+ 2008-12-20 23:15:13 214,528 -c--a-w c:\windows\system32\dllcache\dxtrans.dll
- 2008-10-16 20:38:35 133,120 -c--a-w c:\windows\system32\dllcache\extmgr.dll
+ 2008-12-20 23:15:13 133,120 -c--a-w c:\windows\system32\dllcache\extmgr.dll
- 2001-08-23 12:00:00 55,296 -c--a-w c:\windows\system32\dllcache\freecell.exe
+ 2005-12-29 03:15:16 55,296 -c--a-w c:\windows\system32\dllcache\freecell.exe
- 2001-08-23 12:00:00 605,696 -c--a-w c:\windows\system32\dllcache\getuname.dll
+ 2005-12-29 03:15:16 605,696 -c--a-w c:\windows\system32\dllcache\getuname.dll
- 2001-08-23 12:00:00 57,409 -c--a-w c:\windows\system32\dllcache\hrtz.dll
+ 2005-12-29 03:15:18 57,409 -c--a-w c:\windows\system32\dllcache\hrtz.dll
- 2001-08-23 12:00:00 1,175,635 -c--a-w c:\windows\system32\dllcache\hrtzres.dll
+ 2005-12-29 03:15:18 1,175,635 -c--a-w c:\windows\system32\dllcache\hrtzres.dll
- 2001-08-23 12:00:00 42,573 -c--a-w c:\windows\system32\dllcache\hrtzzm.exe
+ 2005-12-29 03:15:18 42,573 -c--a-w c:\windows\system32\dllcache\hrtzzm.exe
- 2001-08-23 12:00:00 13,312 -c--a-w c:\windows\system32\dllcache\htrn_jis.dll
+ 2005-12-29 03:15:18 13,312 -c--a-w c:\windows\system32\dllcache\htrn_jis.dll
- 2008-10-16 20:38:35 63,488 -c----w c:\windows\system32\dllcache\icardie.dll
+ 2008-12-20 23:15:13 63,488 -c----w c:\windows\system32\dllcache\icardie.dll
- 2008-10-16 13:11:09 70,656 -c----w c:\windows\system32\dllcache\ie4uinit.exe
+ 2008-12-19 09:10:15 70,656 -c----w c:\windows\system32\dllcache\ie4uinit.exe
- 2008-10-16 20:38:35 153,088 -c----w c:\windows\system32\dllcache\ieakeng.dll
+ 2008-12-20 23:15:14 153,088 -c----w c:\windows\system32\dllcache\ieakeng.dll
- 2008-10-16 20:38:35 230,400 -c----w c:\windows\system32\dllcache\ieaksie.dll
+ 2008-12-20 23:15:14 230,400 -c----w c:\windows\system32\dllcache\ieaksie.dll
- 2008-10-15 07:04:53 161,792 -c--a-w c:\windows\system32\dllcache\ieakui.dll
+ 2008-12-19 05:23:56 161,792 -c--a-w c:\windows\system32\dllcache\ieakui.dll
- 2008-10-16 20:38:35 383,488 -c----w c:\windows\system32\dllcache\ieapfltr.dll
+ 2008-12-20 23:15:15 383,488 -c----w c:\windows\system32\dllcache\ieapfltr.dll
- 2008-10-16 20:38:35 384,512 -c----w c:\windows\system32\dllcache\iedkcs32.dll
+ 2008-12-20 23:15:16 384,512 -c----w c:\windows\system32\dllcache\iedkcs32.dll
- 2008-10-16 20:38:37 6,066,176 -c----w c:\windows\system32\dllcache\ieframe.dll
+ 2008-12-20 23:15:21 6,066,688 -c----w c:\windows\system32\dllcache\ieframe.dll
- 2008-10-16 20:38:37 44,544 -c----w c:\windows\system32\dllcache\iernonce.dll
+ 2008-12-20 23:15:21 44,544 -c----w c:\windows\system32\dllcache\iernonce.dll
- 2008-10-16 20:38:37 267,776 -c----w c:\windows\system32\dllcache\iertutil.dll
+ 2008-12-20 23:15:22 267,776 -c----w c:\windows\system32\dllcache\iertutil.dll
- 2008-10-16 13:11:09 13,824 -c----w c:\windows\system32\dllcache\ieudinit.exe
+ 2008-12-19 09:10:15 13,824 -c----w c:\windows\system32\dllcache\ieudinit.exe
- 2008-10-15 07:06:26 633,632 -c----w c:\windows\system32\dllcache\iexplore.exe
+ 2008-12-19 05:25:25 634,024 -c----w c:\windows\system32\dllcache\iexplore.exe
- 2008-10-16 20:38:37 27,648 -c--a-w c:\windows\system32\dllcache\jsproxy.dll
+ 2008-12-20 23:15:23 27,648 -c--a-w c:\windows\system32\dllcache\jsproxy.dll
+ 2008-04-14 00:12:27 123,392 -c--a-w c:\windows\system32\dllcache\mplay32.exe
- 2008-10-16 20:38:37 459,264 -c----w c:\windows\system32\dllcache\msfeeds.dll
+ 2008-12-20 23:15:23 459,264 -c----w c:\windows\system32\dllcache\msfeeds.dll
- 2008-10-16 20:38:37 52,224 -c----w c:\windows\system32\dllcache\msfeedsbs.dll
+ 2008-12-20 23:15:24 52,224 -c----w c:\windows\system32\dllcache\msfeedsbs.dll
- 2001-08-23 12:00:00 126,976 -c--a-w c:\windows\system32\dllcache\mshearts.exe
+ 2005-12-29 03:15:37 126,976 -c--a-w c:\windows\system32\dllcache\mshearts.exe
- 2008-12-13 06:40:02 3,593,216 -c--a-w c:\windows\system32\dllcache\mshtml.dll
+ 2009-01-17 05:35:14 3,594,752 -c--a-w c:\windows\system32\dllcache\mshtml.dll
- 2008-10-16 20:38:38 477,696 -c--a-w c:\windows\system32\dllcache\mshtmled.dll
+ 2008-12-20 23:15:30 477,696 -c--a-w c:\windows\system32\dllcache\mshtmled.dll
+ 2008-04-14 00:12:28 343,040 -c--a-w c:\windows\system32\dllcache\mspaint.exe
- 2008-10-16 20:38:38 193,024 -c--a-w c:\windows\system32\dllcache\msrating.dll
+ 2008-12-20 23:15:31 193,024 -c--a-w c:\windows\system32\dllcache\msrating.dll
- 2008-10-16 20:38:39 671,232 -c--a-w c:\windows\system32\dllcache\mstime.dll
+ 2008-12-20 23:15:32 671,232 -c--a-w c:\windows\system32\dllcache\mstime.dll
- 2008-10-16 20:38:39 102,912 -c----w c:\windows\system32\dllcache\occache.dll
+ 2008-12-20 23:15:38 102,912 -c----w c:\windows\system32\dllcache\occache.dll
+ 2008-04-14 00:12:31 281,088 -c--a-w c:\windows\system32\dllcache\pinball.exe
- 2008-10-16 20:38:39 44,544 -c--a-w c:\windows\system32\dllcache\pngfilt.dll
+ 2008-12-20 23:15:38 44,544 -c--a-w c:\windows\system32\dllcache\pngfilt.dll
- 2001-08-23 12:00:00 48,706 -c--a-w c:\windows\system32\dllcache\rvse.dll
+ 2005-12-29 03:15:55 48,706 -c--a-w c:\windows\system32\dllcache\rvse.dll
- 2001-08-23 12:00:00 753,236 -c--a-w c:\windows\system32\dllcache\rvseres.dll
+ 2005-12-29 03:15:55 753,236 -c--a-w c:\windows\system32\dllcache\rvseres.dll
- 2001-08-23 12:00:00 42,574 -c--a-w c:\windows\system32\dllcache\rvsezm.exe
+ 2005-12-29 03:15:55 42,574 -c--a-w c:\windows\system32\dllcache\rvsezm.exe
- 2001-08-23 12:00:00 66,113 -c--a-w c:\windows\system32\dllcache\shvl.dll
+ 2005-12-29 03:15:58 66,113 -c--a-w c:\windows\system32\dllcache\shvl.dll
- 2001-08-23 12:00:00 2,178,131 -c--a-w c:\windows\system32\dllcache\shvlres.dll
+ 2005-12-29 03:15:58 2,178,131 -c--a-w c:\windows\system32\dllcache\shvlres.dll
- 2001-08-23 12:00:00 42,573 -c--a-w c:\windows\system32\dllcache\shvlzm.exe
+ 2005-12-29 03:15:58 42,573 -c--a-w c:\windows\system32\dllcache\shvlzm.exe
+ 2008-04-14 00:12:36 131,584 -c--a-w c:\windows\system32\dllcache\sndrec32.exe
- 2001-08-23 12:00:00 138,752 -c--a-w c:\windows\system32\dllcache\sndvol32.exe
+ 2005-12-29 03:15:59 138,752 -c--a-w c:\windows\system32\dllcache\sndvol32.exe
- 2001-08-23 12:00:00 56,832 -c--a-w c:\windows\system32\dllcache\sol.exe
+ 2005-12-29 03:15:59 56,832 -c--a-w c:\windows\system32\dllcache\sol.exe
+ 2008-04-14 00:12:36 538,624 -c--a-w c:\windows\system32\dllcache\spider.exe
- 2008-09-08 10:41:42 333,824 -c----w c:\windows\system32\dllcache\srv.sys
+ 2008-12-11 10:57:09 333,952 -c----w c:\windows\system32\dllcache\srv.sys
- 2001-08-23 12:00:00 32,339 -c--a-w c:\windows\system32\dllcache\uniansi.dll
+ 2005-12-29 03:16:04 32,339 -c--a-w c:\windows\system32\dllcache\uniansi.dll
- 2008-10-16 20:38:39 105,984 -c----w c:\windows\system32\dllcache\url.dll
+ 2008-12-20 23:15:39 105,984 -c----w c:\windows\system32\dllcache\url.dll
- 2008-10-16 20:38:39 1,160,192 -c--a-w c:\windows\system32\dllcache\urlmon.dll
+ 2008-12-20 23:15:40 1,160,192 -c--a-w c:\windows\system32\dllcache\urlmon.dll
- 2008-10-16 20:38:39 233,472 -c----w c:\windows\system32\dllcache\webcheck.dll
+ 2008-12-20 23:15:40 233,472 -c----w c:\windows\system32\dllcache\webcheck.dll
+ 2008-09-06 07:30:42 241,704 -c----w c:\windows\system32\dllcache\wgaLogon.dll
+ 2008-09-06 07:29:58 917,032 -c----w c:\windows\system32\dllcache\WgaTray.exe
- 2001-08-23 12:00:00 35,328 -c--a-w c:\windows\system32\dllcache\winchat.exe
+ 2005-12-29 03:16:12 35,328 -c--a-w c:\windows\system32\dllcache\winchat.exe
- 2008-10-16 20:38:40 826,368 -c--a-w c:\windows\system32\dllcache\wininet.dll
+ 2008-12-20 23:15:41 826,368 -c--a-w c:\windows\system32\dllcache\wininet.dll
- 2001-08-23 12:00:00 119,808 -c--a-w c:\windows\system32\dllcache\winmine.exe
+ 2005-12-29 03:16:12 119,808 -c--a-w c:\windows\system32\dllcache\winmine.exe
+ 2008-04-14 00:12:40 214,528 -c--a-w c:\windows\system32\dllcache\wordpad.exe
- 2001-08-23 12:00:00 5,632 -c--a-w c:\windows\system32\dllcache\write.exe
+ 2005-12-29 03:16:15 5,632 -c--a-w c:\windows\system32\dllcache\write.exe
- 2001-08-23 12:00:00 36,937 -c--a-w c:\windows\system32\dllcache\zclientm.exe
+ 2005-12-29 03:16:17 36,937 -c--a-w c:\windows\system32\dllcache\zclientm.exe
- 2001-08-23 12:00:00 41,029 -c--a-w c:\windows\system32\dllcache\zcorem.dll
+ 2005-12-29 03:16:17 41,029 -c--a-w c:\windows\system32\dllcache\zcorem.dll
- 2001-08-23 12:00:00 4,677 -c--a-w c:\windows\system32\dllcache\zeeverm.dll
+ 2005-12-29 03:16:17 4,677 -c--a-w c:\windows\system32\dllcache\zeeverm.dll
- 2001-08-23 12:00:00 29,760 -c--a-w c:\windows\system32\dllcache\znetm.dll
+ 2005-12-29 03:16:17 29,760 -c--a-w c:\windows\system32\dllcache\znetm.dll
- 2001-08-23 12:00:00 113,222 -c--a-w c:\windows\system32\dllcache\zoneclim.dll
+ 2005-12-29 03:16:17 113,222 -c--a-w c:\windows\system32\dllcache\zoneclim.dll
- 2001-08-23 12:00:00 13,894 -c--a-w c:\windows\system32\dllcache\zonelibm.dll
+ 2005-12-29 03:16:17 13,894 -c--a-w c:\windows\system32\dllcache\zonelibm.dll
+ 2008-12-10 14:17:14 7,808 ----a-w c:\windows\system32\drivers\psi_mf.sys
- 2007-06-28 01:33:26 531,200 ----a-w c:\windows\system32\drivers\rt2860.sys
+ 2007-11-15 21:18:20 572,416 ----a-w c:\windows\system32\drivers\rt2860.sys
- 2007-11-20 19:09:22 104,320 ----a-w c:\windows\system32\drivers\Rtnicxp.sys
+ 2008-12-02 14:05:34 118,656 ----a-w c:\windows\system32\drivers\Rtnicxp.sys
- 2008-09-08 10:41:42 333,824 ----a-w c:\windows\system32\drivers\srv.sys
+ 2008-12-11 10:57:09 333,952 ----a-w c:\windows\system32\drivers\srv.sys
- 2008-10-16 20:38:34 347,136 ----a-w c:\windows\system32\dxtmsft.dll
+ 2008-12-20 23:15:12 347,136 ----a-w c:\windows\system32\dxtmsft.dll
- 2008-10-16 20:38:34 214,528 ----a-w c:\windows\system32\dxtrans.dll
+ 2008-12-20 23:15:13 214,528 ----a-w c:\windows\system32\dxtrans.dll
+ 2008-07-30 05:10:04 73,720 ----a-w c:\windows\system32\dxva2.dll
+ 2008-07-30 05:10:04 493,048 ----a-w c:\windows\system32\evr.dll
- 2008-10-16 20:38:35 133,120 ----a-w c:\windows\system32\extmgr.dll
+ 2008-12-20 23:15:13 133,120 ----a-w c:\windows\system32\extmgr.dll
- 2008-10-15 17:46:32 122,928 ----a-w c:\windows\system32\FNTCACHE.DAT
+ 2009-02-09 23:43:19 126,112 ----a-w c:\windows\system32\FNTCACHE.DAT
- 2001-08-23 12:00:00 55,296 ----a-w c:\windows\system32\freecell.exe
+ 2005-12-29 03:15:16 55,296 ----a-w c:\windows\system32\freecell.exe
- 2008-09-03 22:05:13 21,928 ----a-w c:\windows\system32\GDIPFONTCACHEV1.DAT
+ 2009-02-09 23:47:26 21,928 ----a-w c:\windows\system32\GDIPFONTCACHEV1.DAT
- 2001-08-23 12:00:00 44,544 ----a-w c:\windows\system32\hticons.dll
+ 2005-12-29 03:15:18 44,544 ----a-w c:\windows\system32\hticons.dll
+ 2008-07-30 03:24:50 622,080 ----a-w c:\windows\system32\icardagt.exe
- 2008-10-16 20:38:35 63,488 ----a-w c:\windows\system32\icardie.dll
+ 2008-12-20 23:15:13 63,488 ----a-w c:\windows\system32\icardie.dll
+ 2008-07-30 03:24:50 11,264 ----a-w c:\windows\system32\icardres.dll
- 2008-10-16 13:11:09 70,656 ----a-w c:\windows\system32\ie4uinit.exe
+ 2008-12-19 09:10:15 70,656 ----a-w c:\windows\system32\ie4uinit.exe
- 2008-10-16 20:38:35 153,088 ----a-w c:\windows\system32\ieakeng.dll
+ 2008-12-20 23:15:14 153,088 ----a-w c:\windows\system32\ieakeng.dll
- 2008-10-16 20:38:35 230,400 ----a-w c:\windows\system32\ieaksie.dll
+ 2008-12-20 23:15:14 230,400 ----a-w c:\windows\system32\ieaksie.dll
- 2008-10-15 07:04:53 161,792 ----a-w c:\windows\system32\ieakui.dll
+ 2008-12-19 05:23:56 161,792 ----a-w c:\windows\system32\ieakui.dll
- 2008-10-16 20:38:35 383,488 ----a-w c:\windows\system32\ieapfltr.dll
+ 2008-12-20 23:15:15 383,488 ----a-w c:\windows\system32\ieapfltr.dll
- 2008-10-16 20:38:35 384,512 ----a-w c:\windows\system32\iedkcs32.dll
+ 2008-12-20 23:15:16 384,512 ----a-w c:\windows\system32\iedkcs32.dll
- 2008-10-16 20:38:37 6,066,176 ----a-w c:\windows\system32\ieframe.dll
+ 2008-12-20 23:15:21 6,066,688 ----a-w c:\windows\system32\ieframe.dll
- 2008-10-16 20:38:37 44,544 ----a-w c:\windows\system32\iernonce.dll
+ 2008-12-20 23:15:21 44,544 ----a-w c:\windows\system32\iernonce.dll
- 2008-10-16 20:38:37 267,776 ----a-w c:\windows\system32\iertutil.dll
+ 2008-12-20 23:15:22 267,776 ----a-w c:\windows\system32\iertutil.dll
- 2008-10-16 13:11:09 13,824 ----a-w c:\windows\system32\ieudinit.exe
+ 2008-12-19 09:10:15 13,824 ----a-w c:\windows\system32\ieudinit.exe
+ 2008-07-30 03:24:50 97,800 ----a-w c:\windows\system32\infocardapi.dll
- 2007-09-25 05:30:28 135,168 ----a-w c:\windows\system32\java.exe
+ 2009-02-09 20:31:25 144,792 ----a-w c:\windows\system32\java.exe
- 2007-09-25 05:30:30 135,168 ----a-w c:\windows\system32\javaw.exe
+ 2009-02-09 20:31:25 144,792 ----a-w c:\windows\system32\javaw.exe
- 2007-09-25 06:31:42 139,264 ----a-w c:\windows\system32\javaws.exe
+ 2009-02-09 20:31:25 148,888 ----a-w c:\windows\system32\javaws.exe
- 2008-10-16 20:38:37 27,648 ----a-w c:\windows\system32\jsproxy.dll
+ 2008-12-20 23:15:23 27,648 ----a-w c:\windows\system32\jsproxy.dll
- 2005-07-13 02:04:22 520,456 ----a-w c:\windows\system32\LegitCheckControl.dll
+ 2008-09-06 07:30:06 1,480,232 ----a-w c:\windows\system32\LegitCheckControl.dll
+ 2008-10-05 03:16:26 235,936 ----a-r c:\windows\system32\Macromed\Flash\FlashUtil10a.exe
- 2007-11-21 00:52:38 2,884,992 ----a-w c:\windows\system32\Macromed\Flash\NPSWF32.dll
+ 2008-10-05 03:24:02 3,695,008 ----a-w c:\windows\system32\Macromed\Flash\NPSWF32.dll
- 2007-11-21 00:52:40 218,496 ----a-w c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2008-10-05 03:24:04 235,936 ----a-w c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2009-02-09 20:22:33 89,102 ----a-w c:\windows\system32\Macromed\Flash\uninstall_activeX.exe
- 2008-04-08 02:45:05 70,264 ----a-w c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
+ 2009-02-09 20:50:45 84,661 ----a-w c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
- 2008-12-09 23:24:37 17,593,280 ----a-w c:\windows\system32\MRT.exe
+ 2009-02-03 23:21:12 21,244,864 ----a-w c:\windows\system32\MRT.exe
- 2007-10-24 08:47:38 282,112 ----a-w c:\windows\system32\mscoree.dll
+ 2008-07-25 19:16:58 282,112 ----a-w c:\windows\system32\mscoree.dll
- 2007-10-24 08:47:38 158,720 ----a-w c:\windows\system32\mscorier.dll
+ 2008-07-25 19:16:58 158,720 ----a-w c:\windows\system32\mscorier.dll
- 2007-10-24 08:47:38 84,480 ----a-w c:\windows\system32\mscories.dll
+ 2008-07-25 19:16:58 83,968 ----a-w c:\windows\system32\mscories.dll
- 2008-10-16 20:38:37 459,264 ----a-w c:\windows\system32\msfeeds.dll
+ 2008-12-20 23:15:23 459,264 ----a-w c:\windows\system32\msfeeds.dll
- 2008-10-16 20:38:37 52,224 ----a-w c:\windows\system32\msfeedsbs.dll
+ 2008-12-20 23:15:24 52,224 ----a-w c:\windows\system32\msfeedsbs.dll
- 2001-08-23 12:00:00 126,976 ----a-w c:\windows\system32\mshearts.exe
+ 2005-12-29 03:15:37 126,976 ----a-w c:\windows\system32\mshearts.exe
- 2008-12-13 06:40:02 3,593,216 ----a-w c:\windows\system32\mshtml.dll
+ 2009-01-17 05:35:14 3,594,752 ----a-w c:\windows\system32\mshtml.dll
- 2008-10-16 20:38:38 477,696 ----a-w c:\windows\system32\mshtmled.dll
+ 2008-12-20 23:15:30 477,696 ----a-w c:\windows\system32\mshtmled.dll
- 2008-10-16 20:38:38 193,024 ----a-w c:\windows\system32\msrating.dll
+ 2008-12-20 23:15:31 193,024 ----a-w c:\windows\system32\msrating.dll
- 2008-10-16 20:38:39 671,232 ----a-w c:\windows\system32\mstime.dll
+ 2008-12-20 23:15:32 671,232 ----a-w c:\windows\system32\mstime.dll
- 2003-04-19 00:46:22 1,233,920 ----a-w c:\windows\system32\msxml4.dll
+ 2008-10-01 00:43:34 1,286,152 ----a-w c:\windows\system32\msxml4.dll
+ 2003-02-21 02:43:36 4,096 ----a-w c:\windows\system32\mui\
0409\mscoreer.dll
- 2007-10-24 08:47:44 15,360 ----a-w c:\windows\system32\mui\
0409\mscorees.dll
+ 2008-07-25 19:17:04 15,360 ----a-w c:\windows\system32\mui\
0409\mscorees.dll
- 2008-10-16 20:38:39 102,912 ----a-w c:\windows\system32\occache.dll
+ 2008-12-20 23:15:38 102,912 ----a-w c:\windows\system32\occache.dll
- 2008-11-04 17:21:02 59,780 ----a-w c:\windows\system32\perfc009.dat
+ 2009-02-10 00:37:48 71,002 ----a-w c:\windows\system32\perfc009.dat
- 2008-11-04 17:21:02 397,560 ----a-w c:\windows\system32\perfh009.dat
+ 2009-02-10 00:37:48 440,684 ----a-w c:\windows\system32\perfh009.dat
- 2008-10-16 20:38:39 44,544 ----a-w c:\windows\system32\pngfilt.dll
+ 2008-12-20 23:15:38 44,544 ----a-w c:\windows\system32\pngfilt.dll
+ 2008-07-30 03:59:58 105,016 ----a-w c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
+ 2008-07-30 04:35:46 326,160 ----a-w c:\windows\system32\PresentationHost.exe
+ 2008-07-30 03:59:58 43,544 ----a-w c:\windows\system32\PresentationHostProxy.dll
+ 2008-07-30 03:59:58 781,344 ----a-w c:\windows\system32\PresentationNative_v0300.dll
+ 2006-08-25 00:15:06 150,808 ----a-w c:\windows\system32\rgb9rast_2.dll
- 2001-08-23 12:00:00 138,752 ----a-w c:\windows\system32\sndvol32.exe
+ 2005-12-29 03:15:59 138,752 ----a-w c:\windows\system32\sndvol32.exe
- 2001-08-23 12:00:00 56,832 ----a-w c:\windows\system32\sol.exe
+ 2005-12-29 03:15:59 56,832 ----a-w c:\windows\system32\sol.exe
- 2007-11-30 12:39:22 17,272 ------w c:\windows\system32\spmsg.dll
+ 2008-07-09 07:38:24 17,272 ------w c:\windows\system32\spmsg.dll
+ 2008-07-06 12:06:10 765,440 ----a-w c:\windows\system32\spool\drivers\w32x86\3\mxdwdrv.dll
+ 2008-07-06 12:06:10 198,656 ----a-w c:\windows\system32\spool\drivers\w32x86\3\mxdwdui.dll
- 2008-04-14 00:12:07 373,248 ----a-w c:\windows\system32\spool\drivers\w32x86\3\unidrv.dll
+ 2008-07-06 12:06:10 373,248 ----a-w c:\windows\system32\spool\drivers\w32x86\3\unidrv.dll
- 2008-04-14 00:12:07 744,448 ----a-w c:\windows\system32\spool\drivers\w32x86\3\unidrvui.dll
+ 2008-07-06 12:06:10 744,960 ----a-w c:\windows\system32\spool\drivers\w32x86\3\unidrvui.dll
- 2007-05-15 08:08:53 761,344 ----a-w c:\windows\system32\spool\drivers\w32x86\3\unires.dll
+ 2008-03-13 04:52:36 761,344 ----a-w c:\windows\system32\spool\drivers\w32x86\3\unires.dll
+ 2008-07-06 12:06:10 1,676,288 ----a-w c:\windows\system32\spool\drivers\w32x86\3\XpsSvcs.dll
+ 2008-07-06 12:06:10 89,088 ----a-w c:\windows\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
+ 2008-07-06 10:50:03 597,504 ------w c:\windows\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
+ 2008-07-06 12:06:10 147,456 ----a-w c:\windows\system32\spool\prtprocs\x64\filterpipelineprintproc.dll
+ 2008-07-06 12:06:10 748,032 ----a-w c:\windows\system32\spool\XPSEP\amd64\amd64\mxdwdrv.dll
+ 2008-07-07 01:36:12 2,936,832 ----a-w c:\windows\system32\spool\XPSEP\amd64\amd64\xpssvcs.dll
+ 2008-07-06 12:06:10 748,032 ----a-w c:\windows\system32\spool\XPSEP\amd64\mxdwdrv.dll
+ 2008-07-07 01:36:12 2,936,832 ----a-w c:\windows\system32\spool\XPSEP\amd64\xpssvcs.dll
+ 2008-07-06 12:06:10 765,440 ----a-w c:\windows\system32\spool\XPSEP\i386\i386\mxdwdrv.dll
+ 2008-07-06 12:06:10 1,676,288 ----a-w c:\windows\system32\spool\XPSEP\i386\i386\xpssvcs.dll
+ 2008-07-06 12:06:10 765,440 ----a-w c:\windows\system32\spool\XPSEP\i386\mxdwdrv.dll
+ 2008-07-06 12:06:10 1,676,288 ----a-w c:\windows\system32\spool\XPSEP\i386\xpssvcs.dll
- 2007-08-11 03:46:18 26,488 ----a-w c:\windows\system32\spupdsvc.exe
+ 2007-11-30 11:18:51 26,488 ----a-w c:\windows\system32\spupdsvc.exe
+ 2008-07-30 05:10:04 26,112 ----a-w c:\windows\system32\TsWpfWrp.exe
+ 2008-07-30 03:59:58 161,296 ----a-w c:\windows\system32\UIAutomationCore.dll
- 2008-10-16 20:38:39 105,984 ----a-w c:\windows\system32\url.dll
+ 2008-12-20 23:15:39 105,984 ----a-w c:\windows\system32\url.dll
- 2008-10-16 20:38:39 1,160,192 ----a-w c:\windows\system32\urlmon.dll
+ 2008-12-20 23:15:40 1,160,192 ----a-w c:\windows\system32\urlmon.dll
+ 2003-02-21 13:16:08 49,152 ----a-w c:\windows\system32\URTTEMP\regtlib.exe
- 2008-10-16 20:38:39 233,472 ----a-w c:\windows\system32\webcheck.dll
+ 2008-12-20 23:15:40 233,472 ----a-w c:\windows\system32\webcheck.dll
+ 2008-09-06 07:30:42 241,704 ------w c:\windows\system32\WgaLogon.dll
+ 2008-09-06 07:29:58 917,032 ------w c:\windows\system32\WgaTray.exe
- 2001-08-23 12:00:00 35,328 ----a-w c:\windows\system32\winchat.exe
+ 2005-12-29 03:16:12 35,328 ----a-w c:\windows\system32\winchat.exe
- 2001-08-23 12:00:00 119,808 ----a-w c:\windows\system32\winmine.exe
+ 2005-12-29 03:16:12 119,808 ----a-w c:\windows\system32\winmine.exe
- 2001-08-23 12:00:00 5,632 ----a-w c:\windows\system32\write.exe
+ 2005-12-29 03:16:15 5,632 ----a-w c:\windows\system32\write.exe
+ 2008-07-30 05:26:06 301,568 ----a-w c:\windows\system32\XPSViewer\XPSViewer.exe
+ 2009-02-16 06:10:54 16,384 ----atw c:\windows\temp\Perflib_Perfdata_58c.dat
- 2008-04-12 05:23:47 8,192 ----a-w c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2009-02-09 21:47:59 8,192 ----a-w c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2008-10-01 00:42:08 1,286,152 ----a-w c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9870.0_x-ww_a32d74cf\msxml4.dll
+ 2008-10-01 00:45:12 91,656 ----a-w c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.1.0_x-ww_2a41bceb\msxml4r.dll
+ 2008-07-25 19:17:20 479,232 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcm80.dll
+ 2008-07-25 19:17:20 558,080 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcp80.dll
+ 2008-07-25 19:17:20 635,904 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcr80.dll
+ 2007-11-07 05:23:56 224,768 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcm90.dll
+ 2007-11-07 10:19:32 568,832 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcp90.dll
+ 2007-11-07 10:19:32 655,872 ----a-w c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcr90.dll
- 2008-04-12 05:23:54 258,048 ----a-w c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2009-02-09 21:48:06 258,048 ----a-w c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
- 2008-04-12 05:23:54 113,664 ----a-w c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
+ 2009-02-09 21:48:06 113,664 ----a-w c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 220544]
"WallpaperChanger"="c:\program files\Wallpaper Master\Wallpaper.exe" [2005-11-08 321536]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2005-04-08 48752]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2005-04-17 85184]
"Airlink101 Airlink101 WLAN Monitor"="c:\program files\Airlink101\Airlink101 WLAN Monitor\WLANmon.exe" [2007-06-18 1925120]
"ANIWZCS2Service"="c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2007-01-19 49152]
"zBrowser Launcher"="c:\program files\Logitech\iTouch\iTouch.exe" [2004-03-18 892928]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malwarer\mbam.exe" [2009-02-11 1273488]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-09 136600]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 c:\windows\system32\HdAShCut.exe]
"RTHDCPL"="RTHDCPL.EXE" [2005-09-22 c:\windows\RTHDCPL.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2008-04-13 c:\windows\system32\narrator.exe]
c:\documents and settings\Chris Ball\Start Menu\Programs\Startup\
Adobe Gamma.lnk.disabled [2006-01-23 992]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk.disabled [2007-02-27 1805]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= ffdshow.ax
"msacm.divxa32"= msaud32_divx.acm
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wineo38.sys]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
--a------ 2006-05-09 16:24 50760 c:\program files\Common Files\AOL\1135842093\ee\aolsoftware.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-04-13 16:12 1695232 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2009-01-05 16:18 413696 c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
--a------ 2005-05-03 17:43 69632 c:\windows\ALCMTR.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\MSMSGS.EXE" /background
"Aim6"=
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HostManager"=c:\program files\Common Files\AOL\1135842093\ee\AOLSoftware.exe
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"RemoteControl"=c:\powerdvd\PDVDServ.exe
"SunJavaUpdateSched"=c:\program files\Java\jre1.5.0_06\bin\jusched.exe
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
"ViewMgr"=c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe
"iTunesHelper"="e:\itunes\iTunesHelper.exe"
"0816a70f"=rundll32.exe "c:\windows\system32\muwjjsme.dll",b
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
"c:\\Program Files\\RealVNC\\VNC4\\vncviewer.exe"=
"d:\\Steam\\steamapps\\naric2004@msn.com\\team fortress 2\\hl2.exe"=
"d:\\Steam\\steamapps\\naric2004@msn.com\\counter-strike source\\hl2.exe"=
"d:\\Steam\\steamapps\\naric2004@msn.com\\garrysmod\\hl2.exe"=
"d:\\Steam\\steamapps\\whimsical_nig\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"d:\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"d:\\Dawn of War - Soulstorm\\Soulstorm.exe"=
"e:\\Games\\Warcraft III\\Frozen Throne.exe"=
"d:\\Steam\\Steam.exe"=
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-10 24652]
S0 bzvg;bzvg;c:\windows\system32\drivers\sbpsdh.sys --> c:\windows\system32\drivers\sbpsdh.sys [?]
S3 3dfxvs;3dfxvs;c:\windows\system32\drivers\3dfxvsm.sys [2005-12-28 148352]
S3 cpuz129;cpuz129;\??\c:\docume~1\CHRISB~1\LOCALS~1\Temp\cpuz_x32.sys --> c:\docume~1\CHRISB~1\LOCALS~1\Temp\cpuz_x32.sys [?]
S3 cpuz131;cpuz131;\??\c:\docume~1\CHRISB~1\LOCALS~1\Temp\cpuz131\cpuz_x32.sys --> c:\docume~1\CHRISB~1\LOCALS~1\Temp\cpuz131\cpuz_x32.sys [?]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2008-12-10 7808]
S3 RT80x86;Ralink 802.11n Wireless Driver;c:\windows\system32\drivers\rt2860.sys [2007-11-15 572416]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [2005-04-17 124608]
S3 StreamSurge;StreamSurge Driver (miniport);c:\windows\system32\DRIVERS\ss.sys --> c:\windows\system32\DRIVERS\ss.sys [?]
S4 Eeccae42;Eeccae42; [x]
--- Other Services/Drivers In Memory ---
*Deregistered* - EraserUtilDrvI7
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{50c23b3d-7487-11db-8a4e-0014a53385c8}]
\Shell\AutoRun\command - R:\Setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{50c23b3e-7487-11db-8a4e-0014a53385c8}]
\Shell\AutoRun\command - S:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{50c23b3f-7487-11db-8a4e-0014a53385c8}]
\Shell\AutoRun\command - T:\autoplay.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{50c23b40-7487-11db-8a4e-0014a53385c8}]
\Shell\AutoRun\command - Q:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8734bbf8-19d9-11dc-8a83-0014a53385c8}]
\Shell\AutoRun\command - H:\LaunchU3.exe -a
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ccbb0950-2bbb-11db-8a2a-0014a53385c8}]
\Shell\AutoRun\command - I:\StartPortableApps.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e92c7f98-816a-11da-89ad-0014a53385c8}]
\Shell\AutoRun\command - G:\SETUP.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e92c7f99-816a-11da-89ad-0014a53385c8}]
\Shell\AutoRun\command - H:\SETUP.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e92c7f9a-816a-11da-89ad-0014a53385c8}]
\Shell\AutoRun\command - I:\SETUP.EXE
.
Contents of the 'Scheduled Tasks' folder
2007-05-15 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SpybotSD.exe []
2009-02-09 c:\windows\Tasks\Spybot - Search & Destroy.job
- c:\progra~1\SPYBOT~1\SpybotSD.exe []
.
- - - - ORPHANS REMOVED - - - -
BHO-{08E4AF6A-642B-49EB-9035-00C6A99EE8B8} - (no file)
BHO-{3f1ef236-098a-4627-b794-c862f0fea51a} - (no file)
BHO-{7C35C4FC-F512-4996-A10A-169AC2D8DF08} - (no file)
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Chris Ball\Application Data\Mozilla\Firefox\Profiles\rjedpkrg.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage -
www.google.com
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2009-02-15 22:37:44
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1008)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-02-15 22:39:56
ComboFix-quarantined-files.txt 2009-02-16 06:39:53
ComboFix2.txt 2009-01-24 21:09:59
ComboFix3.txt 2009-01-22 23:11:26
ComboFix4.txt 2009-01-22 19:59:48
Pre-Run: 57,044,754,432 bytes free
Post-Run: 57,071,353,856 bytes free
1424 --- E O F --- 2009-02-11 00:57:15
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:48:26 PM, on 2/15/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Airlink101\Airlink101 WLAN Monitor\WLANmon.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Wallpaper Master\Wallpaper.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micros\HijackThiss\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [Airlink101 Airlink101 WLAN Monitor] C:\Program Files\Airlink101\Airlink101 WLAN Monitor\WLANmon.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malwarer\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [WallpaperChanger] C:\Program Files\Wallpaper Master\Wallpaper.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk.disabled
O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1137478557140
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Wireless Service - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
--
End of file - 7664 bytes
