Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

"Expiro.gen/f" virus infecting a bunch of programs at an alarming rate.


  • This topic is locked This topic is locked
7 replies to this topic

#1 BCMusic

BCMusic

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:U.S.A.
  • Local time:12:06 AM

Posted 16 July 2013 - 10:04 PM

Apologies if my thread title is a bit alarmist. I understand that others have problems that need attention, however I also understand that some problems are simply more severe than others. This virus is infecting a bunch of my programs as well as opening connections to random .RU TLDs. I ran OmniPeek yesterday to check my network activity and noticed some very suspicious connections coming from my computer to randomly-named Russian servers. I just ran it again while I type and see no such connections at this time. I downloaded Microsoft Security Essentials and it detected right away many infected applications. I also run WinPatrol and am being notified every time a program has become infected. Running WinPatrol and MSE seems to have sped the virus up somehow and it is literally out of control. MSE is cleaning/quarantining crucial system applications (explorer, svchost, etc.) and I am scared of what it's doing. MSE and WinPatrol go nuts every time I click OK on a dialog box so I've not touched anything since.



BC AdBot (Login to Remove)

 


#2 noknojon

noknojon

  • Banned
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:03:06 PM

Posted 17 July 2013 - 02:15 AM

Hello -

 

Step 1 - Download Security Check by Screen317 from HERE
* Save it to your Desktop.
* Double-click SecurityCheck.exe
* Follow the onscreen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt; please post the contents of that document.
Note: If a security program requests permission to access the Internet, allow it to do so.

 

 

Step 2 - Please download AdwCleaner by Xplode onto your desktop.

*Close all open programs and internet browsers.
*Double click on adwcleaner.exe to run the tool.
*Click on Delete.
*Confirm each time with Ok.
* NOTE :Your computer will be rebooted automatically. A text file will open after the restart.

*Please post the contents of that logfile with your next reply.
*You can find the logfile at C:\AdwCleaner[S1].txt as well.

 

 

Step 3 - Please download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them.
NOTE : You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.
rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

  • Double-click on the Rkill desktop icon to run the tool.
  • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  • If not, delete the file, then download and use the one provided in Link 2.
  • Do not reboot until instructed.
  • If the tool does not run from any of the links provided, please let me know.

If normal mode still doesn't work, run the tool from safe mode.
When the scan is done Notepad will open with rKill log.
Post it in your next reply.
NOTE. rKill.txt log will also be present on your desktop.

 

 

 

Step 4 - Scan your machine with ESET OnlineScan

This is best done with Internet Explorer, but other directions are left.

You may need to Disable your Antivirus during this scan
1.Hold down Control and click on This Link to open ESET OnlineScan in a new window.
2.Click the ESET Online Scanner button.
3.NOTE : For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

  • 1.Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
  • 2.Double click on the icon on your desktop.

4.Check "YES, I accept the Terms of Use."
5.Click the Start button.
6.Accept any security warnings from your browser.
7.Under scan settings, check "Scan Archives" and "Remove found threats"
8.Click Advanced settings and select the following:

*Scan potentially unwanted applications
*Scan for potentially unsafe applications
*Enable Anti-Stealth technology

9.ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this will take quite some time.
10.When the scan completes, click List Threats
11.Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
12.Click the Back button.
13.Click the Finish button.

 

NOTE:Sometimes if ESET finds no infections it will not create a log.

 

 

Please Copy / Paste each log back here -

 

Thank You -



#3 BCMusic

BCMusic
  • Topic Starter

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:U.S.A.
  • Local time:12:06 AM

Posted 17 July 2013 - 07:57 AM

I am unable to run SecurityCheck due to the following error:

 
Windows cannot find 'C:\Users\[username]\AppData\Local\Temp\RarSFX0\SecurityCheck\SecurityCheck.bat'. Make sure you typed the name correctly, and then try again.

 This error pops up every time I double click it.


Edited by BCMusic, 17 July 2013 - 07:58 AM.


#4 BCMusic

BCMusic
  • Topic Starter

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:U.S.A.
  • Local time:12:06 AM

Posted 17 July 2013 - 02:31 PM

I am in desperate need of help, so I am bumping this thread with an update.

 

I believe this virus has infected msiexec as I can't install anything with an MSI extension. Not sure about EXE files, but if me not being able to run SystemChecker is any indication, then that is also true as well. So far I have found that It has affected WinRAR, 7Zip, and according to MSE, it has also infected critical system files such as svchost, explorer, and a number of other critical/non-critical system files. If MSE has detected that explorer.exe and others are indeed infected and have been cleaned/quarantined, then upon restarting the system like it has advised me to do, wouldn't it make the system unusable?


Edited by BCMusic, 17 July 2013 - 03:07 PM.


#5 noknojon

noknojon

  • Banned
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:03:06 PM

Posted 17 July 2013 - 04:39 PM

OK -
Please try Step 3 as your first step, as this takes less than 1 minute, and can reset your .EXEs -
I have just finished the removal of an Expiro infection, and it changed some .EXE files.

 

Win32:Expiro has a few versions, and can alter your Antivirus, and prevent it from finding the infection.

So far we removed over 40 locations where the infection had settled, and Redirector trojan was also removed

The above listed programs, at times, were needed to be installed with a cleaned USB Flash drive.

 

Please note that all these programs are from Bleeping Computer links, and not outside links.

 

Thank You -

EDIT Extra Information - Virus:Win32/Expiro.gen!F is a generic detection for variants of Win32/Expiro, a virus that infects executable files with .EXE extensions in all drives, and collects user credentials from an infected computer.

The following Microsoft product can also detect and remove this threat: Microsoft Security Scanner
 


Edited by noknojon, 17 July 2013 - 04:50 PM.


#6 BCMusic

BCMusic
  • Topic Starter

  • Members
  • 43 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:U.S.A.
  • Local time:12:06 AM

Posted 17 July 2013 - 05:22 PM

RKill is crashing after about five minutes, so here's the log that it generates before that happens:

 

 

Rkill 2.5.6 by Lawrence Abrams (Grinler)
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
 
Program started at: 07/17/2013 05:02:32 PM in x64 mode.
Windows Version: Windows 7 Ultimate Service Pack 1
 
Checking for Windows services to stop:
 
 * No malware services found to stop.
 
Checking for processes to terminate:
 
 * C:\Windows\System32\WUDFHost.exe (PID: 36080) [WD-HEUR]
 
1 proccess terminated! (NOTE: The first time it crashed, it said 4 processes terminated.)

 

 
Possibly Patched Files.
 
 * C:\Windows\system32\csrss.exe
 * C:\Windows\system32\csrss.exe
 * C:\Windows\system32\wininit.exe
 * C:\Windows\system32\winlogon.exe
 * C:\Windows\system32\services.exe
 * C:\Windows\system32\lsass.exe
 * C:\Windows\system32\lsm.exe
 * C:\Windows\system32\svchost.exe
 * C:\Windows\system32\svchost.exe
 * C:\Windows\System32\svchost.exe
 * C:\Windows\System32\svchost.exe
 * C:\Windows\system32\svchost.exe
 * C:\Windows\system32\svchost.exe
 * C:\Windows\system32\svchost.exe
 * C:\Windows\System32\spoolsv.exe
 * C:\Windows\system32\svchost.exe
 * C:\Windows\system32\taskhost.exe
 * C:\Windows\system32\Dwm.exe
 * C:\Windows\Explorer.EXE
 * C:\Windows\system32\svchost.exe
 * C:\Windows\system32\svchost.exe
 * C:\Windows\system32\svchost.exe
 * C:\Windows\system32\conhost.exe
 * C:\Windows\system32\DllHost.exe
 * C:\Windows\system32\conhost.exe
 
Checking Registry for malware related settings:
 
 * No issues found in the Registry.
 
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
 
Performing miscellaneous checks:
 
 * No issues found.
 
Checking Windows Service Integrity: 
 
 *  (MpsSvc) is not Running.
   Startup Type set to: 
 
 *  (RpcSs) is not Running.
   Startup Type set to: 
 
 * AeLookupSvc [Missing Service]
 * AppIDSvc [Missing Service]
 * Appinfo [Missing Service]
 * AudioEndpointBuilder [Missing Service]
 * Audiosrv [Missing Service]
 * AxInstSV [Missing Service]
 * BDESVC [Missing Service]
 * BFE [Missing Service]
 * BITS [Missing Service]
 * Browser [Missing Service]
 * bthserv [Missing Service]
 * CertPropSvc [Missing Service]
 * CryptSvc [Missing Service]
 * defragsvc [Missing Service]
 * Dhcp [Missing Service]
 * Dnscache [Missing Service]
 * dot3svc [Missing Service]
 * DPS [Missing Service]
 * EapHost [Missing Service]
 * EventSystem [Missing Service]
 * fdPHost [Missing Service]
 * FontCache [Missing Service]
 * hidserv [Missing Service]
 * hkmsvc [Missing Service]
 * HomeGroupListener [Missing Service]
 * HomeGroupProvider [Missing Service]
 * IKEEXT [Missing Service]
 * IPBusEnum [Missing Service]
 * KtmRm [Missing Service]
 * LanmanWorkstation [Missing Service]
 * lltdsvc [Missing Service]
 * lmhosts [Missing Service]
 * MMCSS [Missing Service]
 * MSiSCSI [Missing Service]
 * msiserver [Missing Service]
 * Netman [Missing Service]
 * netprofm [Missing Service]
 * NlaSvc [Missing Service]
 * nsi [Missing Service]
 * p2pimsvc [Missing Service]
 * p2psvc [Missing Service]
 * PcaSvc [Missing Service]
 * pla [Missing Service]
 * PlugPlay [Missing Service]
 * PNRPAutoReg [Missing Service]
 * PNRPsvc [Missing Service]
 * PolicyAgent [Missing Service]
 * Power [Missing Service]
 * ProfSvc [Missing Service]
 * QWAVE [Missing Service]
 * RasAuto [Missing Service]
 * RemoteAccess [Missing Service]
 * RemoteRegistry [Missing Service]
 * RpcEptMapper [Missing Service]
 * SCardSvr [Missing Service]
 * Schedule [Missing Service]
 * SCPolicySvc [Missing Service]
 * SDRSVC [Missing Service]
 * seclogon [Missing Service]
 * SENS [Missing Service]
 * SensrSvc [Missing Service]
 * SessionEnv [Missing Service]
 * ShellHWDetection [Missing Service]
 * sppuinotify [Missing Service]
 * SSDPSRV [Missing Service]
 * SstpSvc [Missing Service]
 * StiSvc [Missing Service]
 * swprv [Missing Service]
 * SysMain [Missing Service]
 * TabletInputService [Missing Service]
 * TapiSrv [Missing Service]
 * TBS [Missing Service]
 * Themes [Missing Service]
 * THREADORDER [Missing Service]
 * TrkWks [Missing Service]
 * upnphost [Missing Service]
 * UxSms [Missing Service]
 * W32Time [Missing Service]
 * WbioSrvc [Missing Service]
 * wcncsvc [Missing Service]
 * WcsPlugInService [Missing Service]
 * WdiServiceHost [Missing Service]
 * WdiSystemHost [Missing Service]
 * WebClient [Missing Service]
 * Wecsvc [Missing Service]
 * wercplsupport [Missing Service]
 * WerSvc [Missing Service]
 * WinDefend [Missing Service]
 * WinHttpAutoProxySvc [Missing Service]
 * Winmgmt [Missing Service]
 * WinRM [Missing Service]
 * WPCSvc [Missing Service]
 * WPDBusEnum [Missing Service]
 * wscsvc [Missing Service]
 * WSearch [Missing Service]
 * wuauserv [Missing Service]
 * wudfsvc [Missing Service]
 * AppMgmt [Missing Service]
 * CscService [Missing Service]
 * PeerDistSvc [Missing Service]
 * UmRdpService [Missing Service]
 
 * eventlog [Missing ImagePath]
 * FDResPub [Missing ImagePath]
 * iphlpsvc [Missing ImagePath]
 * LanmanServer [Missing ImagePath]
 * MpsSvc [Missing ImagePath]
 
 * SharedAccess [Missing ServiceDLL Value]
 
Searching for Missing Digital Signatures: 
 
 * C:\Windows\System32\appmgmts.dll : 193,536 : 07/13/2009 08:40 PM : 4aba3e75a76195a3e38ed2766c962899 [NoSig]
 +-> C:\Windows\SysWOW64\appmgmts.dll : 149,504 : 07/13/2009 08:14 PM : a45d184df6a8803da13a0b329517a64a [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-g..oftwareinstallation_31bf3856ad364e35_6.1.7600.16385_none_ddc3da0b75baa7e0\appmgmts.dll : 193,536 : 07/13/2009 08:40 PM : 4aba3e75a76195a3e38ed2766c962899 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-g..oftwareinstallation_31bf3856ad364e35_6.1.7600.16385_none_e818845daa1b69db\appmgmts.dll : 149,504 : 07/13/2009 08:14 PM : a45d184df6a8803da13a0b329517a64a [Pos Repl]
 
 * C:\Windows\System32\browser.dll : 136,704 : 07/04/2012 05:13 PM : 05f5a0d14a2ee1d8255c2aa0e9e8e694 [NoSig]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-browserservice_31bf3856ad364e35_6.1.7600.16385_none_d4de1860b7af7c14\browser.dll : 136,192 : 07/13/2009 08:40 PM : 94fbc06f294d58d02361918418f996e3 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-browserservice_31bf3856ad364e35_6.1.7600.17056_none_d4ff6bf4b79663c4\browser.dll : 136,704 : 07/04/2012 05:01 PM : 6b054c67aaa87843504e8e3c09102009 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-browserservice_31bf3856ad364e35_6.1.7600.21256_none_d5890aa5d0b400b5\browser.dll : 136,704 : 07/04/2012 05:17 PM : 00a7a2067e9822e4626de846574ada80 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-browserservice_31bf3856ad364e35_6.1.7601.17514_none_d70f2c28b49dffae\browser.dll : 136,192 : 11/20/2010 08:25 AM : 8ef0d5c41ec907751b8429162b1239ed [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-browserservice_31bf3856ad364e35_6.1.7601.17887_none_d6c68344b4d406bf\browser.dll : 136,704 : 07/04/2012 05:13 PM : 05f5a0d14a2ee1d8255c2aa0e9e8e694 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-browserservice_31bf3856ad364e35_6.1.7601.22044_none_d7783703cdd41e02\browser.dll : 136,704 : 07/04/2012 05:06 PM : 156768abae1daf29ba0b0c05c21fef09 [Pos Repl]
 
 * C:\Windows\System32\cngaudit.dll : 18,944 : 07/13/2009 08:40 PM : 86fe1b1f8fd42cd0db641ab1cdb13093 [NoSig]
 +-> C:\Windows\SysWOW64\cngaudit.dll : 12,288 : 07/13/2009 08:15 PM : 50ba656134f78af64e4dd3c8b6fefd7e [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll : 18,944 : 07/13/2009 08:40 PM : 86fe1b1f8fd42cd0db641ab1cdb13093 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll : 12,288 : 07/13/2009 08:15 PM : 50ba656134f78af64e4dd3c8b6fefd7e [Pos Repl]
 
 * C:\Windows\System32\comctl32.dll : 633,856 : 11/20/2010 08:25 AM : 14dfdeaf4e589ed3f1ff187a86b9408c [NoSig]
 +-> C:\Windows\SysWOW64\comctl32.dll : 530,432 : 11/20/2010 07:18 AM : bdac1aa64495d0f7e1ff810ebbf1f018 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-shell-comctl32-v5_31bf3856ad364e35_6.1.7600.16385_none_959110a7f1a88a21\comctl32.dll : 633,856 : 07/13/2009 08:40 PM : 7e8ab50ab7f2f81f30dcc8a98025b73a [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-shell-comctl32-v5_31bf3856ad364e35_6.1.7600.16661_none_95a2b509f19be458\comctl32.dll : 633,856 : 11/11/2010 12:05 AM : bc052efad10aca1ad69545b629f50d99 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-shell-comctl32-v5_31bf3856ad364e35_6.1.7600.20787_none_961cb3b90ac4540e\comctl32.dll : 633,856 : 11/11/2010 12:05 AM : b0cb1d2d5ffa6335dd94b1b531756412 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-shell-comctl32-v5_31bf3856ad364e35_6.1.7601.17514_none_97c2246fee970dbb\comctl32.dll : 633,856 : 11/20/2010 08:25 AM : 14dfdeaf4e589ed3f1ff187a86b9408c [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7600.16385_none_a44af8ec57f961cf\comctl32.dll : 633,856 : 07/13/2009 08:40 PM : 7e8ab50ab7f2f81f30dcc8a98025b73a [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7600.16661_none_a44e1fc257f685f6\comctl32.dll : 633,856 : 11/11/2010 12:05 AM : bc052efad10aca1ad69545b629f50d99 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7600.20787_none_a6357652551c0c2c\comctl32.dll : 633,856 : 11/11/2010 12:05 AM : b0cb1d2d5ffa6335dd94b1b531756412 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\comctl32.dll : 633,856 : 11/20/2010 08:25 AM : 14dfdeaf4e589ed3f1ff187a86b9408c [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_fa645303170382f6\comctl32.dll : 2,030,080 : 07/13/2009 08:24 PM : c093e7835c1372d6d70a6675edaa97b5 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7\comctl32.dll : 2,030,080 : 11/11/2010 12:05 AM : 113921fc4a80a3ddf646852998b836d0 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.20787_none_e3967e4730ab1731\comctl32.dll : 2,030,080 : 11/11/2010 12:05 AM : 882c1c473be598df08730da11c5b2b27 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll : 2,030,080 : 11/20/2010 07:51 AM : 7fa8fdc2c2a27817fd0f624e78d3b50c [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-shell-comctl32-v5_31bf3856ad364e35_6.1.7600.16385_none_39727524394b18eb\comctl32.dll : 530,432 : 07/13/2009 08:15 PM : b62aa1bb1f63839051441d2c6dd7b775 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-shell-comctl32-v5_31bf3856ad364e35_6.1.7600.16661_none_39841986393e7322\comctl32.dll : 530,432 : 11/11/2010 12:05 AM : d3ead1cf16ba729a7f7c9a5d94aa7c05 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-shell-comctl32-v5_31bf3856ad364e35_6.1.7600.20787_none_39fe18355266e2d8\comctl32.dll : 530,432 : 11/11/2010 12:05 AM : bf5d71b4a40687a90c8b47f776758a6f [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-shell-comctl32-v5_31bf3856ad364e35_6.1.7601.17514_none_3ba388ec36399c85\comctl32.dll : 530,432 : 11/20/2010 07:18 AM : bdac1aa64495d0f7e1ff810ebbf1f018 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7600.16385_none_ebf82fc36c758ad5\comctl32.dll : 530,432 : 07/13/2009 08:15 PM : b62aa1bb1f63839051441d2c6dd7b775 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7600.16661_none_ebfb56996c72aefc\comctl32.dll : 530,432 : 11/11/2010 12:05 AM : d3ead1cf16ba729a7f7c9a5d94aa7c05 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7600.20787_none_ede2ad2969983532\comctl32.dll : 530,432 : 11/11/2010 12:05 AM : bf5d71b4a40687a90c8b47f776758a6f [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll : 530,432 : 11/20/2010 07:18 AM : bdac1aa64495d0f7e1ff810ebbf1f018 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll : 1,680,896 : 07/13/2009 08:03 PM : 0fa436a553408cbeba070e3182658de3 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll : 1,680,896 : 11/11/2010 12:05 AM : 4b8dd8541c0e26602005dd0137333615 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.20787_none_2b43b51e45274037\comctl32.dll : 1,680,896 : 11/11/2010 12:05 AM : 70ef5dfef7069164eacf7140c2cc6344 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll : 1,680,896 : 11/20/2010 06:55 AM : 352b3dc62a0d259a82a052238425c872 [Pos Repl]
 
 * C:\Windows\System32\comres.dll : 1,297,408 : 07/13/2009 08:26 PM : 1a47d52e303b7543e4e6026595b95422 [NoSig]
 +-> C:\Windows\SysWOW64\comres.dll : 1,297,408 : 07/13/2009 08:04 PM : 808d8a8b2a3074002852bc856d419576 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-com-complus.res_31bf3856ad364e35_6.1.7600.16385_none_88a5cc7effe2dfca\comres.dll : 1,297,408 : 07/13/2009 08:26 PM : 1a47d52e303b7543e4e6026595b95422 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-com-complus.res_31bf3856ad364e35_6.1.7600.16385_none_2c8730fb47856e94\comres.dll : 1,297,408 : 07/13/2009 08:04 PM : 808d8a8b2a3074002852bc856d419576 [Pos Repl]
 
 * C:\Windows\System32\conhost.exe : 338,432 : 11/29/2012 10:23 PM : 1bcdb508143b517f21bbdac10f5777bf [NoSig]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7600.16385_none_d050b8f81bcacc5a\conhost.exe : 338,432 : 07/13/2009 08:39 PM : f64e8258351e501aa065ac499530367c [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7600.17135_none_d086ae001ba25ff8\conhost.exe : 338,432 : 10/04/2012 10:19 AM : a19acd209bc143f8a9cfbcefa3c564f5 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7600.17179_none_d05f6f781bbf3518\conhost.exe : 338,432 : 11/29/2012 10:33 PM : c6fef8c40d6f9a3766fdbe31cb3f6640 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7600.17206_none_d0a81ff41b8922a3\conhost.exe : 338,432 : 01/03/2013 10:19 PM : 7eb88f63d424832b774e24458dce2049 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7600.21335_none_d1104cb134bffce9\conhost.exe : 338,432 : 10/04/2012 10:19 AM : 92c2c613e1f5923ce592d095b6d03b3e [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7600.21386_none_d0db3d5f34e7a1f5\conhost.exe : 338,432 : 11/29/2012 10:29 PM : c2cb0c2503732c0c7254f20bf1ed1e1d [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7600.21416_none_d126eeb934aedb85\conhost.exe : 338,432 : 01/04/2013 07:03 AM : 7924ffce41f37b8f3560bcd2b1319cc5 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7601.17514_none_d281ccc018b94ff4\conhost.exe : 337,920 : 11/20/2010 08:24 AM : bd51024fb014064bc9fe8c715c18392f [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7601.17965_none_d24cc50618e0e99c\conhost.exe : 338,432 : 10/04/2012 10:21 AM : 3326166011c9bc13d6a8efd856e9921c [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7601.18015_none_d282acc418b89129\conhost.exe : 338,432 : 11/29/2012 10:23 PM : 1bcdb508143b517f21bbdac10f5777bf [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7601.22125_none_d30179a331de4ce4\conhost.exe : 338,432 : 10/04/2012 10:18 AM : d1f53bedd4c2288af00142f74928ee0e [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7601.22177_none_d2cd6a9b32050b47\conhost.exe : 338,432 : 11/30/2012 00:49 AM : b19b30e594ee374c69f71dad26198400 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7601.22209_none_d31b1c8931ca7785\conhost.exe : 338,432 : 01/03/2013 10:17 PM : a31ed9834a85e049585f95413a30c755 [Pos Repl]
 
 * C:\Windows\System32\cryptsvc.dll : 184,320 : 05/13/2013 00:51 AM : d8129c49798cbbfb2e4351d4b7b8ef9c [NoSig]
 +-> C:\Windows\SysWOW64\cryptsvc.dll : 140,288 : 05/12/2013 11:45 PM : 3897dff247d9ed0006190349de264e14 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7600.16385_none_d1f48b0bb4805490\cryptsvc.dll : 175,104 : 07/13/2009 08:40 PM : 8c57411b66282c01533cb776f98ad384 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7600.17035_none_d22a7e2db457eb07\cryptsvc.dll : 182,272 : 06/02/2012 00:25 AM : baf19b633933a9fb4883d27d66c39e9a [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7600.21225_none_d2beeccacd6d6c07\cryptsvc.dll : 183,808 : 06/02/2012 00:32 AM : 456107d69d4ee850a559434f19efee65 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.17514_none_d4259ed3b16ed82a\cryptsvc.dll : 177,152 : 11/20/2010 08:25 AM : 15597883fbe9b056f276ada3ad87d9af [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.17856_none_d3fc6569b18d7211\cryptsvc.dll : 184,320 : 06/02/2012 00:41 AM : 9c01375be382e834cc26d1b7eaf2c4fe [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.18150_none_d3f63f9bb1930797\cryptsvc.dll : 184,320 : 05/10/2013 00:49 AM : 7fdc4626b01106a8ef328c88c7c0dee3 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.18151_none_d3f73fe5b19220ee\cryptsvc.dll : 184,320 : 05/13/2013 00:51 AM : d8129c49798cbbfb2e4351d4b7b8ef9c [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.22010_none_d4ab184aca903d4f\cryptsvc.dll : 186,880 : 06/04/2012 02:52 AM : 7e7d2dacf65d750d466f36bd3d09ae20 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.22321_none_d4a14e5aca976a0c\cryptsvc.dll : 186,880 : 05/10/2013 00:18 AM : ca13c4f92bee66db48e58ab3223ddf6e [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.22322_none_d4a24ea4ca968363\cryptsvc.dll : 186,880 : 05/11/2013 00:18 AM : 8122252f0a4acfa92fa0c1d50d18493b [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7600.16385_none_75d5ef87fc22e35a\cryptsvc.dll : 135,680 : 07/13/2009 08:15 PM : 9c231178ce4fb385f4b54b0a9080b8a4 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7600.17035_none_760be2a9fbfa79d1\cryptsvc.dll : 139,264 : 06/01/2012 11:45 PM : f2fde6c8dbaad44cc58d1e07e4af4eed [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7600.21225_none_76a05147150ffad1\cryptsvc.dll : 141,312 : 06/01/2012 11:41 PM : ea8c26ecf1656d9647ef044f115ec6da [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.17514_none_7807034ff91166f4\cryptsvc.dll : 136,192 : 11/20/2010 07:18 AM : a585bebf7d054bd9618eda0922d5484a [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.17856_none_77ddc9e5f93000db\cryptsvc.dll : 140,288 : 06/01/2012 11:36 PM : 96c0e38905cfd788313be8e11dae3f2f [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.18150_none_77d7a417f9359661\cryptsvc.dll : 140,288 : 05/09/2013 11:49 PM : 33adf6e0853ab39ea1723be82842c1d3 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.18151_none_77d8a461f934afb8\cryptsvc.dll : 140,288 : 05/12/2013 11:45 PM : 3897dff247d9ed0006190349de264e14 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.22010_none_788c7cc71232cc19\cryptsvc.dll : 142,336 : 06/01/2012 11:52 PM : 063dd65889d21035311463337bd268e7 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.22321_none_7882b2d71239f8d6\cryptsvc.dll : 142,848 : 05/10/2013 00:06 AM : e122aa1c9a3cc46ff9ddde46e5eb0c58 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-cryptsvc-dll_31bf3856ad364e35_6.1.7601.22322_none_7883b3211239122d\cryptsvc.dll : 142,848 : 05/10/2013 11:59 PM : ac04d05309bb2c418d0d80b9fb014642 [Pos Repl]
 
 * C:\Windows\System32\csrss.exe : 7,680 : 07/13/2009 08:39 PM : 60c2862b4bf0fd9f582ef344c2b1ec72 [NoSig]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-csrss_31bf3856ad364e35_6.1.7600.16385_none_b4d8d57efdc6b4f3\csrss.exe : 7,680 : 07/13/2009 08:39 PM : 60c2862b4bf0fd9f582ef344c2b1ec72 [Pos Repl]
 
 * C:\Windows\System32\ctfmon.exe : 9,728 : 07/13/2009 08:39 PM : 42b6a94dd747df2b5f628a2752e62a98 [NoSig]
 +-> C:\Windows\SysWOW64\ctfmon.exe : 8,704 : 07/13/2009 08:14 PM : 4a3cdcef8ed41b221f3dbef5792fb52d [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_6.1.7600.16385_none_f9257e7aaa4290ce\ctfmon.exe : 9,728 : 07/13/2009 08:39 PM : 42b6a94dd747df2b5f628a2752e62a98 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_6.1.7600.16385_none_9d06e2f6f1e51f98\ctfmon.exe : 8,704 : 07/13/2009 08:14 PM : 4a3cdcef8ed41b221f3dbef5792fb52d [Pos Repl]
 
 * C:\Windows\System32\d3d8thk.dll : 12,288 : 07/13/2009 08:40 PM : 3044d07abdf4bbea27e2ee7b1e0c0c65 [NoSig]
 +-> C:\Windows\SysWOW64\d3d8thk.dll : 11,264 : 07/13/2009 08:15 PM : 77b1471a490b53b24efe136f09f76550 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-directx-direct3d9_31bf3856ad364e35_6.1.7600.16385_none_1e425e4c7a773ca0\d3d8thk.dll : 12,288 : 07/13/2009 08:40 PM : 3044d07abdf4bbea27e2ee7b1e0c0c65 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-directx-direct3d9_31bf3856ad364e35_6.1.7601.17514_none_207372147765c03a\d3d8thk.dll : 12,288 : 07/13/2009 08:40 PM : 3044d07abdf4bbea27e2ee7b1e0c0c65 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-directx-direct3d9_31bf3856ad364e35_6.1.7600.16385_none_c223c2c8c219cb6a\d3d8thk.dll : 11,264 : 07/13/2009 08:15 PM : 77b1471a490b53b24efe136f09f76550 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-directx-direct3d9_31bf3856ad364e35_6.1.7601.17514_none_c454d690bf084f04\d3d8thk.dll : 11,264 : 07/13/2009 08:15 PM : 77b1471a490b53b24efe136f09f76550 [Pos Repl]
 
 * C:\Windows\System32\d3d9.dll : 2,067,456 : 11/20/2010 08:26 AM : 4c3daee652b005b483f16b8e9131c99d [NoSig]
 +-> C:\Windows\SysWOW64\d3d9.dll : 1,828,352 : 11/20/2010 07:18 AM : 6ef5f3f18413c367195f06e503ab86a6 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-directx-direct3d9_31bf3856ad364e35_6.1.7600.16385_none_1e425e4c7a773ca0\d3d9.dll : 2,065,920 : 07/13/2009 08:40 PM : 318285f1590c4484e3253ba2b189d2df [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-directx-direct3d9_31bf3856ad364e35_6.1.7601.17514_none_207372147765c03a\d3d9.dll : 2,067,456 : 11/20/2010 08:26 AM : 4c3daee652b005b483f16b8e9131c99d [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-directx-direct3d9_31bf3856ad364e35_6.1.7600.16385_none_c223c2c8c219cb6a\d3d9.dll : 1,826,816 : 07/13/2009 08:15 PM : 7459301d21c2e21468823f73042d9f87 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-directx-direct3d9_31bf3856ad364e35_6.1.7601.17514_none_c454d690bf084f04\d3d9.dll : 1,828,352 : 11/20/2010 07:18 AM : 6ef5f3f18413c367195f06e503ab86a6 [Pos Repl]
 
 * C:\Windows\System32\ddraw.dll : 569,344 : 07/13/2009 08:40 PM : a6c09924c6730de8deed9890a12aa691 [NoSig]
 +-> C:\Windows\SysWOW64\ddraw.dll : 531,968 : 07/13/2009 08:15 PM : 198552aefeca69d646867ec8d792de95 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-directx-directdraw_31bf3856ad364e35_6.1.7600.16385_none_60fa9493d9b24564\ddraw.dll : 569,344 : 07/13/2009 08:40 PM : a6c09924c6730de8deed9890a12aa691 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-directx-directdraw_31bf3856ad364e35_6.1.7600.16385_none_04dbf9102154d42e\ddraw.dll : 531,968 : 07/13/2009 08:15 PM : 198552aefeca69d646867ec8d792de95 [Pos Repl]
 
 * C:\Windows\System32\dllhost.exe : 9,728 : 07/13/2009 08:39 PM : a8edb86fc2a4d6d1285e4c70384ac35a [NoSig]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-com-surrogate_31bf3856ad364e35_6.1.7600.16385_none_a018e05d0d33081d\dllhost.exe : 9,728 : 07/13/2009 08:39 PM : a8edb86fc2a4d6d1285e4c70384ac35a [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-com-surrogate_31bf3856ad364e35_6.1.7600.16385_none_43fa44d954d596e7\dllhost.exe : 113,664 : 07/16/2013 09:47 PM : ecae7ada958998abab92e522edfe0291 [Pos Repl]
 
 * C:\Windows\System32\dsound.dll : 540,672 : 07/13/2009 08:40 PM : 9110ffad124283f37d38771bb60556af [NoSig]
 +-> C:\Windows\SysWOW64\dsound.dll : 453,632 : 07/13/2009 08:15 PM : 0e85c11f8850d524b02181c6e02ba9ae [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-audio-dsound_31bf3856ad364e35_6.1.7600.16385_none_b490afff5b93e5a7\dsound.dll : 540,672 : 07/13/2009 08:40 PM : 9110ffad124283f37d38771bb60556af [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-audio-dsound_31bf3856ad364e35_6.1.7600.16385_none_5872147ba3367471\dsound.dll : 453,632 : 07/13/2009 08:15 PM : 0e85c11f8850d524b02181c6e02ba9ae [Pos Repl]
 
 * C:\Windows\System32\dwm.exe : 120,320 : 07/13/2009 08:39 PM : f162d5f5e845b9dc352dd1bad8cef1bc [NoSig]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-d..pwindowmanager-core_31bf3856ad364e35_6.1.7600.16385_none_e99885bbd6e301de\dwm.exe : 120,320 : 07/13/2009 08:39 PM : f162d5f5e845b9dc352dd1bad8cef1bc [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-d..pwindowmanager-core_31bf3856ad364e35_6.1.7601.17514_none_ebc99983d3d18578\dwm.exe : 120,320 : 07/13/2009 08:39 PM : f162d5f5e845b9dc352dd1bad8cef1bc [Pos Repl]
 
 * C:\Windows\System32\es.dll : 402,944 : 07/13/2009 08:40 PM : 4166f82be4d24938977dd1746be9b8a0 [NoSig]
 +-> C:\Windows\SysWOW64\es.dll : 271,360 : 07/13/2009 08:15 PM : f6916efc29d9953d5d0df06882ae8e16 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-c..complus-eventsystem_31bf3856ad364e35_6.1.7600.16385_none_68e290c46b6ea6d0\es.dll : 402,944 : 07/13/2009 08:40 PM : 4166f82be4d24938977dd1746be9b8a0 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-c..complus-eventsystem_31bf3856ad364e35_6.1.7600.16385_none_73373b169fcf68cb\es.dll : 271,360 : 07/13/2009 08:15 PM : f6916efc29d9953d5d0df06882ae8e16 [Pos Repl]
 
 * C:\Windows\System32\hid.dll : 30,208 : 07/13/2009 08:41 PM : 896f15a6434d93edb42519d5e18e6b50 [NoSig]
 +-> C:\Windows\SysWOW64\hid.dll : 22,016 : 07/13/2009 08:15 PM : 63df770df74acb370ef5a16727069aaf [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-hid-user_31bf3856ad364e35_6.1.7600.16385_none_32a13a14a11faede\hid.dll : 30,208 : 07/13/2009 08:41 PM : 896f15a6434d93edb42519d5e18e6b50 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-hid-user_31bf3856ad364e35_6.1.7600.16385_none_3cf5e466d58070d9\hid.dll : 22,016 : 07/13/2009 08:15 PM : 63df770df74acb370ef5a16727069aaf [Pos Repl]
 
 * C:\Windows\System32\hnetcfg.dll : 424,448 : 07/13/2009 08:41 PM : 3b367397320c26dba890b260f80d1b1b [NoSig]
 +-> C:\Windows\SysWOW64\hnetcfg.dll : 288,256 : 07/13/2009 08:15 PM : 6383c60ec0133b14f5705f96369421b2 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-i..ectionsharingconfig_31bf3856ad364e35_6.1.7600.16385_none_0c2b375bae4a8d38\hnetcfg.dll : 424,448 : 07/13/2009 08:41 PM : 3b367397320c26dba890b260f80d1b1b [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-i..ectionsharingconfig_31bf3856ad364e35_6.1.7600.16385_none_167fe1ade2ab4f33\hnetcfg.dll : 288,256 : 07/13/2009 08:15 PM : 6383c60ec0133b14f5705f96369421b2 [Pos Repl]
 
 * C:\Windows\System32\ias.dll : 26,624 : 07/13/2009 08:41 PM : 39415b10172c431f5ab87488d79e9dc4 [NoSig]
 +-> C:\Windows\SysWOW64\ias.dll : 19,456 : 07/13/2009 08:15 PM : a1e91b5b5273573fc132b683e550b5e6 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-n..ion_service_runtime_31bf3856ad364e35_6.1.7600.16385_none_54f5cc4b5c3749bf\ias.dll : 26,624 : 07/13/2009 08:41 PM : 39415b10172c431f5ab87488d79e9dc4 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-n..ion_service_runtime_31bf3856ad364e35_6.1.7601.17514_none_5726e0135925cd59\ias.dll : 26,624 : 07/13/2009 08:41 PM : 39415b10172c431f5ab87488d79e9dc4 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-n..ion_service_runtime_31bf3856ad364e35_6.1.7600.16385_none_f8d730c7a3d9d889\ias.dll : 19,456 : 07/13/2009 08:15 PM : a1e91b5b5273573fc132b683e550b5e6 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-n..ion_service_runtime_31bf3856ad364e35_6.1.7601.17514_none_fb08448fa0c85c23\ias.dll : 19,456 : 07/13/2009 08:15 PM : a1e91b5b5273573fc132b683e550b5e6 [Pos Repl]
 
 * C:\Windows\System32\imm32.dll : 167,424 : 07/13/2009 08:41 PM : aa2c08ce85653b1a0d2e4ab407fa176c [NoSig]
 +-> C:\Windows\SysWOW64\imm32.dll : 119,808 : 11/20/2010 07:08 AM : a6f09e5669d9a19035f6d942caa15882 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-imm32_31bf3856ad364e35_6.1.7600.16385_none_b84b0fbd941c03a9\imm32.dll : 167,424 : 07/13/2009 08:41 PM : aa2c08ce85653b1a0d2e4ab407fa176c [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-imm32_31bf3856ad364e35_6.1.7600.16385_none_c29fba0fc87cc5a4\imm32.dll : 119,808 : 07/13/2009 08:11 PM : 0de3069d6e09ba262856ef31c941befe [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-imm32_31bf3856ad364e35_6.1.7601.17514_none_c4d0cdd7c56b493e\imm32.dll : 119,808 : 11/20/2010 07:08 AM : a6f09e5669d9a19035f6d942caa15882 [Pos Repl]
 
 * C:\Windows\System32\ipsecsvc.dll : 501,248 : 11/20/2010 08:26 AM : 4f15d75adf6156bf56eced6d4a55c389 [NoSig]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-n..-domain-clients-svc_31bf3856ad364e35_6.1.7600.16385_none_a003697905b64513\IPSECSVC.DLL : 500,224 : 07/13/2009 08:41 PM : 166eb40d1f5b47e615de3d0fffe5f243 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-n..-domain-clients-svc_31bf3856ad364e35_6.1.7601.17514_none_a2347d4102a4c8ad\IPSECSVC.DLL : 501,248 : 11/20/2010 08:26 AM : 4f15d75adf6156bf56eced6d4a55c389 [Pos Repl]
 
 * C:\Windows\System32\kernel32.dll : 1,161,216 : 11/30/2012 00:41 AM : 65c113214f7b05820f6d8a65b1485196 [NoSig]
 +-> C:\Windows\SysWOW64\kernel32.dll : 1,114,112 : 11/29/2012 11:53 PM : ac0b6f41882fc6ed186962d770ebf1d2 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7600.16385_none_efb2d6e86ffc8f55\kernel32.dll : 1,162,240 : 07/13/2009 08:41 PM : 5b4b379ad10deda4eda01b8c6961b193 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7600.17135_none_efe8cbf06fd422f3\kernel32.dll : 1,161,216 : 10/04/2012 12:32 AM : 1ddcacab8da5399e5521051923016b18 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7600.17179_none_efc18d686ff0f813\kernel32.dll : 1,161,216 : 11/30/2012 00:43 AM : e3bc37881d92eb59ee0ba3b854a54d1e [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7600.17206_none_f00a3de46fbae59e\kernel32.dll : 1,161,216 : 01/04/2013 00:30 AM : 43db3433f141f01e53d1c5aa0f434098 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7600.21335_none_f0726aa188f1bfe4\kernel32.dll : 1,162,752 : 10/04/2012 12:29 AM : 6eed0d77c20137948979ea47360a890b [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7600.21386_none_f03d5b4f891964f0\kernel32.dll : 1,162,752 : 11/30/2012 00:38 AM : b6b1ab98ba656ba1d8e0ca03f59ded51 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7600.21416_none_f0890ca988e09e80\kernel32.dll : 1,162,752 : 01/04/2013 09:14 AM : 9dd828efbd17246275e8a74d58e836ac [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7601.17514_none_f1e3eab06ceb12ef\kernel32.dll : 1,161,216 : 11/20/2010 08:26 AM : 7a6326d96d53048fdec542df23d875a0 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7601.17965_none_f1aee2f66d12ac97\kernel32.dll : 1,161,216 : 10/04/2012 12:41 AM : 1dc3504ca4c57900f1557e9a3f01d272 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7601.18015_none_f1e4cab46cea5424\kernel32.dll : 1,161,216 : 11/30/2012 00:41 AM : 65c113214f7b05820f6d8a65b1485196 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7601.22125_none_f263979386100fdf\kernel32.dll : 1,162,240 : 10/04/2012 12:37 AM : f3c594d0da3acfa6c7b781a490ab4282 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7601.22177_none_f22f888b8636ce42\kernel32.dll : 1,163,264 : 11/30/2012 00:52 AM : b3bea6420d482356e53b7c728e05c637 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7601.22209_none_f27d3a7985fc3a80\kernel32.dll : 1,162,240 : 01/04/2013 00:36 AM : b844114b247d8ef1e5e4e93a282d2e6f [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7600.16385_none_fa07813aa45d5150\kernel32.dll : 836,608 : 07/13/2009 08:11 PM : 606ecb76a424cc535407e7a24e2a34bc [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7600.17135_none_fa3d7642a434e4ee\kernel32.dll : 1,114,112 : 10/04/2012 11:54 AM : a6778fc49011313995a4d718f624cc74 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7600.17179_none_fa1637baa451ba0e\kernel32.dll : 1,114,112 : 11/30/2012 00:06 AM : c95793f4be3471aeed92f5bf367be69e [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7600.17206_none_fa5ee836a41ba799\kernel32.dll : 1,114,112 : 01/03/2013 11:51 PM : 385be92e3106491bbb542f8f1c06c606 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7600.21335_none_fac714f3bd5281df\kernel32.dll : 1,114,112 : 10/04/2012 11:56 AM : de7a37cb1f48526a78a2d42786411578 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7600.21386_none_fa9205a1bd7a26eb\kernel32.dll : 1,114,112 : 11/29/2012 11:51 PM : e747adb6223dbbe1bb138f08a09adad6 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7600.21416_none_faddb6fbbd41607b\kernel32.dll : 1,114,112 : 01/03/2013 11:51 PM : f9f6cd9ef1f6c896a56b5259b81027d9 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7601.17514_none_fc389502a14bd4ea\kernel32.dll : 837,632 : 11/20/2010 07:08 AM : e80758cf485db142fca1ee03a34ead05 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7601.17965_none_fc038d48a1736e92\kernel32.dll : 1,114,112 : 10/04/2012 11:47 AM : d4f3176082566cefa633b4945802d4c4 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7601.18015_none_fc397506a14b161f\kernel32.dll : 1,114,112 : 11/29/2012 11:53 PM : ac0b6f41882fc6ed186962d770ebf1d2 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7601.22125_none_fcb841e5ba70d1da\kernel32.dll : 1,114,112 : 10/04/2012 11:36 AM : 5fa395364ee727e4bee6b1406c207f98 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7601.22177_none_fc8432ddba97903d\kernel32.dll : 1,114,112 : 11/29/2012 11:57 PM : 9cc2571e3646b9a24296ad7adcc71682 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7601.22209_none_fcd1e4cbba5cfc7b\kernel32.dll : 1,114,112 : 01/03/2013 11:52 PM : 7e55988f5cb3ba67e2732370e8d71bbb [Pos Repl]
 
 * C:\Windows\System32\ksuser.dll : 5,120 : 07/13/2009 08:41 PM : 8560fffc8eb3a806dcd4f82252cfc8c6 [NoSig]
 +-> C:\Windows\SysWOW64\ksuser.dll : 4,608 : 07/13/2009 08:15 PM : 9c67f6bbda3881cfd02095160cf91576 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-d..tshow-kernelsupport_31bf3856ad364e35_6.1.7600.16385_none_43f68e03b0fd4b38\ksuser.dll : 5,120 : 07/13/2009 08:41 PM : 8560fffc8eb3a806dcd4f82252cfc8c6 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-d..tshow-kernelsupport_31bf3856ad364e35_6.1.7601.17514_none_4627a1cbadebced2\ksuser.dll : 5,120 : 07/13/2009 08:41 PM : 8560fffc8eb3a806dcd4f82252cfc8c6 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-d..tshow-kernelsupport_31bf3856ad364e35_6.1.7600.16385_none_e7d7f27ff89fda02\ksuser.dll : 4,608 : 07/13/2009 08:15 PM : 9c67f6bbda3881cfd02095160cf91576 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-d..tshow-kernelsupport_31bf3856ad364e35_6.1.7601.17514_none_ea090647f58e5d9c\ksuser.dll : 4,608 : 07/13/2009 08:15 PM : 9c67f6bbda3881cfd02095160cf91576 [Pos Repl]
 
 * C:\Windows\System32\linkinfo.dll : 29,696 : 07/13/2009 08:41 PM : a0a65d306a5490d2eb8e7de66898ecfd [NoSig]
 +-> C:\Windows\SysWOW64\linkinfo.dll : 22,016 : 07/13/2009 08:15 PM : 5987ea8a82c53359bcd2c29d6588583e [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-linkinfo_31bf3856ad364e35_6.1.7600.16385_none_945a23c3bf051859\linkinfo.dll : 29,696 : 07/13/2009 08:41 PM : a0a65d306a5490d2eb8e7de66898ecfd [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-linkinfo_31bf3856ad364e35_6.1.7600.16385_none_9eaece15f365da54\linkinfo.dll : 22,016 : 07/13/2009 08:15 PM : 5987ea8a82c53359bcd2c29d6588583e [Pos Repl]
 
 * C:\Windows\System32\lpk.dll : 41,984 : 07/13/2009 08:41 PM : d202223587518b13d72d68937b7e3f70 [NoSig]
 +-> C:\Windows\SysWOW64\lpk.dll : 25,600 : 07/13/2009 08:11 PM : 384721ef4024890092625e20cadfaf85 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7600.16385_none_05c80a1f743763f3\lpk.dll : 41,984 : 07/13/2009 08:41 PM : d202223587518b13d72d68937b7e3f70 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7600.16402_none_061b8a8773f9358d\lpk.dll : 41,984 : 07/13/2009 08:41 PM : d202223587518b13d72d68937b7e3f70 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7600.16444_none_05f24b6b7417d7ff\lpk.dll : 41,984 : 07/13/2009 08:41 PM : d202223587518b13d72d68937b7e3f70 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7600.16600_none_06198dbf73fafd2d\lpk.dll : 41,984 : 07/13/2009 08:41 PM : d202223587518b13d72d68937b7e3f70 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7600.17194_none_05bc1f55744085e0\lpk.dll : 41,984 : 07/13/2009 08:41 PM : d202223587518b13d72d68937b7e3f70 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7600.20498_none_0649d7dc8d5a6bb3\lpk.dll : 41,984 : 07/13/2009 08:41 PM : d202223587518b13d72d68937b7e3f70 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7600.20553_none_067018008d3e7a63\lpk.dll : 41,984 : 07/13/2009 08:41 PM : d202223587518b13d72d68937b7e3f70 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7600.20720_none_068d8ab28d28d4d9\lpk.dll : 41,984 : 07/13/2009 08:41 PM : d202223587518b13d72d68937b7e3f70 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7600.21402_none_06a50ea48d16f1d1\lpk.dll : 41,472 : 12/16/2012 12:19 AM : 838bf2634a38b344b27ac080d76b28c2 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7601.17514_none_07f91de77125e78d\lpk.dll : 41,984 : 07/13/2009 08:41 PM : d202223587518b13d72d68937b7e3f70 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7601.18032_none_07e15d357138149f\lpk.dll : 41,984 : 07/13/2009 08:41 PM : d202223587518b13d72d68937b7e3f70 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7601.22195_none_082d1b568a83a814\lpk.dll : 41,984 : 07/13/2009 08:41 PM : d202223587518b13d72d68937b7e3f70 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7600.16385_none_101cb471a89825ee\lpk.dll : 25,600 : 07/13/2009 08:11 PM : 384721ef4024890092625e20cadfaf85 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7600.16402_none_107034d9a859f788\lpk.dll : 25,600 : 07/13/2009 08:11 PM : 384721ef4024890092625e20cadfaf85 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7600.16444_none_1046f5bda87899fa\lpk.dll : 25,600 : 07/13/2009 08:11 PM : 384721ef4024890092625e20cadfaf85 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7600.16600_none_106e3811a85bbf28\lpk.dll : 25,600 : 07/13/2009 08:11 PM : 384721ef4024890092625e20cadfaf85 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7600.17194_none_1010c9a7a8a147db\lpk.dll : 25,600 : 07/13/2009 08:11 PM : 384721ef4024890092625e20cadfaf85 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7600.20498_none_109e822ec1bb2dae\lpk.dll : 25,600 : 07/13/2009 08:11 PM : 384721ef4024890092625e20cadfaf85 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7600.20553_none_10c4c252c19f3c5e\lpk.dll : 25,600 : 07/13/2009 08:11 PM : 384721ef4024890092625e20cadfaf85 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7600.20720_none_10e23504c18996d4\lpk.dll : 25,600 : 07/13/2009 08:11 PM : 384721ef4024890092625e20cadfaf85 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7600.21402_none_10f9b8f6c177b3cc\lpk.dll : 25,600 : 12/16/2012 11:34 AM : bf6cda72e4112dac01e2ed8911c3fd74 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7601.17514_none_124dc839a586a988\lpk.dll : 25,600 : 07/13/2009 08:11 PM : 384721ef4024890092625e20cadfaf85 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7601.18032_none_12360787a598d69a\lpk.dll : 25,600 : 07/13/2009 08:11 PM : 384721ef4024890092625e20cadfaf85 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-gdi_31bf3856ad364e35_6.1.7601.22195_none_1281c5a8bee46a0f\lpk.dll : 25,600 : 07/13/2009 08:11 PM : 384721ef4024890092625e20cadfaf85 [Pos Repl]
 
 * C:\Windows\System32\lsass.exe : 31,232 : 11/17/2011 01:33 AM : c118a82cd78818c29ab228366ebf81c3 [NoSig]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7600.16385_none_023f7c69767c3edd\lsass.exe : 31,232 : 07/13/2009 08:39 PM : 0793f40b9b8a1bdd266296409dbd91ea [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7600.16484_none_023e7e05767d22ad\lsass.exe : 31,232 : 07/13/2009 08:39 PM : 0793f40b9b8a1bdd266296409dbd91ea [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7600.16915_none_028b374176436a30\lsass.exe : 31,232 : 11/17/2011 02:05 AM : 156f6159457d0aa7e59b62681b56eb90 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7600.17035_none_02756f8b7653d554\lsass.exe : 31,232 : 11/17/2011 02:05 AM : 156f6159457d0aa7e59b62681b56eb90 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7600.20594_none_02bd4ae48fa2de68\lsass.exe : 31,232 : 07/13/2009 08:39 PM : 0793f40b9b8a1bdd266296409dbd91ea [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7600.21092_none_02bb2a0a8fa4d398\lsass.exe : 31,232 : 11/17/2011 01:42 AM : d21bd47e528cd62e79311fb5df0150e6 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7600.21225_none_0309de288f695654\lsass.exe : 31,232 : 06/02/2012 00:30 AM : bf63ce11a25f3509129888710d5111fc [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7601.17514_none_04709031736ac277\lsass.exe : 31,232 : 07/13/2009 08:39 PM : 0793f40b9b8a1bdd266296409dbd91ea [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7601.17725_none_0466c45b7371f20d\lsass.exe : 31,232 : 11/17/2011 01:33 AM : c118a82cd78818c29ab228366ebf81c3 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7601.17856_none_044756c773895c5e\lsass.exe : 31,232 : 11/17/2011 01:33 AM : c118a82cd78818c29ab228366ebf81c3 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7601.21861_none_04c1204e8cb39c3f\lsass.exe : 31,232 : 11/17/2011 01:20 AM : 0a10b74fbb437ff9a23f1d5de4446a83 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7601.22010_none_04f609a88c8c279c\lsass.exe : 31,232 : 06/04/2012 02:51 AM : 79c908caa6f43021eb05f4c733a927d1 [Pos Repl]
 
 * C:\Windows\System32\lsm.exe : 343,040 : 11/20/2010 08:24 AM : 9662ee182644511439f1c53745dc1c88 [NoSig]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-t..localsessionmanager_31bf3856ad364e35_6.1.7600.16385_none_0139be68243bb634\lsm.exe : 333,312 : 07/13/2009 08:39 PM : 04fca22b77a2e37332cc8226187af87b [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-t..localsessionmanager_31bf3856ad364e35_6.1.7601.17514_none_036ad230212a39ce\lsm.exe : 343,040 : 11/20/2010 08:24 AM : 9662ee182644511439f1c53745dc1c88 [Pos Repl]
 
 * C:\Windows\System32\midimap.dll : 20,480 : 07/13/2009 08:41 PM : ca2a0750ed830678997695ff61b04c30 [NoSig]
 +-> C:\Windows\SysWOW64\midimap.dll : 16,896 : 07/13/2009 08:15 PM : 5a12c364ad1d4fcc0ad0e56dbbc34462 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-audio-mmecore-other_31bf3856ad364e35_6.1.7600.16385_none_e8f2b9ab2a40e84d\midimap.dll : 20,480 : 07/13/2009 08:41 PM : ca2a0750ed830678997695ff61b04c30 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-audio-mmecore-other_31bf3856ad364e35_6.1.7600.16385_none_8cd41e2771e37717\midimap.dll : 16,896 : 07/13/2009 08:15 PM : 5a12c364ad1d4fcc0ad0e56dbbc34462 [Pos Repl]
 
 * C:\Windows\System32\mshtml.dll : 19,238,912 : 06/11/2013 06:25 PM : 9586ec4e1cc39ccba26a5e7dfe774c9e [NoSig]
 +-> C:\Windows\SysWOW64\mshtml.dll : 14,329,856 : 06/11/2013 06:43 PM : af31e7d2c385f647adfd5f5736b3ba64 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16576_none_91213bba929917b7\mshtml.dll : 19,231,232 : 05/18/2013 03:13 AM : c56ef4c50a1feed0cc9b7ae068cbbbbb [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16614_none_911097a292a6685c\mshtml.dll : 19,233,792 : 05/16/2013 07:58 PM : 945c49fa10b96570dfe37cfb145a1d10 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16618_none_91103c8292a6cee0\mshtml.dll : 19,233,792 : 06/08/2013 09:07 AM : 5c41af3f4b83340d2783ce8fde30566a [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16635_none_9112816e92a4b4ab\mshtml.dll : 19,238,912 : 06/11/2013 06:25 PM : 9586ec4e1cc39ccba26a5e7dfe774c9e [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.20719_none_7a37af32ac566427\mshtml.dll : 19,480,576 : 05/16/2013 08:34 PM : dbb793d8b7ed6747f121d5831e749b6a [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.20723_none_7a39382cac54e3b8\mshtml.dll : 19,479,552 : 06/08/2013 07:23 AM : d8fea3117bea18064da7f0668fa94f38 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.20742_none_7a3b4f88ac52fcc5\mshtml.dll : 19,482,112 : 06/12/2013 00:10 AM : 884691f819503dd2191a2641cc827a52 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7600.16385_none_89f24b7ab2dc7a40\mshtml.dll : 9,271,296 : 07/13/2009 08:41 PM : 12c3f25ea578daa752024e1918d59313 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7600.16625_none_8a3330b4b2abca0f\mshtml.dll : 9,298,432 : 11/11/2010 11:59 AM : 74da18bb61fe98fc002866f032329265 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7600.16671_none_89f91ff0b2d7f068\mshtml.dll : 9,296,384 : 11/11/2010 12:06 AM : ba91ef2891b44e03fa71a8f608e6fb0d [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7600.17256_none_8a13a2dab2c35c3e\mshtml.dll : 9,377,280 : 02/28/2013 11:34 AM : e1cff56fb9ffc1ff6e3e549b04c94292 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7600.20745_none_8aa72da7cbd9a1bb\mshtml.dll : 9,295,360 : 11/11/2010 11:59 AM : e16d240876bad97b05dcad346ac734f6 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7600.20795_none_8a711e0bcc022d70\mshtml.dll : 9,298,944 : 11/11/2010 12:06 AM : 87f2577e0240b62d6934d1076358a96a [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7600.21471_none_8a82a041cbf5b25e\mshtml.dll : 9,377,792 : 02/28/2013 12:28 AM : 6463cdd9b90d184e14e6ce55e557534b [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17514_none_8c235f42afcafdda\mshtml.dll : 8,988,160 : 11/20/2010 08:27 AM : 1c8b787baa52dead1a6fec1502d652f0 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.18094_none_8bccbf9cb00c0540\mshtml.dll : 9,061,376 : 02/28/2013 08:57 AM : 9b623c302b59a2507e79d8739e37992c [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.22258_none_8c859f25c90597c9\mshtml.dll : 9,062,400 : 02/28/2013 08:56 AM : db63665f96064725be7b8686aca7d048 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16470_none_87aa40f7f4f6b025\mshtml.dll : 17,815,040 : 03/27/2013 05:09 AM : 460723a080d6f22e56d45bc8c1f15b2a [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16476_none_87b042b3f4f1482f\mshtml.dll : 17,817,088 : 02/22/2013 01:57 AM : 1154fefc73880a2ef44295ef0dbdc59f [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16483_none_87a271e9f4fc181b\mshtml.dll : 17,818,624 : 04/04/2013 08:51 PM : f63d8615292792d36edf24913636685d [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16484_none_87a37233f4fb3172\mshtml.dll : 17,818,624 : 05/05/2013 04:36 PM : 7212340908e00ad2f28e58ea04ceb852 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20586_none_882f0f930e1703ea\mshtml.dll : 17,817,600 : 02/22/2013 02:12 AM : 0e860bf2bcddd94202a6ab9a10ee95eb [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20593_none_88213ec90e21d3d6\mshtml.dll : 17,818,624 : 04/04/2013 07:33 PM : 43fef944ff64be0354a5c129c98eb13d [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20594_none_88223f130e20ed2d\mshtml.dll : 17,819,136 : 05/05/2013 05:35 PM : e139a28843f52f383d414bf0aaef6ce4 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16576_none_9b75e60cc6f9d9b2\mshtml.dll : 14,323,712 : 05/18/2013 03:13 AM : 7a468bc721c1d34e60389d3f2f87bbea [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16614_none_9b6541f4c7072a57\mshtml.dll : 14,327,808 : 05/16/2013 08:25 PM : 69a03ab053cad761e51bae1b01f95f55 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16618_none_9b64e6d4c70790db\mshtml.dll : 14,327,808 : 06/08/2013 06:40 AM : 05920bd009621d06722a1cd339da6481 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.16635_none_9b672bc0c70576a6\mshtml.dll : 14,329,856 : 06/11/2013 06:43 PM : af31e7d2c385f647adfd5f5736b3ba64 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.20719_none_848c5984e0b72622\mshtml.dll : 14,355,968 : 05/16/2013 08:42 PM : d77d1a53c38df6ce26749d77bed6a527 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.20723_none_848de27ee0b5a5b3\mshtml.dll : 14,355,456 : 06/08/2013 06:44 AM : 2c01ea6cbf9e7c6a96535bea1ab35580 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_10.2.9200.20742_none_848ff9dae0b3bec0\mshtml.dll : 14,358,528 : 06/11/2013 11:17 PM : e6cc3f7eaa761794e13e0f99393eeb97 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7600.16385_none_9446f5cce73d3c3b\mshtml.dll : 5,957,632 : 07/13/2009 08:15 PM : 43592d31aff84dd957199248898d9430 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7600.16625_none_9487db06e70c8c0a\mshtml.dll : 5,971,456 : 11/11/2010 11:59 AM : bdfd710842c8a25dd27254d91de60ac6 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7600.16671_none_944dca42e738b263\mshtml.dll : 5,977,600 : 11/11/2010 12:06 AM : baf92c3c3d5a0958817b661439a81fd9 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7600.17256_none_94684d2ce7241e39\mshtml.dll : 6,031,360 : 02/28/2013 11:16 AM : b344b36a2f21b7e5d3ec8060b5f2ab69 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7600.20745_none_94fbd7fa003a63b6\mshtml.dll : 5,972,992 : 11/11/2010 11:59 AM : 25c1646adc24c371b594544c3d530967 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7600.20795_none_94c5c85e0062ef6b\mshtml.dll : 5,977,088 : 11/11/2010 12:06 AM : 4f3deee94b0f650862f7ab7abbe40ca1 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7600.21471_none_94d74a9400567459\mshtml.dll : 6,033,408 : 02/28/2013 12:20 AM : a57c58d541c37a74fd3a6187817b3a48 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17514_none_96780994e42bbfd5\mshtml.dll : 5,977,600 : 11/20/2010 07:19 AM : c50799f0d47dfb9774f721521b6c41d5 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.18094_none_962169eee46cc73b\mshtml.dll : 6,032,384 : 02/28/2013 08:37 AM : 3a060a8d4de4a2e6e132e437c8773069 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.22258_none_96da4977fd6659c4\mshtml.dll : 6,032,896 : 02/28/2013 10:58 AM : 95e980e40bd1885d3edba6e432d9fa5a [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16470_none_91feeb4a29577220\mshtml.dll : 12,321,792 : 03/27/2013 05:09 AM : 263963d93a3ca8f685efa5966f1e6581 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16476_none_9204ed0629520a2a\mshtml.dll : 12,324,352 : 02/21/2013 11:05 PM : 658ebc74bd38d16805648c4775f7fa82 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16483_none_91f71c3c295cda16\mshtml.dll : 12,324,864 : 04/04/2013 05:23 PM : 79b0d843b26bea808ea89ba2d8a026f2 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.16484_none_91f81c86295bf36d\mshtml.dll : 12,324,864 : 05/05/2013 02:25 PM : 26f30066b9fa78c97a0e92803d496211 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20586_none_9283b9e54277c5e5\mshtml.dll : 12,324,864 : 02/21/2013 11:06 PM : 474d43d76e2a33fee21c6f4bb7c4a3b7 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20593_none_9275e91b428295d1\mshtml.dll : 12,325,376 : 04/04/2013 04:33 PM : 4ebf337d1f52ea9202072348ba41ca95 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_9.4.8112.20594_none_9276e9654281af28\mshtml.dll : 12,325,888 : 05/05/2013 03:26 PM : 1152de9d7fe16ec92a12165d1cbe8406 [Pos Repl]
 
 * C:\Windows\System32\msimg32.dll : 8,192 : 07/13/2009 08:41 PM : e424b3ef666b184cee0b6871aaa8c9f6 [NoSig]
 +-> C:\Windows\SysWOW64\msimg32.dll : 4,608 : 07/13/2009 08:15 PM : 18ab2e5a40064ed5f7791ac5946a90f3 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-gdi-painting_31bf3856ad364e35_6.1.7600.16385_none_d360c9c235bd1868\msimg32.dll : 8,192 : 07/13/2009 08:41 PM : e424b3ef666b184cee0b6871aaa8c9f6 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-gdi-painting_31bf3856ad364e35_6.1.7600.16385_none_77422e3e7d5fa732\msimg32.dll : 4,608 : 07/13/2009 08:15 PM : 18ab2e5a40064ed5f7791ac5946a90f3 [Pos Repl]
 
 * C:\Windows\System32\msprivs.dll : 2,048 : 07/13/2009 08:29 PM : 02b64609f865a39365ff88580df11738 [NoSig]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-lsa-msprivs_31bf3856ad364e35_6.1.7600.16385_none_680de2b99516e12e\msprivs.dll : 2,048 : 07/13/2009 08:29 PM : 02b64609f865a39365ff88580df11738 [Pos Repl]
 
 * C:\Windows\System32\msvcrt.dll : 634,880 : 12/16/2011 03:46 AM : c391fc68282a000cdf953f8b6b55d2ef [NoSig]
 +-> C:\Windows\SysWOW64\msvcrt.dll : 690,688 : 12/16/2011 02:52 AM : 9dc80a8aaaaac397bdab3c67165a824e [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-msvcrt_31bf3856ad364e35_6.1.7600.16385_none_2d4a27c7b8972454\msvcrt.dll : 634,880 : 07/13/2009 08:41 PM : 7319bb10fa1f86e49e3dcf4136f6c957 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-msvcrt_31bf3856ad364e35_6.1.7600.16930_none_2d7b4155b87308d6\msvcrt.dll : 634,368 : 12/16/2011 03:42 AM : 579f6afc6a6561951fa2202efc3fe485 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-msvcrt_31bf3856ad364e35_6.1.7600.21108_none_2e2d2856d17152c7\msvcrt.dll : 634,880 : 12/16/2011 03:38 AM : 7d8b505e35ab89d3c3e9ae54a2c95dd2 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-msvcrt_31bf3856ad364e35_6.1.7601.17744_none_2f5acf97b59df60f\msvcrt.dll : 634,880 : 12/16/2011 03:46 AM : c391fc68282a000cdf953f8b6b55d2ef [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-msvcrt_31bf3856ad364e35_6.1.7601.21878_none_2fc7fdc6ced04f08\msvcrt.dll : 634,880 : 12/16/2011 03:39 AM : f9a4c695c86cc32048fe2c987a0bd387 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-msvcrt_31bf3856ad364e35_6.1.7600.16385_none_d12b8c440039b31e\msvcrt.dll : 690,688 : 07/13/2009 08:15 PM : e46d48a7fe961401f1cbf85531cdf05d [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-msvcrt_31bf3856ad364e35_6.1.7600.16930_none_d15ca5d2001597a0\msvcrt.dll : 690,688 : 12/16/2011 02:59 AM : f8a61b2e713309b4616d107919bdab6e [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-msvcrt_31bf3856ad364e35_6.1.7600.21108_none_d20e8cd31913e191\msvcrt.dll : 690,688 : 12/16/2011 02:49 AM : 10142c1975202a767c0edb3bc066fd88 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-msvcrt_31bf3856ad364e35_6.1.7601.17744_none_d33c3413fd4084d9\msvcrt.dll : 690,688 : 12/16/2011 02:52 AM : 9dc80a8aaaaac397bdab3c67165a824e [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-msvcrt_31bf3856ad364e35_6.1.7601.21878_none_d3a962431672ddd2\msvcrt.dll : 690,688 : 12/16/2011 03:58 AM : 2f740c4b458331357e825e94afb0953a [Pos Repl]
 
 * C:\Windows\System32\mswsock.dll : 326,144 : 11/20/2010 08:27 AM : 1d5185a4c7e6695431ae4b55c3d7d333 [NoSig]
 +-> C:\Windows\SysWOW64\mswsock.dll : 232,448 : 11/20/2010 07:19 AM : 8999b8631c7fd9f7f9ec3cafd953ba24 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-w..-infrastructure-bsp_31bf3856ad364e35_6.1.7600.16385_none_144848ad46fcc535\mswsock.dll : 320,000 : 07/13/2009 08:41 PM : fc76fe3c1e1fdb761244d4f74ef560fd [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-w..-infrastructure-bsp_31bf3856ad364e35_6.1.7601.17514_none_16795c7543eb48cf\mswsock.dll : 326,144 : 11/20/2010 08:27 AM : 1d5185a4c7e6695431ae4b55c3d7d333 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-w..-infrastructure-bsp_31bf3856ad364e35_6.1.7600.16385_none_b829ad298e9f53ff\mswsock.dll : 232,448 : 07/13/2009 08:15 PM : 11a41f17527ed75d6b758fdd7f4fd00d [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-w..-infrastructure-bsp_31bf3856ad364e35_6.1.7601.17514_none_ba5ac0f18b8dd799\mswsock.dll : 232,448 : 11/20/2010 07:19 AM : 8999b8631c7fd9f7f9ec3cafd953ba24 [Pos Repl]
 
 * C:\Windows\System32\netlogon.dll : 695,808 : 11/20/2010 08:27 AM : aa339dd8bb128ef66660dfbbb59043d3 [NoSig]
 +-> C:\Windows\SysWOW64\netlogon.dll : 563,712 : 11/20/2010 07:20 AM : c1809b9907adedaf16f50c894100883b [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll : 692,736 : 07/13/2009 08:41 PM : 956d030d375f207b22fb111e06ef9c35 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll : 695,808 : 11/20/2010 08:27 AM : aa339dd8bb128ef66660dfbbb59043d3 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll : 563,712 : 07/13/2009 08:16 PM : eaa75d9000b71f10eec04d2ae6c60e81 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll : 563,712 : 11/20/2010 07:20 AM : c1809b9907adedaf16f50c894100883b [Pos Repl]
 
 * C:\Windows\System32\netman.dll : 360,448 : 07/13/2009 08:41 PM : 847d3ae376c0817161a14a82c8922a9e [NoSig]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-netman_31bf3856ad364e35_6.1.7600.16385_none_6bb20d3d6b80d9da\netman.dll : 360,448 : 07/13/2009 08:41 PM : 847d3ae376c0817161a14a82c8922a9e [Pos Repl]
 
 * C:\Windows\System32\ole32.dll : 2,086,912 : 11/20/2010 08:27 AM : 6c60b5aca7442efb794082cdacfc001c [NoSig]
 +-> C:\Windows\SysWOW64\ole32.dll : 1,414,144 : 11/20/2010 07:20 AM : 928cf7268086631f54c3d8e17238c6dd [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_6.1.7600.16385_none_081299030c02672b\ole32.dll : 2,084,352 : 07/13/2009 08:41 PM : 4b25dde615ac2cabab73169ca7da96e6 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_6.1.7600.16624_none_08527df30bd29da3\ole32.dll : 2,085,376 : 11/11/2010 12:01 AM : ac8f79017c5c1fb316930edead0af517 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_6.1.7600.20744_none_08c67ae62500754f\ole32.dll : 2,085,376 : 11/11/2010 12:01 AM : 49401892e8305914a9e7f64c7000d6a6 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_6.1.7601.17514_none_0a43accb08f0eac5\ole32.dll : 2,086,912 : 11/20/2010 08:27 AM : 6c60b5aca7442efb794082cdacfc001c [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_6.1.7600.16385_none_abf3fd7f53a4f5f5\ole32.dll : 1,412,608 : 07/13/2009 08:16 PM : 4acb903ad1693858a918907358cbd9e4 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_6.1.7600.16624_none_ac33e26f53752c6d\ole32.dll : 1,413,632 : 11/11/2010 12:01 AM : e2c2d8c982316c8abf800c6ce3f28fab [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_6.1.7600.20744_none_aca7df626ca30419\ole32.dll : 1,414,144 : 11/11/2010 12:01 AM : 40e6bf57f6a923038b94c07387118089 [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_6.1.7601.17514_none_ae2511475093798f\ole32.dll : 1,414,144 : 11/20/2010 07:20 AM : 928cf7268086631f54c3d8e17238c6dd [Pos Repl]
 
 * C:\Windows\System32\perfctrs.dll : 44,544 : 07/13/2009 08:41 PM : 8056a3e51b569c3f437a5026a0abe66d [NoSig]
 +-> C:\Windows\SysWOW64\perfctrs.dll : 39,424 : 07/13/2009 08:16 PM : edd2ad141debd425d74a52a4d7be6ac4 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-p..ormancebasecounters_31bf3856ad364e35_6.1.7600.16385_none_8d682f6a76cad93f\perfctrs.dll : 44,544 : 07/13/2009 08:41 PM : 8056a3e51b569c3f437a5026a0abe66d [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-p..ormancebasecounters_31bf3856ad364e35_6.1.7600.16385_none_97bcd9bcab2b9b3a\perfctrs.dll : 39,424 : 07/13/2009 08:16 PM : edd2ad141debd425d74a52a4d7be6ac4 [Pos Repl]
 
 * C:\Windows\System32\powrprof.dll : 167,424 : 07/13/2009 08:41 PM : 716175021bda290504ce434273f666bc [NoSig]
 +-> C:\Windows\SysWOW64\powrprof.dll : 145,408 : 07/13/2009 08:16 PM : 08dfdbd2fd4ea951dc46b1c7661ed35a [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-userpowermanagement_31bf3856ad364e35_6.1.7600.16385_none_ff0e900816896618\powrprof.dll : 167,424 : 07/13/2009 08:41 PM : 716175021bda290504ce434273f666bc [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-userpowermanagement_31bf3856ad364e35_6.1.7600.16385_none_a2eff4845e2bf4e2\powrprof.dll : 145,408 : 07/13/2009 08:16 PM : 08dfdbd2fd4ea951dc46b1c7661ed35a [Pos Repl]
 
 * C:\Windows\System32\psbase.dll : 52,224 : 07/13/2009 08:41 PM : ab95fbae4f9a5a56b177cec427b2b35e [NoSig]
 +-> C:\Windows\SysWOW64\psbase.dll : 50,688 : 07/13/2009 08:16 PM : 274992d0945889a6b56d0e1bd4288a6e [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-s..ty-protectedstorage_31bf3856ad364e35_6.1.7600.16385_none_a43e06414a0fcb4b\psbase.dll : 52,224 : 07/13/2009 08:41 PM : ab95fbae4f9a5a56b177cec427b2b35e [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-s..ty-protectedstorage_31bf3856ad364e35_6.1.7600.16385_none_ae92b0937e708d46\psbase.dll : 50,688 : 07/13/2009 08:16 PM : 274992d0945889a6b56d0e1bd4288a6e [Pos Repl]
 
 * C:\Windows\System32\pstorsvc.dll : 36,352 : 07/13/2009 08:41 PM : 35ba5aa671887fe8a62b88a9a6229fd5 [NoSig]
 +-> C:\Windows\SysWOW64\pstorsvc.dll : 23,552 : 07/13/2009 08:16 PM : 0a3ccb2c4f603d99f34d742fc9544b97 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-s..ty-protectedstorage_31bf3856ad364e35_6.1.7600.16385_none_a43e06414a0fcb4b\pstorsvc.dll : 36,352 : 07/13/2009 08:41 PM : 35ba5aa671887fe8a62b88a9a6229fd5 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-s..ty-protectedstorage_31bf3856ad364e35_6.1.7600.16385_none_ae92b0937e708d46\pstorsvc.dll : 23,552 : 07/13/2009 08:16 PM : 0a3ccb2c4f603d99f34d742fc9544b97 [Pos Repl]
 
 * C:\Windows\System32\qmgr.dll : 849,920 : 11/20/2010 08:27 AM : 1ea7969e3271cbc59e1730697dc74682 [NoSig]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-bits-client_31bf3856ad364e35_6.1.7600.16385_none_7f85b69413231233\qmgr.dll : 848,384 : 07/13/2009 08:41 PM : 7f0c323fe3da28aa4aa1bda3f575707f [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-bits-client_31bf3856ad364e35_6.1.7601.17514_none_81b6ca5c101195cd\qmgr.dll : 849,920 : 11/20/2010 08:27 AM : 1ea7969e3271cbc59e1730697dc74682 [Pos Repl]
 
 * C:\Windows\System32\rasadhlp.dll : 16,384 : 07/13/2009 08:41 PM : 88351b29b622b30962d2feb6ca8d860b [NoSig]
 +-> C:\Windows\SysWOW64\rasadhlp.dll : 11,776 : 07/13/2009 08:16 PM : ed6ee83d61ebc683c2cd8e899ea6febe [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_6.1.7600.16385_none_6bcef05d7f04260a\rasadhlp.dll : 16,384 : 07/13/2009 08:41 PM : 88351b29b622b30962d2feb6ca8d860b [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-rasautodial_31bf3856ad364e35_6.1.7600.16385_none_76239aafb364e805\rasadhlp.dll : 11,776 : 07/13/2009 08:16 PM : ed6ee83d61ebc683c2cd8e899ea6febe [Pos Repl]
 
 * C:\Windows\System32\regsvc.dll : 159,232 : 07/13/2009 08:41 PM : e4d94f24081440b5fc5aa556c7c62702 [NoSig]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-remoteregistry-service_31bf3856ad364e35_6.1.7600.16385_none_e55af7609d2857a8\regsvc.dll : 159,232 : 07/13/2009 08:41 PM : e4d94f24081440b5fc5aa556c7c62702 [Pos Repl]
 
 * C:\Windows\System32\rpcss.dll : 512,000 : 11/20/2010 08:27 AM : 5c627d1b1138676c0a7ab2c2c190d123 [NoSig]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7600.16385_none_c5bfcda3579104e3\rpcss.dll : 509,440 : 07/13/2009 08:41 PM : 7266972e86890e2b30c0c322e906b027 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_c7f0e16b547f887d\rpcss.dll : 512,000 : 11/20/2010 08:27 AM : 5c627d1b1138676c0a7ab2c2c190d123 [Pos Repl]
 
 * C:\Windows\System32\scecli.dll : 232,960 : 11/20/2010 08:27 AM : ed78427259134c63ed69804d2132b86c [NoSig]
 +-> C:\Windows\SysWOW64\scecli.dll : 175,616 : 11/20/2010 07:21 AM : 8124944ec89d6a1815e4e53f5b96aaf4 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll : 232,448 : 07/13/2009 08:41 PM : 398712dddaefb85edf61df6a07b65c79 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll : 232,960 : 11/20/2010 08:27 AM : ed78427259134c63ed69804d2132b86c [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll : 175,616 : 07/13/2009 08:16 PM : 26073302daea83cc5b944c546d6b47d2 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll : 175,616 : 11/20/2010 07:21 AM : 8124944ec89d6a1815e4e53f5b96aaf4 [Pos Repl]
 
 * C:\Windows\System32\schannel.dll : 340,992 : 06/02/2012 00:45 AM : 1573c45e65de32b1bc3572634f8f1e8e [NoSig]
 +-> C:\Windows\SysWOW64\schannel.dll : 225,280 : 06/01/2012 11:40 PM : 3d3cbd1847f980fb03343a63671e7886 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7600.16385_none_7e0b3cb56ef3dd68\schannel.dll : 348,672 : 07/13/2009 08:41 PM : 5a148b1574be77742d337ec81c23fc7a [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7600.16612_none_7e53f0fd6ebdc541\schannel.dll : 340,992 : 11/11/2010 11:53 AM : 7cc59a28bcf0f791cc5f173093e06db1 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7600.16661_none_7e1ce1176ee7379f\schannel.dll : 340,992 : 11/11/2010 12:03 AM : 426a455cacd1261d05d158ca8ad8ef2e [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7600.16915_none_7e56f78d6ebb08bb\schannel.dll : 340,992 : 11/17/2011 02:10 AM : 65238bdc2ec498ef5bc52ccf0ac2736b [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7600.17035_none_7e412fd76ecb73df\schannel.dll : 340,992 : 06/02/2012 00:27 AM : 90b780886bd813882cb382ff3e90e092 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7600.20735_none_7ecaeece87e8e8f2\schannel.dll : 339,456 : 11/11/2010 11:53 AM : 595a4a6058b95b52da0badde57eb211f [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7600.20785_none_7e94df32881174a7\schannel.dll : 339,456 : 11/11/2010 12:03 AM : fe91c090df05b9b2c623b244bb97e76b [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7600.21092_none_7e86ea56881c7223\schannel.dll : 339,456 : 11/17/2011 01:49 AM : 4abe93525123ba830a3d33ea0d5d93ad [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7600.21225_none_7ed59e7487e0f4df\schannel.dll : 338,944 : 06/02/2012 00:37 AM : 107519f9849d947ee1ba5085f7bc2763 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7601.17514_none_803c507d6be26102\schannel.dll : 340,992 : 11/20/2010 08:27 AM : a199de544bf5c61c134b22c7592226fc [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7601.17725_none_803284a76be99098\schannel.dll : 340,992 : 11/17/2011 01:35 AM : fbd1d2169aceee3073861f8ca3a28c49 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7601.17856_none_801317136c00fae9\schannel.dll : 340,992 : 06/02/2012 00:45 AM : 1573c45e65de32b1bc3572634f8f1e8e [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7601.21861_none_808ce09a852b3aca\schannel.dll : 340,992 : 11/17/2011 01:26 AM : ed848d806f639ce611b3bedc6c958140 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7601.22010_none_80c1c9f48503c627\schannel.dll : 340,992 : 06/04/2012 02:54 AM : f6184411925d84c41a87fb9821554da8 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7600.16385_none_885fe707a3549f63\schannel.dll : 220,160 : 07/13/2009 08:16 PM : 0a53fd4ebbd92002ccc362a9b8087885 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7600.16612_none_88a89b4fa31e873c\schannel.dll : 224,256 : 11/11/2010 11:53 AM : 61a9b3194f8497b864b1c98a72736d07 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7600.16661_none_88718b69a347f99a\schannel.dll : 224,256 : 11/11/2010 12:03 AM : 21cf5c7d8d727dcc337a1d251b6135f4 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7600.16915_none_88aba1dfa31bcab6\schannel.dll : 224,768 : 11/17/2011 00:39 AM : 83041697ae93aa4b783ae8746904edd2 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7600.17035_none_8895da29a32c35da\schannel.dll : 225,280 : 06/01/2012 11:48 PM : 76c48f0cd8a526858ab9a4886586942a [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7600.20735_none_891f9920bc49aaed\schannel.dll : 224,256 : 11/11/2010 11:53 AM : da2974595719d65c27b5198b971ef121 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7600.20785_none_88e98984bc7236a2\schannel.dll : 224,256 : 11/11/2010 12:03 AM : bf33806d317af52b6860a82d9fdc7e00 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7600.21092_none_88db94a8bc7d341e\schannel.dll : 224,768 : 11/17/2011 02:15 AM : cb6b6b1f8d283de4540445c5313cb445 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7600.21225_none_892a48c6bc41b6da\schannel.dll : 225,280 : 06/01/2012 11:45 PM : 1f7939c11281755a7b0a6ac47929f701 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7601.17514_none_8a90facfa04322fd\schannel.dll : 224,256 : 11/20/2010 07:21 AM : 135f7ac9be35ab1df727faf2e60e92f8 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7601.17725_none_8a872ef9a04a5293\schannel.dll : 224,768 : 11/17/2011 00:34 AM : 1affb765af1fdcc0c185c38e9ddddaee [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7601.17856_none_8a67c165a061bce4\schannel.dll : 225,280 : 06/01/2012 11:40 PM : 3d3cbd1847f980fb03343a63671e7886 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7601.21861_none_8ae18aecb98bfcc5\schannel.dll : 224,768 : 11/17/2011 00:29 AM : 3dbcbd8adb406c43a2127544d7ba974e [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-security-schannel_31bf3856ad364e35_6.1.7601.22010_none_8b167446b9648822\schannel.dll : 225,280 : 06/01/2012 11:55 PM : c5b2dc72f2453cef2e150a81f696703d [Pos Repl]
 
 * C:\Windows\System32\schedsvc.dll : 1,110,016 : 11/20/2010 08:27 AM : 262f6592c3299c005fd6bec90fc4463a [NoSig]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-taskscheduler-service_31bf3856ad364e35_6.1.7600.16385_none_8af61038b0b37f5f\schedsvc.dll : 1,104,384 : 07/13/2009 08:41 PM : ec56b171f85c7e855e7b0588ac503eea [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-taskscheduler-service_31bf3856ad364e35_6.1.7600.16699_none_8aef4726b0b7f821\schedsvc.dll : 1,114,624 : 11/02/2010 00:16 AM : 624d0f5ff99428bb90a5b8a4123e918e [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-taskscheduler-service_31bf3856ad364e35_6.1.7600.20830_none_8bb0c2c5c9ad095d\schedsvc.dll : 1,114,624 : 11/02/2010 00:22 AM : 5269a787c24d968d291b22f7ed4955b1 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-taskscheduler-service_31bf3856ad364e35_6.1.7601.17514_none_8d272400ada202f9\schedsvc.dll : 1,110,016 : 11/20/2010 08:27 AM : 262f6592c3299c005fd6bec90fc4463a [Pos Repl]
 
 * C:\Windows\System32\services.exe : 328,704 : 07/13/2009 08:39 PM : 24acb7e5be595468e3b9aa488b9b4fcb [NoSig]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe : 328,704 : 07/13/2009 08:39 PM : 24acb7e5be595468e3b9aa488b9b4fcb [Pos Repl]
 
 * C:\Windows\System32\setupapi.dll : 1,900,544 : 11/20/2010 08:27 AM : 5d8e6c95156ed1f79a63d1eade6f9ed5 [NoSig]
 +-> C:\Windows\SysWOW64\setupapi.dll : 1,667,584 : 11/20/2010 07:21 AM : 10fb16b50affda6d44588f3c445dc273 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-setupapi_31bf3856ad364e35_6.1.7600.16385_none_90ea4b57dfeee0fc\setupapi.dll : 1,899,520 : 07/13/2009 08:41 PM : 6a4ea4c29fbf78112ae20013fb71e9c1 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-setupapi_31bf3856ad364e35_6.1.7601.17514_none_931b5f1fdcdd6496\setupapi.dll : 1,900,544 : 11/20/2010 08:27 AM : 5d8e6c95156ed1f79a63d1eade6f9ed5 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-setupapi_31bf3856ad364e35_6.1.7600.16385_none_9b3ef5aa144fa2f7\setupapi.dll : 1,668,608 : 07/13/2009 08:16 PM : 41323ab614a2b66ad77b1121d24ac895 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-setupapi_31bf3856ad364e35_6.1.7601.17514_none_9d700972113e2691\setupapi.dll : 1,667,584 : 11/20/2010 07:21 AM : 10fb16b50affda6d44588f3c445dc273 [Pos Repl]
 
 * C:\Windows\System32\sfc.dll : 3,072 : 07/13/2009 08:33 PM : c6dcd1d11ed6827f05c00773c3e7053c [NoSig]
 +-> C:\Windows\SysWOW64\sfc.dll : 2,560 : 07/13/2009 08:10 PM : 40caeee0eaf1b8569f7c8df6420f2cb9 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-sfc_31bf3856ad364e35_6.1.7600.16385_none_032ab4f375e2ac1f\sfc.dll : 3,072 : 07/13/2009 08:33 PM : c6dcd1d11ed6827f05c00773c3e7053c [Pos Repl]
 +-> C:\Windows\winsxs\x86_microsoft-windows-sfc_31bf3856ad364e35_6.1.7600.16385_none_a70c196fbd853ae9\sfc.dll : 2,560 : 07/13/2009 08:10 PM : 40caeee0eaf1b8569f7c8df6420f2cb9 [Pos Repl]
 
 * C:\Windows\System32\shsvcs.dll : 370,688 : 11/20/2010 08:27 AM : aaf932b4011d14052955d4b212a4da8d [NoSig]
 +-> C:\Windows\SysWOW64\shsvcs.dll : 328,192 : 11/20/2010 07:21 AM : 414da952a35bf5d50192e28263b40577 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-shsvcs_31bf3856ad364e35_6.1.7600.16385_none_29254ed1369e9d89\shsvcs.dll : 369,664 : 07/13/2009 08:41 PM : 0298ac45d0efffb2db4baa7dd186e7bf [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-shsvcs_31bf3856ad364e35_6.1.7601.17514_none_2b566299338d2123\shsvcs.dll : 370,688 : 11/20/2010 08:27 AM : aaf932b4011d14052955d4b212a4da8d [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-shsvcs_31bf3856ad364e35_6.1.7600.16385_none_3379f9236aff5f84\shsvcs.dll : 328,192 : 07/13/2009 08:16 PM : cd2e48fa5b29ee2b3b5858056d246ef2 [Pos Repl]
 +-> C:\Windows\winsxs\wow64_microsoft-windows-shsvcs_31bf3856ad364e35_6.1.7601.17514_none_35ab0ceb67ede31e\shsvcs.dll : 328,192 : 11/20/2010 07:21 AM : 414da952a35bf5d50192e28263b40577 [Pos Repl]
 
 * C:\Windows\System32\smss.exe : 112,640 : 03/18/2013 10:06 PM : f0371de302ffff8f086661611be60848 [NoSig]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-smss_31bf3856ad364e35_6.1.7600.16385_none_082f99a432e2a661\smss.exe : 112,640 : 07/13/2009 08:39 PM : 1911a3356fa3f77ccc825ccbac038c2a [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-smss_31bf3856ad364e35_6.1.7600.17273_none_0838504e32dc743c\smss.exe : 112,640 : 03/18/2013 10:19 PM : fa64733bd65f52712f0545f56fdb4be6 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-smss_31bf3856ad364e35_6.1.7600.21490_none_08a94e494c0cfd0a\smss.exe : 112,640 : 03/18/2013 10:20 PM : 7180204786a9ded8723b2d8cf3cdd388 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-smss_31bf3856ad364e35_6.1.7601.18113_none_0a5f8ec22fd235a9\smss.exe : 112,640 : 03/18/2013 10:06 PM : f0371de302ffff8f086661611be60848 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-smss_31bf3856ad364e35_6.1.7601.22280_none_0a9a7b3b492b4d05\smss.exe : 112,640 : 03/18/2013 09:57 PM : 498e2a20e145199709cd100cdba8603d [Pos Repl]
 
 * C:\Windows\System32\spoolsv.exe : 559,104 : 02/11/2012 01:36 AM : 85daa09a98c9286d4ea2ba8d0e644377 [NoSig]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_6.1.7600.16385_none_324094c8db39cbbd\spoolsv.exe : 558,080 : 07/13/2009 08:39 PM : 89e8550c5862999fcf482ea562b0e98e [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_6.1.7600.16661_none_3252392adb2d25f4\spoolsv.exe : 558,592 : 11/11/2010 11:43 AM : f8e1fa03cb70d54a9892ac88b91d1e7b [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_6.1.7600.16962_none_32533f26db2c36c0\spoolsv.exe : 559,104 : 02/11/2012 01:29 AM : 567977dc43cc13c4c35ed7084c0b84d5 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_6.1.7600.20785_none_32ca3745f45762fc\spoolsv.exe : 559,104 : 11/11/2010 11:43 AM : 8547491be7086ee317163365d83a37d2 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_6.1.7600.21149_none_32f955f1f433834b\spoolsv.exe : 559,104 : 02/11/2012 01:26 AM : 807b5b0e287027f72ac37b0cda9512da [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_6.1.7601.17514_none_3471a890d8284f57\spoolsv.exe : 559,104 : 11/20/2010 08:25 AM : b96c17b5dc1424d56eea3a99e97428cd [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_6.1.7601.17777_none_3433cdb2d8563d50\spoolsv.exe : 559,104 : 02/11/2012 01:36 AM : 85daa09a98c9286d4ea2ba8d0e644377 [Pos Repl]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_6.1.7601.21921_none_34ed7a43f150b682\spoolsv.exe : 559,616 : 02/11/2012 01:20 AM : b9d7a4858cf32a6a15d2763f1de47e0e [Pos Repl]
 
 * C:\Windows\System32\ssdpsrv.dll : 193,024 : 07/13/2009 08:41 PM : 51b52fbd583cde8aa9ba62b8b4298f33 [NoSig]
 +-> C:\Windows\winsxs\amd64_microsoft-windows-upnpssdp_31bf3856ad364e35_6.1.7600.16385_none_dbbe6492eae9505c\ssdpsrv.dll : 193,024 : 07/13/2009 08:41 PM : 51b52fbd583cde8aa9ba62b8b4298f33 [Pos Repl]
 
 * C:\Windows\System32\svchost.exe : 27,136 : 07/13/2009 08:39 PM : c78655bc80301d76ed4fef1c1ea40a7d [NoSig]

Edited by BCMusic, 17 July 2013 - 05:23 PM.


#7 noknojon

noknojon

  • Banned
  • 10,871 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:03:06 PM

Posted 17 July 2013 - 06:08 PM

Hi -

This has already eaten into several processes and this may be the reason why you are not able to run some programs.

The small scan usually only takes less than 1 minute on most computers.

 

As the infection has already taken over, please follow these directions to the Experts area >

Please follow the instructions in ==>This Guide<== starting at Step #6.  If you cannot complete a step, skip it and continue.

Once the proper logs are created, then make a NEW TOPIC and post it ==>HERE<==

Please include a description of your computer issues, what you have done to resolve them, and a link to this topic.

If you can produce at least some of the logs, then please create the new topic and explain what happens when you try to create the log(s) that you couldn't get. If you cannot produce any of the logs, then still post the topic and explain that you followed the Prep. Guide, were unable to create the logs, and describe what happens when you try to create the logs.

NOTE : Please Copy / Paste all logs requested, and do not use Attach unless specifically asked -

Good luck and be very patient, as the area can get very busy, but will look after you.

Due to your problem, be sure to have a clean USB Flash drive if needed to download some of the tools -

 

If HelpBot replies to your topic, PLEASE follow His Step One so it will report your topic to the team members.

 

Thank You -

EDIT - http://www.bleepingcomputer.com/forums/t/501333/expirogenf-virus-infecting-a-bunch-of-programs-at-an-alarming-rate/#entry3105953

Added link to this topic for you -


Edited by noknojon, 17 July 2013 - 06:15 PM.


#8 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,914 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:01:06 AM

Posted 17 July 2013 - 07:49 PM

Now that your log is properly posted, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a Malware Removal Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.
From this point on the Malware Removal Team should be the only members that you take advice from, until they have verified your log as clean.
Please be patient. It may take a while to get a response because the Malware Removal Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the Malware Removal Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another MRL Team member is already assisting you and not open the thread to respond.
The current wait time is 1 - 2 days and ALL logs are answered.
If HelpBot replies to your topic, PLEASE follow Step One so it will report your topic to the team members.
To avoid confusion, I am closing this topic.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users