Please help!!!

[Ayre13]

+ 2006-03-13 22:54:48 3,984 -c--a-r C:\WINDOWS\system32\DRVSTORE\z520sdmw_00D3F40169DE920AC43D88AA6EF98245DBB4F4A1\z520cr.sys
+ 2006-03-13 22:54:56 84,928 -c--a-r C:\WINDOWS\system32\DRVSTORE\z520sdmw_00D3F40169DE920AC43D88AA6EF98245DBB4F4A1\z520mgmt.sys
+ 2006-02-18 01:17:32 61,536 -c--a-r C:\WINDOWS\system32\DRVSTORE\z525bus_3C7F5F79E689172B34A461EC0A6F4BFC389B600F\z525bus.sys
+ 2006-02-18 01:17:54 5,840 -c--a-r C:\WINDOWS\system32\DRVSTORE\z525bus_3C7F5F79E689172B34A461EC0A6F4BFC389B600F\z525whnt.sys
+ 2006-02-18 01:17:34 6,208 -c--a-r C:\WINDOWS\system32\DRVSTORE\z525mdm2_BCF80DF43817A6E2FF54119C6253B27FE7DCAD13\z525cmnt.sys
+ 2006-02-18 01:17:36 9,264 -c--a-r C:\WINDOWS\system32\DRVSTORE\z525mdm2_BCF80DF43817A6E2FF54119C6253B27FE7DCAD13\z525mdfl.sys
+ 2006-02-18 01:17:38 97,056 -c--a-r C:\WINDOWS\system32\DRVSTORE\z525mdm2_BCF80DF43817A6E2FF54119C6253B27FE7DCAD13\z525mdm.sys
+ 2006-02-18 01:17:34 10,832 -c--a-r C:\WINDOWS\system32\DRVSTORE\z525mdmw_BCF80DF43817A6E2FF54119C6253B27FE7DCAD13\z525cm95.sys
+ 2006-02-18 01:17:34 6,208 -c--a-r C:\WINDOWS\system32\DRVSTORE\z525mdmw_BCF80DF43817A6E2FF54119C6253B27FE7DCAD13\z525cmnt.sys
+ 2006-02-18 01:17:36 4,048 -c--a-r C:\WINDOWS\system32\DRVSTORE\z525mdmw_BCF80DF43817A6E2FF54119C6253B27FE7DCAD13\z525cr.sys
+ 2006-02-18 01:17:38 97,056 -c--a-r C:\WINDOWS\system32\DRVSTORE\z525mdmw_BCF80DF43817A6E2FF54119C6253B27FE7DCAD13\z525mdm.sys
+ 2006-02-18 01:17:34 6,208 -c--a-r C:\WINDOWS\system32\DRVSTORE\z525obx2_28BEEEF3E5E976D190C8B7611E2A302AF561302E\z525cmnt.sys
+ 2006-02-18 01:17:46 86,368 -c--a-r C:\WINDOWS\system32\DRVSTORE\z525obx2_28BEEEF3E5E976D190C8B7611E2A302AF561302E\z525obex.sys
+ 2006-02-18 01:17:34 10,832 -c--a-r C:\WINDOWS\system32\DRVSTORE\z525obxw_28BEEEF3E5E976D190C8B7611E2A302AF561302E\z525cm95.sys
+ 2006-02-18 01:17:34 6,208 -c--a-r C:\WINDOWS\system32\DRVSTORE\z525obxw_28BEEEF3E5E976D190C8B7611E2A302AF561302E\z525cmnt.sys
+ 2006-02-18 01:17:36 4,048 -c--a-r C:\WINDOWS\system32\DRVSTORE\z525obxw_28BEEEF3E5E976D190C8B7611E2A302AF561302E\z525cr.sys
+ 2006-02-18 01:17:46 86,368 -c--a-r C:\WINDOWS\system32\DRVSTORE\z525obxw_28BEEEF3E5E976D190C8B7611E2A302AF561302E\z525obex.sys
+ 2006-02-18 01:17:34 6,208 -c--a-r C:\WINDOWS\system32\DRVSTORE\z525sdm2_4739E4159E316047F5F452CB07B092EFE246CEEA\z525cmnt.sys
+ 2006-02-18 01:17:44 88,560 -c--a-r C:\WINDOWS\system32\DRVSTORE\z525sdm2_4739E4159E316047F5F452CB07B092EFE246CEEA\z525mgmt.sys
+ 2006-02-18 01:17:34 10,832 -c--a-r C:\WINDOWS\system32\DRVSTORE\z525sdmw_4739E4159E316047F5F452CB07B092EFE246CEEA\z525cm95.sys
+ 2006-02-18 01:17:34 6,208 -c--a-r C:\WINDOWS\system32\DRVSTORE\z525sdmw_4739E4159E316047F5F452CB07B092EFE246CEEA\z525cmnt.sys
+ 2006-02-18 01:17:36 4,048 -c--a-r C:\WINDOWS\system32\DRVSTORE\z525sdmw_4739E4159E316047F5F452CB07B092EFE246CEEA\z525cr.sys
+ 2006-02-18 01:17:44 88,560 -c--a-r C:\WINDOWS\system32\DRVSTORE\z525sdmw_4739E4159E316047F5F452CB07B092EFE246CEEA\z525mgmt.sys
+ 2006-02-18 01:26:30 58,288 -c--a-r C:\WINDOWS\system32\DRVSTORE\z530bus_711F5B1543E0E2E75095437AAD113BA7EC90C151\z530bus.sys
+ 2006-02-18 01:26:52 5,808 -c--a-r C:\WINDOWS\system32\DRVSTORE\z530bus_711F5B1543E0E2E75095437AAD113BA7EC90C151\z530whnt.sys
+ 2006-02-18 01:26:32 6,176 -c--a-r C:\WINDOWS\system32\DRVSTORE\z530mdm2_ED2CD1341CD36120CE066D4CA433D5D6E86BD7CF\z530cmnt.sys
+ 2006-02-18 01:26:34 8,336 -c--a-r C:\WINDOWS\system32\DRVSTORE\z530mdm2_ED2CD1341CD36120CE066D4CA433D5D6E86BD7CF\z530mdfl.sys
+ 2006-02-18 01:26:36 94,064 -c--a-r C:\WINDOWS\system32\DRVSTORE\z530mdm2_ED2CD1341CD36120CE066D4CA433D5D6E86BD7CF\z530mdm.sys
+ 2006-02-18 01:26:30 10,736 -c--a-r C:\WINDOWS\system32\DRVSTORE\z530mdmw_ED2CD1341CD36120CE066D4CA433D5D6E86BD7CF\z530cm95.sys
+ 2006-02-18 01:26:32 6,176 -c--a-r C:\WINDOWS\system32\DRVSTORE\z530mdmw_ED2CD1341CD36120CE066D4CA433D5D6E86BD7CF\z530cmnt.sys
+ 2006-02-18 01:26:34 3,984 -c--a-r C:\WINDOWS\system32\DRVSTORE\z530mdmw_ED2CD1341CD36120CE066D4CA433D5D6E86BD7CF\z530cr.sys
+ 2006-02-18 01:26:36 94,064 -c--a-r C:\WINDOWS\system32\DRVSTORE\z530mdmw_ED2CD1341CD36120CE066D4CA433D5D6E86BD7CF\z530mdm.sys
+ 2006-02-18 01:26:32 6,176 -c--a-r C:\WINDOWS\system32\DRVSTORE\z530obx2_FD421C2424AE65A119ABC16012CA2153897D4825\z530cmnt.sys
+ 2006-02-18 01:26:42 83,344 -c--a-r C:\WINDOWS\system32\DRVSTORE\z530obx2_FD421C2424AE65A119ABC16012CA2153897D4825\z530obex.sys
+ 2006-02-18 01:26:30 10,736 -c--a-r C:\WINDOWS\system32\DRVSTORE\z530obxw_FD421C2424AE65A119ABC16012CA2153897D4825\z530cm95.sys
+ 2006-02-18 01:26:32 6,176 -c--a-r C:\WINDOWS\system32\DRVSTORE\z530obxw_FD421C2424AE65A119ABC16012CA2153897D4825\z530cmnt.sys
+ 2006-02-18 01:26:34 3,984 -c--a-r C:\WINDOWS\system32\DRVSTORE\z530obxw_FD421C2424AE65A119ABC16012CA2153897D4825\z530cr.sys
+ 2006-02-18 01:26:42 83,344 -c--a-r C:\WINDOWS\system32\DRVSTORE\z530obxw_FD421C2424AE65A119ABC16012CA2153897D4825\z530obex.sys
+ 2006-02-18 01:26:32 6,176 -c--a-r C:\WINDOWS\system32\DRVSTORE\z530sdm2_7CE664B8B6F578872DC59E086511B18A66B49CA3\z530cmnt.sys
+ 2006-02-18 01:26:40 85,408 -c--a-r C:\WINDOWS\system32\DRVSTORE\z530sdm2_7CE664B8B6F578872DC59E086511B18A66B49CA3\z530mgmt.sys
+ 2006-02-18 01:26:30 10,736 -c--a-r C:\WINDOWS\system32\DRVSTORE\z530sdmw_7CE664B8B6F578872DC59E086511B18A66B49CA3\z530cm95.sys
+ 2006-02-18 01:26:32 6,176 -c--a-r C:\WINDOWS\system32\DRVSTORE\z530sdmw_7CE664B8B6F578872DC59E086511B18A66B49CA3\z530cmnt.sys
+ 2006-02-18 01:26:34 3,984 -c--a-r C:\WINDOWS\system32\DRVSTORE\z530sdmw_7CE664B8B6F578872DC59E086511B18A66B49CA3\z530cr.sys
+ 2006-02-18 01:26:40 85,408 -c--a-r C:\WINDOWS\system32\DRVSTORE\z530sdmw_7CE664B8B6F578872DC59E086511B18A66B49CA3\z530mgmt.sys
+ 2007-01-02 19:26:00 61,504 -c--a-r C:\WINDOWS\system32\DRVSTORE\z535bus_DCD91EE8DEE80D3F874CFD56813F3DFB94BF1FF8\z535bus.sys
+ 2007-01-02 19:26:32 5,840 -c--a-r C:\WINDOWS\system32\DRVSTORE\z535bus_DCD91EE8DEE80D3F874CFD56813F3DFB94BF1FF8\z535whnt.sys
+ 2007-01-02 19:26:04 6,208 -c--a-r C:\WINDOWS\system32\DRVSTORE\z535mdm2_7688904778F33B0EF9607469167254DC5E912D36\z535cmnt.sys
+ 2007-01-02 19:26:06 9,328 -c--a-r C:\WINDOWS\system32\DRVSTORE\z535mdm2_7688904778F33B0EF9607469167254DC5E912D36\z535mdfl.sys
+ 2007-01-02 19:26:10 97,056 -c--a-r C:\WINDOWS\system32\DRVSTORE\z535mdm2_7688904778F33B0EF9607469167254DC5E912D36\z535mdm.sys
+ 2007-01-02 19:26:02 10,832 -c--a-r C:\WINDOWS\system32\DRVSTORE\z535mdmw_7688904778F33B0EF9607469167254DC5E912D36\z535cm95.sys
+ 2007-01-02 19:26:04 6,208 -c--a-r C:\WINDOWS\system32\DRVSTORE\z535mdmw_7688904778F33B0EF9607469167254DC5E912D36\z535cmnt.sys
+ 2007-01-02 19:26:06 4,048 -c--a-r C:\WINDOWS\system32\DRVSTORE\z535mdmw_7688904778F33B0EF9607469167254DC5E912D36\z535cr.sys
+ 2007-01-02 19:26:10 97,056 -c--a-r C:\WINDOWS\system32\DRVSTORE\z535mdmw_7688904778F33B0EF9607469167254DC5E912D36\z535mdm.sys
+ 2007-01-02 19:26:04 6,208 -c--a-r C:\WINDOWS\system32\DRVSTORE\z535obx2_2590EC095375176AC4C40E4D3DEE47BFE1D94699\z535cmnt.sys
+ 2007-01-02 19:26:18 86,368 -c--a-r C:\WINDOWS\system32\DRVSTORE\z535obx2_2590EC095375176AC4C40E4D3DEE47BFE1D94699\z535obex.sys
+ 2007-01-02 19:26:02 10,832 -c--a-r C:\WINDOWS\system32\DRVSTORE\z535obxw_2590EC095375176AC4C40E4D3DEE47BFE1D94699\z535cm95.sys
+ 2007-01-02 19:26:04 6,208 -c--a-r C:\WINDOWS\system32\DRVSTORE\z535obxw_2590EC095375176AC4C40E4D3DEE47BFE1D94699\z535cmnt.sys
+ 2007-01-02 19:26:06 4,048 -c--a-r C:\WINDOWS\system32\DRVSTORE\z535obxw_2590EC095375176AC4C40E4D3DEE47BFE1D94699\z535cr.sys
+ 2007-01-02 19:26:18 86,368 -c--a-r C:\WINDOWS\system32\DRVSTORE\z535obxw_2590EC095375176AC4C40E4D3DEE47BFE1D94699\z535obex.sys
+ 2007-01-02 19:26:04 6,208 -c--a-r C:\WINDOWS\system32\DRVSTORE\z535sdm2_B879025BB9A08B07DDC5386907E5AA1005526811\z535cmnt.sys
+ 2007-01-02 19:26:16 88,560 -c--a-r C:\WINDOWS\system32\DRVSTORE\z535sdm2_B879025BB9A08B07DDC5386907E5AA1005526811\z535mgmt.sys
+ 2007-01-02 19:26:02 10,832 -c--a-r C:\WINDOWS\system32\DRVSTORE\z535sdmw_B879025BB9A08B07DDC5386907E5AA1005526811\z535cm95.sys
+ 2007-01-02 19:26:04 6,208 -c--a-r C:\WINDOWS\system32\DRVSTORE\z535sdmw_B879025BB9A08B07DDC5386907E5AA1005526811\z535cmnt.sys
+ 2007-01-02 19:26:06 4,048 -c--a-r C:\WINDOWS\system32\DRVSTORE\z535sdmw_B879025BB9A08B07DDC5386907E5AA1005526811\z535cr.sys
+ 2007-01-02 19:26:16 88,560 -c--a-r C:\WINDOWS\system32\DRVSTORE\z535sdmw_B879025BB9A08B07DDC5386907E5AA1005526811\z535mgmt.sys
+ 2006-03-13 20:37:38 60,800 -c--a-r C:\WINDOWS\system32\DRVSTORE\z550bus_23BA2C85B1427198EB2F84794612301D31A2B517\Z550bus.sys
+ 2006-03-13 20:38:08 5,840 -c--a-r C:\WINDOWS\system32\DRVSTORE\z550bus_23BA2C85B1427198EB2F84794612301D31A2B517\Z550whnt.sys
+ 2006-03-13 20:37:40 6,208 -c--a-r C:\WINDOWS\system32\DRVSTORE\z550mdm2_9A77265F85F930344BFDF62F6EDEA9E21D13D5AB\Z550cmnt.sys
+ 2006-03-13 20:37:44 9,264 -c--a-r C:\WINDOWS\system32\DRVSTORE\z550mdm2_9A77265F85F930344BFDF62F6EDEA9E21D13D5AB\Z550mdfl.sys
+ 2006-03-13 20:37:46 96,352 -c--a-r C:\WINDOWS\system32\DRVSTORE\z550mdm2_9A77265F85F930344BFDF62F6EDEA9E21D13D5AB\Z550mdm.sys
+ 2006-03-13 20:37:40 10,832 -c--a-r C:\WINDOWS\system32\DRVSTORE\z550mdmw_9A77265F85F930344BFDF62F6EDEA9E21D13D5AB\Z550cm95.sys
+ 2006-03-13 20:37:40 6,208 -c--a-r C:\WINDOWS\system32\DRVSTORE\z550mdmw_9A77265F85F930344BFDF62F6EDEA9E21D13D5AB\Z550cmnt.sys
+ 2006-03-13 20:37:44 4,048 -c--a-r C:\WINDOWS\system32\DRVSTORE\z550mdmw_9A77265F85F930344BFDF62F6EDEA9E21D13D5AB\Z550cr.sys
+ 2006-03-13 20:37:46 96,352 -c--a-r C:\WINDOWS\system32\DRVSTORE\z550mdmw_9A77265F85F930344BFDF62F6EDEA9E21D13D5AB\Z550mdm.sys
+ 2006-03-13 20:37:40 6,208 -c--a-r C:\WINDOWS\system32\DRVSTORE\z550obx2_3CDD265B0595A0D8DFEAD7B6E194EB810CC396BE\Z550cmnt.sys
+ 2006-03-13 20:37:56 85,696 -c--a-r C:\WINDOWS\system32\DRVSTORE\z550obx2_3CDD265B0595A0D8DFEAD7B6E194EB810CC396BE\Z550obex.sys
+ 2006-03-13 20:37:40 10,832 -c--a-r C:\WINDOWS\system32\DRVSTORE\z550obxw_3CDD265B0595A0D8DFEAD7B6E194EB810CC396BE\Z550cm95.sys
+ 2006-03-13 20:37:40 6,208 -c--a-r C:\WINDOWS\system32\DRVSTORE\z550obxw_3CDD265B0595A0D8DFEAD7B6E194EB810CC396BE\Z550cmnt.sys
+ 2006-03-13 20:37:44 4,048 -c--a-r C:\WINDOWS\system32\DRVSTORE\z550obxw_3CDD265B0595A0D8DFEAD7B6E194EB810CC396BE\Z550cr.sys
+ 2006-03-13 20:37:56 85,696 -c--a-r C:\WINDOWS\system32\DRVSTORE\z550obxw_3CDD265B0595A0D8DFEAD7B6E194EB810CC396BE\Z550obex.sys
+ 2006-03-13 20:37:40 6,208 -c--a-r C:\WINDOWS\system32\DRVSTORE\z550sdm2_6381084063DC92D8EA69071ABC9237F2EE5CF158\Z550cmnt.sys
+ 2006-03-13 20:37:52 87,824 -c--a-r C:\WINDOWS\system32\DRVSTORE\z550sdm2_6381084063DC92D8EA69071ABC9237F2EE5CF158\Z550mgmt.sys
+ 2006-03-13 20:37:40 10,832 -c--a-r C:\WINDOWS\system32\DRVSTORE\z550sdmw_6381084063DC92D8EA69071ABC9237F2EE5CF158\Z550cm95.sys
+ 2006-03-13 20:37:40 6,208 -c--a-r C:\WINDOWS\system32\DRVSTORE\z550sdmw_6381084063DC92D8EA69071ABC9237F2EE5CF158\Z550cmnt.sys
+ 2006-03-13 20:37:44 4,048 -c--a-r C:\WINDOWS\system32\DRVSTORE\z550sdmw_6381084063DC92D8EA69071ABC9237F2EE5CF158\Z550cr.sys
+ 2006-03-13 20:37:52 87,824 -c--a-r C:\WINDOWS\system32\DRVSTORE\z550sdmw_6381084063DC92D8EA69071ABC9237F2EE5CF158\Z550mgmt.sys
+ 2006-08-28 19:44:40 61,504 -c--a-r C:\WINDOWS\system32\DRVSTORE\z558bus_136AB054077A57B4DC845E4307C2E0B885AC84A2\Z558bus.sys
+ 2006-08-28 19:44:58 5,840 -c--a-r C:\WINDOWS\system32\DRVSTORE\z558bus_136AB054077A57B4DC845E4307C2E0B885AC84A2\Z558whnt.sys
+ 2006-08-28 19:44:42 6,208 -c--a-r C:\WINDOWS\system32\DRVSTORE\z558mdm2_A19AC7A9C5445FA3AD13ADE06E9784DD1BEC1B2B\Z558cmnt.sys
+ 2006-08-28 19:44:44 9,328 -c--a-r C:\WINDOWS\system32\DRVSTORE\z558mdm2_A19AC7A9C5445FA3AD13ADE06E9784DD1BEC1B2B\Z558mdfl.sys
+ 2006-08-28 19:44:46 97,056 -c--a-r C:\WINDOWS\system32\DRVSTORE\z558mdm2_A19AC7A9C5445FA3AD13ADE06E9784DD1BEC1B2B\Z558mdm.sys
+ 2006-08-28 19:44:40 10,832 -c--a-r C:\WINDOWS\system32\DRVSTORE\z558mdmw_A19AC7A9C5445FA3AD13ADE06E9784DD1BEC1B2B\Z558cm95.sys
+ 2006-08-28 19:44:42 6,208 -c--a-r C:\WINDOWS\system32\DRVSTORE\z558mdmw_A19AC7A9C5445FA3AD13ADE06E9784DD1BEC1B2B\Z558cmnt.sys
+ 2006-08-28 19:44:44 4,048 -c--a-r C:\WINDOWS\system32\DRVSTORE\z558mdmw_A19AC7A9C5445FA3AD13ADE06E9784DD1BEC1B2B\Z558cr.sys
+ 2006-08-28 19:44:46 97,056 -c--a-r C:\WINDOWS\system32\DRVSTORE\z558mdmw_A19AC7A9C5445FA3AD13ADE06E9784DD1BEC1B2B\Z558mdm.sys
+ 2006-08-28 19:44:42 6,208 -c--a-r C:\WINDOWS\system32\DRVSTORE\z558obx2_3F0ADC568A28D65DE282A24556F969F90D0DF371\Z558cmnt.sys
+ 2006-08-28 19:44:50 86,368 -c--a-r C:\WINDOWS\system32\DRVSTORE\z558obx2_3F0ADC568A28D65DE282A24556F969F90D0DF371\Z558obex.sys
+ 2006-08-28 19:44:40 10,832 -c--a-r C:\WINDOWS\system32\DRVSTORE\z558obxw_3F0ADC568A28D65DE282A24556F969F90D0DF371\Z558cm95.sys
+ 2006-08-28 19:44:42 6,208 -c--a-r C:\WINDOWS\system32\DRVSTORE\z558obxw_3F0ADC568A28D65DE282A24556F969F90D0DF371\Z558cmnt.sys
+ 2006-08-28 19:44:44 4,048 -c--a-r C:\WINDOWS\system32\DRVSTORE\z558obxw_3F0ADC568A28D65DE282A24556F969F90D0DF371\Z558cr.sys
+ 2006-08-28 19:44:50 86,368 -c--a-r C:\WINDOWS\system32\DRVSTORE\z558obxw_3F0ADC568A28D65DE282A24556F969F90D0DF371\Z558obex.sys
+ 2006-08-28 19:44:42 6,208 -c--a-r C:\WINDOWS\system32\DRVSTORE\z558sdm2_9394ED7204022F0909155FC18EC385A82B466B70\Z558cmnt.sys
+ 2006-08-28 19:44:50 88,560 -c--a-r C:\WINDOWS\system32\DRVSTORE\z558sdm2_9394ED7204022F0909155FC18EC385A82B466B70\Z558mgmt.sys
+ 2006-08-28 19:44:40 10,832 -c--a-r C:\WINDOWS\system32\DRVSTORE\z558sdmw_9394ED7204022F0909155FC18EC385A82B466B70\Z558cm95.sys
+ 2006-08-28 19:44:42 6,208 -c--a-r C:\WINDOWS\system32\DRVSTORE\z558sdmw_9394ED7204022F0909155FC18EC385A82B466B70\Z558cmnt.sys
+ 2006-08-28 19:44:44 4,048 -c--a-r C:\WINDOWS\system32\DRVSTORE\z558sdmw_9394ED7204022F0909155FC18EC385A82B466B70\Z558cr.sys
+ 2006-08-28 19:44:50 88,560 -c--a-r C:\WINDOWS\system32\DRVSTORE\z558sdmw_9394ED7204022F0909155FC18EC385A82B466B70\Z558mgmt.sys
+ 2006-03-13 22:53:52 55,216 -c--a-r C:\WINDOWS\system32\DRVSTORE\z800bus_E33A4370F20B35A0E769D6A0C506521060CE196E\z800bus.sys
+ 2006-03-13 22:54:20 5,744 -c--a-r C:\WINDOWS\system32\DRVSTORE\z800bus_E33A4370F20B35A0E769D6A0C506521060CE196E\z800whnt.sys
+ 2006-03-13 22:53:54 6,144 -c--a-r C:\WINDOWS\system32\DRVSTORE\z800mdm2_EE30AC0900ED0BA0341D8C8CBF48308C879E73F4\z800cmnt.sys
+ 2006-03-13 22:53:58 6,576 -c--a-r C:\WINDOWS\system32\DRVSTORE\z800mdm2_EE30AC0900ED0BA0341D8C8CBF48308C879E73F4\z800mdfl.sys
+ 2006-03-13 22:54:00 89,872 -c--a-r C:\WINDOWS\system32\DRVSTORE\z800mdm2_EE30AC0900ED0BA0341D8C8CBF48308C879E73F4\z800mdm.sys
+ 2006-03-13 22:53:54 10,736 -c--a-r C:\WINDOWS\system32\DRVSTORE\z800mdmw_EE30AC0900ED0BA0341D8C8CBF48308C879E73F4\z800cm95.sys
+ 2006-03-13 22:53:54 6,144 -c--a-r C:\WINDOWS\system32\DRVSTORE\z800mdmw_EE30AC0900ED0BA0341D8C8CBF48308C879E73F4\z800cmnt.sys
+ 2006-03-13 22:53:58 4,048 -c--a-r C:\WINDOWS\system32\DRVSTORE\z800mdmw_EE30AC0900ED0BA0341D8C8CBF48308C879E73F4\z800cr.sys
+ 2006-03-13 22:54:00 89,872 -c--a-r C:\WINDOWS\system32\DRVSTORE\z800mdmw_EE30AC0900ED0BA0341D8C8CBF48308C879E73F4\z800mdm.sys
+ 2006-03-13 22:53:54 6,144 -c--a-r C:\WINDOWS\system32\DRVSTORE\z800obx2_2998C412471A915CA1E2DCFDC9608F2F40454CAF\z800cmnt.sys
+ 2006-03-13 22:54:08 79,488 -c--a-r C:\WINDOWS\system32\DRVSTORE\z800obx2_2998C412471A915CA1E2DCFDC9608F2F40454CAF\z800obex.sys
+ 2006-03-13 22:53:54 10,736 -c--a-r C:\WINDOWS\system32\DRVSTORE\z800obxw_2998C412471A915CA1E2DCFDC9608F2F40454CAF\z800cm95.sys
+ 2006-03-13 22:53:54 6,144 -c--a-r C:\WINDOWS\system32\DRVSTORE\z800obxw_2998C412471A915CA1E2DCFDC9608F2F40454CAF\z800cmnt.sys
+ 2006-03-13 22:53:58 4,048 -c--a-r C:\WINDOWS\system32\DRVSTORE\z800obxw_2998C412471A915CA1E2DCFDC9608F2F40454CAF\z800cr.sys
+ 2006-03-13 22:54:08 79,488 -c--a-r C:\WINDOWS\system32\DRVSTORE\z800obxw_2998C412471A915CA1E2DCFDC9608F2F40454CAF\z800obex.sys
+ 2006-03-13 22:53:54 6,144 -c--a-r C:\WINDOWS\system32\DRVSTORE\z800sdm2_86D3CFB34D4DBD0843C8BCB4E05BB71B9A4FC200\z800cmnt.sys
+ 2006-03-13 22:54:06 81,760 -c--a-r C:\WINDOWS\system32\DRVSTORE\z800sdm2_86D3CFB34D4DBD0843C8BCB4E05BB71B9A4FC200\z800mgmt.sys

[Ayre13]

+ 1999-08-09 20:51:16 40,208 ----a-w C:\WINDOWS\system32\DSETUP.DLL
- 2006-10-17 16:58:06 346,624 ----a-w C:\WINDOWS\system32\dxtmsft.dll
+ 2008-06-23 16:57:27 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll
- 2006-10-17 16:57:50 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll
+ 2008-06-23 16:57:27 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll
- 2007-02-28 23:05:26 86,016 ----a-w C:\WINDOWS\system32\ElbyCDIO.dll
+ 2007-08-10 19:56:53 93,128 ----a-w C:\WINDOWS\system32\ElbyCDIO.dll
- 2005-07-26 04:39:45 243,200 ----a-w C:\WINDOWS\system32\es.dll
+ 2008-07-07 20:32:22 253,952 ----a-w C:\WINDOWS\system32\es.dll
- 2007-06-27 14:34:51 132,608 ----a-w C:\WINDOWS\system32\extmgr.dll
+ 2008-06-23 16:57:27 133,120 ----a-w C:\WINDOWS\system32\extmgr.dll
+ 2007-08-23 22:30:00 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll
- 2007-04-05 07:11:23 254,272 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-04-10 10:27:39 317,152 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2004-08-04 10:00:00 6,144 ----a-w C:\WINDOWS\system32\ftlx041e.dll
- 2007-06-19 13:31:19 282,112 ----a-w C:\WINDOWS\system32\gdi32.dll
+ 2008-02-20 06:51:05 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
+ 2002-03-28 08:50:23 208,896 ----a-w C:\WINDOWS\system32\hpzcoi05.dll
+ 2002-03-28 08:50:23 266,240 ----a-w C:\WINDOWS\system32\hpzcon05.dll
+ 2002-03-28 08:50:26 147,512 ----a-w C:\WINDOWS\system32\hpzlnt05.dll
- 2006-10-17 16:58:20 61,952 ------w C:\WINDOWS\system32\icardie.dll
+ 2008-06-23 16:57:28 63,488 ----a-w C:\WINDOWS\system32\icardie.dll
- 2007-06-27 08:27:04 63,488 ----a-w C:\WINDOWS\system32\ie4uinit.exe
+ 2008-06-23 09:20:25 70,656 ----a-w C:\WINDOWS\system32\ie4uinit.exe
- 2007-06-27 14:34:51 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll
+ 2008-06-23 16:57:29 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll
- 2007-06-27 14:34:51 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll
+ 2008-06-23 16:57:29 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll
- 2007-06-27 07:00:33 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll
+ 2008-06-21 05:23:54 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll
- 2007-06-27 14:34:51 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
+ 2008-06-23 16:57:29 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
- 2007-06-27 14:34:51 384,512 ----a-w C:\WINDOWS\system32\iedkcs32.dll
+ 2008-06-23 16:57:29 384,512 ----a-w C:\WINDOWS\system32\iedkcs32.dll
- 2007-06-27 14:34:55 6,058,496 ----a-w C:\WINDOWS\system32\ieframe.dll
+ 2008-06-23 16:57:33 6,066,176 ----a-w C:\WINDOWS\system32\ieframe.dll
- 2007-06-27 14:34:55 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll
+ 2008-06-23 16:57:33 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll
- 2007-06-27 14:34:55 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
+ 2008-06-23 16:57:34 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
- 2007-06-27 08:27:05 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
+ 2008-06-23 09:20:26 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
- 2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
+ 2008-04-11 18:50:43 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
+ 2000-05-31 13:39:44 588,288 ----a-w C:\WINDOWS\system32\IPX32d56.dll
- 2007-03-14 04:31:24 135,168 ----a-w C:\WINDOWS\system32\java.exe
+ 2008-06-10 05:21:01 135,168 ----a-w C:\WINDOWS\system32\java.exe
- 2007-03-14 04:31:28 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
+ 2008-06-10 05:21:04 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
- 2007-03-14 06:04:46 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2008-06-10 06:32:34 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
- 2007-06-27 14:34:56 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll
+ 2008-06-23 16:57:35 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll
- 2005-05-17 00:34:48 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2005-05-24 16:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
- 2006-03-20 18:17:24 65,536 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 19:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
- 2006-03-20 18:17:20 798,720 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
+ 2007-08-29 19:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
+ 2004-08-04 10:00:00 5,632 ----a-w C:\WINDOWS\system32\kbda1.dll
+ 2004-08-04 10:00:00 5,632 ----a-w C:\WINDOWS\system32\kbda2.dll
+ 2004-08-04 10:00:00 5,632 ----a-w C:\WINDOWS\system32\kbda3.dll
+ 2004-08-04 10:00:00 5,120 ----a-w C:\WINDOWS\system32\kbdarme.dll
+ 2004-08-04 10:00:00 5,120 ----a-w C:\WINDOWS\system32\kbdarmw.dll
+ 2004-08-04 10:00:00 5,632 ----a-w C:\WINDOWS\system32\kbddiv1.dll
+ 2004-08-04 10:00:00 5,632 ----a-w C:\WINDOWS\system32\kbddiv2.dll
+ 2004-08-04 10:00:00 5,632 ----a-w C:\WINDOWS\system32\kbdfa.dll
+ 2004-08-04 10:00:00 5,120 ----a-w C:\WINDOWS\system32\kbdgeo.dll
+ 2004-08-04 10:00:00 5,632 ----a-w C:\WINDOWS\system32\kbdheb.dll
+ 2004-08-04 10:00:00 5,632 ----a-w C:\WINDOWS\system32\kbdindev.dll
+ 2004-08-04 10:00:00 5,632 ----a-w C:\WINDOWS\system32\kbdinguj.dll
+ 2004-08-04 10:00:00 5,632 ----a-w C:\WINDOWS\system32\kbdinhin.dll
+ 2004-08-04 10:00:00 5,632 ----a-w C:\WINDOWS\system32\kbdinkan.dll
+ 2004-08-04 10:00:00 5,632 ----a-w C:\WINDOWS\system32\kbdinmar.dll
+ 2004-08-04 10:00:00 6,144 ----a-w C:\WINDOWS\system32\kbdinpun.dll
+ 2004-08-04 10:00:00 5,632 ----a-w C:\WINDOWS\system32\kbdintam.dll
+ 2004-08-04 10:00:00 5,632 ----a-w C:\WINDOWS\system32\kbdintel.dll
+ 2004-08-04 10:00:00 5,632 ----a-w C:\WINDOWS\system32\kbdsyr1.dll
+ 2004-08-04 10:00:00 5,632 ----a-w C:\WINDOWS\system32\kbdsyr2.dll
+ 2004-08-04 10:00:00 5,632 ----a-w C:\WINDOWS\system32\kbdth0.dll
+ 2004-08-04 10:00:00 5,632 ----a-w C:\WINDOWS\system32\kbdth1.dll
+ 2004-08-04 10:00:00 6,144 ----a-w C:\WINDOWS\system32\kbdth2.dll
+ 2004-08-04 10:00:00 6,144 ----a-w C:\WINDOWS\system32\kbdth3.dll
+ 2004-08-04 10:00:00 5,632 ----a-w C:\WINDOWS\system32\kbdurdu.dll
+ 2004-08-04 10:00:00 5,632 ----a-w C:\WINDOWS\system32\kbdusa.dll
+ 2004-08-04 10:00:00 5,632 ----a-w C:\WINDOWS\system32\kbdvntc.dll
+ 2004-08-04 10:00:00 2,000 ----a-w C:\WINDOWS\system32\keyboard.drv
+ 2004-08-04 10:00:00 221,600 ----a-w C:\WINDOWS\system32\lanman.drv
- 2006-08-17 12:28:27 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
+ 2007-11-07 09:26:56 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
+ 2004-08-04 10:00:00 2,560 ----a-w C:\WINDOWS\system32\lz32.dll
- 2006-09-04 04:10:30 54,960 ----a-w C:\WINDOWS\system32\Macromed\Director\SwDir.dll
+ 2007-08-07 22:20:44 182,248 ----a-w C:\WINDOWS\system32\Macromed\Director\SwDir.dll
+ 2007-08-07 22:21:02 55,272 ----a-w C:\WINDOWS\system32\Macromed\Director\SwDnld.exe
+ 2007-12-03 20:39:18 112,016 ----a-w C:\WINDOWS\system32\Macromed\Download\Download.dll
+ 2007-12-04 00:39:16 67,984 ----a-w C:\WINDOWS\system32\Macromed\Download\Download.exe
+ 2007-12-03 20:39:18 59,717 ----a-w C:\WINDOWS\system32\Macromed\Download\Install.exe
+ 2007-04-12 23:59:10 10,240 ----a-w C:\WINDOWS\system32\Macromed\Download\RestartIEUser.exe
+ 2008-03-25 02:32:44 218,496 ----a-r C:\WINDOWS\system32\Macromed\Flash\FlashUtil9f.exe
+ 2008-03-25 00:21:00 2,889,088 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
+ 2008-03-25 00:21:00 218,496 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2008-09-10 14:29:33 74,137 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
- 2006-09-20 22:42:22 585,728 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\Control.dll
+ 2007-08-07 18:35:56 585,728 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\Control.dll
- 2006-09-03 18:11:18 1,490,944 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\dirapi.dll
+ 2007-08-07 18:19:40 1,490,944 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\dirapi.dll
- 2006-09-03 18:13:02 24,576 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\DynaPlayer.dll
+ 2007-08-07 18:36:32 24,576 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\DynaPlayer.dll
+ 2007-08-07 21:52:32 1,113,600 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\gi.dll
+ 2007-08-07 18:08:48 52,288 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\gtapi.dll
- 2006-09-23 17:18:28 606,208 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\iml32.dll
+ 2007-08-07 18:17:24 606,208 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\iml32.dll
- 2006-09-21 12:29:32 339,968 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\Plugin.dll
+ 2007-08-07 18:35:22 339,968 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\Plugin.dll
- 2006-09-21 12:29:36 483,328 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\PluginPing.dll
+ 2007-08-07 18:35:32 483,328 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\PluginPing.dll
- 2006-09-03 18:13:06 180,224 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\Proj.dll
+ 2007-08-07 18:28:38 180,224 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\Proj.dll
+ 2007-08-07 22:20:28 391,144 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\SwHelper_1020023.exe
- 2006-09-19 02:03:02 73,728 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\SwInit.exe
+ 2007-08-07 18:37:56 77,824 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\SwInit.exe
- 2006-09-19 02:02:58 86,016 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\SwMenu.dll
+ 2007-08-07 18:35:18 86,016 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\SwMenu.dll
- 2006-09-19 02:03:00 98,304 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\SwOnce.dll
+ 2007-08-07 18:37:58 98,304 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\SwOnce.dll
+ 2007-08-07 18:08:46 50,808 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\SYMCCHECKER.DLL
+ 2004-08-04 10:00:00 73,376 ----a-w C:\WINDOWS\system32\mciavi.drv
+ 1998-08-17 09:21:54 11,776 ----a-w C:\WINDOWS\system32\mciqtz.drv
+ 2004-08-04 10:00:00 25,264 ----a-w C:\WINDOWS\system32\mciseq.drv
+ 2004-08-04 10:00:00 28,160 ----a-w C:\WINDOWS\system32\mciwave.drv
+ 1996-02-27 16:03:28 448,000 ----a-w C:\WINDOWS\system32\mm32DCMP.DLL
+ 2004-08-04 10:00:00 2,032 ----a-w C:\WINDOWS\system32\mouse.drv
- 2007-09-06 02:50:42 17,474,680 ----a-w C:\WINDOWS\system32\MRT.exe
+ 2008-08-26 20:28:12 16,208,504 ----a-w C:\WINDOWS\system32\MRT.exe
+ 2004-08-04 10:00:00 20,480 ----a-w C:\WINDOWS\system32\msacm32.drv
- 2005-06-29 01:46:00 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
+ 2008-06-24 16:23:05 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
- 2006-12-22 16:28:14 271,360 ----a-w C:\WINDOWS\system32\mscoree.dll
+ 2007-10-24 05:47:38 282,112 ----a-w C:\WINDOWS\system32\mscoree.dll
- 2004-07-15 04:34:06 16,896 ----a-w C:\WINDOWS\system32\mscorier.dll
+ 2007-10-24 05:47:38 158,720 ----a-w C:\WINDOWS\system32\mscorier.dll
- 2003-02-21 00:09:14 106,496 ----a-w C:\WINDOWS\system32\mscories.dll
+ 2007-10-24 05:47:38 84,480 ----a-w C:\WINDOWS\system32\mscories.dll
- 2004-08-04 10:00:00 294,400 ----a-w C:\WINDOWS\system32\MSCTF.dll
+ 2008-02-26 11:59:50 294,912 ----a-w C:\WINDOWS\system32\msctf.dll
- 2004-08-04 10:00:00 512,029 ----a-w C:\WINDOWS\system32\msexch40.dll
+ 2008-03-25 04:50:28 518,944 ----a-w C:\WINDOWS\system32\msexch40.dll
- 2004-08-04 10:00:00 319,517 ----a-w C:\WINDOWS\system32\msexcl40.dll
+ 2008-03-25 04:50:30 326,432 ----a-w C:\WINDOWS\system32\msexcl40.dll
- 2007-06-27 14:34:56 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
+ 2008-06-23 16:57:36 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
- 2007-06-27 14:34:56 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
+ 2008-06-23 16:57:36 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll
+ 2004-08-04 10:00:00 188,416 ----a-w C:\WINDOWS\system32\msh261.drv
+ 2004-08-04 10:00:00 294,912 ----a-w C:\WINDOWS\system32\msh263.drv
- 2007-07-19 06:59:59 3,583,488 ----a-w C:\WINDOWS\system32\mshtml.dll
+ 2008-06-24 14:57:40 3,592,192 ----a-w C:\WINDOWS\system32\mshtml.dll
- 2007-06-27 14:34:57 477,696 ----a-w C:\WINDOWS\system32\mshtmled.dll
+ 2008-06-23 16:57:39 477,696 ----a-w C:\WINDOWS\system32\mshtmled.dll
- 2004-08-04 10:00:00 1,507,356 ----a-w C:\WINDOWS\system32\msjet40.dll
+ 2008-03-25 04:50:34 1,516,568 ----a-w C:\WINDOWS\system32\msjet40.dll
- 2004-08-04 10:00:00 358,976 ----a-w C:\WINDOWS\system32\msjetoledb40.dll
+ 2008-03-25 04:50:40 355,112 ----a-w C:\WINDOWS\system32\msjetoledb40.dll
- 2004-08-04 10:00:00 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
+ 2008-03-27 08:12:54 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
- 2004-08-04 10:00:00 53,279 ----a-w C:\WINDOWS\system32\msjter40.dll
+ 2008-03-25 04:50:42 60,192 ----a-w C:\WINDOWS\system32\msjter40.dll
- 2004-08-04 10:00:00 241,693 ----a-w C:\WINDOWS\system32\msjtes40.dll
+ 2008-03-25 04:50:42 248,608 ----a-w C:\WINDOWS\system32\msjtes40.dll
- 2004-08-04 10:00:00 213,023 ----a-w C:\WINDOWS\system32\msltus40.dll
+ 2008-03-25 04:50:44 219,936 ----a-w C:\WINDOWS\system32\msltus40.dll
- 2004-08-04 10:00:00 348,189 ----a-w C:\WINDOWS\system32\mspbde40.dll
+ 2008-03-25 04:50:45 355,104 ----a-w C:\WINDOWS\system32\mspbde40.dll
- 2007-06-27 14:34:58 193,024 ----a-w C:\WINDOWS\system32\msrating.dll
+ 2008-06-23 16:57:39 193,024 ----a-w C:\WINDOWS\system32\msrating.dll
- 2004-08-04 10:00:00 421,919 ----a-w C:\WINDOWS\system32\msrd2x40.dll
+ 2008-03-25 04:50:47 432,928 ----a-w C:\WINDOWS\system32\msrd2x40.dll
- 2004-08-04 10:00:00 315,423 ----a-w C:\WINDOWS\system32\msrd3x40.dll
+ 2008-03-25 04:50:49 322,336 ----a-w C:\WINDOWS\system32\msrd3x40.dll
- 2004-08-04 10:00:00 552,989 ----a-w C:\WINDOWS\system32\msrepl40.dll
+ 2008-03-25 04:50:52 559,904 ----a-w C:\WINDOWS\system32\msrepl40.dll
- 2000-05-24 03:45:58 118,784 ----a-w C:\WINDOWS\system32\MSSTDFMT.DLL
+ 2000-04-04 00:05:58 118,784 ----a-w C:\WINDOWS\system32\msstdfmt.dll
- 2004-08-04 10:00:00 258,077 ----a-w C:\WINDOWS\system32\mstext40.dll
+ 2008-03-25 04:50:55 264,992 ----a-w C:\WINDOWS\system32\mstext40.dll
- 2007-06-27 14:34:58 671,232 ----a-w C:\WINDOWS\system32\mstime.dll
+ 2008-06-23 16:57:40 671,232 ----a-w C:\WINDOWS\system32\mstime.dll
- 2004-08-04 10:00:00 1,392,671 ----a-w C:\WINDOWS\system32\msvbvm60.dll
+ 2004-02-23 04:00:00 1,386,496 ----a-w C:\WINDOWS\system32\MSVBVM60.DLL
- 2004-08-04 10:00:00 831,519 ----a-w C:\WINDOWS\system32\mswdat10.dll
+ 2008-03-25 04:50:57 838,432 ----a-w C:\WINDOWS\system32\mswdat10.dll
- 2004-08-04 10:00:00 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
+ 2008-06-20 17:41:10 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
- 2004-08-04 10:00:00 614,429 ----a-w C:\WINDOWS\system32\mswstr10.dll
+ 2008-03-25 04:50:58 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
- 2004-08-04 10:00:00 348,189 ----a-w C:\WINDOWS\system32\msxbde40.dll
+ 2008-03-25 04:50:58 355,104 ----a-w C:\WINDOWS\system32\msxbde40.dll
- 2007-07-30 23:19:10 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
+ 2008-07-19 02:07:34 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
- 2006-12-22 17:02:36 6,144 ----a-w C:\WINDOWS\system32\mui\0409\mscorees.dll
+ 2007-10-24 05:47:44 15,360 ----a-w C:\WINDOWS\system32\mui\0409\mscorees.dll
- 2007-07-30 23:19:04 207,736 ----a-w C:\WINDOWS\system32\muweb.dll
+ 2008-07-19 02:07:32 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
- 2007-06-27 14:34:58 102,400 ----a-w C:\WINDOWS\system32\occache.dll
+ 2008-06-23 16:57:40 102,912 ----a-w C:\WINDOWS\system32\occache.dll
+ 2003-04-09 00:38:12 663,552 ----a-w C:\WINDOWS\system32\OEPicker.dll
- 2007-05-17 11:28:05 549,376 ----a-w C:\WINDOWS\system32\oleaut32.dll
+ 2007-12-04 18:38:13 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
- 2007-03-15 07:21:39 61,188 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-04-12 07:18:02 71,952 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2007-03-15 07:21:39 399,522 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-04-12 07:18:02 425,500 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-12-27 21:53:30 278,528 ----a-w C:\WINDOWS\system32\pncrt.dll
- 2006-10-17 16:58:08 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll
+ 2008-06-23 16:57:40 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll
+ 2003-04-09 00:38:34 323,584 ----a-w C:\WINDOWS\system32\PowerPlugsOEDll.dll
- 2005-08-30 03:54:26 1,287,168 ----a-w C:\WINDOWS\system32\quartz.dll
+ 2008-05-07 05:18:48 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
- 2004-08-04 10:00:00 581,120 ----a-w C:\WINDOWS\system32\rpcrt4.dll
+ 2007-07-09 13:16:16 582,656 ----a-w C:\WINDOWS\system32\rpcrt4.dll
+ 2008-01-10 18:49:32 870,452 ----a-w C:\WINDOWS\system32\schematic.scr
- 2006-12-19 21:52:18 8,453,632 ----a-w C:\WINDOWS\system32\shell32.dll
+ 2007-10-26 03:34:01 8,460,288 ----a-w C:\WINDOWS\system32\shell32.dll
- 2007-01-19 16:53:04 51,056 ----a-w C:\WINDOWS\system32\sirenacm.dll
+ 2007-10-18 15:31:46 51,224 ----a-w C:\WINDOWS\system32\sirenacm.dll
+ 2008-07-19 02:10:20 36,552 ----a-w C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.2.6001.784\wups.dll
+ 2008-07-19 02:10:40 45,768 ----a-w C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.2.6001.784\wups2.dll
+ 2004-08-04 10:00:00 1,744 ----a-w C:\WINDOWS\system32\sound.drv
- 2006-12-10 18:10:02 14,640 ------w C:\WINDOWS\system32\spmsg.dll
+ 2007-11-30 12:39:22 17,272 ------w C:\WINDOWS\system32\spmsg.dll
+ 2002-03-28 08:50:30 37,206 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpf2y405.dat
+ 2002-03-28 08:50:23 118,784 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpz2ku05.dll
+ 2002-03-28 08:50:29 245,760 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpzcfg05.exe
+ 2002-03-28 08:50:23 208,896 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpzcoi05.dll
+ 2002-03-28 08:50:23 266,240 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpzcon05.dll
+ 2002-03-28 08:50:29 798,720 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpzeng05.exe
+ 2002-03-28 08:50:24 2,625,536 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpzimb05.dll
+ 2002-03-28 08:50:25 200,704 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpzime05.dll
+ 2002-03-28 08:50:26 192,512 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpzjui05.dll
+ 2002-03-28 08:50:26 147,512 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpzlnt05.dll
+ 2002-03-28 08:50:26 290,816 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpzntp05.dll
+ 2002-03-28 08:50:26 135,168 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpzpcl05.dll
+ 2002-03-28 08:50:29 286,720 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpzpre05.exe
+ 2002-03-28 08:50:27 7,401,472 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpzr3205.dll
+ 2002-03-28 08:50:28 405,504 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpzrp305.dll
+ 2002-03-28 08:50:29 372,736 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpzstc05.exe
+ 2002-03-28 08:50:29 172,032 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpzstw05.exe
+ 2002-03-28 08:50:28 73,728 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztbi05.dll
+ 2002-03-28 08:50:30 188,416 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztbu05.exe
+ 2002-03-28 08:50:30 425,984 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztbx05.exe
+ 2002-03-28 08:50:30 188,416 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
+ 2002-03-28 08:50:30 37,206 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\hewlett_packarddeskjd18c\hpf2y405.dat
+ 2002-03-28 08:50:23 118,784 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hewlett_packarddeskjd18c\hpz2ku05.dll
+ 2002-03-28 08:50:29 245,760 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hewlett_packarddeskjd18c\hpzcfg05.exe
+ 2002-03-28 08:50:23 208,896 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hewlett_packarddeskjd18c\hpzcoi05.dll
+ 2002-03-28 08:50:23 266,240 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hewlett_packarddeskjd18c\hpzcon05.dll
+ 2002-03-28 08:50:29 798,720 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hewlett_packarddeskjd18c\hpzeng05.exe
+ 2002-03-28 08:50:24 2,625,536 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hewlett_packarddeskjd18c\hpzimb05.dll
+ 2002-03-28 08:50:25 200,704 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hewlett_packarddeskjd18c\hpzime05.dll
+ 2002-03-28 08:50:26 192,512 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hewlett_packarddeskjd18c\hpzjui05.dll
+ 2002-03-28 08:50:26 147,512 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hewlett_packarddeskjd18c\hpzlnt05.dll
+ 2002-03-28 08:50:26 290,816 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hewlett_packarddeskjd18c\hpzntp05.dll
+ 2002-03-28 08:50:26 135,168 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hewlett_packarddeskjd18c\hpzpcl05.dll
+ 2002-03-28 08:50:29 286,720 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hewlett_packarddeskjd18c\hpzpre05.exe
+ 2002-03-28 08:50:27 7,401,472 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hewlett_packarddeskjd18c\hpzr3205.dll
+ 2002-03-28 08:50:28 405,504 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hewlett_packarddeskjd18c\hpzrp305.dll
+ 2002-03-28 08:50:29 372,736 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hewlett_packarddeskjd18c\hpzstc05.exe
+ 2002-03-28 08:50:29 172,032 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hewlett_packarddeskjd18c\hpzstw05.exe
+ 2002-03-28 08:50:28 73,728 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hewlett_packarddeskjd18c\hpztbi05.dll
+ 2002-03-28 08:50:30 188,416 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hewlett_packarddeskjd18c\hpztbu05.exe
+ 2002-03-28 08:50:30 425,984 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hewlett_packarddeskjd18c\hpztbx05.exe
+ 2002-03-28 08:50:30 37,206 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\hpf2y405.dat
+ 2002-03-28 08:50:23 118,784 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hpz2ku05.dll
+ 2002-03-28 08:50:29 245,760 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hpzcfg05.exe
+ 2002-03-28 08:50:23 208,896 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hpzcoi05.dll
+ 2002-03-28 08:50:23 266,240 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hpzcon05.dll
+ 2002-03-28 08:50:29 798,720 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hpzeng05.exe
+ 2002-03-28 08:50:24 2,625,536 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hpzimb05.dll
+ 2002-03-28 08:50:25 200,704 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hpzime05.dll
+ 2002-03-28 08:50:26 192,512 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hpzjui05.dll
+ 2002-03-28 08:50:26 147,512 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hpzlnt05.dll
+ 2002-03-28 08:50:26 290,816 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hpzntp05.dll
+ 2002-03-28 08:50:26 135,168 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hpzpcl05.dll
+ 2002-03-28 08:50:29 286,720 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hpzpre05.exe
+ 2002-03-28 08:50:27 7,401,472 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hpzr3205.dll
+ 2002-03-28 08:50:28 405,504 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hpzrp305.dll
+ 2002-03-28 08:50:29 372,736 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hpzstc05.exe
+ 2002-03-28 08:50:29 172,032 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hpzstw05.exe
+ 2002-03-28 08:50:28 73,728 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hpztbi05.dll
+ 2002-03-28 08:50:30 188,416 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hpztbu05.exe
+ 2002-03-28 08:50:30 425,984 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\hpztbx05.exe
+ 2004-08-04 10:00:00 3,360 ----a-w C:\WINDOWS\system32\system.drv
+ 2004-08-04 10:00:00 185,344 ----a-w C:\WINDOWS\system32\Thawbrkr.dll
+ 2004-08-04 10:00:00 4,048 ----a-w C:\WINDOWS\system32\timer.drv
- 2007-07-18 12:42:22 60,416 ------w C:\WINDOWS\system32\tzchange.exe
+ 2008-07-14 11:09:18 62,976 ------w C:\WINDOWS\system32\tzchange.exe
- 2007-06-27 14:34:58 105,984 ----a-w C:\WINDOWS\system32\url.dll
+ 2008-06-23 16:57:40 105,984 ----a-w C:\WINDOWS\system32\url.dll
- 2007-06-27 14:34:58 1,152,000 ----a-w C:\WINDOWS\system32\urlmon.dll
+ 2008-06-23 16:57:40 1,159,680 ----a-w C:\WINDOWS\system32\urlmon.dll
+ 2004-08-04 10:00:00 2,176 ----a-w C:\WINDOWS\system32\vga.drv
+ 2007-02-28 21:45:18 2,272 ----a-w C:\WINDOWS\system32\w95inf16.dll
+ 2004-08-04 05:56:58 23,552 ----a-w C:\WINDOWS\system32\wdmaud.drv
- 2007-06-27 14:34:59 232,960 ----a-w C:\WINDOWS\system32\webcheck.dll
+ 2008-06-23 16:57:41 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll
+ 2004-08-04 10:00:00 13,600 ----a-w C:\WINDOWS\system32\wfwnet.drv
- 2007-03-08 13:47:48 1,843,584 ----a-w C:\WINDOWS\system32\win32k.sys
+ 2008-03-19 09:47:00 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
+ 1994-09-21 05:00:00 12,800 ----a-w C:\WINDOWS\system32\WING32.DLL
- 2007-06-27 14:34:59 823,808 ----a-w C:\WINDOWS\system32\wininet.dll
+ 2008-06-23 16:57:41 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
+ 2004-08-04 10:00:00 2,864 ----a-w C:\WINDOWS\system32\winsock.dll
+ 2004-08-04 10:00:00 146,432 ----a-w C:\WINDOWS\system32\winspool.drv
+ 2004-08-04 10:00:00 2,112 ----a-w C:\WINDOWS\system32\winspool.exe
- 2006-10-19 02:47:18 222,208 ----a-w C:\WINDOWS\system32\wmasf.dll
+ 2007-10-27 22:40:30 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
- 2006-10-19 02:47:20 295,936 ------w C:\WINDOWS\system32\wmpeffects.dll
+ 2008-06-24 22:12:58 295,936 ------w C:\WINDOWS\system32\wmpeffects.dll
+ 2004-08-04 10:00:00 2,736 ----a-w C:\WINDOWS\system32\wowdeb.exe
- 2007-07-30 23:19:36 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
+ 2008-07-19 02:09:44 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
- 2007-07-30 23:19:16 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
+ 2008-07-19 02:10:42 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
- 2007-07-30 23:19:42 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll
+ 2008-07-19 02:09:42 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
- 2007-07-30 23:19:32 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
+ 2008-07-19 02:09:46 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
- 2007-07-30 23:18:40 33,624 ----a-w C:\WINDOWS\system32\wups.dll
+ 2008-07-19 02:10:20 36,552 ----a-w C:\WINDOWS\system32\wups.dll
- 2007-07-30 23:19:12 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
+ 2008-07-19 02:10:40 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
- 2007-07-30 23:19:28 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
+ 2008-07-19 02:09:44 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
+ 2006-02-03 12:41:26 14,032 ----a-w C:\WINDOWS\system32\x3daudio1_0.dll
+ 2006-09-28 20:03:28 15,128 ----a-w C:\WINDOWS\system32\x3daudio1_1.dll
+ 2006-02-03 12:42:06 230,096 ----a-w C:\WINDOWS\system32\xactengine2_0.dll
+ 2006-03-31 16:39:48 229,584 ----a-w C:\WINDOWS\system32\xactengine2_1.dll
+ 2006-05-31 11:24:16 230,168 ----a-w C:\WINDOWS\system32\xactengine2_2.dll
+ 2006-07-28 13:30:32 236,824 ----a-w C:\WINDOWS\system32\xactengine2_3.dll
+ 2006-09-28 20:05:56 237,848 ----a-w C:\WINDOWS\system32\xactengine2_4.dll
+ 2006-03-31 16:39:24 62,672 ----a-w C:\WINDOWS\system32\xinput1_1.dll
+ 2006-07-28 13:30:14 62,744 ----a-w C:\WINDOWS\system32\xinput1_2.dll
+ 2006-09-28 20:04:02 68,888 ----a-w C:\WINDOWS\system32\xinput1_3.dll
+ 2005-12-05 22:07:30 61,136 ----a-w C:\WINDOWS\system32\xinput9_1_0.dll
- 2007-03-09 11:28:00 248,320 ----a-w C:\WINDOWS\system32\xpsp3res.dll
+ 2007-10-29 10:04:03 350,720 ----a-w C:\WINDOWS\system32\xpsp3res.dll
+ 2008-01-10 18:46:43 322,304 ----a-w C:\WINDOWS\system32\zz_assembly.scr
+ 2008-01-10 18:49:06 289,508 ----a-w C:\WINDOWS\system32\zz_fast_logo.scr
+ 2008-09-20 23:42:12 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_21c.dat
+ 2000-08-31 12:00:00 49,152 ----a-w C:\WINDOWS\VFind.exe
+ 2008-04-12 07:16:22 8,192 ----a-w C:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2006-12-02 02:56:00 96,256 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
+ 2007-10-24 05:47:56 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\msvcm80.dll
+ 2007-10-24 05:47:56 558,080 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\msvcp80.dll
+ 2007-10-24 05:47:56 635,904 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\msvcr80.dll
+ 2005-09-23 11:29:16 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcm80.dll
+ 2005-09-23 11:29:16 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcp80.dll
+ 2005-09-23 11:29:16 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcr80.dll
+ 2006-12-02 02:54:32 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
+ 2006-12-02 02:54:34 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
+ 2006-12-02 02:54:32 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
+ 2006-12-02 04:25:52 1,101,824 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
+ 2006-12-02 04:25:56 1,093,120 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
+ 2006-12-02 04:25:58 69,632 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
+ 2006-12-02 04:26:00 57,856 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
+ 2006-12-02 04:08:00 40,960 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
+ 2006-12-02 04:08:00 45,056 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
+ 2006-12-02 04:08:00 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
+ 2006-12-02 04:08:00 57,344 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
+ 2006-12-02 04:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
+ 2006-12-02 04:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
+ 2006-12-02 04:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
+ 2006-12-02 04:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
+ 2006-12-02 04:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
+ 2006-12-02 04:46:44 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
+ 2008-04-15 17:54:19 1,724,416 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll
+ 2008-04-12 07:17:10 258,048 ----a-w C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2008-04-12 07:17:10 113,664 ----a-w C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
+ 2000-08-31 12:00:00 68,096 ----a-w C:\WINDOWS\zip.exe
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-08 68856]
"WeatherEye"="C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye.exe" [2008-05-30 4501912]
"OEPowerPlugs"="C:\Program Files\PowerPlugs\Outlook Express Stationery\OLExp\winoeinit.exe" [2002-11-14 33027]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-03-28 593920]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-12-07 30208]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-05-18 49152]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe" [2002-03-28 188416]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-09-17 1235736]

C:\Documents and Settings\Amie\Start Menu\Programs\Startup\
wkcalrem.LNK - C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2006-06-05 21504]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-08-31 24576]
Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-05-03 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll muwmta.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-09-17 97928]
R2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-09-17 875288]
R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-09-17 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-09-17 76040]
S3 se59bus;Sony Ericsson Device 089 driver (WDM);C:\WINDOWS\system32\DRIVERS\se59bus.sys [2006-09-05 61536]
S3 se59mdfl;Sony Ericsson Device 089 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\se59mdfl.sys [2006-09-05 9360]
S3 se59mdm;Sony Ericsson Device 089 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\se59mdm.sys [2006-09-05 97088]
S3 se59mgmt;Sony Ericsson Device 089 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\se59mgmt.sys [2006-09-05 88624]
S3 se59nd5;Sony Ericsson Device 089 USB Ethernet Emulation SEMC59 (NDIS);C:\WINDOWS\system32\DRIVERS\se59nd5.sys [2006-09-05 18704]
S3 se59obex;Sony Ericsson Device 089 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\se59obex.sys [2006-09-05 86432]
S3 se59unic;Sony Ericsson Device 089 USB Ethernet Emulation SEMC59 (WDM);C:\WINDOWS\system32\DRIVERS\se59unic.sys [2006-09-05 90800]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{feaa600f-c1d2-11dc-b42e-0016767d3ef9}]
\Shell\AutoRun\command - E:\DigitalPhotoKeychain.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{61E3FE32-07B9-4563-A3E0-2DE2D620FE10}]
C:\Program Files\PixiePack Codec Pack\InstallerHelper.exe
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

BHO-{06FB19CB-2B74-40ED-9A1C-A05052A9C0E3} - C:\WINDOWS\vmgspntbqvm.dll
BHO-{16225d5b-1912-4253-b261-bd5adceae7cd} - C:\WINDOWS\system32\muwmta.dll
BHO-{3AF6653A-81F7-4AD9-8D68-77272A82247D} - C:\WINDOWS\system32\geBrppnN.dll
BHO-{ADFD5FD2-2DD2-4572-80DA-C74F1193FBA1} - C:\WINDOWS\system32\khfeeETn.dll
Toolbar-{A3AC6E80-6FAE-4B5C-9901-488A75685383} - C:\WINDOWS\fqbewlna.dll
HKCU-Run-BitTorrent DNA - C:\Program Files\DNA\btdna.exe
HKCU-Run-AnyDVD - E:\stuff\AnyDVD 6.0.9.5 -
HKCU-Run-\YUR77C.exe - C:\Windows\system32\YUR77C.exe
HKCU-Run-\YUR77D.exe - C:\Windows\system32\YUR77D.exe
HKCU-Run-\YUR782.exe - C:\Windows\system32\YUR782.exe
HKCU-Run-\YUR790.exe - C:\Windows\system32\YUR790.exe
HKCU-Run-\YUR1.exe - C:\Windows\system32\YUR1.exe
HKCU-Run-\YUR2.exe - C:\Windows\system32\YUR2.exe
HKCU-Run-\YUR3.exe - C:\Windows\system32\YUR3.exe
HKCU-Run-\YUR6.exe - C:\Windows\system32\YUR6.exe
HKCU-Run-\YUR8.exe - C:\Windows\system32\YUR8.exe
HKCU-Run-\YUR1D.exe - C:\Windows\system32\YUR1D.exe
HKCU-Run-\YUR1E.exe - C:\Windows\system32\YUR1E.exe
HKCU-Run-\YUR1F.exe - C:\Windows\system32\YUR1F.exe
HKCU-Run-\YUR26.exe - C:\Windows\system32\YUR26.exe
HKCU-Run-\YUR27.exe - C:\Windows\system32\YUR27.exe
HKCU-Run-\YUR28.exe - C:\Windows\system32\YUR28.exe
HKCU-Run-\YUR4.exe - C:\Windows\system32\YUR4.exe
HKCU-Run-\YUR9.exe - C:\Windows\system32\YUR9.exe
HKCU-Run-\YURA.exe - C:\Windows\system32\YURA.exe
HKLM-Run-\YUR77C.exe - C:\Windows\system32\YUR77C.exe
HKLM-Run-\YUR77D.exe - C:\Windows\system32\YUR77D.exe
HKLM-Run-\YUR782.exe - C:\Windows\system32\YUR782.exe
HKLM-Run-\YUR790.exe - C:\Windows\system32\YUR790.exe
HKLM-Run-\YUR1.exe - C:\Windows\system32\YUR1.exe
HKLM-Run-\YUR2.exe - C:\Windows\system32\YUR2.exe
HKLM-Run-\YUR3.exe - C:\Windows\system32\YUR3.exe
HKLM-Run-\YUR6.exe - C:\Windows\system32\YUR6.exe
HKLM-Run-\YUR8.exe - C:\Windows\system32\YUR8.exe
HKLM-Run-\YUR1D.exe - C:\Windows\system32\YUR1D.exe
HKLM-Run-\YUR1E.exe - C:\Windows\system32\YUR1E.exe
HKLM-Run-\YUR1F.exe - C:\Windows\system32\YUR1F.exe
HKLM-Run-\YUR26.exe - C:\Windows\system32\YUR26.exe
HKLM-Run-\YUR27.exe - C:\Windows\system32\YUR27.exe
HKLM-Run-\YUR28.exe - C:\Windows\system32\YUR28.exe
HKLM-Run-\YUR4.exe - C:\Windows\system32\YUR4.exe
HKLM-Run-\YUR9.exe - C:\Windows\system32\YUR9.exe
HKLM-Run-\YURA.exe - C:\Windows\system32\YURA.exe
HKLM-Run-d4d09191 - C:\WINDOWS\system32\yeugvfup.dll
ShellExecuteHooks-{ADFD5FD2-2DD2-4572-80DA-C74F1193FBA1} - C:\WINDOWS\system32\khfeeETn.dll
SSODL-mgxfebsq-{91C36A27-9A45-45BE-9885-CCC29F21459E} - C:\WINDOWS\mgxfebsq.dll
Notify-khfeeETn - khfeeETn.dll


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Amie\Application Data\Mozilla\Firefox\Profiles\abkdntm2.default\
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-20 19:43:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


C:\WINDOWS\bak sana Paris Hilton ne hale gelmis hapiste :(25.zip 121038 bytes hidden from API
C:\WINDOWS\bak sana Paris Hilton ne hale gelmis hapiste :(34.zip 121038 bytes hidden from API
C:\WINDOWS\bak sana Paris Hilton ne hale gelmis hapiste :(4.zip 121036 bytes hidden from API
C:\WINDOWS\bak sana Paris Hilton ne hale gelmis hapiste :(53.zip 121038 bytes hidden from API
C:\WINDOWS\bak sana Paris Hilton ne hale gelmis hapiste :(79.zip 121038 bytes hidden from API

scan completed successfully
hidden files: 5

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Completion time: 2008-09-20 20:01:57 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-21 00:01:33
ComboFix2.txt 2007-10-14 05:05:29

Pre-Run: 14,832,369,664 bytes free
Post-Run: 15,195,324,416 bytes free

2798 --- E O F --- 2008-09-10 07:11:13

[Ayre13]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:03, on 9/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\PowerPlugs\Outlook Express Stationery\OLExp\winoeinit.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\NOTEPAD.EXE
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.forospyware.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.ca/ig/dell?hl=en&c...row&channel=ca
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WeatherEye] C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye.exe
O4 - HKCU\..\Run: [OEPowerPlugs] C:\Program Files\PowerPlugs\Outlook Express Stationery\OLExp\winoeinit.exe
O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &Search - ?p=ZJ
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/...oUploader5.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Chocolatier%202%20-%20Secret%20Ingredients/Images/stg_drm.ocx
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01...s/MSNPUpld.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/...oUploader3.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1165162244906
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {87056D28-9730-4A47-B9F9-7E890B62C58A} (WildfireActiveXHost Class) - http://www.bigfishgames.com/online/t...ugs/axhost.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.0 Control) - http://memory-of.com/Uploads/ImageUploader3.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/Wedding%20Dash/Images/armhelper.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://a532.g.akamai.net/f/532/6712/.../installer.exe
O16 - DPF: {DA80E089-4648-43D5-93B4-7F37917084E6} (CacheManager.CacheManagerCtrl) - http://www.candystand.com/assets/act...cheManager.CAB
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://aolsvc.aol.com/onlinegames/di...h.1.0.0.93.cab
O16 - DPF: {EA6246B4-F380-443F-8727-9AEA3371146C} (CPlayFirstWeddingDashControl Object) - http://www.shockwave.com/content/wed...h.1.0.0.47.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by104fd.bay104.hotmail.msn.co...x/HMAtchmt.ocx
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll muwmta.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

--
End of file - 8647 bytes

[pskelley]

Thanks for returning your information, you have stuff showing in the combofix log that I do not recognize and it is probably valid. I am going to help you remove what I know is bad and we will see how the computer runs at that point.

Amie? Please read the policy here at SaferNetworking:
http://forums.spybot.info/showthread.php?t=282
If your helper detects the presence of such programs on your computer he/she will ask you to remove them. Help will be withdrawn should you not agree to their removal. LimeWire, uTorrent, Azureus, BitTorrent <<< uninstall those programs

Follow the directons carefully and in the numbered order.

1) Please download ATF Cleaner by Atribune
http://www.atribune.org/public-beta/ATF-Cleaner.exe
Save it to your Desktop. We will use this later.

2) Open notepad and copy/paste the text in the codebox below into it:

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=-
"AppInit_DLLs"="avgrsstx.dll"

Save this as CFScript



Referring to the picture above, drag CFScript into ComboFix.exe.

This will start ComboFix again, I do not need to see that log, the HJT log will show if it was done properly,

3) Run ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Click Select All found at the bottom of the list.
Click the Empty Selected button.
Click Exit on the Main menu to close the program.

*Cleaning Prefetch may results in a few slow starts until the folder is repopulated:
http://www.windowsnetworking.com/art...efetch-XP.html

4) Download Malwarebytes' Anti-Malware to your Desktop
http://www.besttechie.net/tools/mbam-setup.exe

* Double-click mbam-setup.exe and follow the prompts to install the program.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
* Please post contents of that file & a new HJT log in your next reply.

How is the computer running now?

Thanks...Phil

[Ayre13]

It's working much better now but my clock is still set to military time and I can't figure out how to change it back. Then my boyfriend decided to touch it (after repeatedly telling him not to as I was going out for the afternoon) and I now have two mbam logs because he ran it twice. Here is the first one:

Malwarebytes' Anti-Malware 1.28
Database version: 1184
Windows 5.1.2600 Service Pack 2

9/21/2008 1:06:47 PM
mbam-log-2008-09-21 (13-06-47).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 136175
Time elapsed: 3 hour(s), 5 minute(s), 55 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 9

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\fqbewlna.bfxp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\legacy_windev-4d05-1be3 (Rootkit.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP336\A0032118.DLL (Adware.AskSBAR) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP344\A0033118.dll (Adware.AskSBAR) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP349\A0038033.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP349\A0038034.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP349\A0038035.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP349\A0038036.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP349\A0038037.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP351\A0038081.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Amie\Desktop\Micro Antivirus 2009.lnk (Rogue.XPertAntivirus) -> Quarantined and deleted successfully.


And the second one:

Malwarebytes' Anti-Malware 1.28
Database version: 1184
Windows 5.1.2600 Service Pack 2

9/21/2008 6:19:54 PM
mbam-log-2008-09-21 (18-19-54).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 136275
Time elapsed: 3 hour(s), 12 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


And the HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:24, on 9/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\PowerPlugs\Outlook Express Stationery\OLExp\winoeinit.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Microsoft Works\WkDStore.exe
C:\Program Files\Microsoft Works\wkgdcach.exe
C:\Program Files\Microsoft Works\WksWP.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.forospyware.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.ca/ig/dell?hl=en&c...row&channel=ca
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WeatherEye] C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye.exe
O4 - HKCU\..\Run: [OEPowerPlugs] C:\Program Files\PowerPlugs\Outlook Express Stationery\OLExp\winoeinit.exe
O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &Search - ?p=ZJ
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/...oUploader5.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Chocolatier%202%20-%20Secret%20Ingredients/Images/stg_drm.ocx
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01...s/MSNPUpld.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/...oUploader3.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1165162244906
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {87056D28-9730-4A47-B9F9-7E890B62C58A} (WildfireActiveXHost Class) - http://www.bigfishgames.com/online/t...ugs/axhost.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.0 Control) - http://memory-of.com/Uploads/ImageUploader3.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/Wedding%20Dash/Images/armhelper.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://a532.g.akamai.net/f/532/6712/.../installer.exe
O16 - DPF: {DA80E089-4648-43D5-93B4-7F37917084E6} (CacheManager.CacheManagerCtrl) - http://www.candystand.com/assets/act...cheManager.CAB
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://aolsvc.aol.com/onlinegames/di...h.1.0.0.93.cab
O16 - DPF: {EA6246B4-F380-443F-8727-9AEA3371146C} (CPlayFirstWeddingDashControl Object) - http://www.shockwave.com/content/wed...h.1.0.0.47.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by104fd.bay104.hotmail.msn.co...x/HMAtchmt.ocx
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

--
End of file - 8795 bytes


Sorry I wasn't able to follow your instructions the way I was supposed to.

[pskelley]

Thanks for returning your information, we have more to do and if the clock does not return to normal time when we remove combofix later, then here are instructions for doing it manually.
http://www.ehow.com/how_4483170_time...indows-xp.html

This is the next important instruction:

I am sure you saw this:
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
http://www.bleepingcomputer.com/comb...o-use-combofix
Review that information to understand Recovery Console. Installation is optional but if you do not have the CD's needed, as is explained, it can be installed before we remove combofix.
If you do not have access to Recovery Console via a Windows CD, I strongly advise you to install this tool.
If you do not wish to install RC, let me know so I can continue with the cleanup.
If you install RC, post the C:\*CF-RC.txt*.



Since we do not need to scan with combofix, click NO





Thanks...Phil

[Ayre13]

Thanks, I will install this tool as I do not have the neccessary CD but I'm not sure which download I should be choosing. I don't know which service pack I have if any...is there somewhere I can find this information?

[pskelley]

The HJT log header show you have: Windows XP SP2
combofix usually indicate if it is Home or Professional, but here:

ComboFix 08-09-20.05 - Amie 2008-09-20 19:22:49.5 - NTFSx86
Running from: C:\Documents and Settings\Amie\Desktop\ComboFix.exe

You cut off two lines in the combofix header. Right click MyComputer, then click Properties. Near the top right under the word System you will see what version of Windows XP you have. If you can not figure it out from there, post if you have Home or Professional Edition and I will post a link to the correct download.

Thanks

[Ayre13]

Thanks...here si the CF-RC.txt

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

[pskelley]

Good job installing Recovery Console, a little information for you.
http://support.microsoft.com/kb/314058
http://support.microsoft.com/kb/307654
Recovery Console is a tool that will allow you to recover from a catastrophic system failure, so let's hope you never need it. Many experts believe Microsoft should have installed it by default.

Remove combofix like this:

Click START then RUN
Now type or copy Combofix /u in the runbox and click OK.
Note the space between the X and the U, it needs to be there.



Clean infected System Restore files like this:

Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Reboot

Turn ON System Restore,
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.

Update and run MBAM again to make sure we missed none of the junk, no need to post a clean scan result.

Update AVG and scan your system to make sure it is scanning clean.

Let me know all is well at that point and I will close your topic.

Some good information for you:
http://users.telenet.be/bluepatchy/m...wcomputer.html
http://www.microsoft.com/windowsxp/u...s/mcgill1.mspx

Here is some great information from experts in this field that will help you stay clean and safe online.
http://users.telenet.be/bluepatchy/m...revention.html
http://forums.spybot.info/showthread.php?t=279
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml

http://www.malwarecomplaints.info/

Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.

http://users.telenet.be/bluepatchy/m...oes/Links.html