-11-26 14:00 3792736 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\pptico.exe
+ 2010-10-30 11:13 . 2011-12-15 06:47 3792736 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\pptico.exe
+ 2010-10-30 11:13 . 2011-12-15 06:47 1449312 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\accicons.exe
- 2010-10-30 11:13 . 2011-11-26 14:00 1449312 c:\windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\accicons.exe
+ 2010-10-20 05:35 . 2010-10-20 05:35 1479520 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.6029\XLICONS.EXE
+ 2011-02-04 05:41 . 2011-02-04 05:41 2672456 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.6029\VBE7.DLL
+ 2010-10-20 05:35 . 2010-10-20 05:35 3792736 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.6029\PPTICO.EXE
+ 2011-04-06 13:09 . 2011-04-06 13:09 9701736 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.6029\PPCORE.DLL
+ 2010-10-22 06:55 . 2010-10-22 06:55 2162024 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.6029\POWERPNT.EXE
+ 2010-02-17 13:56 . 2010-02-17 13:56 1199008 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\WKCONV.EXE
+ 2010-02-25 03:07 . 2010-02-25 03:07 2672456 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\VBE7.DLL
+ 2010-02-27 18:55 . 2010-02-27 18:55 1040736 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\UMOUTLOOKADDIN.DLL
+ 2010-02-28 21:07 . 2010-02-28 21:07 2831768 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\STSLIST.DLL
+ 2010-03-10 16:44 . 2010-03-10 16:44 1100664 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\SETUP.EXE
+ 2010-03-09 01:57 . 2010-03-09 01:57 2162024 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\POWERPNT.EXE
+ 2010-03-10 16:44 . 2010-03-10 16:44 5789544 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\OSETUP.DLL
+ 2010-03-30 00:29 . 2010-03-30 00:29 1177968 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ONFILTER.DLL
+ 2010-01-09 13:24 . 2010-01-09 13:24 3483000 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\OIMG.DLL
+ 2010-02-27 18:19 . 2010-02-27 18:19 7277440 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\OFFOWC.DLL
+ 2010-03-29 13:48 . 2010-03-29 13:48 6629808 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\NL7MODELS0011.DLL
+ 2010-03-29 13:48 . 2010-03-29 13:48 2460080 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\NL7LEXICONS0011.DLL
+ 2010-03-29 13:47 . 2010-03-29 13:47 7467440 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\NL7DATA0011.DLL
+ 2010-10-30 11:12 . 2010-10-30 11:12 1689472 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\LOBISYNC.DLL
+ 2010-03-30 00:36 . 2010-03-30 00:36 5496688 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\IPEDITOR.DLL
+ 2010-03-30 00:36 . 2010-03-30 00:36 5867896 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\IPDESIGN.DLL
+ 2010-03-30 00:36 . 2010-03-30 00:36 1734000 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\INFOPATH.EXE
+ 2010-03-12 14:45 . 2010-03-12 14:45 4299648 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\GRAPH.EXE
+ 2010-02-28 21:08 . 2010-02-28 21:08 1746280 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\GFX.DLL
+ 2010-02-20 09:20 . 2010-02-20 09:20 1207144 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\FM20.DLL
+ 2010-01-18 12:59 . 2010-01-18 12:59 2182040 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ASSAPIFE.DLL
+ 2010-03-23 02:55 . 2010-03-23 02:55 3049376 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACEWDAT.DLL
+ 2010-03-23 02:55 . 2010-03-23 02:55 2193800 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACECORE.DLL
+ 2010-03-24 12:28 . 2010-03-24 12:28 1449312 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACCICONS.EXE
+ 2010-10-30 11:12 . 2010-10-30 11:12 1857400 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ACCESS.DLL
+ 2011-12-14 04:17 . 2011-12-14 04:17 1551872 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Office.To#\be8866c920d3a7ef5a73a9875defa229\Microsoft.Office.Tools.Excel.Implementation.ni.dll
+ 2011-12-14 04:17 . 2011-12-14 04:17 1117696 c:\windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Office.To#\ab8932f40fc2ae09139579d2bad98ab8\Microsoft.Office.Tools.Word.Implementation.ni.dll
+ 2011-12-13 03:31 . 2011-12-13 03:31 1564672 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\b5f035ed367de31fb3c49d0e83060002\Microsoft.Office.BusinessApplications.Runtime.ni.dll
+ 2011-12-14 04:16 . 2011-12-14 04:16 2091520 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\8fcf59da13a5304629d3086201363b37\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll
+ 2011-12-13 03:31 . 2011-12-13 03:31 4752384 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\2500054cf96b7709cb17b45c6c790546\Microsoft.Office.BusinessApplications.SyncServices.ni.dll
+ 2011-12-13 03:31 . 2011-12-13 03:31 3238400 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\22efaddb3a85e67bc38e077b50c520b3\Microsoft.Office.BusinessData.ni.dll
+ 2011-12-13 03:28 . 2011-12-13 03:28 1857400 c:\windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Access.dll
- 2010-10-30 11:12 . 2010-10-30 11:12 1857400 c:\windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Access.dll
+ 2011-12-13 03:29 . 2011-12-13 03:29 1689472 c:\windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices\14.0.0.0__71e9bce111e9429c\Microsoft.Office.BusinessApplications.SyncServices.dll
- 2010-10-30 11:12 . 2010-10-30 11:12 1689472 c:\windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices\14.0.0.0__71e9bce111e9429c\Microsoft.Office.BusinessApplications.SyncServices.dll
+ 2011-12-13 03:13 . 2011-08-30 06:11 12872704 c:\windows\winsxs\x86_microsoft-windows-shell32_31bf3856ad364e35_6.1.7601.21804_none_6ec5054c895384f1\shell32.dll
+ 2011-12-13 03:13 . 2011-08-30 04:21 12872704 c:\windows\winsxs\x86_microsoft-windows-shell32_31bf3856ad364e35_6.1.7601.17678_none_6df3b84f706b10f3\shell32.dll
+ 2011-12-13 03:13 . 2011-08-30 04:40 12871168 c:\windows\winsxs\x86_microsoft-windows-shell32_31bf3856ad364e35_6.1.7600.21039_none_6cc310308c4121a6\shell32.dll
+ 2011-12-13 03:13 . 2011-08-30 04:28 12868096 c:\windows\winsxs\x86_microsoft-windows-shell32_31bf3856ad364e35_6.1.7600.16874_none_6c095a2173483fab\shell32.dll
+ 2011-12-14 06:51 . 2011-11-03 23:35 12279808 c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20544_none_2c39b32b559af042\mshtml.dll
+ 2011-12-14 06:51 . 2011-11-03 23:02 12279808 c:\windows\winsxs\x86_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16440_none_2bac15383c80eb1c\mshtml.dll
+ 2011-12-13 03:13 . 2011-08-30 04:21 12872704 c:\windows\System32\shell32.dll
+ 2011-12-14 06:51 . 2011-11-03 23:02 12279808 c:\windows\System32\mshtml.dll
+ 2010-12-07 09:20 . 2011-12-14 06:52 52988224 c:\windows\System32\MRT.exe
+ 2011-10-26 14:45 . 2011-10-26 14:45 66426368 c:\windows\Installer\94a497.msp
+ 2011-04-28 15:28 . 2011-04-28 15:28 16972800 c:\windows\Installer\50d4ee.msp
+ 2011-04-28 15:28 . 2011-04-28 15:28 11056128 c:\windows\Installer\50d4d9.msp
+ 2011-04-28 12:34 . 2011-04-28 12:34 11155456 c:\windows\Installer\50d4c6.msp
+ 2011-04-28 12:27 . 2011-04-28 12:27 14467072 c:\windows\Installer\50d327.msp
+ 2011-10-26 14:47 . 2011-10-26 14:47 10328064 c:\windows\Installer\1645789.msp
+ 2011-10-26 14:49 . 2011-10-26 14:49 16245760 c:\windows\Installer\164577f.msp
+ 2011-10-26 14:49 . 2011-10-26 14:49 10427392 c:\windows\Installer\1645777.msp
+ 2010-02-28 21:09 . 2010-02-28 21:09 13988704 c:\windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\MSACCESS.EXE
+ 2011-05-19 04:21 . 2011-12-14 06:55 133038837 c:\windows\winsxs\ManifestCache\a786a517e28d5687_blobs.bin
+ 2011-04-28 12:33 . 2011-04-28 12:33 425345024 c:\windows\Installer\50d4ac.msp
+ 2011-10-16 06:38 . 2011-10-16 06:38 100966912 c:\windows\Installer\164576f.msp
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2011-08-24 1299248]
.
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-10-31 21:02 94208 ----a-w- c:\users\Royce Borja\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-10-31 21:02 94208 ----a-w- c:\users\Royce Borja\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-10-31 21:02 94208 ----a-w- c:\users\Royce Borja\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Mobile Partner"="c:\program files\Globe Broadband\Globe Broadband.exe" [2010-12-22 114688]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-22 35760]
"ATKOSD2"="c:\program files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2009-10-26 6998656]
"ATKMEDIA"="c:\program files\ASUS\ATK Package\ATK Media\DMedia.exe" [2009-08-19 170624]
"HControlUser"="c:\program files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2010-07-04 17408]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-09-30 498560]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2011-08-01 114992]
.
c:\users\royth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
CNET TechTracker.lnk - c:\users\Royce Borja\AppData\Roaming\CBS Interactive\CNET TechTracker\TechTracker.exe [N/A]
OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE [2011-9-2 227712]
.
c:\users\Royce Borja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Royce Borja\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-12-6 24242056]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-04-14 03:32 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 09:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USB Antivirus]
2010-06-04 09:31 91040 ----a-w- c:\program files\USB Disk Security\RunUSBGuard.exe
.
R1 MpKsl1ea0f0a6;MpKsl1ea0f0a6;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{573B6BFC-0866-49E9-B1FF-70AE14145248}\MpKsl1ea0f0a6.sys [x]
R1 MpKsl42acd663;MpKsl42acd663;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1174694A-8C94-4B31-A0F4-61CDDF1B49DE}\MpKsl42acd663.sys [x]
R1 MpKsl479a3507;MpKsl479a3507;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D13A2F51-E41C-4EA7-910C-330AFFA4C876}\MpKsl479a3507.sys [x]
R1 MpKsl67757f99;MpKsl67757f99;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B605D2CF-C0D4-4538-9437-1BCE94E2DB77}\MpKsl67757f99.sys [x]
R1 MpKsl69855dc9;MpKsl69855dc9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{78D5E0BD-486A-446F-97CB-AEAA9AFF0F62}\MpKsl69855dc9.sys [x]
R1 MpKsl8570e2e9;MpKsl8570e2e9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4765C582-F2F5-4D03-BD01-5E7358279F48}\MpKsl8570e2e9.sys [x]
R1 MpKsla45b4c38;MpKsla45b4c38;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3A514E88-EDF1-469A-B536-AF7E982B430B}\MpKsla45b4c38.sys [x]
R1 MpKsla56be771;MpKsla56be771;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7351DAEA-1334-443C-919B-5824A0004F24}\MpKsla56be771.sys [x]
R1 MpKslb395fe83;MpKslb395fe83;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{776DC24D-441B-4F85-A721-00CB109F5E2D}\MpKslb395fe83.sys [x]
R1 MpKslbb54a3f1;MpKslbb54a3f1;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C9EE492F-8A24-4461-939B-77775320F86B}\MpKslbb54a3f1.sys [x]
R1 MpKslbee5cc11;MpKslbee5cc11;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B4031139-59AC-4A84-B205-33E48DFD2BF8}\MpKslbee5cc11.sys [x]
R1 MpKsld1e86cb6;MpKsld1e86cb6;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{34A58B9B-37E7-4056-9A4B-BDA357BA7A7E}\MpKsld1e86cb6.sys [x]
R1 MpKsleb984165;MpKsleb984165;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{ADC7B865-0BDA-4A74-980D-A80A7A2F7F38}\MpKsleb984165.sys [x]
R1 MpKslf12c955b;MpKslf12c955b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{34A58B9B-37E7-4056-9A4B-BDA357BA7A7E}\MpKslf12c955b.sys [x]
R1 MpKslf96ff9ed;MpKslf96ff9ed;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C9EE492F-8A24-4461-939B-77775320F86B}\MpKslf96ff9ed.sys [x]
R1 MpKslf9fa9f79;MpKslf9fa9f79;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{711F04EF-5EE1-4D02-8DBA-493C8651BC99}\MpKslf9fa9f79.sys [x]
R1 MpKslfb75e3cd;MpKslfb75e3cd;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8A16FDC5-B0A9-492A-AABE-6D58AE32ECC6}\MpKslfb75e3cd.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2009-04-06 13224]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-11-02 1343400]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-17 176128]
S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-04-16 173352]
S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files\Intel\Intel® Management Engine Components\UNS\UNS.exe [2009-09-30 2314240]
S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-04-13 45736]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2009-10-15 94208]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [2009-10-12 101120]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2010-10-30 119408]
S3 JME;JMicron Ethernet Adapter NDIS6 Driver;c:\windows\system32\DRIVERS\JME.sys [2010-10-30 87152]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - NisDrv
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2997370033-3740561985-2119248922-1001Core.job
- c:\users\BORJiNGS only\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-20 00:12]
.
2011-12-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2997370033-3740561985-2119248922-1001UA.job
- c:\users\BORJiNGS only\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-20 00:12]
.
2011-12-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2997370033-3740561985-2119248922-1003Core.job
- c:\users\Royce Borja\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-01 02:01]
.
2011-12-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2997370033-3740561985-2119248922-1003UA.job
- c:\users\Royce Borja\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-01 02:01]
.
.
------- Supplementary Scan -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://home.sweetim.com
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
IE: Search the Web - c:\program files\SweetIM\Toolbars\Internet Explorer\resources\menuext.html
FF - ProfilePath -
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{09ec805c-cb2e-4d53-b0d3-a75a428b81c7} - c:\program files\4shared.com\prxtb4sha.dll
WebBrowser-{09EC805C-CB2E-4D53-B0D3-A75A428B81C7} - c:\program files\4shared.com\prxtb4sha.dll
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0010\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'Explorer.exe'(3396)
c:\users\Royce Borja\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
Completion time: 2011-12-19 13:21:18
ComboFix-quarantined-files.txt 2011-12-19 05:21
ComboFix2.txt 2011-12-15 21:26
ComboFix3.txt 2011-12-08 09:54
.
Pre-Run: 122,090,319,872 bytes free
Post-Run: 121,853,575,168 bytes free
.
- - End Of File - - 71FD2BDBD476FB8D782652B7E62680D9

#4 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:24 AM

Posted 19 December 2011 - 12:50 AM

Download both the registry files

http://www.mediafire.com/?317ea53a883288d

http://www.mediafire.com/?z6aw8j7997qa7j9

Launch and import them to registry

Restart your PC

Now,open RUN and type

regedit and click ok

go to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE

Right click on it-permissions

Click on ADD and type

Everyone and click ok

Now Click on Everyone

Below you have permission for users

Select full control and click ok

Now,open RUN and type

services.msc and click ok

start base filtering engine service and then windows firewall service
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#5 roycegwapo

roycegwapo
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:24 AM

Posted 19 December 2011 - 06:33 AM

Thanks a lot Gringo! Windows firewall is back and running . So I'm not infected with anything?
Thanks again! I owe you

#6 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:24 AM

Posted 19 December 2011 - 08:15 AM

Greetings

Good That cleaned up some bad guys but I see some other stuff that we need to go after, so I want you to run this custom script for me.

:Run CFScript:

Open Notepad and copy/paste the text in the box into the window:

ClearJavaCache::

Save it to your desktop as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe
Posted Image
This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

"information and logs"

  • In your next post I need the following

  • report from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now after running the script?

Gringo

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#7 roycegwapo

roycegwapo
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:24 AM

Posted 19 December 2011 - 08:19 AM

I'm on the process on the doing it now. Can you give me more details on the problems that your referring to? hehe . thanks! I'm studying Information Technology and I'm sure I can easily relate .hehe

#8 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:24 AM

Posted 19 December 2011 - 01:33 PM

Hello

let me have the report when complete

Have you had any problems running the programs or any new problems with the computer


gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#9 roycegwapo

roycegwapo
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:24 AM

Posted 19 December 2011 - 06:56 PM

hi gringo,

so far, everything is going fairly well. No hangs, no redirects, etc.

I recently had a notification from my AV (MSE) of a file named iexplore.exe (which I know is the Internet Explorer process) that is residing in a folder in partition C:\ . I don't use IE.



ComboFix 11-12-18.02 - Royce Borja 12/20/2011 7:29.4.4 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.1964.1185 [GMT 8:00]
Running from: c:\users\Royce Borja\Downloads\ComboFix.exe
Command switches used :: c:\users\Royce Borja\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2011-11-19 to 2011-12-19 )))))))))))))))))))))))))))))))
.
.
2011-12-19 23:35 . 2011-12-19 23:35 -------- d-----w- c:\users\royth\AppData\Local\temp
2011-12-19 23:35 . 2011-12-19 23:35 -------- d-----w- c:\users\Guest\AppData\Local\temp
2011-12-19 23:35 . 2011-12-19 23:35 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-12-19 23:35 . 2011-12-19 23:35 -------- d-----w- c:\users\BORJiNGS only\AppData\Local\temp
2011-12-19 22:34 . 2011-12-19 22:34 29904 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0F30E78E-5F4C-4E3E-A96B-66405AAD434C}\MpKsl26fff3dd.sys
2011-12-19 22:34 . 2011-12-19 23:37 56200 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0F30E78E-5F4C-4E3E-A96B-66405AAD434C}\offreg.dll
2011-12-19 13:15 . 2011-12-19 13:15 703824 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E0A3CFDB-9B32-497E-84AA-6BDCD47F47D0}\gapaengine.dll
2011-12-19 13:15 . 2011-11-20 18:47 6823496 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0F30E78E-5F4C-4E3E-A96B-66405AAD434C}\mpengine.dll
2011-12-19 12:43 . 2011-12-19 12:44 -------- d-----w- c:\program files\Microsoft Security Client
2011-12-14 05:19 . 2011-11-24 04:25 2342912 ----a-w- c:\windows\system32\win32k.sys
2011-12-14 05:19 . 2011-11-05 04:26 2048 ----a-w- c:\windows\system32\tzres.dll
2011-12-14 05:19 . 2011-10-15 05:38 534528 ----a-w- c:\windows\system32\EncDec.dll
2011-12-14 05:19 . 2011-10-26 04:28 38912 ----a-w- c:\windows\system32\csrsrv.dll
2011-12-14 05:19 . 2011-10-26 04:47 3912560 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-12-14 05:19 . 2011-10-26 04:47 3967856 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-12-14 00:19 . 2011-12-14 00:19 4448256 ----a-w- c:\windows\system32\GPhotos.scr
2011-12-11 08:08 . 2011-12-11 08:08 -------- d-----w- c:\program files\Google
2011-12-08 09:17 . 2011-04-25 02:18 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2011-12-07 05:44 . 2011-12-07 05:44 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-12-06 00:20 . 2011-12-06 00:20 -------- d-----w- c:\program files\FileZilla FTP Client
2011-12-05 21:46 . 2011-12-05 21:46 -------- d--h--w- c:\windows\msdownld.tmp
2011-12-05 03:02 . 2011-12-05 03:02 -------- d-----w- c:\program files\uTorrent
2011-12-04 04:52 . 2011-12-04 04:52 -------- d-----w- c:\users\Ryan Gwapo
2011-12-04 01:47 . 2009-07-16 09:20 25984 ----a-w- c:\windows\system32\drivers\tap0901.sys
2011-12-04 01:47 . 2011-12-04 01:50 -------- d-----w- c:\program files\Hypernet
2011-12-01 02:56 . 2011-12-01 02:56 -------- d-----w- c:\program files\VirtualDJ
2011-12-01 02:42 . 2011-12-01 02:42 -------- dc-h--w- c:\programdata\{4A818508-3355-4FBC-B302-D53B599DD9D5}
2011-12-01 02:41 . 2011-12-01 02:41 -------- d-----w- c:\program files\Common Files\Native Instruments
2011-12-01 02:41 . 2011-12-01 02:41 -------- d-----w- c:\programdata\Native Instruments
2011-12-01 02:41 . 2011-12-01 02:41 -------- d-----w- c:\program files\Native Instruments
2011-12-01 01:55 . 2011-12-01 01:56 -------- d-----w- c:\users\Royce Borja
2011-11-25 13:28 . 2011-09-29 16:03 1290608 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-11-25 13:27 . 2011-10-01 04:37 708608 ----a-w- c:\program files\Common Files\System\wab32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-17 11:06 . 2011-01-24 13:12 539984 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-12-16 00:54 . 2011-05-10 07:02 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore-2\Microsoft.MediaCenter.Sports.UI.dll
2011-12-16 00:53 . 2011-03-27 10:20 4283672 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2011-12-16 00:50 . 2011-01-24 13:12 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2011-12-14 01:08 . 2011-02-12 05:01 539984 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2011-12-11 08:00 . 2011-04-03 04:57 737072 ----a-w- c:\programdata\Microsoft\eHome\Packages\SportsV2\SportsTemplateCore\Microsoft.MediaCenter.Sports.UI.dll
2011-12-11 07:59 . 2011-03-27 08:53 4283672 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2011-12-11 07:58 . 2011-01-29 13:02 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2011-08-24 1299248]
.
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-10-31 21:02 94208 ----a-w- c:\users\Royce Borja\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-10-31 21:02 94208 ----a-w- c:\users\Royce Borja\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-10-31 21:02 94208 ----a-w- c:\users\Royce Borja\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Mobile Partner"="c:\program files\Globe Broadband\Globe Broadband.exe" [2010-12-22 114688]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-22 35760]
"ATKOSD2"="c:\program files\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2009-10-26 6998656]
"ATKMEDIA"="c:\program files\ASUS\ATK Package\ATK Media\DMedia.exe" [2009-08-19 170624]
"HControlUser"="c:\program files\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2010-07-04 17408]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"ETDWare"="c:\program files\Elantech\ETDCtrl.exe" [2009-09-30 498560]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2011-08-01 114992]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
.
c:\users\royth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
CNET TechTracker.lnk - c:\users\Royce Borja\AppData\Roaming\CBS Interactive\CNET TechTracker\TechTracker.exe [N/A]
OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office14\ONENOTEM.EXE [2011-9-2 227712]
.
c:\users\Royce Borja\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Royce Borja\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-12-6 24242056]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-04-14 03:32 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 09:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USB Antivirus]
2010-06-04 09:31 91040 ----a-w- c:\program files\USB Disk Security\RunUSBGuard.exe
.
R1 MpKsl1ea0f0a6;MpKsl1ea0f0a6;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{573B6BFC-0866-49E9-B1FF-70AE14145248}\MpKsl1ea0f0a6.sys [x]
R1 MpKsl42acd663;MpKsl42acd663;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1174694A-8C94-4B31-A0F4-61CDDF1B49DE}\MpKsl42acd663.sys [x]
R1 MpKsl479a3507;MpKsl479a3507;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D13A2F51-E41C-4EA7-910C-330AFFA4C876}\MpKsl479a3507.sys [x]
R1 MpKsl67757f99;MpKsl67757f99;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B605D2CF-C0D4-4538-9437-1BCE94E2DB77}\MpKsl67757f99.sys [x]
R1 MpKsl69855dc9;MpKsl69855dc9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{78D5E0BD-486A-446F-97CB-AEAA9AFF0F62}\MpKsl69855dc9.sys [x]
R1 MpKsl8570e2e9;MpKsl8570e2e9;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4765C582-F2F5-4D03-BD01-5E7358279F48}\MpKsl8570e2e9.sys [x]
R1 MpKsla45b4c38;MpKsla45b4c38;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3A514E88-EDF1-469A-B536-AF7E982B430B}\MpKsla45b4c38.sys [x]
R1 MpKsla56be771;MpKsla56be771;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{7351DAEA-1334-443C-919B-5824A0004F24}\MpKsla56be771.sys [x]
R1 MpKslb395fe83;MpKslb395fe83;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{776DC24D-441B-4F85-A721-00CB109F5E2D}\MpKslb395fe83.sys [x]
R1 MpKslbb54a3f1;MpKslbb54a3f1;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C9EE492F-8A24-4461-939B-77775320F86B}\MpKslbb54a3f1.sys [x]
R1 MpKslbee5cc11;MpKslbee5cc11;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B4031139-59AC-4A84-B205-33E48DFD2BF8}\MpKslbee5cc11.sys [x]
R1 MpKsld1e86cb6;MpKsld1e86cb6;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{34A58B9B-37E7-4056-9A4B-BDA357BA7A7E}\MpKsld1e86cb6.sys [x]
R1 MpKsleb984165;MpKsleb984165;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{ADC7B865-0BDA-4A74-980D-A80A7A2F7F38}\MpKsleb984165.sys [x]
R1 MpKslf12c955b;MpKslf12c955b;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{34A58B9B-37E7-4056-9A4B-BDA357BA7A7E}\MpKslf12c955b.sys [x]
R1 MpKslf96ff9ed;MpKslf96ff9ed;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C9EE492F-8A24-4461-939B-77775320F86B}\MpKslf96ff9ed.sys [x]
R1 MpKslf9fa9f79;MpKslf9fa9f79;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{711F04EF-5EE1-4D02-8DBA-493C8651BC99}\MpKslf9fa9f79.sys [x]
R1 MpKslfb75e3cd;MpKslfb75e3cd;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8A16FDC5-B0A9-492A-AABE-6D58AE32ECC6}\MpKslfb75e3cd.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2009-04-06 13224]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [2009-10-12 101120]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 208944]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-11-02 1343400]
S1 MpKsl26fff3dd;MpKsl26fff3dd;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0F30E78E-5F4C-4E3E-A96B-66405AAD434C}\MpKsl26fff3dd.sys [2011-12-19 29904]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-17 176128]
S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-04-16 173352]
S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files\Intel\Intel® Management Engine Components\UNS\UNS.exe [2009-09-30 2314240]
S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-04-13 45736]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2009-10-15 94208]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2010-10-30 119408]
S3 JME;JMicron Ethernet Adapter NDIS6 Driver;c:\windows\system32\DRIVERS\JME.sys [2010-10-30 87152]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2997370033-3740561985-2119248922-1001Core.job
- c:\users\BORJiNGS only\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-20 00:12]
.
2011-12-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2997370033-3740561985-2119248922-1001UA.job
- c:\users\BORJiNGS only\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-20 00:12]
.
2011-12-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2997370033-3740561985-2119248922-1003Core.job
- c:\users\Royce Borja\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-01 02:01]
.
2011-12-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2997370033-3740561985-2119248922-1003UA.job
- c:\users\Royce Borja\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-01 02:01]
.
.
------- Supplementary Scan -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://home.sweetim.com
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
IE: Search the Web - c:\program files\SweetIM\Toolbars\Internet Explorer\resources\menuext.html
FF - ProfilePath -
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0010\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'Explorer.exe'(2116)
c:\users\Royce Borja\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe
c:\program files\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
c:\program files\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
c:\windows\system32\atieclxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Intel\Intel® Management Engine Components\LMS\LMS.exe
c:\program files\TeamViewer\Version5\TeamViewer.exe
c:\windows\system32\WUDFHost.exe
c:\program files\ASUS\SmartLogon\sensorsrv.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\ASUS\ATK Package\ATK Hotkey\HControl.exe
c:\program files\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
c:\program files\ASUS\ATK Package\ATK Hotkey\WDC.exe
c:\windows\system32\sppsvc.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Completion time: 2011-12-20 07:41:21 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-19 23:41
ComboFix2.txt 2011-12-19 05:21
ComboFix3.txt 2011-12-15 21:26
ComboFix4.txt 2011-12-08 09:54
.
Pre-Run: 121,725,157,376 bytes free
Post-Run: 121,413,652,480 bytes free
.
- - End Of File - - 053CA473AAA1677CD1C3CA007EE537C5

#10 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:24 AM

Posted 19 December 2011 - 11:57 PM

Hello

:P2P Warning!:

IMPORTANT I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.

Please note that as long as you are using any form of Peer-to-Peer networking and downloading files from non-documented sources, you can expect infestations of malware to occur
Once upon a time, P2P file sharing was fairly safe. That is no longer true. P2P programs form a direct conduit on to your computer, their security measures are easily circumvented and malware writers are increasingly exploiting them to spread their wares on to your computer. Further to that, if your P2P program is not configured correctly, your computer may be sharing more files than you realize. There have been cases where people's passwords, address books and other personal, private, and financial details have been exposed to a file sharing network by a badly configured program.

Please read these short reports on the dangers of peer-2-peer programs and file sharing.

FBI Cyber Education Letter
File sharing infects 500,000 computers
USAToday
infoworld


These logs are looking allot better. But we still have some work to do.

Please print out these instructions, or copy them to a Notepad file. It will make it easier for you to follow the instructions and complete all of the necessary steps..

uninstall some programs

NOTE** Because of the cleanup process some of the programs I have listed may not be in add/remove anymore just move to the next item on the list.

1. click on start
2. then go to settings
3. after that you need control panel
4. look for the icon add/remove programs
click on the following programs

Adobe Reader 9.4.0
Java™ 6 Update 22


and click on remove

Update Adobe Reader

Recently there have been vulnerabilities detected in older versions of Adobe Reader. It is strongly suggested that you update to the current version.

You can download it from http://www.adobe.com/products/acrobat/readstep2.html
After installing the latest Adobe Reader, uninstall all previous versions.
If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

If you don't like Adobe Reader (53 MB), you can download Foxit PDF Reader(7 MB) from here. It's a much smaller file to download and uses a lot less resources than Adobe Reader.

Note: When installing FoxitReader, be careful not to install anything to do with AskBar.
[/list]
Install Java:

Please go here to install Java

  • click on the Free Java Download Button
  • click on Agree and start Free download
  • click on Run
  • click on run again
  • click on install
  • when install is complete click on close


TFC(Temp File Cleaner):

  • Please download TFC to your desktop,
  • Save any unsaved work. TFC will close all open application windows.
  • Double-click TFC.exe to run the program.
  • If prompted, click "Yes" to reboot.
Note: Save your work. TFC will automatically close any open programs, let it run uninterrupted. It shouldn't take longer take a couple of minutes, and may only take a few seconds. Only if needed will you be prompted to reboot.

: Malwarebytes' Anti-Malware :

  • Please download Malwarebytes' Anti-Malware to your desktop.
  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to
    • Update Malwarebytes' Anti-Malware
    • and Launch Malwarebytes' Anti-Malware
  • then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is Checked (ticked) except items in the C:\System Volume Information folder and click on Remove Selected.
  • When completed, a log will open in Notepad. please copy and paste the log into your next reply
    • If you accidently close it, the log file is saved here and will be named like this:
    • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.


Download HijackThis

  • Go Here to download HijackThis Installer
  • Save HijackThis Installer to your desktop.
  • Double-click on the HijackThis Installer icon on your desktop. (Vista and Win 7 right click and run as admin)
  • By default it will install to C:\Program Files\Trend Micro\HijackThis .
  • Click on Install.
  • It will create a HijackThis icon on the desktop.
  • Once installed it will launch Hijackthis.
  • Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
  • Click on Edit > Select All then click on Edit > Copy to copy the entire contents of the log.
  • Come back here to this thread and Paste the log in your next reply.
  • DO NOT use the AnalyseThis button its findings are dangerous if misinterpreted.
  • DO NOT have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.


If you have problems running Hijackthis.

sometimes we have to run it like this To run HijackThis as an administrator,
rightclick HijackThis.exe (located: C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe)
and select to run as administrator

"information and logs"

  • In your next post I need the following

  • Log From MBAM
  • report from Hijackthis
  • let me know of any problems you may have had
  • How is the computer doing now?

Gringo

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#11 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:24 AM

Posted 23 December 2011 - 11:45 AM

Hello




Happy Holidays, It has been a couple of days since I have you heard from you so I came by to check on you



Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#12 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:24 AM

Posted 27 December 2011 - 12:46 AM

Hello

48 Hour bump

It has been more than 48 hours since my last post.

  • do you still need help with this?
  • do you need more time?
  • are you having problems following my instructions?
  • if after 48hrs you have not replied to this thread then it will have to be closed!

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#13 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:24 AM

Posted 31 December 2011 - 01:27 PM

Due to the lack of feedback, this topic is now closed.In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days. Please include a link to your topic in the Private Message. Thank you.
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users