We're aware that some users are experiencing technical issues which the team are working to resolve. See the Community Noticeboard for more info. Thank you for your patience.
📨 Have you signed up to the Forum's new Email Digest yet? Get a selection of trending threads sent straight to your inbox daily, weekly or monthly!

Hijack this - help please

Options
2

Comments

  • RedBern
    RedBern Posts: 1,237 Forumite
    I've run Malwarebytes again and it is showing as 'clean' - so hopefully that's me sorted!

    thanks for your all your help - AlienRik - if you would have a quick check that there's nothing really nasty hiding, I'd be grateful....
    Bern :j
  • closed
    closed Posts: 10,886 Forumite
    Is it slow, (lot of things running), - if so, how much ram, what's the commit charge in task manager?
    !!
    > . !!!! ----> .
  • RedBern
    RedBern Posts: 1,237 Forumite
    closed Is it slow, (lot of things running), - if so, how much ram, what's the commit charge in task manager?

    not particularly slow : 57 processes (which seems a lot?) CPU usage 1%
    the only thing that was running was mozilla...

    I've put Avira on and that has quarantined another virus which didn't show up on Malware.....

    So perhaps all is not quite well after all....:o
    Bern :j
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    Open notepad and copy/paste the text in RED below

    File::
    c:\windows\system32\lk.dat
    c:\windows\system32\chg.exe


    Save this as "CFScript" (FULL file will be 'CFScript.txt' EXACTLY as shown)

    Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

    CFScript.gif


    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply

    Combofix should never take more that 30 minutes including the reboot if malware is detected.
    If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
    :idea:
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    Then post a fresh hijack log

    Think id run another malwarebytes scan too, chances are with all the problems youve had theres still something lurking
    :idea:
  • RedBern
    RedBern Posts: 1,237 Forumite
    Ok did the combo 'thing' and this is the new hijack log

    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 18:51:52, on 24/08/2010
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    C:\Program Files\RealVNC\VNC4\WinVNC4.exe
    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    C:\WINDOWS\system32\mqsvc.exe
    C:\WINDOWS\system32\mqtgsvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\AccelerometerSt.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
    C:\WINDOWS\SMINST\Scheduler.exe
    C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
    C:\Program Files\btbb_wcm\McciTrayApp.exe
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\WINDOWS\system32\igfxsrvc.exe
    C:\Program Files\Citrix\ICA Client\concentr.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\Program Files\Citrix\ICA Client\wfcrun32.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpCtr.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://bt.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R3 - URLSearchHook: BT Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll (file missing)
    O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll
    O3 - Toolbar: BT Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
    O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
    O4 - HKLM\..\Run: [AccelerometerSysTrayApplet] C:\WINDOWS\system32\AccelerometerSt.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
    O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe
    O4 - HKLM\..\Run: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe
    O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [btbb_wcm_McciTrayApp] C:\Program Files\btbb_wcm\McciTrayApp.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [ConnectionCenter] "C:\Program Files\Citrix\ICA Client\concentr.exe" /startup
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
    O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\aro.exe -rem
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Bluetooth.lnk = ?
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
    O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} (Infotl Control) - http://site.ebrary.com/lib/uon/support/plugins/ebraryRdr.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper2007261.dll
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.truprint.co.uk/TruprintActivia.cab
    O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
    O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
    O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe
    O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe
    O23 - Service: Wireless Adapter Configurator - Unknown owner - C:\Program Files\BT Home Hub\Wireless Configuration\WirelessDaemon.exe (file missing)
    O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

    --
    End of file - 9663 bytes
    Bern :j
  • aliEnRIK
    aliEnRIK Posts: 17,741 Forumite
    Part of the Furniture Combo Breaker
    aliEnRIK wrote: »
    post the contents of Combofix.txt in your next reply

    As above please
    :idea:
  • RedBern
    RedBern Posts: 1,237 Forumite
    have to split into 3 - it's huge!

    omboFix 10-08-23.06 - 24/08/2010 17:56:37.2.2 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.627 [GMT 1:00]
    Running from: c:\documents and settings\My Documents\Downloads\ComboFix.exe
    AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
    .

    ((((((((((((((((((((((((( Files Created from 2010-07-24 to 2010-08-24 )))))))))))))))))))))))))))))))
    .

    2010-08-23 22:07 . 2010-08-24 14:13
    d
    w- c:\windows\LastGood
    2010-08-23 19:37 . 2010-08-23 19:37
    d
    w- c:\windows\system32\scripting
    2010-08-23 19:37 . 2010-08-23 19:37
    d
    w- c:\windows\l2schemas
    2010-08-23 19:37 . 2010-08-23 19:37
    d
    w- c:\windows\system32\en
    2010-08-23 19:37 . 2010-08-23 19:37
    d
    w- c:\windows\system32\bits
    2010-08-22 21:00 . 2010-08-23 21:16
    d
    w- c:\windows\system32\NtmsData
    2010-08-22 17:02 . 2010-08-22 17:02
    d
    w- c:\documents and settings\Andy Peters\Application Data\Avira
    2010-08-22 11:57 . 2010-03-01 09:05 124784 ----a-w- c:\windows\system32\drivers\avipbb.sys
    2010-08-22 11:57 . 2010-02-16 13:24 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
    2010-08-22 11:57 . 2009-05-11 11:49 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
    2010-08-22 11:57 . 2009-05-11 11:49 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
    2010-08-22 11:57 . 2010-08-22 11:57
    d
    w- c:\program files\Avira
    2010-08-22 11:57 . 2010-08-22 11:57
    d
    w- c:\documents and settings\All Users\Application Data\Avira
    2010-08-22 09:24 . 2010-08-22 09:24 0 ----a-w- c:\windows\nsreg.dat
    2010-08-22 09:24 . 2010-08-22 09:24
    d
    w- c:\documents and settings\Andy Peters\Local Settings\Application Data\Mozilla
    2010-08-22 09:07 . 2010-08-22 09:07 388096 ----a-r- c:\documents and settings\Andy Peters\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
    2010-08-22 09:07 . 2010-08-22 09:07
    d
    w- c:\program files\Trend Micro
    2010-08-21 19:30 . 2009-06-30 08:37 28552 ----a-w- c:\windows\system32\drivers\pavboot.sys
    2010-08-21 19:30 . 2010-08-21 19:30
    d
    w- c:\program files\Panda Security
    2010-08-21 19:08 . 2010-08-21 19:08
    d
    w- c:\program files\Defraggler
    2010-08-21 18:59 . 2010-08-21 18:59
    d
    w- c:\documents and settings\Andy Peters\Application Data\Sammsoft
    2010-08-21 18:59 . 2010-08-21 18:59
    d
    w- c:\program files\Advanced Registry Optimizer
    2010-08-21 18:42 . 2010-08-21 18:42
    d
    w- c:\program files\CCleaner
    2010-08-21 17:23 . 2010-08-21 17:23
    d
    w- c:\documents and settings\Andy Peters\Application Data\Malwarebytes
    2010-08-21 17:22 . 2010-04-29 14:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-08-21 17:22 . 2010-08-21 17:23
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2010-08-21 17:22 . 2010-08-21 17:22
    d
    w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2010-08-21 17:22 . 2010-04-29 14:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-08-05 23:29 . 2010-08-05 23:29
    d-sh--w- c:\documents and settings\Andy Peters\IECompatCache
    2010-08-05 23:28 . 2010-08-05 23:28
    d-sh--w- c:\documents and settings\Andy Peters\PrivacIE
    2010-08-05 23:27 . 2010-08-05 23:27
    d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
    2010-08-05 23:27 . 2010-08-05 23:27
    d-sh--w- c:\documents and settings\Andy Peters\IETldCache
    2010-08-05 23:25 . 2010-08-05 23:25
    d
    w- c:\windows\ie8updates
    2010-08-05 23:23 . 2010-08-05 23:23
    dc-h--w- c:\windows\ie8
    2010-08-05 23:23 . 2010-08-05 23:25
    d--h--w- c:\windows\msdownld.tmp
    2010-08-05 23:20 . 2010-05-06 10:41 12800
    w- c:\windows\system32\dllcache\xpshims.dll
    2010-08-05 23:20 . 2010-05-06 10:41 599040
    w- c:\windows\system32\dllcache\msfeeds.dll
    2010-08-05 23:20 . 2010-05-06 10:41 55296
    w- c:\windows\system32\dllcache\msfeedsbs.dll
    2010-08-05 23:20 . 2010-05-06 10:41 247808
    w- c:\windows\system32\dllcache\ieproxy.dll
    2010-08-05 23:20 . 2010-05-06 10:41 743424
    w- c:\windows\system32\dllcache\iedvtool.dll
    2010-08-05 23:20 . 2010-05-06 10:41 1985536
    w- c:\windows\system32\dllcache\iertutil.dll
    2010-08-05 23:20 . 2010-05-06 10:41 11076096
    w- c:\windows\system32\dllcache\ieframe.dll
    2010-08-05 23:20 . 2010-04-16 11:43 41984
    w- c:\windows\system32\dllcache\iecompat.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-08-23 19:39 . 2004-08-07 13:12 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
    2010-08-21 17:20 . 2010-01-03 21:00 9061852 ----a-w- c:\windows\system32\lk.dat
    2010-08-05 23:29 . 2007-03-21 19:40
    d
    w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
    2010-08-05 23:24 . 2007-03-21 18:57
    d
    w- c:\documents and settings\All Users\Application Data\yahoo!
    2010-08-05 23:24 . 2007-03-21 18:56
    d
    w- c:\program files\Yahoo!
    2010-06-14 14:31 . 2004-08-04 08:00 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
    .
    Bern :j
  • RedBern
    RedBern Posts: 1,237 Forumite
    ((((((((((((((((((((((((((((( SnapShot@2010-08-22_12.19.57 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2008-04-14 00:12 . 2008-04-14 00:12 57344 c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcirt.dll
    - 2007-03-22 08:19 . 2007-01-19 20:15 74802 c:\windows\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\atl.dll
    + 2008-04-14 00:12 . 2008-04-14 00:12 74802 c:\windows\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\atl.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 50688 c:\windows\twain_32.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 50688 c:\windows\twain_32.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 11776 c:\windows\system32\xolehlp.dll
    - 2004-08-04 08:00 . 2006-03-01 19:42 11776 c:\windows\system32\xolehlp.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 50176 c:\windows\system32\xmlprovi.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 50176 c:\windows\system32\xmlprovi.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 30720 c:\windows\system32\xcopy.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 30720 c:\windows\system32\xcopy.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 91648 c:\windows\system32\xactsrv.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 91648 c:\windows\system32\xactsrv.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 52736 c:\windows\system32\wzcsapi.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 18432 c:\windows\system32\wtsapi32.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 18432 c:\windows\system32\wtsapi32.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 50688 c:\windows\system32\wstdecod.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 50688 c:\windows\system32\wstdecod.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 22528 c:\windows\system32\wsock32.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 22528 c:\windows\system32\wsock32.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 41984 c:\windows\system32\wsnmp32.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 19456 c:\windows\system32\wshtcpip.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 11264 c:\windows\system32\wshrm.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 14336 c:\windows\system32\wship6.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 14336 c:\windows\system32\wship6.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 90112 c:\windows\system32\wshext.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 36864 c:\windows\system32\wshcon.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 80896 c:\windows\system32\wscsvc.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 13824 c:\windows\system32\wscntfy.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 13824 c:\windows\system32\wscntfy.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 19968 c:\windows\system32\ws2help.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 19968 c:\windows\system32\ws2help.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 82432 c:\windows\system32\ws2_32.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 11264 c:\windows\system32\wpnpinst.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 32256 c:\windows\system32\wpabaln.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 32256 c:\windows\system32\wpabaln.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 92672 c:\windows\system32\wlnotify.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 92672 c:\windows\system32\wlnotify.dll
    + 2008-04-14 00:12 . 2008-04-14 00:12 69120 c:\windows\system32\wlanapi.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 53760 c:\windows\system32\winsta.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 53760 c:\windows\system32\winsta.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 17408 c:\windows\system32\winshfhc.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 17408 c:\windows\system32\winshfhc.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 99328 c:\windows\system32\winscard.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 99328 c:\windows\system32\winscard.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 16896 c:\windows\system32\winrnr.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 16896 c:\windows\system32\winrnr.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 32256 c:\windows\system32\winipsec.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 75776 c:\windows\system32\wiascr.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 75776 c:\windows\system32\wiascr.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 65024 c:\windows\system32\wextract.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 68096 c:\windows\system32\webclnt.dll
    - 2004-08-04 08:00 . 2006-01-04 03:35 68096 c:\windows\system32\webclnt.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 23552 c:\windows\system32\wdmaud.drv
    - 2004-08-04 08:00 . 2004-08-04 08:00 23552 c:\windows\system32\wdmaud.drv
    + 2004-08-04 08:00 . 2009-06-25 08:25 54272 c:\windows\system32\wdigest.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 95232 c:\windows\system32\wbem\wmiutils.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 95232 c:\windows\system32\wbem\wmiutils.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 41472 c:\windows\system32\wbem\wmipsess.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 41472 c:\windows\system32\wbem\wmipsess.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 62464 c:\windows\system32\wbem\wmipjobj.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 61952 c:\windows\system32\wbem\wmipiprt.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 60928 c:\windows\system32\wbem\wmicookr.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 60928 c:\windows\system32\wbem\wmicookr.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 88576 c:\windows\system32\wbem\wmiaprpl.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 43520 c:\windows\system32\wbem\wbemsvc.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 43520 c:\windows\system32\wbem\wbemsvc.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 18944 c:\windows\system32\wbem\wbemprox.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 18944 c:\windows\system32\wbem\wbemprox.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 43008 c:\windows\system32\wbem\wbemperf.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 43008 c:\windows\system32\wbem\wbemperf.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 71680 c:\windows\system32\wbem\wbemcons.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 71680 c:\windows\system32\wbem\wbemcons.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 86528 c:\windows\system32\wbem\stdprov.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 86528 c:\windows\system32\wbem\stdprov.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 36352 c:\windows\system32\wbem\scrcons.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 92672 c:\windows\system32\wbem\policman.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 92672 c:\windows\system32\wbem\policman.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 47104 c:\windows\system32\wbem\ncprov.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 47104 c:\windows\system32\wbem\ncprov.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 16384 c:\windows\system32\wbem\mofcomp.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 16384 c:\windows\system32\wbem\mofcomp.exe
    + 2004-08-04 08:00 . 2008-04-14 00:11 24576 c:\windows\system32\wbem\krnlprov.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 24576 c:\windows\system32\wbem\krnlprov.dll
    + 2004-08-04 08:00 . 2008-04-14 00:11 21504 c:\windows\system32\wbem\evntrprv.dll
    + 2004-08-04 08:00 . 2008-04-14 00:11 45056 c:\windows\system32\wbem\cmdevtgprov.dll
    + 2004-08-04 08:00 . 2008-04-13 18:44 17664 c:\windows\system32\watchdog.sys
    - 2004-08-04 08:00 . 2004-08-04 08:00 17664 c:\windows\system32\watchdog.sys
    + 2004-08-04 08:00 . 2008-04-14 00:12 15872 c:\windows\system32\w3ssl.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 15872 c:\windows\system32\w3ssl.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 18944 c:\windows\system32\version.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 18944 c:\windows\system32\version.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 26624 c:\windows\system32\verifier.dll
    + 2006-03-17 00:38 . 2008-04-14 00:12 28672 c:\windows\system32\verclsid.exe
    - 2006-03-17 00:38 . 2006-03-17 00:38 28672 c:\windows\system32\verclsid.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 51712 c:\windows\system32\vdmredir.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 51712 c:\windows\system32\vdmredir.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 26112 c:\windows\system32\vdmdbg.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 26112 c:\windows\system32\vdmdbg.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 30749 c:\windows\system32\vbajet32.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 30749 c:\windows\system32\vbajet32.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 50176 c:\windows\system32\utilman.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 50176 c:\windows\system32\utilman.exe
    + 2004-08-04 08:00 . 2008-04-14 00:11 19968 c:\windows\system32\usmt\log.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 19968 c:\windows\system32\usmt\log.dll
    + 2008-04-13 16:44 . 2008-04-13 16:44 17920 c:\windows\system32\usmt\cobramsg.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 26112 c:\windows\system32\userinit.exe
    + 2004-08-03 19:56 . 2008-04-14 00:12 74240 c:\windows\system32\usbui.dll
    - 2004-08-03 19:56 . 2004-08-03 19:56 74240 c:\windows\system32\usbui.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 16896 c:\windows\system32\usbmon.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 16896 c:\windows\system32\usbmon.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 18432 c:\windows\system32\ups.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 18432 c:\windows\system32\ups.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 16896 c:\windows\system32\upnpcont.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 16896 c:\windows\system32\upnpcont.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 13824 c:\windows\system32\uniplat.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 13824 c:\windows\system32\uniplat.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 74240 c:\windows\system32\unimdmat.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 74240 c:\windows\system32\unimdmat.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 35840 c:\windows\system32\umandlg.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 35840 c:\windows\system32\umandlg.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 26624 c:\windows\system32\udhisapi.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 57856 c:\windows\system32\twext.dll
    + 2008-04-14 00:12 . 2008-04-14 00:12 50688 c:\windows\system32\tspkg.dll
    + 2008-04-14 00:12 . 2008-04-14 00:12 53248 c:\windows\system32\tsgqec.dll
    + 2004-08-04 08:00 . 2008-04-14 00:13 12168 c:\windows\system32\tsddd.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 12168 c:\windows\system32\tsddd.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 93696 c:\windows\system32\tscfgwmi.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 93696 c:\windows\system32\tscfgwmi.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 90112 c:\windows\system32\trkwks.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 12800 c:\windows\system32\tree.com
    - 2004-08-04 08:00 . 2004-08-04 08:00 12288 c:\windows\system32\tracert.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 12288 c:\windows\system32\tracert.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 73216 c:\windows\system32\tlntsvr.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 73216 c:\windows\system32\tlntsvr.exe
    - 2004-08-04 08:00 . 2009-06-12 11:50 80896 c:\windows\system32\tlntsess.exe
    + 2004-08-04 08:00 . 2009-06-12 12:31 80896 c:\windows\system32\tlntsess.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 61440 c:\windows\system32\tlntadmn.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 61440 c:\windows\system32\tlntadmn.exe
    + 2004-08-04 08:00 . 2009-06-12 12:31 76288 c:\windows\system32\telnet.exe
    - 2004-08-04 08:00 . 2009-06-12 11:50 76288 c:\windows\system32\telnet.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 45568 c:\windows\system32\tcpmonui.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 45568 c:\windows\system32\tcpmonui.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 45568 c:\windows\system32\tcpmon.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 45568 c:\windows\system32\tcpmon.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 14848 c:\windows\system32\tcpmib.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 14848 c:\windows\system32\tcpmib.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 77824 c:\windows\system32\tasklist.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 76288 c:\windows\system32\taskkill.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 71680 c:\windows\system32\systeminfo.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 57856 c:\windows\system32\synceng.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 57856 c:\windows\system32\synceng.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 14336 c:\windows\system32\svchost.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 14336 c:\windows\system32\svchost.exe
    - 2004-08-04 08:00 . 2009-10-21 06:00 75776 c:\windows\system32\strmfilt.dll
    + 2004-08-04 08:00 . 2009-10-21 05:38 75776 c:\windows\system32\strmfilt.dll
    - 2004-08-03 19:56 . 2004-08-03 19:56 74752 c:\windows\system32\storprop.dll
    + 2004-08-03 19:56 . 2008-04-14 00:12 74752 c:\windows\system32\storprop.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 14848 c:\windows\system32\stimon.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 14848 c:\windows\system32\stimon.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 68096 c:\windows\system32\sti.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 59392 c:\windows\system32\stclient.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 14336 c:\windows\system32\ssstars.scr
    - 2004-08-04 08:00 . 2004-08-04 08:00 14336 c:\windows\system32\ssstars.scr
    - 2004-08-04 08:00 . 2004-08-04 08:00 18944 c:\windows\system32\ssmyst.scr
    + 2004-08-04 08:00 . 2008-04-14 00:12 18944 c:\windows\system32\ssmyst.scr
    - 2004-08-04 08:00 . 2004-08-04 08:00 47104 c:\windows\system32\ssmypics.scr
    + 2004-08-04 08:00 . 2008-04-14 00:12 47104 c:\windows\system32\ssmypics.scr
    - 2004-08-04 08:00 . 2004-08-04 08:00 20992 c:\windows\system32\ssmarque.scr
    + 2004-08-04 08:00 . 2008-04-14 00:12 20992 c:\windows\system32\ssmarque.scr
    - 2004-08-04 08:00 . 2004-08-04 08:00 71680 c:\windows\system32\ssdpsrv.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 71680 c:\windows\system32\ssdpsrv.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 34816 c:\windows\system32\ssdpapi.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 34816 c:\windows\system32\ssdpapi.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 19968 c:\windows\system32\ssbezier.scr
    - 2004-08-04 08:00 . 2004-08-04 08:00 19968 c:\windows\system32\ssbezier.scr
    - 2004-08-04 08:00 . 2004-12-07 19:32 96768 c:\windows\system32\srvsvc.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 96768 c:\windows\system32\srvsvc.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 67584 c:\windows\system32\srclient.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 67584 c:\windows\system32\srclient.dll
    + 2008-04-14 00:12 . 2008-04-14 00:12 20992 c:\windows\system32\spupdwxp.exe
    - 2004-08-04 08:00 . 2005-06-10 23:53 57856 c:\windows\system32\spoolsv.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 57856 c:\windows\system32\spoolsv.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 75264 c:\windows\system32\spoolss.dll
    + 2004-08-04 08:00 . 2008-04-14 04:42 11264 c:\windows\system32\spnpinst.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 12800 c:\windows\system32\spiisupd.exe
    + 2004-08-04 08:00 . 2008-04-13 18:43 12800 c:\windows\system32\spiisupd.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 24576 c:\windows\system32\sort.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 18944 c:\windows\system32\snmpapi.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 18944 c:\windows\system32\snmpapi.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 50688 c:\windows\system32\smss.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 50688 c:\windows\system32\smss.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 89600 c:\windows\system32\smlogsvc.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 89600 c:\windows\system32\smlogsvc.exe
    + 2008-04-14 00:12 . 2008-04-14 00:12 73796 c:\windows\system32\slserv.exe
    + 2008-04-14 00:12 . 2008-04-14 00:12 32866 c:\windows\system32\slrundll.exe
    + 2008-04-14 00:12 . 2008-04-14 00:12 73832 c:\windows\system32\slcoinst.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 98304 c:\windows\system32\slbiop.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 98304 c:\windows\system32\slbiop.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 25088 c:\windows\system32\slayerxp.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 25088 c:\windows\system32\slayerxp.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 26112 c:\windows\system32\skeys.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 26112 c:\windows\system32\skeys.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 70144 c:\windows\system32\sigverif.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 70144 c:\windows\system32\sigverif.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 13312 c:\windows\system32\sigtab.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 13312 c:\windows\system32\sigtab.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 19456 c:\windows\system32\shutdown.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 19456 c:\windows\system32\shutdown.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 27648 c:\windows\system32\shscrap.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 27648 c:\windows\system32\shscrap.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 77824 c:\windows\system32\shrpubw.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 77824 c:\windows\system32\shrpubw.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 45056 c:\windows\system32\shmgrate.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 65024 c:\windows\system32\shimeng.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 68096 c:\windows\system32\shgina.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 68096 c:\windows\system32\shgina.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 25088 c:\windows\system32\shfolder.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 25088 c:\windows\system32\shfolder.dll
    + 2008-04-14 00:12 . 2008-04-14 00:12 32768 c:\windows\system32\setupn.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 33792 c:\windows\system32\Setup\tabletoc.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 33792 c:\windows\system32\Setup\tabletoc.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 17408 c:\windows\system32\Setup\ocmsn.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 17408 c:\windows\system32\Setup\ocmsn.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 15360 c:\windows\system32\Setup\ocgen.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 62976 c:\windows\system32\Setup\ntoc.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 62976 c:\windows\system32\Setup\ntoc.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 77312 c:\windows\system32\Setup\netoc.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 77312 c:\windows\system32\Setup\netoc.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 15360 c:\windows\system32\Setup\msgrocm.dll
    + 2004-08-04 08:00 . 2008-04-14 00:11 15360 c:\windows\system32\Setup\msgrocm.dll
    + 2004-08-04 08:00 . 2008-04-14 00:11 90112 c:\windows\system32\Setup\msdtcstp.dll
    + 2004-08-04 08:00 . 2008-04-14 00:11 16896 c:\windows\system32\Setup\medctroc.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 16896 c:\windows\system32\Setup\medctroc.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 32828 c:\windows\system32\Setup\fp40ext.dll
    + 2004-08-04 08:00 . 2008-04-14 00:11 32828 c:\windows\system32\Setup\fp40ext.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 23040 c:\windows\system32\setup.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 23040 c:\windows\system32\setup.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 31232 c:\windows\system32\sethc.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 31232 c:\windows\system32\sethc.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 56320 c:\windows\system32\servdeps.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 56320 c:\windows\system32\servdeps.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 39424 c:\windows\system32\sens.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 54784 c:\windows\system32\sendmail.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 29184 c:\windows\system32\sendcmsg.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 29184 c:\windows\system32\sendcmsg.dll
    + 2004-08-04 08:00 . 2009-06-25 08:25 56832 c:\windows\system32\secur32.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 18944 c:\windows\system32\seclogon.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 18944 c:\windows\system32\seclogon.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 18944 c:\windows\system32\secedit.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 29184 c:\windows\system32\sdhcinst.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 29184 c:\windows\system32\sdhcinst.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 77312 c:\windows\system32\sdbinst.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 77312 c:\windows\system32\sdbinst.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 20480 c:\windows\system32\sclgntfy.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 95744 c:\windows\system32\scardsvr.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 95744 c:\windows\system32\scardsvr.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 69632 c:\windows\system32\scarddlg.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 69632 c:\windows\system32\scarddlg.dll
    + 2004-08-04 08:00 . 2009-02-06 10:39 35328 c:\windows\system32\sc.exe
    - 2004-08-04 08:00 . 2009-02-06 16:54 35328 c:\windows\system32\sc.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 13312 c:\windows\system32\savedump.exe
    - 2004-08-04 08:00 . 2004-08-04 08:00 13312 c:\windows\system32\savedump.exe
    + 2004-08-04 08:00 . 2008-04-14 00:12 64000 c:\windows\system32\samlib.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 64000 c:\windows\system32\samlib.dll
    Bern :j
  • RedBern
    RedBern Posts: 1,237 Forumite
    + 2009-06-03 19:09 . 2010-02-05 18:27 1291776 c:\windows\system32\dllcache\quartz.dll
    + 2009-10-22 15:13 . 2010-02-17 08:10 2189952 c:\windows\system32\dllcache\ntoskrnl.exe
    + 2009-10-22 15:13 . 2010-02-16 13:25 2024448 c:\windows\system32\dllcache\ntkrpamp.exe
    + 2009-02-07 18:02 . 2010-02-16 13:25 2066816 c:\windows\system32\dllcache\ntkrnlpa.exe
    + 2009-10-22 15:13 . 2010-02-16 14:08 2146304 c:\windows\system32\dllcache\ntkrnlmp.exe
    + 2008-04-14 00:12 . 2009-07-31 10:05 1372672 c:\windows\system32\dllcache\msxml6.dll
    - 2006-09-13 05:01 . 2009-07-31 04:57 1172480 c:\windows\system32\dllcache\msxml3.dll
    + 2006-09-13 05:01 . 2009-07-31 04:35 1172480 c:\windows\system32\dllcache\msxml3.dll
    + 2009-10-22 15:09 . 2010-01-29 15:01 1315328 c:\windows\system32\dllcache\msoe.dll
    + 2010-03-10 06:41 . 2009-10-23 15:28 3558912 c:\windows\system32\dllcache\moviemk.exe
    + 2004-08-04 08:00 . 2008-04-14 00:11 1504256 c:\windows\system32\diskcopy.dll
    - 2004-08-04 08:00 . 2010-04-16 15:36 1054208 c:\windows\system32\danim.dll
    + 2004-08-04 08:00 . 2008-04-14 00:11 1054208 c:\windows\system32\danim.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 1689088 c:\windows\system32\d3d9.dll
    + 2004-08-04 08:00 . 2008-04-14 00:11 1689088 c:\windows\system32\d3d9.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 1179648 c:\windows\system32\d3d8.dll
    + 2004-08-04 08:00 . 2008-04-14 00:11 1179648 c:\windows\system32\d3d8.dll
    - 2004-08-04 08:00 . 2005-07-26 04:39 1267200 c:\windows\system32\comsvcs.dll
    + 2004-08-04 08:00 . 2008-04-14 00:11 1267200 c:\windows\system32\comsvcs.dll
    + 2004-08-04 08:00 . 2008-04-14 00:11 2091520 c:\windows\system32\cdosys.dll
    + 2004-08-04 08:00 . 2008-04-14 00:11 1025024 c:\windows\system32\browseui.dll
    + 2008-04-14 00:11 . 2008-04-14 00:11 1888992 c:\windows\system32\ati3duag.dll
    + 2004-08-04 08:00 . 2008-04-14 00:11 3166208 c:\windows\srchasst\msgr3en.dll
    - 2004-08-04 08:00 . 2004-08-04 08:00 3166208 c:\windows\srchasst\msgr3en.dll
    + 2008-04-14 00:12 . 2008-04-14 00:12 1695232 c:\windows\ServicePackFiles\ServicePackCache\i386\msmsgs.exe
    + 2008-04-13 17:39 . 2008-04-13 17:39 2897920 c:\windows\ServicePackFiles\i386\xpsp2res.dll
    + 2008-04-14 00:12 . 2008-04-14 00:12 1135616 c:\windows\ServicePackFiles\i386\wuaueng.dll
    + 2008-04-14 00:12 . 2008-04-14 00:12 4256768 c:\windows\ServicePackFiles\i386\wmm2res.dll
    + 2008-04-13 16:48 . 2008-04-13 16:48 1647616 c:\windows\ServicePackFiles\i386\winbrand.dll
    + 2008-04-13 19:30 . 2008-04-13 19:30 1845632 c:\windows\ServicePackFiles\i386\win32k.sys
    + 2009-10-22 15:30 . 2004-08-04 08:00 1326080 c:\windows\ServicePackFiles\i386\webfldrs.msi
    + 2007-06-27 12:59 . 2007-06-27 12:59 1302528 c:\windows\ServicePackFiles\i386\system.xml.dll
    + 2007-06-27 12:59 . 2007-06-27 12:59 2002944 c:\windows\ServicePackFiles\i386\system.windows.forms.dll
    + 2007-12-17 12:00 . 2007-12-17 12:00 1200128 c:\windows\ServicePackFiles\i386\system.web.dll
    + 2007-06-27 12:58 . 2007-06-27 12:58 1695744 c:\windows\ServicePackFiles\i386\system.design.dll
    + 2007-06-27 12:58 . 2007-06-27 12:58 1179648 c:\windows\ServicePackFiles\i386\system.data.dll
    + 2007-12-17 11:59 . 2007-12-17 11:59 1179648 c:\windows\ServicePackFiles\i386\sy52106.dll
    + 2008-04-13 18:37 . 2008-04-13 18:37 2842112 c:\windows\ServicePackFiles\i386\sprb040d.dll
    + 2008-04-13 18:35 . 2008-04-13 18:35 2869248 c:\windows\ServicePackFiles\i386\sprb0401.dll
    + 2008-04-14 00:12 . 2008-04-14 00:12 2134528 c:\windows\ServicePackFiles\i386\smtpsnap.dll
    + 2008-04-14 00:12 . 2008-04-14 00:12 8461312 c:\windows\ServicePackFiles\i386\shell32.dll
    + 2008-04-14 00:12 . 2008-04-14 00:12 1499136 c:\windows\ServicePackFiles\i386\shdocvw.dll
    + 2008-04-14 00:12 . 2008-04-14 00:12 1614848 c:\windows\ServicePackFiles\i386\sfcfiles.dll
    + 2008-04-14 00:12 . 2008-04-14 00:12 1435648 c:\windows\ServicePackFiles\i386\query.dll
    + 2008-04-14 00:12 . 2008-04-14 00:12 1288192 c:\windows\ServicePackFiles\i386\quartz.dll
    + 2007-05-15 08:08 . 2007-05-15 08:08 1057280 c:\windows\ServicePackFiles\i386\pcl5ures.dll
    + 2007-05-15 08:08 . 2007-05-15 08:08 1058816 c:\windows\ServicePackFiles\i386\pcl5eres.dll
    + 2008-04-14 00:12 . 2008-04-14 00:12 1287168 c:\windows\ServicePackFiles\i386\ole32.dll
    + 2009-10-22 15:30 . 2004-08-03 21:29 1897408 c:\windows\ServicePackFiles\i386\nv4_mini.sys
    + 2008-04-14 00:12 . 2008-04-14 00:12 4274816 c:\windows\ServicePackFiles\i386\nv4_disp.dll
    + 2008-04-13 19:27 . 2008-04-13 19:27 2188928 c:\windows\ServicePackFiles\i386\ntoskrnl.exe
    + 2008-04-13 18:31 . 2008-04-13 18:31 2023936 c:\windows\ServicePackFiles\i386\ntkrpamp.exe
    + 2008-04-13 18:31 . 2008-04-13 18:31 2065792 c:\windows\ServicePackFiles\i386\ntkrnlpa.exe
    + 2008-04-13 19:24 . 2008-04-13 19:24 2145280 c:\windows\ServicePackFiles\i386\ntkrnlmp.exe
    + 2008-04-14 00:12 . 2008-04-14 00:12 1200640 c:\windows\ServicePackFiles\i386\ntbackup.exe
    + 2008-04-14 00:12 . 2008-04-14 00:12 1703936 c:\windows\ServicePackFiles\i386\netshell.dll
    + 2008-04-14 00:12 . 2008-04-14 00:12 1737856 c:\windows\ServicePackFiles\i386\mtxparhd.dll
    + 2009-10-22 15:30 . 2004-08-03 21:41 1309184 c:\windows\ServicePackFiles\i386\mtlstrm.sys
    + 2008-04-14 00:12 . 2008-04-14 00:12 1104896 c:\windows\ServicePackFiles\i386\msxml3.dll
    + 2008-04-14 00:12 . 2008-04-14 00:12 1428992 c:\windows\ServicePackFiles\i386\msvidctl.dll
    + 2008-04-14 00:12 . 2008-04-14 00:12 1384479 c:\windows\ServicePackFiles\i386\msvbvm60.dll
    + 2008-04-13 16:23 . 2008-04-13 16:23 2479616 c:\windows\ServicePackFiles\i386\msoeres.dll
    + 2008-04-14 00:12 . 2008-04-14 00:12 1314816 c:\windows\ServicePackFiles\i386\msoe.dll
    + 2009-10-22 15:30 . 2004-08-04 08:00 1327320 c:\windows\ServicePackFiles\i386\msnsusii.exe
    + 2009-10-22 15:30 . 2004-08-04 08:00 5080576 c:\windows\ServicePackFiles\i386\msnmsgs.msi
    + 2008-04-14 00:12 . 2008-04-14 00:12 1695232 c:\windows\ServicePackFiles\i386\msmsgs.exe
    + 2007-10-22 09:30 . 2007-10-22 09:30 1516568 c:\windows\ServicePackFiles\i386\msjet40.dll
    + 2008-04-14 00:11 . 2008-04-14 00:11 2843136 c:\windows\ServicePackFiles\i386\msi.dll
    + 2008-04-14 00:11 . 2008-04-14 00:11 3066880 c:\windows\ServicePackFiles\i386\mshtml.dll
    + 2008-04-14 00:11 . 2008-04-14 00:11 3166208 c:\windows\ServicePackFiles\i386\msgr3en.dll
    + 2007-12-17 11:59 . 2007-12-17 11:59 2281472 c:\windows\ServicePackFiles\i386\mscorwks.dll
    + 2007-12-17 11:58 . 2007-12-17 11:58 2273280 c:\windows\ServicePackFiles\i386\mscorsvr.dll
    + 2007-12-17 11:58 . 2007-12-17 11:58 1998848 c:\windows\ServicePackFiles\i386\mscorlib.dll
    + 2007-06-27 12:54 . 2007-06-27 12:54 1564672 c:\windows\ServicePackFiles\i386\mscorcfg.dll
    + 2008-04-14 00:12 . 2008-04-14 00:12 3558912 c:\windows\ServicePackFiles\i386\moviemk.exe
    + 2008-04-14 00:11 . 2008-04-14 00:11 1872896 c:\windows\ServicePackFiles\i386\mmcndmgr.dll
    + 2008-04-14 00:12 . 2008-04-14 00:12 1414656 c:\windows\ServicePackFiles\i386\mmc.exe
    + 2008-04-14 00:11 . 2008-04-14 00:11 1028096 c:\windows\ServicePackFiles\i386\mfc42.dll
    + 2008-04-14 00:11 . 2008-04-14 00:11 2061824 c:\windows\ServicePackFiles\i386\lhmstscx.dll
    + 2009-10-22 15:30 . 2004-08-03 21:41 1041536 c:\windows\ServicePackFiles\i386\hsfdpsp2.sys
    + 2008-04-14 00:12 . 2008-04-14 00:12 1033728 c:\windows\ServicePackFiles\i386\explorer.exe
    + 2008-04-14 00:11 . 2008-04-14 00:11 1082368 c:\windows\ServicePackFiles\i386\esent.dll
    + 2008-04-14 00:11 . 2008-04-14 00:11 2113536 c:\windows\ServicePackFiles\i386\dxdiagn.dll
    + 2008-04-14 00:12 . 2008-04-14 00:12 1298432 c:\windows\ServicePackFiles\i386\dxdiag.exe
    + 2008-04-14 00:11 . 2008-04-14 00:11 1227264 c:\windows\ServicePackFiles\i386\dx8vb.dll
    + 2008-04-14 00:11 . 2008-04-14 00:11 1293824 c:\windows\ServicePackFiles\i386\dsound3d.dll
    + 2008-04-14 00:11 . 2008-04-14 00:11 1504256 c:\windows\ServicePackFiles\i386\diskcopy.dll
    + 2008-04-14 00:11 . 2008-04-14 00:11 1054208 c:\windows\ServicePackFiles\i386\danim.dll
    + 2008-04-14 00:11 . 2008-04-14 00:11 1689088 c:\windows\ServicePackFiles\i386\d3d9.dll
    + 2008-04-14 00:11 . 2008-04-14 00:11 1179648 c:\windows\ServicePackFiles\i386\d3d8.dll
    + 2008-04-14 00:12 . 2008-04-14 00:12 1032192 c:\windows\ServicePackFiles\i386\conf.exe
    + 2008-04-14 00:11 . 2008-04-14 00:11 1267200 c:\windows\ServicePackFiles\i386\comsvcs.dll
    + 2008-04-14 00:11 . 2008-04-14 00:11 1358848 c:\windows\ServicePackFiles\i386\cimwin32.dll
    + 2008-04-14 00:11 . 2008-04-14 00:11 2091520 c:\windows\ServicePackFiles\i386\cdosys.dll
    + 2008-04-14 00:11 . 2008-04-14 00:11 1025024 c:\windows\ServicePackFiles\i386\browseui.dll
    + 2008-04-14 00:11 . 2008-04-14 00:11 1888992 c:\windows\ServicePackFiles\i386\ati3duag.dll
    + 2008-04-14 00:11 . 2008-04-14 00:11 1057760 c:\windows\ServicePackFiles\i386\ati3d2ag.dll
    + 2008-04-14 00:11 . 2008-04-14 00:11 1852928 c:\windows\ServicePackFiles\i386\acgenral.dll
    + 2004-08-04 08:00 . 2008-04-14 00:12 1033728 c:\windows\explorer.exe
    + 2009-10-22 15:13 . 2010-02-17 08:10 2189952 c:\windows\Driver Cache\i386\ntoskrnl.exe
    + 2009-10-22 15:13 . 2010-02-16 13:25 2024448 c:\windows\Driver Cache\i386\ntkrpamp.exe
    + 2009-02-07 18:02 . 2010-02-16 13:25 2066816 c:\windows\Driver Cache\i386\ntkrnlpa.exe
    + 2009-10-22 15:13 . 2010-02-16 14:08 2146304 c:\windows\Driver Cache\i386\ntkrnlmp.exe
    + 2004-08-04 08:00 . 2008-04-14 00:11 1852928 c:\windows\AppPatch\acgenral.dll
    + 2010-04-14 20:21 . 2009-12-08 18:11 2142720 c:\windows\$NtUninstallKB979683_0$\ntoskrnl.exe
    + 2010-04-14 20:21 . 2009-12-08 17:35 2020864 c:\windows\$NtUninstallKB979683_0$\ntkrpamp.exe
    + 2010-04-14 20:21 . 2009-12-08 17:35 2020864 c:\windows\$NtUninstallKB979683_0$\ntkrnlpa.exe
    + 2010-04-14 20:21 . 2009-12-08 18:11 2142720 c:\windows\$NtUninstallKB979683_0$\ntkrnlmp.exe
    + 2010-06-21 01:12 . 2009-08-14 12:19 1850112 c:\windows\$NtUninstallKB979559_0$\win32k.sys
    + 2010-05-13 22:09 . 2009-07-10 13:42 1315328 c:\windows\$NtUninstallKB978542_0$\msoe.dll
    - 2010-05-13 22:09 . 2009-07-10 13:42 1315328 c:\windows\$NtUninstallKB978542$\msoe.dll
    + 2010-03-11 09:01 . 2009-08-04 12:49 2142720 c:\windows\$NtUninstallKB977165-v2_0$\ntoskrnl.exe
    + 2010-03-11 09:01 . 2009-08-04 12:02 2020864 c:\windows\$NtUninstallKB977165-v2_0$\ntkrpamp.exe
    + 2010-03-11 09:01 . 2009-08-04 12:02 2020864 c:\windows\$NtUninstallKB977165-v2_0$\ntkrnlpa.exe
    + 2010-03-11 09:01 . 2009-08-04 12:49 2142720 c:\windows\$NtUninstallKB977165-v2_0$\ntkrnlmp.exe
    + 2010-06-21 01:12 . 2009-11-27 17:33 1291264 c:\windows\$NtUninstallKB975562_0$\quartz.dll
    + 2010-03-11 09:01 . 2004-08-04 08:00 3555328 c:\windows\$NtUninstallKB975561_0$\moviemk.exe
    - 2010-03-11 09:01 . 2004-08-04 08:00 3555328 c:\windows\$NtUninstallKB975561$\moviemk.exe
    + 2010-02-11 12:44 . 2009-06-03 19:27 1290752 c:\windows\$NtUninstallKB975560_0$\quartz.dll
    + 2009-11-28 12:14 . 2008-09-04 16:42 1106944 c:\windows\$NtUninstallKB973687_0$\msxml3.dll
    + 2009-11-28 12:14 . 2007-05-16 15:12 1314816 c:\windows\$NtUninstallKB973354_0$\msoe.dll
    - 2009-11-28 12:14 . 2007-05-16 15:12 1314816 c:\windows\$NtUninstallKB973354$\msoe.dll
    + 2009-11-28 12:15 . 2007-10-29 22:43 1287680 c:\windows\$NtUninstallKB971633_0$\quartz.dll
    + 2009-11-28 12:12 . 2007-02-28 09:53 2137600 c:\windows\$NtUninstallKB971486_0$\ntoskrnl.exe
    + 2009-11-28 12:12 . 2007-02-28 09:15 2017280 c:\windows\$NtUninstallKB971486_0$\ntkrpamp.exe
    + 2009-11-28 12:12 . 2007-02-28 09:15 2017280 c:\windows\$NtUninstallKB971486_0$\ntkrnlpa.exe
    + 2009-11-28 12:12 . 2007-02-28 09:53 2137600 c:\windows\$NtUninstallKB971486_0$\ntkrnlmp.exe
    + 2009-11-28 12:11 . 2007-03-08 13:47 1843584 c:\windows\$NtUninstallKB969947_0$\win32k.sys
    + 2009-11-28 12:16 . 2006-06-22 05:06 1435648 c:\windows\$NtUninstallKB969059_0$\query.dll
    - 2009-11-28 12:16 . 2006-06-22 05:06 1435648 c:\windows\$NtUninstallKB969059$\query.dll
    + 2009-11-28 12:14 . 2007-10-26 03:36 8454656 c:\windows\$NtUninstallKB967715_0$\shell32.dll
    + 2009-11-28 12:12 . 2007-06-26 06:08 1104896 c:\windows\$NtUninstallKB955069_0$\msxml3.dll
    + 2009-10-22 15:30 . 2004-08-04 08:00 11053008 c:\windows\ServicePackFiles\i386\msncli.exe
    + 2008-04-14 00:09 . 2008-04-14 00:09 13463552 c:\windows\ServicePackFiles\i386\lang\hwxjpn.dll
    .
    -- Snapshot reset to current date --
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\ypager.exe" [2005-08-31 2478080]
    "AROReminder"="c:\program files\Advanced Registry Optimizer\aro.exe" [2009-10-22 2132480]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MsmqIntCert"="mqrt.dll" [2009-06-25 177152]
    "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
    "AccelerometerSysTrayApplet"="c:\windows\system32\AccelerometerSt.exe" [2006-01-17 53248]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 761948]
    "QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-03-02 131072]
    "Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2006-02-22 40960]
    "Recguard"="c:\windows\Sminst\Recguard.exe" [2005-12-20 1187840]
    "Scheduler"="c:\windows\SMINST\Scheduler.exe" [2006-02-15 892928]
    "OrderReminder"="c:\program files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-01-30 98304]
    "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
    "btbb_wcm_McciTrayApp"="c:\program files\btbb_wcm\McciTrayApp.exe" [2005-12-29 543232]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
    "igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
    "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
    "igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
    "ConnectionCenter"="c:\program files\Citrix\ICA Client\concentr.exe" [2009-09-12 103768]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-10 417792]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-2-27 581693]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
    @="Service"

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AntiVirus Plus.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AntiVirus Plus.lnk
    backup=c:\windows\pss\AntiVirus Plus.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^update.exe]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\update.exe
    backup=c:\windows\pss\update.exeCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^Andy Peters^Start Menu^Programs^Startup^AntiVirus Plus.lnk]
    path=c:\documents and settings\Andy Peters\Start Menu\Programs\Startup\AntiVirus Plus.lnk
    backup=c:\windows\pss\AntiVirus Plus.lnkStartup

    [HKLM\~\startupfolder\C:^Documents and Settings^Andy Peters^Start Menu^Programs^Startup^TrueAssistant.lnk]
    path=c:\documents and settings\Andy Peters\Start Menu\Programs\Startup\TrueAssistant.lnk
    backup=c:\windows\pss\TrueAssistant.lnkStartup
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AntiVirus Plus

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\WINDOWS\\SMINST\\Scheduler.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\ypager.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\WINDOWS\\system32\\mqsvc.exe"=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "c:\\Program Files\\3 Mobile Broadband\\3Connect\\Wilog.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "5900:TCP"= 5900:TCP:VNC

    R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [8/21/2010 8:30 PM 28552]
    R1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\drivers\ctxusbm.sys [9/8/2009 7:13 PM 65584]
    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [8/22/2010 12:57 PM 135336]
    R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [9/20/2006 8:24 AM 87936]
    R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [6/10/2005 2:26 PM 35968]
    S3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\drivers\ewusbfake.sys [10/24/2009 9:32 AM 102656]

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
    2009-03-08 03:32 128512 ----a-w- c:\windows\system32\advpack.dll
    .
    Contents of the 'Scheduled Tasks' folder

    2010-06-01 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
    .
    .
    Supplementary Scan
    .
    uStart Page = hxxp://bt.yahoo.com
    mSearch Bar = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html
    uInternet Settings,ProxyOverride = *.local
    uSearchAssistant =
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    Trusted Zone: gov.uk\cra.monmouthshire
    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
    FF - ProfilePath - c:\documents and settings\Andy Peters\Application Data\Mozilla\Firefox\Profiles\i9lgvocl.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk
    FF - prefs.js: network.proxy.type - 0
    FF - plugin: c:\documents and settings\Andy Peters\Local Settings\Application Data\Yahoo!\BrowserPlus\2.9.2\Plugins\npybrowserplus_2.9.2.dll

    ---- FIREFOX POLICIES ----
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
    .

    **************************************************************************
    scanning hidden processes ...

    scanning hidden autostart entries ...

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe?????? ???@???????????????@? ????]??????(?@???????@

    scanning hidden files ...

    scan completed successfully
    hidden files:

    **************************************************************************
    .
    DLLs Loaded Under Running Processes

    - - - - - - - > 'explorer.exe'(4392)
    c:\windows\system32\WININET.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    .
    Completion time: 2010-08-24 18:03:27
    ComboFix-quarantined-files.txt 2010-08-24 17:03
    ComboFix2.txt 2010-08-22 12:21

    Pre-Run: 49,146,920,960 bytes free
    Post-Run: 49,114,742,784 bytes free

    - - End Of File - - 9D9E131E086E6E214E82AFE890A1ECD4
    Bern :j
This discussion has been closed.
★ ★ ★ Meet your Ambassadors

🚀 Getting Started

Hi new member!

Our Getting Started Guide will help you get the most out of the Forum

Categories

  • All Categories
  • 351K Banking & Borrowing
  • 253.1K Reduce Debt & Boost Income
  • 453.6K Spending & Discounts
  • 244K Work, Benefits & Business
  • 598.8K Mortgages, Homes & Bills
  • 176.9K Life & Family
  • 257.3K Travel & Transport
  • 1.5M Hobbies & Leisure
  • 16.1K Discuss & Feedback
  • 37.6K Read-Only Boards

Is this how you want to be seen?

We see you are using a default avatar. It takes only a few seconds to pick a picture.
Update Your Picture