PDA

View Full Version : Help with redirecting please! (HJT included)


mikekk
2010-01-02, 18:14
I've tried posting here and have not received any help. I'm pretty sure I'm following the guidelines, but not 100% sure, so I'll try again.

After doing a Spybot scan, I get the following message: 'Unexpected Error in fixing problems, cannot create file C:WINDOWS/system32/drivers/etc/hosts. access denied'

I cannot use my internet search bars, and the google/gmail page does not work. If anyone can help that would be fantastic!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:52:26 AM, on 1/2/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16945)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O1 - Hosts: 74.125.45.100 test1111.com
O1 - Hosts: 74.125.45.100 test1112.com
O1 - Hosts: 74.125.45.100 4-open-davinci.com
O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com
O1 - Hosts: 74.125.45.100 privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com (http://www.getantivirusplusnow.com)
O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com (http://www.secure-plus-payments.com)
O1 - Hosts: 74.125.45.100 www.getavplusnow.com (http://www.getavplusnow.com)
O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com (http://www.securesoftwarebill.com)
O1 - Hosts: 64.86.17.32 google.ae
O1 - Hosts: 64.86.17.32 google.as
O1 - Hosts: 64.86.17.32 google.at
O1 - Hosts: 64.86.17.32 google.az
O1 - Hosts: 64.86.17.32 google.ba
O1 - Hosts: 64.86.17.32 google.be
O1 - Hosts: 64.86.17.32 google.bg
O1 - Hosts: 64.86.17.32 google.bs
O1 - Hosts: 64.86.17.32 google.ca
O1 - Hosts: 64.86.17.32 google.cd
O1 - Hosts: 64.86.17.32 google.com.gh
O1 - Hosts: 64.86.17.32 google.com.hk
O1 - Hosts: 64.86.17.32 google.com.jm
O1 - Hosts: 64.86.17.32 google.com.mx
O1 - Hosts: 64.86.17.32 google.com.my
O1 - Hosts: 64.86.17.32 google.com.na
O1 - Hosts: 64.86.17.32 google.com.nf
O1 - Hosts: 64.86.17.32 google.com.ng
O1 - Hosts: 64.86.17.32 google.ch
O1 - Hosts: 64.86.17.32 google.com.np
O1 - Hosts: 64.86.17.32 google.com.pr
O1 - Hosts: 64.86.17.32 google.com.qa
O1 - Hosts: 64.86.17.32 google.com.sg
O1 - Hosts: 64.86.17.32 google.com.tj
O1 - Hosts: 64.86.17.32 google.com.tw
O1 - Hosts: 64.86.17.32 google.dj
O1 - Hosts: 64.86.17.32 google.de
O1 - Hosts: 64.86.17.32 google.dk
O1 - Hosts: 64.86.17.32 google.dm
O1 - Hosts: 64.86.17.32 google.ee
O1 - Hosts: 64.86.17.32 google.fi
O1 - Hosts: 64.86.17.32 google.fm
O1 - Hosts: 64.86.17.32 google.fr
O1 - Hosts: 64.86.17.32 google.ge
O1 - Hosts: 64.86.17.32 google.gg
O1 - Hosts: 64.86.17.32 google.gm
O1 - Hosts: 64.86.17.32 google.gr
O1 - Hosts: 64.86.17.32 google.ht
O1 - Hosts: 64.86.17.32 google.ie
O1 - Hosts: 64.86.17.32 google.im
O1 - Hosts: 64.86.17.32 google.in
O1 - Hosts: 64.86.17.32 google.it
O1 - Hosts: 64.86.17.32 google.ki
O1 - Hosts: 64.86.17.32 google.la
O1 - Hosts: 64.86.17.32 google.li
O1 - Hosts: 64.86.17.32 google.lv
O1 - Hosts: 64.86.17.32 google.ma
O1 - Hosts: 64.86.17.32 google.ms
O1 - Hosts: 64.86.17.32 google.mu
O1 - Hosts: 64.86.17.32 google.mw
O1 - Hosts: 64.86.17.32 google.nl
O1 - Hosts: 64.86.17.32 google.no
O1 - Hosts: 64.86.17.32 google.nr
O1 - Hosts: 64.86.17.32 google.nu
O1 - Hosts: 64.86.17.32 google.pl
O1 - Hosts: 64.86.17.32 google.pn
O1 - Hosts: 64.86.17.32 google.ro
O1 - Hosts: 64.86.17.32 google.ru
O1 - Hosts: 64.86.17.32 google.rw
O1 - Hosts: 64.86.17.32 google.sc
O1 - Hosts: 64.86.17.32 google.se
O1 - Hosts: 64.86.17.32 google.sh
O1 - Hosts: 64.86.17.32 google.si
O1 - Hosts: 64.86.17.32 google.sm
O1 - Hosts: 64.86.17.32 google.sn
O1 - Hosts: 64.86.17.32 google.tl
O1 - Hosts: 64.86.17.32 google.tm
O1 - Hosts: 64.86.17.32 google.tt
O1 - Hosts: 64.86.17.32 google.us
O1 - Hosts: 64.86.17.32 google.vu
O1 - Hosts: 64.86.17.32 google.ws
O1 - Hosts: 64.86.17.32 google.co.ck
O1 - Hosts: 64.86.17.32 google.co.id
O1 - Hosts: 64.86.17.32 google.co.il
O1 - Hosts: 64.86.17.32 google.co.in
O1 - Hosts: 64.86.17.32 google.co.jp
O1 - Hosts: 64.86.17.32 google.co.kr
O1 - Hosts: 64.86.17.32 google.co.ls
O1 - Hosts: 64.86.17.32 google.co.ma
O1 - Hosts: 64.86.17.32 google.co.nz
O1 - Hosts: 64.86.17.32 google.co.tz
O1 - Hosts: 64.86.17.32 google.co.ug
O1 - Hosts: 64.86.17.32 google.co.uk
O1 - Hosts: 64.86.17.32 google.co.za
O1 - Hosts: 64.86.17.32 google.co.zm
O1 - Hosts: 64.86.17.32 google.com
O1 - Hosts: 64.86.17.32 google.com.af
O1 - Hosts: 64.86.17.32 google.com.ag
O1 - Hosts: 64.86.17.32 google.com.ar
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [StatusClient] C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup] C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles
O4 - HKLM\..\Run: [NokiaMusic FastStart] "C:\Program Files\Nokia\Nokia Music\NokiaMusic.exe" /command:faststart
O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Autodesk Network Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskNetSrv.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 10757 bytes
=====================

Edit:

I've tried posting here and have not received any help.
Archived topic closed due to lack of a response. ;)
http://forums.spybot.info/showthread.php?p=347570#post347570
Shaba
2010-01-07, 20:28
Hi mikekk

Download HostsXpert (http://www.funkytoad.com/download/HostsXpert.zip) and unzip it to your desktop.

Open HostsXpert that you earlier unzipped on your desktop

Click "Make Hosts Writable?" upper right corner (if available)
Click "Restore Microsoft's Original Hosts File" and then click OK
Close HostsXpert
Note; IF you used any custom Hosts (eg. MVPS Hosts), you will have put them back manually

After that:

Download at your desktop DDS from one of the links below:

Link 1 (http://download.bleepingcomputer.com/sUBs/dds.scr)
Link 2 (http://www.forospyware.com/sUBs/dds)

Double click the tool to run it.
A black Screen will open, just read the contents and do nothing.
When the tool finish it will open 2 reports.
Copy/paste both reports back here and remove DDS from your desktop.
mikekk
2010-01-26, 02:32
Thanks you very much for taking the time to reply. I kept checking but i guess i missed your reply.After clicking Restore MS Original hosts Files I got the message "Error. cannot create file C:WINDOWS/system32/drivers/etc/hosts." Should i still continue with the DDS?
Mike
Shaba
2010-01-26, 07:08
Yes please :)
mikekk
2010-01-27, 04:51
This is part of what came up. It was too many characters to paste in here.


MZ   @  !L!This program cannot be run in DOS mode.$ PE L +I  2 n h   @     0            .code     PEC2FO .rsrc    $R Pd5 d% 3PECompact2 VK ўoTN<N<T#=L34w
lTS`M6lՍ[NPHr_0)a ؾ,f)|Bţ3]ˣoKjvh-Pw4l4` \3nfwp"nseXcDgϨ|0 O E J\#2\bN\Mk(^EK] m
<_@tHw,K{YwCdAEj]vWbڰ.ϓcF (C&{;y*U2)[)g*uŊ0ʫ䜁M呎s
PKڟ}Cb{/p=_IѶ_' ֐`VSJYgĹ|_KwD ;6ИoOGS̷c7K*gB-6Xfv-pĝ]PmUu ;&ƲoY-00
+=C<%#ɚxu C1y4jST)<H]nwPmq*?>?244 i)mK᪆*+:@C
N>t-dDS[.^ݏ|@ِtP\R-TqLAu\hcD4fi]6nl
o@AFGo*=ܔ|Hϗ~'VR
`m۟IͬK1Ux>ARC)^M.!5 ?S& vjulB礪`2vb'
J:%Æ5,
h2*3g/C\.2wiL*%g𞁇ji]f˓@U?*@.H0߽$UwGBݜԣb]jڞe
)l Lz?j,Bћw`UE[ԃPFW'
Ӛ𜤊*h2QNY2ע:ڏ"5_:fyfƈɘ2V" Gx ys{[ "}g+Zqp=sA
0 Nİ"fC0:m4g3 %۹ά͢
<WqW0Y],AlBw$
]agH(aIyց>(D P5Z{qR9*.r)791;rT5X{ ; 1
಴X*0fTq{ 00|-_
۾%h;s?8PVz^Po?&%fKx_IPzPHi@l0Y!)ߵl=*M3| kY6m&鼦 qO͖hCܾ*1=K1
T 5BIk>yI~v +:`
60-npvpT^ }}LJqScs!
FcZ4qkh/g↎5i/>!J$^`S$(]4*\Vɶq9DK3v:32XEղB7Žbk.K{ ɱ滝v8]e Mp92S -4!/M[#C~*`"_Ǥ*Q*9hm!I獚b ;)!ƿfWJriK̦#BϚʱv߬qNU_5&΢Z׽ S .tP7i^ țvSQ!`[@7z35dD@tqToehK$w!cDzXCUUY3P+O"%x&1IxMoh*}od6#$"~IXڷl既ΔֿUFIo`C&K49.!+(ʯ%0'g "By;OAwdž<.ªYŜlJǐ=v0/5mjtwu.5g"*[/~|6}Nnf9<?Sт &.0BY D{NhٽFrqi0sl򥥼4!;x*xug3eZrjN#h=s`U=c*a]Ĵu{*\ ։Ja)cpjJjW)nۧVB\k0:T6i͗***|H [Tu5oPE#^
)MU\ N/Kt!yc-
֒Ī,eH/C!yI<&PK
*gMefF
* XBc O 0BmBh9t腗u'j]nėz#
*2{+X21z
~S=|auO'ў#pgm5;_vfVu6sh*_~d2;]|R'_U
m@G?])[B+;$x44=Q(b ۗ[@UёyZ$$qBb΂zٸskrY- d5UXI(*ygkJB64ZG7b'XSIҾ]AI@HmHCXR@dM,M 7|J |HPMoO=;2ow/zi]&dTO/E-߇B?)~d#*.ʉAn
k f){l! ԏÜD%6 f\T^S5wQxrnC8@m
޶0
}*ۢ*8[},8Hj^+& qX dDKGc0Fsv7X@-
\<*XMt f$pi}Oӝ^_2jnШXhxy=2uߋӿiz--N՝Ovq?4"
#€X*^H95^7XBB[Ŀjե(?<2
z.8*O^%??-0 F0^F߇Mfάd,2'^ΰR;QVV-ɝ?78Zh\cnKl[W{~8WUztCp'o*s!gS,~ ⏏{9HSI _UapM;jD%Iuj-8/P_vT[P=*2V#C%92<\*8mj%*yT% ]v{@YPx"+czP6#ְX.aʌ*eR0R0_L,mKBx30`2P}ud'"-,4_7Ͷ}}I|M 1cdrC^2CPM4RhӺmKao{*oZ+$^2QʫlNj$
a w+bESfJ
q%߷ܥ P B
vEh?j9BLQ~ UZsWa 5Dzo$_6o|_|2f{ٷQL*bPwjJ$5P> Ҹ*!
_"AsNсTW*A'):Pld`_L3EG)QWV,n:M ֗rʢs<Y D*Gg$U㔟Hzo2t%F1(g K
Q"ۄ NIߥdUtFgIcghnX*g~n[ /Ī_rξN<qGPJ,/cgߍm*rhS.r'r6 V5S @Xal|z*]\W.
&:*A .G8B9|hz}
8X=|]G0n clNS2
W}syA$2KWS@Er}g2fF3TOwrF!9zC4=Әx)uQmhf|B7doң)- ky=fo1 L)e 4(to(??v|\+TQ c
NewΧ}֩Ml*Aw{1E!CAOd#4е#/Uۼvt JAW_IԱSS^33hAf=`WJLJ]pr䫽n»A ωBAa;h$sI&A=1ChړKZk(uʁCq{V= O^!.\'*f끻Ѐ\A M_/cbq%18>.T^* [Kte!X!ꙃ'K*2fB@s3fvMH讹0 gSk*l R"2Ќ*Xb) K}I@,[5>r$U2
~$^jXCw4Ta%Url\<D*z#.mD|gX ز<1L=ÖS[IH?N*N?\lT?cpDa^GtL4C!:18_qߝ&exyCΘö6D Fw P?4,HeR@1yߑ1vKQhHsw7ڸ*kTa }#n?~è^](tXJWʞړ\YwMClLmIfAzL* 4~b}Se8[ sL
!3ژCySv۞jϿRU^?ݬ> ;aJbeμ{B9IdjŋmOLlj_tڋ6?VXtJ'*>2fv17(uA\{іK{ `<jfdt**!: KmHt'c :^igfd fH<WoHo/݅['."bD{"FP*R
`#JasUܚ:2ik߇ '|+qHU:V#HIݡїTC׏.}UA*y%P?RSCOɉԺg
i5N}<Z3BV'rȶI4iP!=^F?#5;"W5WәiMe
h?*ؓe>>'hTa+%f'P\į z"NMԥ:@=BUzAˆNVcc,WS%$ =HS(Lo)kNo޸ )Q+Tv *Ӆp/7 gp }5BG+=QS)90[* plr*Jȟ"ㄿFkfq xx!/+B-7!Qr5 Qp"HJ D:2
m[fݙ^+'B`$ojehx4c'P`"Y!U7ՁmRD
cMTuL6]Jvb^:w`2* !
a:k=Kv&"q;lZP|1\)A-} g''4t>\oqY*N{ صTNRo,g & 3{Um :sJxK ˜>rosf]>u1xݯɗJAgs44C
bhEuyߌ'TYz絺 (va!)
e3d7сλ4ۿSɋ
+
$'A)#5bzmy3J
6D1w&oF?CS͍̊iSB7v&'m[Zn8Xhw_9kP8\z@ό: ¢;q2Lo*y*Pvhޛ7+wK{yPѯ,ֿ5@P:+0xUy/1|ye\klx<b*
qAG$1'lRIp_*Tksdkw
W:n4wȥא<^p#>-'JL8PyNOܚm#V^'Y@+n@?ݰR6 C3k3z<QBI"!DL?VTBQtɦ7O/ٛ#ebR=ܻ6W&n9fɺ7ͅZDbvg>*
0*CxjCcѡe{K
6`c#e[.!#!!ee[=2g&5b,H-:Eu=f~cvtm!*RAh1q<B= :+x KY ^is+nFssS0گr_톆QZb3 $Ⱥ$y_!!W0'_LxI*Ȍ%`a4yW[`N'W $^H)o*};#i0H4puehS4

!b& !.N c=G@ۈ;b?TbRG \o!R `;N
O^jAv>'䆆|9YwQ9eHf*G raDrsE@F
K5wEzb 6 1un2Ǹ]oت#`<Wj`ezdaBbD5%OuYs;0V-˂YC}C^Ƿ7lDŽ,k*'ުBLMU]^5 l^e7*p{>ۈp k?vt3jQL/.!tvɊ)oL]v4u
_4_>bU c-%#=e:?'/GYvXgZ^ h|6`R@QnZUS'+"9l_/P>\yXO{Α3i
?SJE^rFhM<Тm1hVkR %KrB/Y-k*4E4{<q7vXڲ6ҽS|3FfB0`;
IV=u}o`jl}]7w|m˄|VX??6쒫N53k:&IjP ex{vQd%jٰG 9\[ Z*Jڹ 0! U-?!uѼJ+yH~QmZ4KMO0?o=k$\ZlDW/oWW_dF߹'\SО2&h6d.,bf>O{<U]$_Z_[7lLX#
whZ t">1hcphWOTux6J`p Վ2Uvu;N1Ng]<Μ{BQ4zF`9Yg`Z&5/[LH%FVv1 DUqOIm|x*R5o%*1jdasU)9DFƍt<6e<҈p{}zzU0/ξ V 33xBlO;UUK(-cpDiȞR!¦FA [r]V8D'['+e](6 $gX|~LcQ
q
gТ)L*$;*?ʧ"
>\Z3!كeX) A!
(DҊ-b@j[<W~ԻWF8q;лI&X-C*'KL~h+tVh$iYrOC xϻMjDff4l@e2_|j_r櫞3{fɄw'\G*<-kRZU[5w.}5&b 3My;O@Fbh;0xa09ln؅Ixh w7CsFftøܱSlMz5ZYGDK~K>c_)'YR+/%;P(&-!݉DkTP?/gyA
-YOG=3N GWȉ2bw w?W܉
]rn]C.XIxC~6M>aea
cJ2f=;}=Qm*eºֈ䪿=,b,g4C~$}rWŀXaf#*kfhӋ`Ý959"{WDh YQz^/}
n.pDrR]ofƑf8:W"a0J:k_X ;ŷږ~n[ER^hPk˻y#њďqqbnUlk *Jռ8@!.wxS}P3q)F8u߄:zK#. @B
) wnNˇtﰉADCrl#1Y?ؑ9DBQa%_UCF%:#M3`/-` -Wu*eXg ȵz

#:tе=u*Kw+0V9Gܦҗ}jB# J5hW>!}$ E"vcVxx.zF) 2[?Xey{ ҲIMNq3qQ+AsŖS|f*&'t.r.9I+A. pmI
6]2
XCz;D~E˰ -E T sv [Ӏ*iG ArP3A7 |,
=] ։n3TRZc7/&)tʼnCrtl3`tR{wp\*h."nN $`\$QrgO hҵCnX̏5Eѯf@S *Q]29'_OaU.:@,p׉J*34$3_ %xrbtfqǀt9*:tЦ%=8dZTWG7h/;#rG
tP+/G,|Qz__ AG43ff2lD*Y
/VINhS !hW<!i}lSܐMx_ ;0
a2tԘ\ը CIl0|geZl =h**c~x5.*qaf?(,Jc )2]eٝ|"sjU*:e >ʐ" U8%8j|2Ud׷cdV:Z\R5ofinz0!"g# Q
n.S1b'}n׆bIj1wB^38>8~y̫ըq}eA[WZ6*dJ*`GڧJ*+"d
2m=uk}*׳W$RNa4ڢ 2= hp4{Y.5n 0NΘ;ȏ_*ï3Q57"
o_;~j
s{
1s7 Dk 6:Xm9LAH*Yri8CN5y7lr&0N^"=Lh-\$AvT7(&0z(<UٗŅg_MЦ#'` [PF0@:*3Jg^g۵8"s`r:r ~FAq_}DI#5[[Es+gkXu*W=lH~9P'y"=ok㐫}[-M<>:AGᅢ T6ԣ>ꕵk`iC>'q 6+{㉺3-QH1Yhw} 92eýN۪s;w"]~a 5milqqmp 78F⇌1qv/,i}=vɋztQ*U n
$I
0:4T7r_*3ۓ}c*BCηДT{ܻ4֞>XdnI,(g3 Ҙ
pPBg&AZQ+."鵵T q_(ß,.c l~4vWjv P
1 -h4}{5VЅ4U0*Zf
mⓙ)oӏ2
Nkvѓ -5O]<t {ӗIb!|\4JG~(A}fM_*,P%<86v-po>x*A.0ɃK=4Y^mZwv@Xt^Ubd,e{%U ?~*[Vtx@*k*uN@kڂo7XŔURVV6='8BU)eNb9kF5a(c*hjTn{!3 (}),V9=V : M(qI'
ϒPz-bj, bR~ىv)$.߀ui"|C Ae"Y+zXsl]J )HD
?Qw7"&7qw#lBF@v}`VC"#*mS3s$f\!dP*Y±) ψ!J*-C31icTg
m0&)/#6=mNjK=9/kgM7=* "q+
2q'<(hݢlGKqW
S1z}*?H=i|8
g|[hz %LolKy <NF!.>{\3g2)Hy|XU6 gϿwD@ b$.O,n=۶ MxlҪ(:#F{Y׊u[.I,U:-J̓pc5/Ʊ 4V~5#]U(R
L
o*r&F\{PD:8'5UKBܣ'JLъ;^-S8._4PUӗm8($2+?B*3.L6G"TK'-m*ڽ~D[3$*^QY:b%z t'CMWZf!"XS3ӅD4'{|rnU7UOONi<S5~kn4<K]QwTs:t sQeas
*VLA^
*/3;c=CS|-
GOqH9B%7/yA6fy Hϊ1M*ͅGUWa z8.yxqm̗fݢB{RPF3bs9a i%,Hٳɫ#w`ϻ[[5cdݽyBx`5" DX鸡[ 4DX:xeaJ2`_C”UV<{:><-y,ce⊜NWL{t#7ZP*aw xˢLr'œh ˳-nT*8H6x*xb3_SY<*Rl`&O;:"//1>73@AvDQ\j!ָe.;6>f=*=n/ =G6Y2erA]* t!*0ncb44:Ar`S?Fܫa,P^rR…@t_uS&3"2h4ߓⴉ*fkrzd!O\Z>y>d.[P}F,@T:F"Rs>Ty6zL!']7
):Cdբ{Hi4n:"tk"mx%0AU0sWϑ(֓ $uW*+l%Ǹ\`Fsfc+R7vrCve \HtjZQA+~*߾ZK1r',*+M8H|BK̥s;NbZs.a[}kckz#XG@ xjuer/F!dv1_p
kTMJx\[XP*&U²FNv
O9'e>rp
%~CL5a
qU7*tRR+5K
aM4JF8^k!ݟN$;)=ŎW\!+wZ[Hx}}O/q>/g5]c򎱼a>FC۸_LXثDǏ`^/2^=UhDCpT$sMΊ  tP>fCQHV`ptЊrdFJTT\Hޫ|5~[K;ס^8v%tG1i9W7K^VW^`@Xu0*jO>'LI? llR*YՊ>1b7&gI.V4d,bX9u^z*T1-q諄)MrxI 3֫=As"b;*l:3.]yK0!`嫳D?~N{cjGxgtz<nH!U"0$>QQ2B.?zkWVtuo4p3p=*%9E{ J

-r>;\fhK3ｍAbꐢ]OI,[s"*/8*QG0-Zhh|{8E-=HH
[d;9I/vU<&*Wj[!ʽ j*UvM5|Cwu64 OWe bJ3-{#U<P*_'_cu@B7k'Uf\:@2>TT` Vvl>`>9zJr4VrH/Uiz0|mXVoa5"w9oJ R57+.`?9O:r /hK}m@<6OU{5vwPYЬys׎,Mlb0lh줸 dco֞V*QyoN}S4iĀ)[O:FW7{6  m3jF\Ӧ4BCѡ9Q*6>D**{.x4n+MȘm]H@dDO`
hS^3I2߃z8Tm'N51
V~` ӷ>rѝ`} _E+QћɼɣpCZg(
Q MK*2 ]96=ȃ ֻ'pΗ1hӕƧd@(W-J+Ʉ.әk(GvKƅxQ{":+ FGt V!0%Xk5H4PYkNKՁXʿUïoW ufc^:*29(u9&#*lNZx2эrQsF04CD7
K&]RxO*ҝGPxtX3)86ʚ f]$
-lq$|E4b""$%2~S-"ߜԪ ߷Lhws'|]P[TTBV̿Z\ְMD_".Ytp½h|Ji&AgK}2h0Q:VQ
~=yUKޞBہHl{l|Sdn9ҿ8b>!2*`HR*0T"G8lg/<U*5tņ#w=n/h&T>Zy!vq*aW\A3 @]ȑ(:4L4v=kڈkիbZ%*Xn,1ｗ_fǰ%'[SR@QK/8g(8M,֕tWtl, S>ƻ!*|8_$}
E>{&963ߵuud)?OՙIԜh1;V**S0s"Uւ0M@|.}K
dd#Y;P#6(F$e~4DH!b+Tӧmd9[σ#
p6ڗ1"j&mrzgplN`Z〓r .&ؿ*vE{L,܄nHƫĺ$hz5u*e;'.j.Ga hY>~>ًik!iF=E%Wȶhr䎷#ӳX2[7q%vtsqӏ< ?Pcq@dBTƗb*iwMUb_ۘ Oј9PߋfEy͝1kbN)XJgJ̏y*@9
.2?-2|<L
|dD
gHx[w<v *ufT~
vUws`32RI"`czm/{1Kjv"?*R>*}$Cjd7DX
YdS;
_|זl^a݆iEچ}Y۲>c䶃%+_*8BG12MGYmlT s*eC'$2F'^`Ώ-+RY*mQNvheC WUJ}% /60\AShA,rзÔ**ӷ= ysx-FUPQ ɝG|-GSJ"ud-
!L/%QQigٮI[{^gQ~c7 ~!ReqJAi/ģ0,ըKL3b%jՑ^* ߽,gIK:1#(-u".yR(ՔMl>_#/Ax2 bSKr4N/4RmA:˫%
Hx
w
&D8~@&VU^:N$HŖ~DٲAqEaMw,8H#pH<o Ѱ`(DAT}*,<QkQᯖ1%@]#psoYZ͹*5$S
:"^
d[hu '<ocZ7YFfJuM|-L)nG YG3flh64LS[*ph?hNrT1+{$;HaM|a mJ vzHh(&W TOk
{`NwDظFC9#( fxHW}x[*ho`X.-ɒeh[G*Bq)$-u6ˈ
7WK5 f) !f|Vx3yz2U
<щLlm*:W !gca˃V CA߽~kFpRwG g/3,#2aZꉩ-p]}Auc$.6rNXtxf*:c$O%K_k؛q1{` KWڐzb%fݗr>\R*Q@(o[M )rt4cƐ
, 1w*Ov3;pE2nS8d.'Fħ`{Gi)CF:QO2DP( EM*ڮc7#x(D
*oN-@SWYSє
*˻RKt8>^, hIϱwMBNļ^ 9CU7BېwE) ?yN, v\-m^"k-l(Υd]4zWF`)w滂Id2{}jO+ `v\_vfP_c0w7v/-XbkG]g?Nww+ xe޼%w3?SZI-e
YMn'ȃ6IܮN y8T!7Z^dL'8Q)hЯ7p񩣌﫻* :j NxLjӔO+_r%3wuyK*?=aS[Ìakkf>i2/*hˣ&?1ZyvN4QCd؄<Wy0q*۽uޮB$ѹJMnj<BapY#?&0O>'/Z u)jX,׮z*Nme 7IwiOۏWUŸ8Į3~E[U _BUI3h0;"DgŞ.x/&L 7%>!Qƚ4h;ѫʩ|"ƒ7_կ3I;[:
ӡ:*Smc146*Pl>+6qe_WG7vLVhbr C>bwe
WФ6IjmpR.ȸSf vJPle> SPB͓tڌG7>eXIu[X-T=
ܮ$%Ҩz Ll
4BLퟯS %`l\ zI).*cw]]fE1g,%gh$}@;sWșB*; ٱp~7}N4d=GSƥ팈6z4)ѲEYy1V1މƞ'BN*nps dwF,r|&b[G&f|N~!B*#kc ҝ!?7~
Bٽ^r8I{m +~=ָ -*XPʛ :>\3V&3BcOU~߄<nЈ C#S7HS ue*f4qaa1
~ZCV*)V~
K<D
1nulDިL'rT-A
j#DJԳrްgSuŗ9 ۃڍ$8I% 5w(6M1 Za< "ozNqn~7Ҭ{w7`'&# o(]$SȨڧRr*C3_Z#iҞSn3evk#IG$}M'8*$h\G$o#gr;EӖrJgFqD{kRT
b37ڲxV|}<x|ZF`ۆU=22{Ə`"'A5 MDl
!d+ ~\ȄqQ:rmL0S*E> R D5Y(,Y@%[~>! >>m.{tbeWp&kos,o J J`%5.^|03JN?kx$:aKԗJ
kz{|mi;B.BeD*|_P%Za:|Ж4DYh&;7T$5f(x=Otg100fxX&@g @FX{rC/=lJy麨=0m[UƁd3ۃ{6RO
4]= ,*'dlk
I(2
(cWu\sDpdyȚ͍nY_*S] ^TGvk=!-q^Ѿ^O*Yӷk@;q؍ Ifej iRhrgd!=A18fCQ_%/$^Ij.-"8]3Y.@/N{>Tvʍ
\- icTcy#+-5-v)y!r~;},8q0{4;څP6zoXaD9rφ4@P|ˌԲq4Xţ*1a5+'a*( CI臱Z;99Y8}T86ck7B91z2 bQni(t z*2:B:K01i+L
4^r΂
L"u1@~:#[m(aɇK%I
rFVlue2.6~q8i>x{2f"cSv80nV^V
Ѿ6=Fa%-4mɺK}f1>X\Zos[zr(60O.}Rl/#c*(R<mVaۧO32J}3=[ީhc&LPz1pSoWF({ZDb$F:b#W\oڧ1*p }
_siG3eI_~k67݇'t/ngU49'"{ZԨgxQQȳYўLkልߥxC95@-鴛do|= Rl1z:ԋ41|aU:ò`ʓI̗>&p7ЊNf3f8]F<XN-G}眔+!—@ +kuΆ*uQ'@~˧-(R+}EѡLKRqjpfF6/P.D-B Ф`'.DeFSRLN i~/T*IhDeV g;-jRѻ9@ *JH@lLxe+*i3-qO15uV4 A @܄/IIA9e97Ѫz~&[ogӛ}݂pa>+s</_[)O3[~8f|F:ΝY:W}`cØ69*O.+^չ)K ۵*}c9iC=CƣJ`Mj
z|'_=B}(px vi
YhH涜lc}ꊹssM"gbB 
uZF?2u8@zn86-x߷> (s+ #,pnB:%dTamkh=yzbCV
a׮i/bCuxhq:*b3G`f\ th%-쫝m1>U2*E eRPo#[0wo>oϔx+b`'}b#"<7uEM(Oe:[Et$URl[#s](t;J}F-&.T"L2UgIyƼ*z* =O$w2 *;h-~*I1hx.~n/N.z(ue7)J>~O*tu-j*~j'4>8Q\q:n( rA7EsI|P\7ZF-j:ar
ڹ
7_͙J_ 04Yr&
; =AS1c<jNgv],f+mI9tA,XyC1 FmI iY*6p81cW2k)kdF=<W%rfB17h6\%wy1N]'DQq3qл\b xkRǿ=J qJȻ'~m>rHb[E2 {IVWchэݕi=TJLL:-cӉk*d-4}qPpa#U1Ƙn^ڋLJN4q=aG K'ɩzi0vIv83CB/wiڢ,c*˗
:- GLxbAy ~iYJrܰ2$* .=@FA0/mN\4A>d82eh W~Ǧ#m,CU-<C&~ГDDYssLbR3ٿ9(VĮM;#7o_%](I58:1cgx䶳}B_tr
:.[B %HA U)ȯ r,#{G3 ['OK_^U6Q_XSY *
F;f[j.(nUUSG*ah&` >1{Pewљ-eh*wlLW37JpoӁ(ɔjXeF BTzBد5#f?مh+W~#mWH3 C~+ȓ'\ĵz
'Ii|,KɊިh5ҵ[V̸je?*"#р(t&doQ-%lDHjfI'aC""j'+֌?*〗b]g 2MZ~M;֋*Gfi *"/*rjI=(aw;V/6҈a4l ME&}~(K\}
U*OpXHK&Į2Mjx`yLbr#Wn敪tB{Lv{ /<sޣSl:L
J.& >}csH +MrH"V,*7(Gx@q&*hp:zji_Ac^ [Je
,*y4:ww-3ᤌ1k8Efo X~j87;7ع{n(^Ӿhr1cJozMP3ׂΫ+)G{gJEVTD*óL>I2ԉ0UWO[UdHM^-@ |J3i3O)*4*)bGbw%d|31-qH <g_EqX'|]uZr^-K4:#iԵW[5ٝ-U*%(|8m<*^aR~.0*(,) w{1zn:I^L$>܅6H)8pTLBu2 "a[- yNIg@R@'a `oC&w]
;-G;o*[̹]Ad~6(YDD*׽;O/_ z}tp:/!_ǣCqEq "8tLWmEҮॲbnyJVJԏX"k =LTy>"P*mXWԒ.B4lK7rX4F֧ˁ*PWuBENVq,As<\q.F\oĆW]Nbqש Bh*|yL׉Rb[ba,hxhFf Ȍэm,#=ձ4Dϥq ˝OI ʩ dR]@(*Vipl>=!Ƶr"kA =О-c < (&[B3!]M\QZ1O&A`~He ^Gj|cBNzٕ-15T*Nz%#v`vx!'Q : 9PvN'2eFQk0M|OUƞ^]cN}tԈSqf{&eh"@뾂*hjqWQ_ҵMۻQ?C ch&]mVCCE ^m4l;Dl[ʘ@?쌘-c؝kzé Qn3\3縣 w PqjǍ W@5K "
QscOfIJ~ZDd!e6^A:.sk8x~ī 47- ] VWǥxcflD/ ZcPlA'H m
'#38l`mԘ 潱a[hfY* uʍc-b7ʩ]iDcL|!π]*V%mniH;$&#rH`˟`m+ =NrSS^o .iaujE{|_Í/-ɈS/B#H=p4* 
W A7x艹4xJ s
~nNl PI?#RM*hbT]\sU1)%
GZa,ӱJ/ݮ J9bEg^;LBH d. eĒMMп;iEU{M\W"%t'q=K*D%,wkcК_T5d;">$8\)L(FW)DD1"\v?|M_wMM7h;ٙʹ5r )WLuDԩQ1 h5
{19O
,~T!\ *{&k7{aV1#y <o)+E ^rlLCTJ\}B*HITd89K}wm2clb%ή֥Woo\cI=gzvՎe@ =-j քRQP'KWű9ͨqۏ 󉟀ኘEc^]Ngeÿ=\xզ_V͑k$<iØs &c 3w"vfL**aa-k\±®d G[q
W1MSF<IeK"XRqb#t_TiX*nN85}z!\-ӱ5k׳+N0:[R#7$9 Q@T3h\6I8JaXt$KVvs}٫<FI:8aabDVq|$SkUK+@m`9oi̺5yԻZ+1벥3>l
E*tPg׉}E" *8 v"bi]?\y)vYtfmG3^KWf/ H*?o@@?A/(X7\iH>>pͩ!%*,]n|W6s9Y
}xl"b4/i寏1ŹO ?*{@*X}}8`KrɤRv\b'^298njPyK x,O2`n%*ʋRb#{Oy ԋ"b9H}0zPߨV$7x*>Ĕcߥ'%(5;P;vﴷ:n`< F玸A.z )Rgc.15~}jp6`{FHwB )$kKHUUw*6?ٷXIgtNh/LZ*9SaM":<,}1<$@+2e#$@LYǀ_"t}q3&[-1M$ɳv@]
X7u)r E<DyC7>Y仵v–g'`44S>Ӭ?zrO?b-(\r|>/lv
wLDG(";Z
<U舞۫A~cBŠU'k^Ôa#+x0v]mǫ&ը<뚳9&7y˥gB8M,RfOk\**B
<;r1x-l+$_bW{)Y"yBS1뾖ŧ }C72nCH5
6ZU4
RQ<cOa0&5\Ж'g*6ڧRG2WJ,rs*iMza~XF:0핊pgɹ:5Ph@G.>0Ƚ}o #< R9ܞ*Wf=Al&2b_"&VzƹNQ*D.)A5)F*K=@*#SQoBzi*t ZExy+qj
:eͼ8-T)*g 2uDv@ؕm}i03a=K8Ӎ!d`7[2<ϡfUE=p竇A~хh5gBTk$& ߖK*вF{RZXa 6E^eg$>Hpm1Z:DP2|9&XC7<M3PW_2)KLԖˡ4Z{1$ir>f펓U}mXhUjsPeNMD5v=L玙z[Na zzPˈ6wvL,Rߌ._O?tH9"4@'ٕKC5~_ ?spY 66=T>lJ*$!rkrlzZԐWNg٥,ҋgLC+)p9qMFrS ct
`BԹ.2*W&X=8'a+(Ce$rIKKl<[g*S%++pڊjs#+e jwUYoƙ7&-#tZR}HYZBPռ|bXz!@o?Ax*wWZCװ X> 8prMN$*שSĒ3h\@F&J!u  . 4*‹R<}ME8_q9>{WC֏a/7c5f*\Z|mPdVZ\XU*yU"%(*1OԈyBnI\QQBJ]0R'~Tt?gK,%.邆>*/g(A n$
ka= *F&!кaD^7B:zc7ZedG;ܑ+߳J(02D~Jp
'CY'vH߃* &,RGҐl̯靖 rˮwxN7HɶLr**@Zx)&Av4N-J_y^!2ܥg0|ZBOq/%XoT~ި#jY\:3r $X=ЩrD(!ό竪9b'^|
N*IGW
eniH8o*'rEk\]Z=,rz(!Kg=ZCoZ&(2c [[Q~d5T@p΅,ޅߍ$*z!ց#
\_Z~%Y
x.M=ܙ/0V* ZPE2"~#_Htf5IB;+2*. V,@">Ty .MDxx`5@ D7mk]Fq.anʊb.$sb7'Js:4zh.>?>¡ĸ!7Ӳn,MiXGI}z/BQϩ~. o|ϫ%)pV 5O5QW4ʪ{-On/B8x[><'
q_n/6

Ǟƛ#ɣP2bY;LžV%irYgغxV*:ȏa*Twֿ{JW2/^J[uǖiMui9Qvk ҔՋn׳<^*A/G*b"ja=] Zq:sY!)iJwG9T}PβtuR~Wc\d6@+i9aPƳzVK\Լ4ÂD~<"50N {G!B)F li:v܈l9V'Gp* +oI LgS1TF Gqn Z.vþUdmHA u-*Z-Vd*ԩS E;N93K_
@JvvEszV%%iAASoռNњ(KΦk3ׁWO̿gO_o{q
wN/^1mbzqޜfR*RMe?wrI 9\h͈gdx^"P&h@BWY/]_iIڵ(C*pt]1=@1mx46wxnq*7OS #89-j)dʪ*%%#b<>`Ɣ:Rh]zR]\iXv[
?($V!Zwre:3)WUA-Pv5*]x9<H{ )~,bZ2oؙF 4^GPa7*Tv8.Wѣ%*yb_*2I-`RBن{!5ٕkP 뼖Y;+#ęE. PFo+8&07ŁW4DA D!b4fjb]AR6$ \WQOr BkӂT1p2޶wweG&[y-,kOITyQr*,**C`@YH-t\_|v1OaijKr)Xt)a5̇ 4)nj2o)bi+RLoS*\+mmz'2f\^fo2Bs[1y pg ln{Ǐ|F҂^=&*NEp"涌} 5!m[eךWbѻ?K"&N:ls@vaE.JG|ݕv}c^*H<
+IFNva `.nԽm|DL&}+S򔽃ۚ+c.z6E4߹ٗ01'?꧜6d!?7[&e{1zg-U
k+Sy$tj]ى.[&b| (N▒wF;7P}\ ~,}21M8AJ`Zwәrn[ ¤0R>\Ё*y2Y
'_(?B]*vw5Ae~r6<<lmYFRE,V3}ڥE vU TG$jV&,>Z$rÄ΂70Y&" c>\֐c!h ohgahC=S[QInGށ"loQ;VV|}^V|%˓:r Bz_*uY2̌#v (* %~kt+sq•+owR%Qņ-qnԢT
08P?kiax
L XYv`hK|.Gj*^FE5{ƧfbXm^THf_]NvmdԿt 4@ɋQ
,mD AHpw vHq0!ЫrBWKkJhO* |r[yNjZ#;<b&5<*Wmfԏ
;2aZIcMѼ5 nW
%q;-y*-@Զû1rDcP
f
ZH"'_k~*FndU`h*J$ NhZnB]4w-/mރB*;}eB py
ŎR[xbeG4ہܪ
$bPvh*3K+"Ͽ]ZVs* [)~
_CbА6Bg4VЧɐk*J CFҧa|*Gߪlto@ *:K{cf.AaUxPB *#/wX1t|/?"2 8' k~h?ɜ
닉5 OO͛M9o]꬛p"D43ՖFmfle
<?I1֙ _$sD0 /p :#Q> yڔ9
z[>Pi;LDSXݓ;^?\0
vx'z*qΏIQи>%USh }z=M>45n;y{NjiWN=Ԑy<;<e9auߚ>>=8c.M,B!iZڬK$nsY׵`Y uA<:@㴚el^ KA155(H"4 ~. uC/,V4)F.*]`qlJ0J4~Q*Jq(XbA+rK+ C.~'ܧI~CUCճ^C% 8YL)v_=j ji4'n23!NmԱT4yy`4ϵ? tgfSBk֟eahhXTvdsSJ;A7+ِ
<מPԤ7Aܵm5xx[N<MC! \D;6n|NZ>〝7-ǗvN͚s$Y?g{4bb3WC'ZY^D )"<4"}8ppv.,͒ mO0$,J% C*3
6HE:FӯX 4E>֊AfOG9yQ!kg;KKM]_7%<6ujie핺ݐ-:6[+F(ze_әicJIZPK Xd)+l<ь;$6 lBXdDh߀y]@30ף%5!eO|.ӫdbw1?73'*Q2&|Ms
~b {J|.ZoTke\qH9x y#

z3:Ar1pZ]&*ƉZK3ABc:1f&8S[2' <}3'WQɕ]\IJ06v8b~R*vаJzqr",H+v*؍ 3*9S`շFG2O'
D+dj1swiA*x 0e}_s>UHdxrCWᖬw5)GJ.p:K| 
*snAq@q2lbLpKCkM|*SS7
"%ZϦ``gm]hiQ4IFARTٖ+sa~@ed @
YcĿ ث&6}Z&ؤ&A<g ZL<FM)clyQ;54?+b
m^-4Ɇ2D嬸[I`a :EӞޏuw
#\|mN @Y·5G"sEוEWkrRXqލNe!ŪV*]od'GO/8}EPM9Gk iA?
r8Ýé@4n}Y4,g#-^aSęBa_Ut)*$?M_[r@kkVsIJ*g{|3
.SFhiT"DH,X3'p}}RڥJd[=;>EնԖ'-4
ƨ#
;m';//c3:_w
4duo-N@bTEQJězj7B'De$sh+)PRXhE<AZZف
m'ob
UB4^ө([L3LqH8~?~y1tX[zVs88HBJuěMt|Ip>3aFi7
+<Olzt\eҸ+/KyjrVy@(:"ɰ5c|*A6v =ja'яRt] #V
E(\,# 56nmr&)"P=b*(Ȉn*` KAG'|L*αL0X=+UeMd:ʄ)FjhdPpyyA&:"TZvՁ ,S`Oͧ,2 sϷ[ۛgVȲ<\iDqz}c/݀#+(/ۺؗ7H#ÄW7*\Pxqwb7QtR
1IXvSIV
SY2.Ǩ>
QyA
RY6nW\}<cFBN9Gx5soKe0-?&Ȗq ka;
N6im]bdy_0 !nb/*dtɔcZQik}
A#yDC #VGsq0H*b6c\
|
T82;@|^v YqJ2)p%#4fG%\Aaʾ T^*쯪4LTl"T,~*gt@EKI+z.+iu3{/wqW*_2})}øƽ ǰ\=!3UO*!N0){i
;Q+.41"kꦪzu;ת)3t
TYK^/;X9wvNȮ"T:mdçUriG0*֤C[igXrG*zp:Sx[YEj 0#7&<}WĈH|z. Z"R9D^1 (,uȕ#'7"\ϝ2MnE8/ len 1!S6g?:CSP.,4C]\H*ol=pA{5̆pTreNC*.+ӎ݃",G4mJsJP**'o%*
asi62coG% 8urL-JB%P'!X0&Ynta ^aIggR/Wkg%_{&_>`;
oE൝M3IE1= ջ~+a\z~ג`g̀Wn iwymw4(9na{~ŨQǛ몦!BVj2cq{(;`أۧ* G!M/6ecv&Rs'צ(Texg&'q*}`|5y!i[|˸꩎ Z4Jݩ]VޏMB2"/aivӂخ3LOjr꣰"*l'_+yD^,bڣh4+A65"(i|yw%04LdZvtҕ0Desl-% ~M˫ |``#x+e|NmIMQ bdrB"
%XQM8Ԏ!;y*m*!Vp2
~*y*Oƣ0뇟s*+4o,1[9wL<ZUθ
Ip [GHqBk0L6`<l zjܘ3
ͩi \0f%/l04|PF̆qJҬN`biT3E<Rsrם0¼8%qϷVC!2oK}Q?GPYN'۪0iNUf []*͊ OL8J]x}Rv͘JY۪ M4z#bI߀nVt*8CMv=EgB+R#DgՀ^^gr4*²&^*| XiÖmJ;Mo#}Hw"ɟp7&=XƄ_3!(è࢏Th04UeZ9͜e?gzQu#fAkaȹ"Ѐʃpo};u 50}u,TՕ}{Ƃ4i||Ip3rReSHpv
c؏YIIvBnC9fB&YjmBȁbI<4Ԭ'/*@@R6qWt*n0ɆFNM<nԒrZ6-M|6q:D#[*{K8 fE}6}%_%+謣 |G)RHetuR~[*5v '>PxzLK$COAIw*Df$e*jDEG77/OtZ *^6Mq~tns8VXKb;JrQgN$W [bvq1"тS8ҨK#SS.K'OzDڍ*iy"Hn/U+JA8wa0Z4-бJ.-\*@sOB :^/vوzw,AEW(mP݋ Bp>
i?VNgo*b\6wQjP wca
P'z´tJKR :JButIr>'*p-?ۣmMDh`17E`gs8>3_"tasa[1madٙ uFI}w?Ɣz@|BFfsS-Q$KĈI-?>$uD^ۊ &a(&{m2#&C_b#z0p NyH`ȜPj I'1I.NO,cy<^RJj3{*ߑ+D\Ʊk(Cؿf*>rf
(o+&j %ztAKC0 0e]Ms`ݽI@|RA JP"#y +RTwL 8\ZƧ1Hln[IL%r2x0={9>Cs{Dއ<g4(;`[<EHVDwb.tF5&<TBIOZ='`$BAfafDPdGeǺ: ns7>zH:qIa6A&jeMߩ @`Kи ɔq7͓*9YͩRQ5+noח[n{
P| 0.d"c/.R=g`+"3ljyY fxA6t!(f'k]c(FxR71T&RgI(=]R2kGTq?) T<H("J6ٺ@aYrLF(*|D1,52$?fX(x^
@Ia>_s (I
n:{* %*@]D;
=)LAF4qD7bN}"(x_6@8 fxB" e-.*?b=<6X.p(Q[oBQu*9%i@q +#2sդYb 3aq.5gR@hxߗ
G0!G,Fttq0*~R)~lp݂罐?|a>*.KY1@M"=W *y"*M >5paL3\1-أ2By0?Z.qzaC.*oE+KϬ
(;*q<e
Ҽ'ǒ*8h La4I4#MVkoY5dlGNuUd8̀EikH3eM,՟ ţt]Ph1r"2}[m H}[FEQg[c%Z
>q'tRR,`e"SvuEL>& eg*k9j?A5DݰXgt:8y~7n #d_ʗ%m(2hxy –Dh=#?ePk9y&G> 0=qbJ+)472ti4*"y/(?gWԔe=`X9;n(t0gI>S*c2,nTwH[DHӌv?'ذ>ϑ>VJ[ΉyƜً?h>W*24[ӥΎF29ݑ"-9xy@M۳<4&w/wj-LQ*M0(9)[Tr<~O{">0f-oə)Dpa?a#J]0hsxQh{B|Jw')Yxgv]0?\~w$RFF?2yטPWpg17\y\͢F &c$4zx0N>(*Q4OfIJ
,}ZkHNY)vX ?T< U'4nA |=03n%A"3w^Ω0/eߢJ4ey|u<G5Pc3Wea˦q̂+PΗ(ҕ
W^=\9*KԖ5A} Z0ah^xPϪ iVrHX6*l{],rwc2 V*wYmWRsO)~po
窦<=!czb6[+.
BgSe%:ʋ}Sz3pr(RenhlA"ŠO[~EaԕBEُ:=3y:9 =)du[l'WB d1"~AWQVP9*RwH}\R ˤ&M^ck&I#3 "DY^
D@әy*^HBSUK$ۥGf#/Li=wHG[mJ^*vk&_d7
S0ycknY6Ɓ5NqaD݌m y8@]Q4eMVisBnsn %6$9qu
( v/$ET<k7a\YTD+] H&z8 (@ #,ƅ}sKKȕU*'Ոnx\q<r C7wS=v#Y)p@KHe{PH
b.QnC*=i~Eeҵ3*=y<hf"ý*3"]9ʗn*e49?HDQYT+bUC]č*\T_ X *M>.qJT_EB W+ IivcڕϜ_ʴY!JHcA{ϯ/fZZW*$e1L6
r^ V-k,]y%&a 9Z%9=?/:)nwpn7."e馝Ľ̬juA*Rf4{HPXUl}n:Ȑi*bej2T3 [-{
DwVs[@VIǸĔ:CO.dg
xUlbTqOyEÌ ޱ
%|5.3rϝGەgϲ@_pSMGؼ
FWDƾ69 &iZ2+gL:_ӷCEGAvݜY(d*SEKɜd|ssQdmJrFznRc
`ⳟJdiN/u?mP4*`x-o/"O`ZN^m\{! 1ڻφ{{mo-MFv9
L]% <by}C="jUXфZRz;P磕"Osv Ue\$o>nsQ@ dR-:Z0aE%Qzw]d[:X(?F˺>-8sD{ N3><i`l/+P6*V޶PU/r3
k~66r\Y>OT5;dj^cfܚPkװ)9oer|'ГZ1n(\*MY4t87#xBMqعTfu@lܱ=BhFǃҽq<PCSDq:HnjSH
o*ꃲ7!Ԫ?%MǫTZTռ f;"yͅKf*V>Eko~A9)w0֤Ln&8F%#]VDhͣQf{Or!V%DK/#Cwpzc>HƜEj :4
>j,d[<qBP
aebfoAoy6kR]"#|QP.D `"hE+ZepsĴa]@36 vtNl)|Ӳ4k-EFbv&8*l^C pXH{#
Rះ̒<欄3
?* -&X-]T+,wtZl.X
7HrAB@B/.#7"bf6t!c/8-\]gIi r*ai=-H
=D\W~$Dvkw*:kO& F`7:1(<5`&,]jk:)D>`Q^18,PDf
-ϸaLF!VXUB*{ cUq?ݑ%#[f^>cqX$P|\NkDϦ@搳<H-!" eI:P
]Km&уrz2 <
.3Ju?im{
$\r0`ŲP(ֺ^dLw
Bmc8Sqp=5ncLE\պp*QJU}`UAZyK뺷b0% 7"jY@ jYs/Gg3HVbD*%L~ W+W&j<NYfdjԽ!>C樗Foy)
VTQ
:=|&0*>-<1-E %k]W>*}?Vdͥ4JQA[ztNT(n<ζ65qݽr+>b% !aQ,@m b\xKW!S8Y(+ K7^t[2Y SS8T=V| TK9H v""-gGKA*C]&ֶEH i|$þLwo"9\-qGיe3;.CU=K5W' p|y߂슬am\bL鑢ضϜ(t)~*cВZ*z {p7j
o4הn O J|4l$ ϧz' u?Gގu/1Nn%oIyH_ }^Cd Bj
O&=ߜ:Vmq? qZJ? aʒ"l V {}|g*e #&Lh)}/պ$C*1(u!
zV*>&8
J9qP-V:J4
S4d#؁E]nPZw5Ք*5` q}V5\21 6͚Tf.fZ?7AF,AQ 
1i8ś#l C<"- *.rvzM:_x+%BǑRVv|yҖ~c,\ 껜x18nt߇ ٸܜ{Mʖ*b.1LE
zlgu'1q/=' R%]UJiN}mjd^ϏÞ 36UgA9ҶA?w
Sƾk- E,-\^
6l_kR#O*:/.
vTetx|wJ[}Kr"iX-H
dYꢽlt~VZ/R:7[xqb%ݥ)*gwyZmx*
';V87%yft S?leɊ7^
(۬y'ӱ7yx*A7!.# !bg [!MMziwv *UnxljԷk]
jw%脻:_6:a{՚)sn+ X33PDZ=.'),Q _WBD@

j"fu$v)<X*(uhKx2 AuV)dvvlc0Ҕ^e,+)N,#㥻}W -9W?dBy{+m<SiJ#z`~7Pzo/UN
r#2YSX~xu2Z&Z0u87FE@!VmO
`S2*Tҡplo#tT,*;}K9j<G'ZLD'NkF7x@:ǖobE
-yʵ0@1bEk
gd֫KxM>_(`*5q\rC7 gMGY] ՚~*[Z_h][(tYMeo h߻#a! D=GeuLw j}t
U܊  z
!Hy?Jq^¡@5; pyx$08&mlTN6Lǘ*g_Y/I*Kv 2%GR> )m)~`
pkg-@ܲ;5.W 34l:у)\D؄Ssk 7Y*XA.M~}ϊG?{nG,!@@)m@3)0dcE%^~eA{y *s`
[//I?ZڇgSӟ*>cСpU
F_7ߚ>קO6+8Nx>^|LsP?֞I#Hij)3H.+}AlIW lY yDa*Mސ+AQb8Ii >/J@d/@e sG$NQj *gFW{ СA?J(!tV
+,>$\np}sЯ-`f\q'/pB,)
FHZE:G%jG1@4pZ)}-pWIdl<p=i!"@m,wI }_*o
HgWFtN:%2.ܚl
,j3æyS|5cVuaB+[Qz-7muq@9/)vs8rN*Xw(;t*Ko^twH[%@Hkn4գgfjvqs|47$ ܽG)ݹeuTǒMm&"p K 0V׹Dd1ow[(j>; .uIV
=z_my9q2m&X CUO70$Se,C8r0lqtm N4?XF[WWKn@l:CU1T*%A2[*>HKѩc/dчfJwq[\>pj#o&퇈uR^h2UU'q*+g}iRRH2%J#寈߶+S 93w !F,CGmzT&lhkrލB'a'vILL9haloSF H;4%HVu Q9k"*:nMw;>cxP_2(׼j#CBJfnұ fn^TR ⿹wjx7l)
}6}&7,6t>]X¨l˯"_ (cZFH*yHnϿѮ9΅[&B .52ȶv0b*,5֩ȁqwr`Cv=<=6" l1xIE NL!**-lt*c<eSX"?
Qn(QRKElϕo 3K8f >9\@
L WX}D-յcʳ4}svrSrCO :Cbk!Ke0n{]o4Frjv^DٚPZ)vc1*ަTҺQeϋ'j!lbxK{ā)).0LTmn
vsf[Ph#4RnNw ۘ~:=+Tix ٽQZ*"ks#6Mtx?lT\ïًh}AzJTd.*Ygl*,'RO 1Xz
N#jaT/,bXMg1yߎ]~"*RxUM!E1&Q&<TLaQa,[>@r $x!O
a)|H27dHCNqD&"Oaogx#iꢢӪQC~<^"  blO~հ{\]$+['nDx!jؤ*g;lam|
(`TbṂp'7^;R)5W92pԱAKh@mu1[Q=1`6Z8WOaK~<
_"[dBM`m59ZIu}.As'Cf@!eA-}7*/&¯Y$(Y
EHN `]O[6 FZ=㳲
\7+W@_Yk~Ɛd.dr\q&*ԴYO7gN

RBڄH0^
vK (esE*t*8uNv<ux\E$Ͼuz,aIzt槀S.j2U5`K%[ʑӥcˢ6v;~eC52-W VЇ'!p0:úd+m\ZG7w{Gcl}Z((k By6~6JZ1ACu8'rz\:KK
(RVsb": GK($H'
@)6o"֘6R~PZWD$! <=g
{x7Y+ #kvC0V <j"(@\ŷE;`UEz& pIȦH'/>>V19(ҵr Qrĝ|vE?|b EO.aE`bHA;[&!/ q7-1STHOꪴ:(u|?(m?G Ś1n5 C}y c =s5 ~T?+:@N>Kﷂ[($e5g]D,7$}hXV `\Fq^ GD/ o`(zwy'B24!AޣV)l"
UGܩtǸT|H
G50dQ<9qRfVJuaJ^<EEm:64#C`
]%kc!"{89*hBa*7J~Jݣ_*`˜ **zzP7>T
FBucQXxv_&{P
Uŷ'4YO
'E$+"Ӄ=pvmܷ6G])~¡8qj*!{v=N
"o܉ԌPJ@*fZO JP@}l֣8>?4c㌋;2'J ŧm@{7+A:D8jaSrکbLR=lFDQo\SSh1!O*}"j
q23cJ(M2Js\pFd,e`~Q.gdM6/siK"#Tfא4@浜 iP=,5.t|y >QgWAuMBޟP
R/;$Qf(T)7~3*]#;i[]~Ig*i[ Mb?5b%ur~^B
ٍ
WBMy}oBiox=N
8E*Qd
waSmkM.Mi/߂)NdLe)u; oV*!갨t$LUR3܃76B,gvuj'fa4] _1 3C䮶wyf}Ϻ*Y6]dR!3ta@F$w|Z ~E<?'2vT΃R soQA iPuBxk:qH|:Qbp
?U룚E2"qc`8SiO֑&1:CuR ώS"fv/< BŘJỨ񍀟uB5yr?eπ4l>"4u1P,Vke=ҡBͨ`(<<MEYoO)BY7 tnp`Ϣs>?8P*fՏG+? 6j1t&te-j_@|?K,Tw<9(S wmRQfd2F~S@F*:lp!Z,VChn=<U(?&*.A}\!K@qWﯞ#F|M*sR8fᲞ ֕ݛ2o{!ѻ0dUZЃ*htPhO: y)(hi zJ(eJ*iND

8?{ɷqͱVi_swjcPO -u:
EsT}r)2\#hi(5vYc xf%b#d|סNs0iUU'n&Y
G
fBעvk7ӱmȰ%L.}
n-L*YVe m%*>P>Q#}/t{_yV9TCdJf=Gn5'I]
*1 ),^A]>
&*Mʯ@> J,a*^2
7 wgo%:r@M;bewEVŸ&TFCk1PT
3*dCPB:5L;*[8%W$ĿpnHBai@pRӄ@^m!ڕ NJq͞Y<5ce>0I֨:i;);>ޙ&sϹ76ƳmDq[h8m:վɗ/5E/!Y dymjr%P,qX͗lZNJ7bߛ:Rk9AK"HIUqO!4⏄/*$Ý*j,c&ac!(u-,xe%aɽX擾R-ʨ zNEvؙv.[s&/b%ϿK_4Y<]K M{q*Ɲ]"_*ܙ2*L5TRgnFZ#4A[(d7@`>^*V1Hu~-):e]o+)蕻).'Y*L;9k/!,tx*B:hn6*Iv%bv oTX/v+D:6&6?y/3`.
չ*h5'*=1*8;koڞL&v~V sA
;V+
`/*%.DeJBNcs&stk(7gntd_"H0.&aw6!C*S,RE<LM]aK hRs'-MWHY]<t*&B*7e8ډis?ԩ`P"EG3d?I vE:kP{r
Oe% *%t*Pi4{JrN-Q;M%XD%+tFtձDf։,{rcZsX=ālw{#bRp#,fkN|we-$5XNJa(*g){~C u!YX׊{;̡B,3aW"38b/9dt䏸a -E>7]wa{uh. +MQ^*z7W .=Ϳ?/UWِeP;$ؤk+i_u~cvzJ˥7=!"*sB[)2Zg!">\Zr
ZeIX3\AF
pbަ3|uo}R PNNd7˳" @"9s~@M0%YWu
E1B0#E;Vߐ*LO*!*H&l]%SU7x/լϡ#nǮndfww ZO)Aj7.3
( Wa]r6aĢ }zaNH?_ I7
,b,`Eؤ 0|jދg;tfv'<=~Ӛ};YLZ]%;V,`|.ձw&Q,bg)ڀ@*Ҿ}&fdbɍ 1zy0:B*G*3p/p(b|(R8]hsHZ=WCT)IFS=]QI:X # .tNR;1tD'P
K" ;(F`LMMT+(~|[H@>KW>.^y.яvRB^!DNBl(}9!$#wq\S1> ?u%}rYe䁱]* H[^
6Vw<I'#}0sIi0dw|ltk`@)ј P&#aQ{vac^&%berqs{ epvIl]ǚoUϿFoxcarj*%!*Vv p"XNe.d,IK W*Ь#puwf҅g.W#IBwGw3]̽
|N2͍%$Y'<i̅P hL>t.v`3Hձvjo>}}D+HP R2=t%ջaYX*;0.uܘf4vT:\qIw7c
k A
5l<H^Qo5;oزUEg w#3Ix$,'kK-E OOn~N}H]Ezutq
0lZhw/K!D !w3 #4|q)c;aE\<EE9ծE
7VX. AKN2K8:{`ڎJFd{dD0\LtB/.cO{61caR6/MȦ!S*{s'(DB ,y<i $j[x)uɬ ~G9gF6lK*ҒJys,İ~Q̓J;ؒחu Ԗ}%V
y7D`*gA@: 0[rl|Gwg(fu|sYb'O0L<֡5!^;TIXld`zQtx4OHRE/YLrFEܴ]\hbB%/GP*]ރt󌒪fYi~T_/f)˖HJoᫌMRLEAe=N7!Ǒ.F;q$]`iUć]qW*hEolp,oqEΊPcA$$O'īd2>-Ctu*=NBIN?$g{Oi'-[L$wrSY$m3F/i,-:. o>0k1E.߱yԺriK͊$f *p G~Iڔ
"
A6[~Χ03SJV*` _YE*H
%ut%P|O`L(% `=3*
b~_T!8̼9,2tkϵVߓhGZe99\ 1-|Є2<j*ic J
1 s?vQGڣi aU)xXD6I#u:|"7ﺜ}EOZŐ)ViM|PApF|1"Ɔ<X_;0?5KJ\f
*Z¾
յvި!* =8}B̋_ h_
M|jQezT:t\Ex:A/n 7_ū@L5;'_Q*VvtobV@TyNj vt=.DLEYstS33-,{A$xQ7~f3D?LPE]-0CEC.&dp@zj4*0Iku9wzDxǢ~i>}
y4-
GM7f8{ 9d*lb&K@U |uCᧃ(v0'bNẌ́B)Ԭ94U:moӀAA8=_FG!Y+(>TZӟ
mT}5j"uUN$h2ٍN-b Y1khI9H͌|QI*#*P*\yr|黕+g<p_d
(G:n/l BPleyR-UA.Is{g]Q]$;Ψ8mmvTm!l Oh9Y?bImuH9] SD'gMlS09/bv8lSֻG ;9*غ*$Ҙ4_*4B*|vJ eij"E
'JA*%
+vmߤAf>}P1]#FtSJϛ"Q:[um5T} P̻a[톷ZMv T-2wxa'p]\"\QTw dB蒬1q!X;+p9(,Z4)z
!PzfXo[ֈat׊͈iǚt=hkʸ;sڳv߰5;b]{ VHV2Fּ^(UŸ*b@W=@-e~?rȇYOdܚƷ=qRX#*I+hɫCQwJQ71Us
m[cB8/$MBX4K7A*
G. }$_n *Y"A+Nc?uQHU2(N^Yv9 p b4f{ T~<\|v84+a-STg61cfOT31l z>$/F\{onЉT sXf[=uiP3'H~9*^
:Z=xE<~Q|P-p1>oƷ
C~h3 3bi C
7Zk*M*t07v*TS ;!,39%NC:e5D ܚ=@*{-7@s7@o>DG'B5KI Z%DPM$z9)>ľY ODЙJxD7{;1m(hj\޷ۮ-DHjU,r[<K:n_FU$Dv$>H;MI*F_(0Ȅ[ETe
$?/jw3Q..X[e)O xttN~x:\W.;*XMޜo:H\rzZ[iȯ'lZ.7*^)ݛql"I0g6T**j[vb"+/$?0t"Ƴ)dD*Q?~s ߇X:юq1Кa5*ϪGvq*t 3o4g\Ē!`#O?[b}!*o1$.N9mlZ N-n]۷l߸s\ڦu].+_0Kc\SbEi\!m )

$hOΘ{otn CtV (%אq&IU][
1> ˅g*EYۙ
CҨ6fcbNe&Kˣ-:
!t;Οwa!No+,j|ZSjzY% Sc),*pz%})ˏe g8FK#spql@`|"|I,z8*i*:=U \K8#.&z.sv_tOFkXHʁҩNN}#*K;szp#sܢp5`؇[\,^gVXy!@<1.LcFO9}&lu&t@50IZbU '@7*۸Y0BE@Dg!h$nZ](qcMR<O9,(' o" w5CkhmL.h" D>-[w\19,[-K8=I; 91y
g%q- \ 8w`pFpΊ(_ir H 8-E-BĞG4oQGD(R^QTxJqn7F0ּOΞVc;"FXP2eV'e U]HfCـwQ3zm[[W$ 7ALK[W;xFӑ5p*^saDzJlݞÃbKt%S`zZq"Ô
c1J[(rXF>I|$x!4êgkJEQ0y1
` 7Rֹcw0%tsR}S&_,v;C]eY9oV D,*Op]1厁b-;q<#ғIt1=\kV7U8X9zDM*lM{
m'^4W;ZnC0ě,S+m.G<\SVY!ePa2eX*(w0*}?JHC$8#GI"+7W0*xE)+0 q\wTP%m=̋XpLрG6+9#*_ȝi<XᶴmL.+m.ܖ0Rir.xUU5B!*ۧEIc@;DaѪ}l]{wk:bg*Ғe1/prHݿW8
}ڃ)r66PKpi^d+T
äU:ZOq)K(,)(D>Bv j0س#[4DϧT xKՒ !ֹP[34Ax|W}4[Qo*
ՔX* !5ĽBv5[iR
wI4P]XqkQ
hA'hO{@8*zv`X\"T e+3~bZ7xsi2"㈪Zl`I
_ll1Ԓ#*vhSn\&;̀@"@O{0+s7:1͍ !U ]ȯ̕k4SOEbŇ!e H'_Ue A )rw2-=&9Sn*3 ܎'⊅ =g6 \ NU,M>&hyf&PRE)y|*&oq 4aB_/Qe4j!
qo88-.74<O-? QOK`>Ҹ(5J*v8|f5j2@~C8{R)u@ܹMI@zq#α?.$2dE%P џWzX%Y+jКO&&dX'4s%{[
~JWi,IvDjlJvhʔK3cq}8*+W3bh$9ޘY.Hu?W萋\hڊ|_ )!֣#Z]s / զr~ dR]Ä;jCK'4Ú9fF/bT9wd"Bam׏GnKW-3z$eXCwecb7x{?Ҩ
Qӫ-޷ U??b|F@,L%
o@񉈄"mu5(l=*-|a)OGo= !N>opcg 9 ۻ^lAKžAþȽN*}IݪzH* 6<'ǢBkI
@TЅwE 0_Wq(װ-{=Cưr`5mt"~:BWdbɡ5zB\wU) tkڥ
ܕHhRz,Xyf?/q;MN^f?,6"`'~j_&+% [BTDcW~[b%';=%ts Rt>W! ]\@JW..`?)h~p0}ZzNyܦvk;u^/`nށC*^cFمm*-*!ΕWS9Un#i9ަD4H,@[0T18mWjP$*0||tmB
]<PG/)iq
, `<igqTQ~cο-6=_P{sm3πGz3lً1,Sa>&؇0 _S5pV$Nj*T`=wpqZ#RRilM IW"I_-80Ԧ~$P (0?vgl=4o<8b~< 5Yuĸ̊9-ݤ*;l̜ ?W"GHdZ2LSS b?
21g*BJd#\q V.U90推;{)w&@o=M-.ŋWӢ(ک|1c'Ncs+I WrPUZFGmg*[5a04AވCO఺`&=/01}&Tcq0?v:?1)yeҾ:oBaKg l% n~7TOs9VAh;(-zZRڣvbe)hIcN WN~%ɰΎ|ײd _1E'P6'y-85+*daJ&u8,:mmJruu x.SLNG</ JdH@1 m{wqU1{=z i2+.ÃCvug+7a ]Lvv#+**l0}1?%{Y{f6s6
sG;a?h@ʶ>w 6=
wO(k6yPq<8!lfR om Oxi}6.ozza
G~|0cP8]*-~;nJQ H{**kBO_#r7C xHwHV
N_TPCڿCa4rB^'oe^@,9
Pղ[BiH*2"
_ "#-L6R,-A5ce4*o$J~<j BģVJc%%.):/
,#!r\ $#!)5h9}!<cӳV ۍ+xx܌,o>oZ 4(zBʼn}iz"Oe}B#٢ f+#3m| ܕ*<Ԙ4~\5mS3€䗘*@Yzr/K2*?^!ĽtRu^r#-T a[_bu
=%M8,D sv :.4DWbeߣ*sy!pU)x$$ , x7,b
'ɝ=<GJ(~ۘvWk:٨Jw%"Pe,!/Ĝ"v#ը;"aK 8}$,I(#
nx^K{$j|;K}._πx_"-HOb*/]j8X6jPtB8*ȻPޗ9Ŏ7_mz #ݸ7 {#FQ
G\y3h2]UL׻
*69!#E5FS>Ev wZ:._-2$ҫ$E,NU;*+
fy&kI`E}bj>VWO7e"`m@L9/siNo6Q?B"*MMA>B^ʹG0>h[īNڛdA ]W՝9̘g(x{H9div=RʼnJ+
<-a#d^
jR3'}$EW>_&HutB '\e!WewX J4襆)^:(akDſWͨ1ČW3kǷ>8kfyuG0 E@{K1X[u&VB s%q)RK=</[}w~7˼.͞n7{o @%T/]6g?DďCZmo
ޝyQѹu%e] `ԄYz.m i5K,|,%*ٶj$!4lV*Ogjݑ2<00`909u?ovEH}2Dwx;Xy-$g
"B)X IȄg"Eo.cRVhy8
VMD\N= rx3FRY\Cq1"4v~!* pQ펮1ު4tѣ\ _)_BF((I+J\,x.O>xFm8Rto&$=Rq[lU*=S8B'ʗtxrX`vCZ^ƌ`ISEL*bY5#qX*ڬ͹rpU^jK_B1(|N1[ fʩM9/2xLb <
:`aUхdAF+NJZtsED!#\(Fq72aaVᔩK x2n-#tnPW{JW*ؚWDfUMӉ5>OrSlw܄nˣ[_B#98Eǎ*nOM,y#Ԉ\:{|ȋnfFE'SyA9F=9TELAqYZ,X3œ3I9N2B2*/nQ)=JqSŕUc/{A[͵&ʔr&ۜ[ .7ޕQ ׵sЫ P'XprX*)h Zzb*-߯
dL)NlK1 m0{m]#x=c3IG( \i\GAf!R<^G28
b8L |0 ]UK;/
ReQ0Cx
/)'
:
L*UGK0b*fS6Lf [+_d\2m25
[kn-Aah*A%dcߝ!hP񎉊bO)*oo$T+]
d
4mQ 8*g9*h%9|2fmd`L4y<@m
~twB؆OHBJt ƬRu+_FTeqΥ.|?B*)tV쇏!m
/t5(@(ףC$fYu5sz3ۘ2 -4*H(U ,P4F'*C(FqC7ݾ,rɩw ;5cMCvNu9e-.0FK_Q˸'Ddfͷw.$
#@&q<jJ^¼;N*)cf8M;t*ELOaT3]t_М^hD(9zL۞g|م) % IT:Dl+%@-1Zx|*I4so>y@Ԃ"6R0y }nYrKH!2
JTwJ\tJ-ɬ^pmb|D+2]aY`_c.HuΓG&yOTaJ8ZP8֝qz@+6q K~eʫC<
`TWO I'|
J4k84*'t< sH|0Ygt>]7pH*UhEU17|(J<=xء%L
9\Ӑaeگy Ȥ
 ZBqM;ff+XzTNzfr:'UiZM
`JM:2{Pe0*9
bddÇvb?hU¢h1
#N䛻`¿[uRERQ--gokLNMIWxM؅%S[^ kP]X+|BfP[~GQԗM/zT C8*1Aжr)lx x̬lb=]
Tg><lKF"V*T[nPi.Jbm1 WF6Reu@Mb؇AV(BK og5=HHMqFgFnY |&\QO2-4%y3{?iR~3 L#O_iaZKpyT欝1U0A Orj \pɰ& ̣5OC85ι˦bh楟5! _X8r- % afi?*>9Qi"XkmHp
2ua")_ykMu>LA אŲ+eIhϖLpALx8֢ҩyț5(*>,6>[Zut םkS Ί(N AB80NT<Q+C*X2"k1ڨ]s5&UY ]iF|yF5CⓆjK :X7G;v*7®EۤS~_́WiMW(P&Ϙy<Gu0hu탈hw>b!oV5[qeA P!lsI[/'h0.U랪B5Z{HR.e-t" S;l_9JzaQ']h
ER>R;fotz_ @]/:ZGLNM7F&xF
qrb6ڻGPb+J א`+U; z`9ӺSBNT~*'/d&oecl:Bϰڬ#~䨪Ы!FcÁ亸#xIŁ/T@
{% w(j^çGV`w:!9A1Юؽ`hg jz)3*8] ֮dP=0 r<VsL5J*P %=sd DU@q(51Os{T?'&*d@wQ{5E_[*?X=ONP}#\z̶h*+8qh}!nϽJMe*ȍFDTʏqFv(1 ME8;h?ECL*Ղq؟ib~[XBuX*%AX?zfXڧOTcUx:?^ +Z^ūsgy n橼u ӯ*0FΣ;bˈQ!VyDLP+Es"d\e4=GhvO3K
Shaba
2010-01-27, 17:58
We will continue with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
If you need help to disable your protection programs see here. (http://www.bleepingcomputer.com/forums/topic114351.html)

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a fresh HijackThis log.
mikekk
2010-01-29, 04:49
They're too many characters for this. I'll send in 3 posts, thanks again.

ComboFix 10-01-28.04 - mkristiansen 01/28/2010 21:33:42.2.4 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1388 [GMT -5:00]
Running from: c:\documents and settings\mkristiansen\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Windows System Suite *On-access scanning enabled* (Updated) {9A6E0301-2079-4983-9D9D-43A137D9EE47}
FW: Windows System Suite *enabled* {B864796F-4B26-47DE-AA02-E7FC76536C2A}
.

((((((((((((((((((((((((( Files Created from 2009-12-28 to 2010-01-29 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-28 02:40 . 2009-09-28 23:10 612048 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-01-26 22:31 . 2009-11-16 20:40 79488 ----a-w- c:\documents and settings\mkristiansen\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-01-05 10:00 . 2008-05-03 12:00 832512 ----a-w- c:\windows\system32\wininet.dll
2010-01-05 10:00 . 2008-05-03 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-01-05 10:00 . 2008-05-03 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-12-14 23:58 . 2009-12-14 23:58 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-11-28 19:52 . 2009-11-28 19:52 8892928 ----a-w- c:\documents and settings\All Users\Application Data\atscie.msi
2009-11-27 22:42 . 2009-10-02 21:42 3695616 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2009-11-21 15:51 . 2008-05-03 12:00 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-14 19:53 . 2009-08-04 22:16 4045528 -c--a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-11-13 01:08 . 2008-11-22 17:49 118248 -c--a-w- c:\documents and settings\mkristiansen\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-13 00:42 . 2009-11-13 00:42 348256 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VSTAHost\Architecture2010\9.0\1033\ResourceCache.dll
2009-11-13 00:39 . 2009-11-13 00:39 416 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\MSDN\9.0\1033\ResourceCache.dll
2009-11-12 01:20 . 2009-11-12 01:20 89962 ----a-w- c:\documents and settings\mkristiansen\Application Data\Dropbox\bin\Uninstall.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-11-05_21.00.03 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-11-07 07:19 . 2007-11-07 07:19 54272 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_ecc42bd1\vcomp90.dll
+ 2010-01-28 22:01 . 2010-01-28 22:01 16384 c:\windows\Temp\Perflib_Perfdata_6f8.dat
- 2008-05-03 12:00 . 2009-07-14 11:03 46080 c:\windows\system32\tzchange.exe
+ 2008-05-03 12:00 . 2009-10-28 15:07 46080 c:\windows\system32\tzchange.exe
- 2008-05-03 12:00 . 2008-04-14 00:12 75776 c:\windows\system32\strmfilt.dll
+ 2008-05-03 12:00 . 2009-10-21 05:38 75776 c:\windows\system32\strmfilt.dll
+ 2009-11-28 19:52 . 2007-01-30 00:13 27136 c:\windows\system32\spool\drivers\w32x86\atprint.dll
+ 2009-11-28 19:52 . 2007-01-30 00:13 27136 c:\windows\system32\spool\drivers\w32x86\3\atprint.dll
- 2008-05-03 12:00 . 2008-04-14 00:12 79872 c:\windows\system32\raschap.dll
+ 2008-05-03 12:00 . 2009-10-12 13:38 79872 c:\windows\system32\raschap.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 44544 c:\windows\system32\pngfilt.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 44544 c:\windows\system32\pngfilt.dll
- 2008-05-03 12:00 . 2009-11-01 17:34 71548 c:\windows\system32\perfc009.dat
+ 2008-05-03 12:00 . 2009-12-09 11:13 71548 c:\windows\system32\perfc009.dat
+ 2008-05-03 12:00 . 2008-05-19 11:33 18944 c:\windows\system32\msisip.dll
+ 2008-05-03 12:00 . 2008-05-19 06:57 95744 c:\windows\system32\msiexec.exe
+ 2007-08-13 18:54 . 2010-01-05 10:00 52224 c:\windows\system32\msfeedsbs.dll
- 2007-08-13 18:54 . 2009-08-29 07:36 52224 c:\windows\system32\msfeedsbs.dll
- 2009-02-05 21:22 . 2009-08-21 10:36 84661 c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
+ 2009-02-05 21:22 . 2010-01-19 00:42 84661 c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
- 2009-08-14 21:58 . 2009-07-03 14:49 15688 c:\windows\system32\lsdelete.exe
+ 2009-08-14 21:58 . 2009-10-02 21:42 15688 c:\windows\system32\lsdelete.exe
- 2008-05-03 12:00 . 2009-08-29 07:36 27648 c:\windows\system32\jsproxy.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 27648 c:\windows\system32\jsproxy.dll
- 2007-08-13 18:39 . 2009-08-28 10:28 13824 c:\windows\system32\ieudinit.exe
+ 2007-08-13 18:39 . 2009-12-31 15:33 13824 c:\windows\system32\ieudinit.exe
+ 2008-05-03 12:00 . 2010-01-05 10:00 44544 c:\windows\system32\iernonce.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 44544 c:\windows\system32\iernonce.dll
+ 2008-05-03 12:00 . 2009-12-31 15:33 70656 c:\windows\system32\ie4uinit.exe
- 2008-05-03 12:00 . 2009-08-28 10:28 70656 c:\windows\system32\ie4uinit.exe
+ 2007-08-13 18:36 . 2010-01-05 10:00 63488 c:\windows\system32\icardie.dll
- 2007-08-13 18:36 . 2009-08-29 07:36 63488 c:\windows\system32\icardie.dll
+ 2008-05-03 12:00 . 2009-10-21 05:38 25088 c:\windows\system32\httpapi.dll
- 2008-05-03 12:00 . 2009-06-16 14:36 81920 c:\windows\system32\fontsub.dll
+ 2008-05-03 12:00 . 2009-10-15 16:28 81920 c:\windows\system32\fontsub.dll
+ 2009-11-28 19:51 . 2009-04-07 20:33 25264 c:\windows\system32\DRVSTORE\purendis_2BB5C0100CC7696D211EF8B1803C647F3FC3AE04\purendis.sys
+ 2009-11-28 19:51 . 2009-04-07 20:33 23984 c:\windows\system32\DRVSTORE\pnarp_A922F7B3F866D334887D355D2A481D18B7F7B54E\pnarp.sys
+ 2009-11-28 19:51 . 2009-04-07 20:33 25264 c:\windows\system32\drivers\purendis.sys
+ 2009-11-28 19:51 . 2009-04-07 20:33 23984 c:\windows\system32\drivers\pnarp.sys
+ 2008-11-22 16:58 . 2009-09-10 19:54 38224 c:\windows\system32\drivers\mbamswissarmy.sys
+ 2008-11-22 16:58 . 2009-09-10 19:53 19160 c:\windows\system32\drivers\mbam.sys
- 2008-05-03 12:00 . 2008-04-14 00:12 75776 c:\windows\system32\dllcache\strmfilt.dll
+ 2008-05-03 12:00 . 2009-10-21 05:38 75776 c:\windows\system32\dllcache\strmfilt.dll
+ 2009-10-12 13:38 . 2009-10-12 13:38 79872 c:\windows\system32\dllcache\raschap.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 44544 c:\windows\system32\dllcache\pngfilt.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 44544 c:\windows\system32\dllcache\pngfilt.dll
+ 2008-05-03 12:00 . 2008-05-19 11:33 18944 c:\windows\system32\dllcache\msisip.dll
+ 2008-05-03 12:00 . 2008-05-19 06:57 95744 c:\windows\system32\dllcache\msiexec.exe
+ 2008-08-26 07:24 . 2010-01-05 10:00 52224 c:\windows\system32\dllcache\msfeedsbs.dll
- 2008-08-26 07:24 . 2009-08-29 07:36 52224 c:\windows\system32\dllcache\msfeedsbs.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 27648 c:\windows\system32\dllcache\jsproxy.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 27648 c:\windows\system32\dllcache\jsproxy.dll
- 2008-08-25 08:38 . 2009-08-28 10:28 13824 c:\windows\system32\dllcache\ieudinit.exe
+ 2008-08-25 08:38 . 2009-12-31 15:33 13824 c:\windows\system32\dllcache\ieudinit.exe
- 2008-05-03 12:00 . 2009-08-29 07:36 44544 c:\windows\system32\dllcache\iernonce.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 44544 c:\windows\system32\dllcache\iernonce.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 78336 c:\windows\system32\dllcache\ieencode.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 78336 c:\windows\system32\dllcache\ieencode.dll
- 2008-05-03 12:00 . 2009-08-28 10:28 70656 c:\windows\system32\dllcache\ie4uinit.exe
+ 2008-05-03 12:00 . 2009-12-31 15:33 70656 c:\windows\system32\dllcache\ie4uinit.exe
- 2008-08-26 07:24 . 2009-08-29 07:36 63488 c:\windows\system32\dllcache\icardie.dll
+ 2008-08-26 07:24 . 2010-01-05 10:00 63488 c:\windows\system32\dllcache\icardie.dll
+ 2008-05-03 12:00 . 2009-10-21 05:38 25088 c:\windows\system32\dllcache\httpapi.dll
+ 2008-05-03 12:00 . 2009-10-15 16:28 81920 c:\windows\system32\dllcache\fontsub.dll
- 2008-05-03 12:00 . 2009-06-16 14:36 81920 c:\windows\system32\dllcache\fontsub.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 17408 c:\windows\system32\dllcache\corpol.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 17408 c:\windows\system32\dllcache\corpol.dll
- 2008-11-22 17:05 . 2008-11-22 17:05 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-11-22 17:05 . 2009-11-14 22:16 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2008-11-22 17:05 . 2008-11-22 17:05 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-11-22 17:05 . 2009-11-14 22:16 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-11-14 22:17 . 2009-11-14 22:16 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2008-11-22 17:05 . 2008-11-22 17:05 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-11-26 00:30 . 2009-11-26 00:30 32768 c:\windows\Installer\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}\icon.exe
+ 2009-11-13 00:22 . 2009-11-13 00:22 38240 c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe
+ 2009-11-13 00:38 . 2009-11-13 00:38 65536 c:\windows\Installer\{55D9E026-DCB0-46FF-B60A-68B972228CF6}\ARPPRODUCTICON.exe
+ 2010-01-23 03:57 . 2009-10-29 07:46 44544 c:\windows\ie7updates\KB978207-IE7\pngfilt.dll
+ 2010-01-23 03:57 . 2009-10-29 07:46 52224 c:\windows\ie7updates\KB978207-IE7\msfeedsbs.dll
+ 2010-01-23 03:57 . 2009-10-29 07:46 27648 c:\windows\ie7updates\KB978207-IE7\jsproxy.dll
+ 2010-01-23 03:57 . 2009-10-28 14:36 13824 c:\windows\ie7updates\KB978207-IE7\ieudinit.exe
+ 2010-01-23 03:57 . 2009-10-29 07:46 44544 c:\windows\ie7updates\KB978207-IE7\iernonce.dll
+ 2010-01-23 03:57 . 2009-10-29 07:46 78336 c:\windows\ie7updates\KB978207-IE7\ieencode.dll
+ 2010-01-23 03:57 . 2009-10-28 14:36 70656 c:\windows\ie7updates\KB978207-IE7\ie4uinit.exe
+ 2010-01-23 03:57 . 2009-10-29 07:46 63488 c:\windows\ie7updates\KB978207-IE7\icardie.dll
+ 2010-01-23 03:57 . 2009-10-29 07:46 17408 c:\windows\ie7updates\KB978207-IE7\corpol.dll
+ 2009-12-09 02:55 . 2009-08-29 07:36 44544 c:\windows\ie7updates\KB976325-IE7\pngfilt.dll
+ 2009-12-09 02:55 . 2009-08-29 07:36 52224 c:\windows\ie7updates\KB976325-IE7\msfeedsbs.dll
+ 2009-12-09 02:55 . 2009-08-29 07:36 27648 c:\windows\ie7updates\KB976325-IE7\jsproxy.dll
+ 2009-12-09 02:55 . 2009-08-28 10:28 13824 c:\windows\ie7updates\KB976325-IE7\ieudinit.exe
+ 2009-12-09 02:55 . 2009-08-29 07:36 44544 c:\windows\ie7updates\KB976325-IE7\iernonce.dll
+ 2009-12-09 02:55 . 2009-08-29 07:36 78336 c:\windows\ie7updates\KB976325-IE7\ieencode.dll
+ 2009-12-09 02:55 . 2009-08-28 10:28 70656 c:\windows\ie7updates\KB976325-IE7\ie4uinit.exe
+ 2009-12-09 02:55 . 2009-08-29 07:36 63488 c:\windows\ie7updates\KB976325-IE7\icardie.dll
+ 2009-12-09 02:55 . 2009-08-29 07:36 17408 c:\windows\ie7updates\KB976325-IE7\corpol.dll
+ 2009-11-13 00:50 . 2009-11-13 00:50 80384 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\ce01ccf8d644ab2bd208b94a974e7450\WindowsFormsIntegration.Package.ni.dll
+ 2009-11-13 01:27 . 2009-11-13 01:27 48640 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\3ace81c69844137015a79b728bad193b\Microsoft.Windows.Design.Host.ni.dll
+ 2009-11-13 01:27 . 2009-11-13 01:27 53760 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\c9b89e9275740e58018468b2ccad3138\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v9.0.ni.dll
+ 2009-11-13 01:27 . 2009-11-13 01:27 60928 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9e0b2ee5267777b90d3074c027892796\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
+ 2009-11-13 01:26 . 2009-11-13 01:26 22016 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8bf7977c9827c97857dd9b3473f918b7\Microsoft.VisualStudio.Designer.Interfaces.ni.dll
+ 2009-11-13 01:27 . 2009-11-13 01:27 35328 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\805520f5488e2c45b7373b51b388cfcb\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
+ 2009-11-13 01:27 . 2009-11-13 01:27 74752 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\37c6e1f1a9bd607f7856f12eb9490335\Microsoft.VisualStudio.Shell.Interop.9.0.ni.dll
+ 2009-11-13 00:50 . 2009-11-13 00:50 18944 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Internal.#\5af3f17f2a8424f4af5ca78d923bb2c5\Microsoft.Internal.VisualStudio.Shell.Interop.9.0.ni.dll
+ 2009-11-13 00:50 . 2009-11-13 00:50 31232 c:\windows\assembly\NativeImages_v2.0.50727_32\EnvDTE90a\ddd0d1e1c9b1108a283c1b870602e353\EnvDTE90a.ni.dll
+ 2009-11-13 00:50 . 2009-11-13 00:50 46080 c:\windows\assembly\NativeImages_v2.0.50727_32\EnvDTE90\b01662b8c93402a9cfe3479757c4b8f7\EnvDTE90.ni.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 40960 c:\windows\assembly\GAC_MSIL\msddslmp\8.0.0.0__b03f5f7f11d50a3a\msddslmp.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 28672 c:\windows\assembly\GAC_MSIL\Microsoft.Windows.Design.Host\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Windows.Design.Host.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 61440 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Zip\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Zip.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 65536 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Zip.9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Zip.9.0.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 12800 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.XmlEditor\3.5.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.XmlEditor.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 73728 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.WizardFramework\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.WizardFramework.Dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.WCFReference.Interop\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.WCFReference.Interop.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 16384 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.VSContentInstaller\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.VSContentInstaller.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 77824 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 36864 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v9.0.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 98304 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.DesignTime.v9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.DesignTime.v9.0.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 22016 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 45056 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 86016 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.TextTemplating\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.TextTemplating.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 98304 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.TextTemplating.VSHost\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.TextTemplating.VSHost.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 15872 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.TemplateWizardInterface\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.TemplateWizardInterface.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 32768 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.ManagedInterfaces\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.ManagedInterfaces.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.ManagedInterfaces.WCF\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.ManagedInterfaces.WCF.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 36864 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.ManagedInterfaces.9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.ManagedInterfaces.9.0.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 53248 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.HostingProcess.Utilities\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.HostingProcess.Utilities.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.HostingProcess.Utilities.Sync\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 36864 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Diagnostics.ServiceModelSink\3.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Diagnostics.ServiceModelSink.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 49152 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.DebuggerVisualizers\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.DebuggerVisualizers.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 13824 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Data.Core\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Data.Core.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 69632 c:\windows\assembly\GAC_MSIL\Microsoft.MSXML\8.0.0.0__b03f5f7f11d50a3a\microsoft.msxml.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 11112 c:\windows\assembly\GAC_MSIL\DesignReviewCore.GAC\1.0.0.0__ead2425575540902\DesignReviewCore.GAC.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 12288 c:\windows\assembly\GAC\VsWebSite.Interop90\9.0.0.0__b03f5f7f11d50a3a\VsWebSite.Interop90.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 49152 c:\windows\assembly\GAC\VsWebSite.Interop\8.0.0.0__b03f5f7f11d50a3a\VsWebSite.Interop.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 73728 c:\windows\assembly\GAC\VSLangProj80\8.0.0.0__b03f5f7f11d50a3a\VSLangProj80.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 19968 c:\windows\assembly\GAC\VSLangProj2\7.0.5000.0__b03f5f7f11d50a3a\VSLangProj2.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 53248 c:\windows\assembly\GAC\VSLangProj\7.0.3300.0__b03f5f7f11d50a3a\VSLangProj.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 25592 c:\windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 13312 c:\windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\msdatasrc.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 11264 c:\windows\assembly\GAC\Microsoft.VisualStudio.VSHelp\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.VSHelp.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 57344 c:\windows\assembly\GAC\Microsoft.VisualStudio.TextManager.Interop.8.0\8.0.0.0__b03f5f7f11d50a3a\microsoft.visualstudio.textmanager.interop.8.0.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 40960 c:\windows\assembly\GAC\Microsoft.VisualStudio.Shell.Interop.9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Shell.Interop.9.0.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 69632 c:\windows\assembly\GAC\Microsoft.VisualStudio.CommandBars\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.CommandBars.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 22552 c:\windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.stdformat.dll
+ 2009-11-13 00:37 . 2009-11-13 00:37 12800 c:\windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
- 2008-11-30 14:12 . 2008-11-30 14:12 12800 c:\windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
- 2008-11-30 14:12 . 2008-11-30 14:12 53248 c:\windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
+ 2009-11-13 00:37 . 2009-11-13 00:37 53248 c:\windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 12800 c:\windows\assembly\GAC\EnvDTE90a\9.0.0.0__b03f5f7f11d50a3a\envdte90a.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 18944 c:\windows\assembly\GAC\EnvDTE90\9.0.0.0__b03f5f7f11d50a3a\envdte90.dll
+ 2009-11-26 00:31 . 2009-07-14 11:03 46080 c:\windows\$NtUninstallKB976098-v2$\tzchange.exe
+ 2009-11-26 00:31 . 2009-10-29 02:03 16896 c:\windows\$NtUninstallKB976098-v2$\spuninst\tzchange.dll
+ 2009-12-09 02:56 . 2008-04-14 00:12 79872 c:\windows\$NtUninstallKB974318$\raschap.dll
+ 2009-12-09 02:56 . 2008-04-14 00:12 75776 c:\windows\$NtUninstallKB970430$\strmfilt.dll
+ 2009-12-09 02:56 . 2008-04-14 00:11 24576 c:\windows\$NtUninstallKB970430$\httpapi.dll
+ 2009-11-13 00:32 . 2008-04-14 00:11 15360 c:\windows\$NtUninstallKB942288-v3$\msisip.dll
+ 2009-11-13 00:32 . 2008-04-14 00:12 78848 c:\windows\$NtUninstallKB942288-v3$\msiexec.exe
+ 2009-12-09 02:55 . 2009-05-26 11:40 26488 c:\windows\$hf_mig$\KB976325-IE7\update\spcustom.dll
+ 2009-12-09 02:55 . 2009-05-26 11:40 17272 c:\windows\$hf_mig$\KB976325-IE7\spmsg.dll
+ 2009-10-29 07:45 . 2009-10-29 07:45 44544 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\pngfilt.dll
+ 2009-10-29 07:45 . 2009-10-29 07:45 52224 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\msfeedsbs.dll
+ 2009-10-29 07:45 . 2009-10-29 07:45 27648 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\jsproxy.dll
+ 2009-10-28 14:05 . 2009-10-28 14:05 13824 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\ieudinit.exe
+ 2009-10-29 07:45 . 2009-10-29 07:45 44544 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\iernonce.dll
+ 2009-10-29 07:45 . 2009-10-29 07:45 78336 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\ieencode.dll
+ 2009-10-28 14:05 . 2009-10-28 14:05 70656 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\ie4uinit.exe
+ 2009-10-29 07:45 . 2009-10-29 07:45 63488 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\icardie.dll
+ 2009-10-29 07:45 . 2009-10-29 07:45 17408 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\corpol.dll
+ 2009-12-09 02:55 . 2009-05-26 11:40 26488 c:\windows\$hf_mig$\KB974392\update\spcustom.dll
+ 2009-12-09 02:55 . 2009-05-26 11:40 17272 c:\windows\$hf_mig$\KB974392\spmsg.dll
+ 2009-12-09 02:56 . 2009-05-26 11:40 26488 c:\windows\$hf_mig$\KB974318\update\spcustom.dll
+ 2009-12-09 02:56 . 2009-05-26 11:40 17272 c:\windows\$hf_mig$\KB974318\spmsg.dll
+ 2009-10-12 13:28 . 2009-10-12 13:28 79872 c:\windows\$hf_mig$\KB974318\SP3QFE\raschap.dll
+ 2009-12-09 02:56 . 2009-05-26 11:40 26488 c:\windows\$hf_mig$\KB973904\update\spcustom.dll
+ 2009-12-09 02:56 . 2009-05-26 11:40 17272 c:\windows\$hf_mig$\KB973904\spmsg.dll
+ 2009-11-26 00:31 . 2008-07-08 13:02 26488 c:\windows\$hf_mig$\KB973687\update\spcustom.dll
+ 2009-11-26 00:31 . 2008-07-08 13:02 17272 c:\windows\$hf_mig$\KB973687\spmsg.dll
+ 2009-12-09 02:55 . 2008-07-08 13:02 26488 c:\windows\$hf_mig$\KB971737\update\spcustom.dll
+ 2009-12-09 02:55 . 2008-07-08 13:02 17272 c:\windows\$hf_mig$\KB971737\spmsg.dll
+ 2009-12-09 02:56 . 2009-05-26 11:40 26488 c:\windows\$hf_mig$\KB970430\update\spcustom.dll
+ 2009-12-09 02:56 . 2009-05-26 11:40 17272 c:\windows\$hf_mig$\KB970430\spmsg.dll
+ 2009-10-21 05:40 . 2009-10-21 05:40 75776 c:\windows\$hf_mig$\KB970430\SP3QFE\strmfilt.dll
+ 2009-10-21 05:40 . 2009-10-21 05:40 25088 c:\windows\$hf_mig$\KB970430\SP3QFE\httpapi.dll
+ 2009-11-12 02:40 . 2008-07-08 13:02 26488 c:\windows\$hf_mig$\KB969947\update\spcustom.dll
+ 2009-11-12 02:40 . 2008-07-08 13:02 17272 c:\windows\$hf_mig$\KB969947\spmsg.dll
+ 2009-11-28 19:52 . 2007-01-30 00:13 9440 c:\windows\system32\spool\drivers\w32x86\atpdrvnt.dll
+ 2009-11-28 19:52 . 2007-01-30 00:13 9440 c:\windows\system32\spool\drivers\w32x86\3\atpdrvnt.dll
+ 2008-05-03 12:00 . 2008-04-17 06:43 2560 c:\windows\system32\msimsg.dll
+ 2008-05-03 12:00 . 2008-04-17 06:43 2560 c:\windows\system32\dllcache\msimsg.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 5632 c:\windows\assembly\GAC_MSIL\VSTADTEProvider.Interop\9.0.0.0__b03f5f7f11d50a3a\VSTADTEProvider.Interop.dll
+ 2009-11-13 00:40 . 2009-11-13 00:40 7680 c:\windows\assembly\GAC_MSIL\RevitVSTAUpgradeHelper\1.0.0.0__7ca4c44a7df1e93b\RevitVSTAUpgradeHelper.dll
+ 2009-11-13 00:40 . 2009-11-13 00:40 5632 c:\windows\assembly\GAC_MSIL\RevitVSTAIPHTerminateOrphaned\1.0.0.0__b1a68e216b24d9de\RevitVSTAIPHTerminateOrphaned.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 4096 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.ProjectAggregator\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.ProjectAggregator.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 5120 c:\windows\assembly\GAC\VslangProj90\9.0.0.0__b03f5f7f11d50a3a\VSLangProj90.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 8704 c:\windows\assembly\GAC\Microsoft.VisualStudio.VSHelp80\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.VSHelp80.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 7680 c:\windows\assembly\GAC\Microsoft.VisualStudio.TextManager.Interop.9.0\9.0.0.0__b03f5f7f11d50a3a\microsoft.visualstudio.textmanager.interop.9.0.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 8704 c:\windows\assembly\GAC\Microsoft.VisualStudio.Designer.Interfaces\1.0.5000.0__b03f5f7f11d50a3a\microsoft.visualstudio.designer.interfaces.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 6656 c:\windows\assembly\GAC\Microsoft.Internal.VisualStudio.Shell.Interop.9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.Internal.VisualStudio.Shell.Interop.9.0.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 4608 c:\windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\extensibility.dll
+ 2007-11-07 07:19 . 2007-11-07 07:19 161784 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_312cf0e9\atl90.dll
+ 2008-05-03 12:00 . 2009-08-25 09:17 354816 c:\windows\system32\winhttp.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 233472 c:\windows\system32\webcheck.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 233472 c:\windows\system32\webcheck.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 105984 c:\windows\system32\url.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 105984 c:\windows\system32\url.dll
+ 2008-05-03 12:00 . 2009-10-15 16:28 119808 c:\windows\system32\t2embed.dll
- 2008-05-03 12:00 . 2009-06-16 14:36 119808 c:\windows\system32\t2embed.dll
+ 2009-11-28 19:52 . 2007-01-30 00:13 619520 c:\windows\system32\spool\drivers\w32x86\unires.dll
+ 2009-11-28 19:52 . 2007-01-30 00:13 197120 c:\windows\system32\spool\drivers\w32x86\unidrvui.dll
+ 2009-11-28 19:52 . 2007-01-30 00:13 239104 c:\windows\system32\spool\drivers\w32x86\unidrv.dll
+ 2008-05-03 12:00 . 2009-10-12 13:38 149504 c:\windows\system32\rastls.dll
+ 2008-05-03 12:00 . 2009-12-09 11:13 443586 c:\windows\system32\perfh009.dat
- 2008-05-03 12:00 . 2009-11-01 17:34 443586 c:\windows\system32\perfh009.dat
- 2008-05-03 12:00 . 2009-08-29 07:36 102912 c:\windows\system32\occache.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 102912 c:\windows\system32\occache.dll
- 2008-05-03 12:00 . 2008-04-14 00:12 270336 c:\windows\system32\oakley.dll
+ 2008-05-03 12:00 . 2009-10-13 10:30 270336 c:\windows\system32\oakley.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 671232 c:\windows\system32\mstime.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 671232 c:\windows\system32\mstime.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 193024 c:\windows\system32\msrating.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 193024 c:\windows\system32\msrating.dll
+ 2008-05-03 12:00 . 2008-05-19 11:33 332800 c:\windows\system32\msihnd.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 477696 c:\windows\system32\mshtmled.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 477696 c:\windows\system32\mshtmled.dll
- 2007-08-13 18:54 . 2009-08-29 07:36 459264 c:\windows\system32\msfeeds.dll
+ 2007-08-13 18:54 . 2010-01-05 10:00 459264 c:\windows\system32\msfeeds.dll
+ 2009-10-28 03:40 . 2009-10-28 03:40 257440 c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
- 2009-07-18 03:21 . 2009-07-18 03:21 257440 c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2007-08-13 18:34 . 2010-01-05 10:00 268288 c:\windows\system32\iertutil.dll
- 2007-08-13 18:34 . 2009-08-29 07:36 268288 c:\windows\system32\iertutil.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 192512 c:\windows\system32\iepeers.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 385024 c:\windows\system32\iedkcs32.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 385024 c:\windows\system32\iedkcs32.dll
+ 2007-07-11 12:27 . 2010-01-05 10:00 380928 c:\windows\system32\ieapfltr.dll
- 2007-07-11 12:27 . 2009-08-29 07:36 380928 c:\windows\system32\ieapfltr.dll
+ 2008-05-03 12:00 . 2009-12-18 13:04 161792 c:\windows\system32\ieakui.dll
- 2008-05-03 12:00 . 2009-08-27 05:18 161792 c:\windows\system32\ieakui.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 230400 c:\windows\system32\ieaksie.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 230400 c:\windows\system32\ieaksie.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 153088 c:\windows\system32\ieakeng.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 153088 c:\windows\system32\ieakeng.dll
+ 2008-11-23 00:04 . 2009-11-13 00:52 412672 c:\windows\system32\FNTCACHE.DAT
- 2008-05-03 12:00 . 2009-08-29 07:36 133120 c:\windows\system32\extmgr.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 133120 c:\windows\system32\extmgr.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 214528 c:\windows\system32\dxtrans.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 214528 c:\windows\system32\dxtrans.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 347136 c:\windows\system32\dxtmsft.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 347136 c:\windows\system32\dxtmsft.dll
+ 2008-05-03 12:00 . 2009-10-20 16:20 265728 c:\windows\system32\drivers\http.sys
+ 2007-08-13 18:54 . 2010-01-05 10:00 832512 c:\windows\system32\dllcache\wininet.dll
- 2007-08-13 18:54 . 2009-08-29 07:36 832512 c:\windows\system32\dllcache\wininet.dll
+ 2008-12-16 12:30 . 2009-08-25 09:17 354816 c:\windows\system32\dllcache\winhttp.dll
- 2007-08-13 18:54 . 2009-08-29 07:36 233472 c:\windows\system32\dllcache\webcheck.dll
+ 2007-08-13 18:54 . 2010-01-05 10:00 233472 c:\windows\system32\dllcache\webcheck.dll
+ 2007-08-13 18:44 . 2010-01-05 10:00 105984 c:\windows\system32\dllcache\url.dll
- 2007-08-13 18:44 . 2009-08-29 07:36 105984 c:\windows\system32\dllcache\url.dll
- 2008-05-03 12:00 . 2009-06-16 14:36 119808 c:\windows\system32\dllcache\t2embed.dll
+ 2008-05-03 12:00 . 2009-10-15 16:28 119808 c:\windows\system32\dllcache\t2embed.dll
+ 2009-10-12 13:38 . 2009-10-12 13:38 149504 c:\windows\system32\dllcache\rastls.dll
- 2007-08-13 18:44 . 2009-08-29 07:36 102912 c:\windows\system32\dllcache\occache.dll
+ 2007-08-13 18:44 . 2010-01-05 10:00 102912 c:\windows\system32\dllcache\occache.dll
+ 2009-10-13 10:30 . 2009-10-13 10:30 270336 c:\windows\system32\dllcache\oakley.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 671232 c:\windows\system32\dllcache\mstime.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 671232 c:\windows\system32\dllcache\mstime.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 193024 c:\windows\system32\dllcache\msrating.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 193024 c:\windows\system32\dllcache\msrating.dll
+ 2008-05-03 12:00 . 2008-05-19 11:33 332800 c:\windows\system32\dllcache\msihnd.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 477696 c:\windows\system32\dllcache\mshtmled.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 477696 c:\windows\system32\dllcache\mshtmled.dll
+ 2008-08-26 07:24 . 2010-01-05 10:00 459264 c:\windows\system32\dllcache\msfeeds.dll
- 2008-08-26 07:24 . 2009-08-29 07:36 459264 c:\windows\system32\dllcache\msfeeds.dll
- 2008-11-23 00:13 . 2009-08-27 05:18 634648 c:\windows\system32\dllcache\iexplore.exe
+ 2008-11-23 00:13 . 2009-12-18 13:05 634648 c:\windows\system32\dllcache\iexplore.exe
+ 2008-08-26 07:24 . 2010-01-05 10:00 268288 c:\windows\system32\dllcache\iertutil.dll
- 2008-08-26 07:24 . 2009-08-29 07:36 268288 c:\windows\system32\dllcache\iertutil.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 192512 c:\windows\system32\dllcache\iepeers.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 385024 c:\windows\system32\dllcache\iedkcs32.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 385024 c:\windows\system32\dllcache\iedkcs32.dll
- 2008-08-26 07:24 . 2009-08-29 07:36 380928 c:\windows\system32\dllcache\ieapfltr.dll
+ 2008-08-26 07:24 . 2010-01-05 10:00 380928 c:\windows\system32\dllcache\ieapfltr.dll
- 2008-05-03 12:00 . 2009-08-27 05:18 161792 c:\windows\system32\dllcache\ieakui.dll
+ 2008-05-03 12:00 . 2009-12-18 13:04 161792 c:\windows\system32\dllcache\ieakui.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 230400 c:\windows\system32\dllcache\ieaksie.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 230400 c:\windows\system32\dllcache\ieaksie.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 153088 c:\windows\system32\dllcache\ieakeng.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 153088 c:\windows\system32\dllcache\ieakeng.dll
+ 2008-05-03 12:00 . 2009-10-20 16:20 265728 c:\windows\system32\dllcache\http.sys
- 2008-05-03 12:00 . 2009-08-29 07:36 133120 c:\windows\system32\dllcache\extmgr.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 133120 c:\windows\system32\dllcache\extmgr.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 214528 c:\windows\system32\dllcache\dxtrans.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 214528 c:\windows\system32\dllcache\dxtrans.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 347136 c:\windows\system32\dllcache\dxtmsft.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 347136 c:\windows\system32\dllcache\dxtmsft.dll
+ 2007-08-13 18:39 . 2010-01-05 10:00 124928 c:\windows\system32\dllcache\advpack.dll
- 2007-08-13 18:39 . 2009-08-29 07:36 124928 c:\windows\system32\dllcache\advpack.dll
+ 2008-05-03 12:00 . 2009-11-21 15:51 471552 c:\windows\system32\dllcache\aclayers.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 124928 c:\windows\system32\advpack.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 124928 c:\windows\system32\advpack.dll
+ 2009-11-13 00:37 . 2006-02-03 12:40 578560 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2910.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-11-13 00:37 . 2005-12-05 22:20 577536 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2909.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-11-13 00:37 . 2005-09-28 19:11 577536 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2908.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-11-13 00:37 . 2005-07-22 22:21 577024 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2907.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-11-13 00:37 . 2005-05-26 20:15 576000 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2906.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-11-13 00:37 . 2005-03-18 22:23 567296 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2905.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-11-13 00:37 . 2005-02-06 00:32 563712 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2904.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-11-13 00:40 . 2009-11-13 00:40 568320 c:\windows\Installer\2d86a61.msi
+ 2009-11-13 00:37 . 2009-11-13 00:37 228352 c:\windows\Installer\2d86a43.msi
+ 2009-11-13 00:22 . 2009-11-13 00:22 355328 c:\windows\Installer\2ca3f12.msi
+ 2009-11-26 00:30 . 2009-11-26 00:30 429568 c:\windows\Installer\2c25c28.msi
+ 2009-11-13 00:38 . 2009-11-13 00:38 450560 c:\windows\Installer\{55D9E026-DCB0-46FF-B60A-68B972228CF6}\NewShortcut3_8F9B2F3608C24383B845BB1C61EF3C49.exe
+ 2009-11-13 00:38 . 2009-11-13 00:38 450560 c:\windows\Installer\{55D9E026-DCB0-46FF-B60A-68B972228CF6}\NewShortcut1.242A9D32_ABC8_4E05_B313_994434C2CC89.exe
+ 2010-01-23 03:57 . 2009-10-29 07:46 832512 c:\windows\ie7updates\KB978207-IE7\wininet.dll
+ 2010-01-23 03:57 . 2009-10-29 07:46 233472 c:\windows\ie7updates\KB978207-IE7\webcheck.dll
+ 2010-01-23 03:57 . 2009-10-29 07:46 105984 c:\windows\ie7updates\KB978207-IE7\url.dll
+ 2010-01-23 03:57 . 2009-05-26 11:40 382840 c:\windows\ie7updates\KB978207-IE7\spuninst\updspapi.dll
+ 2010-01-23 03:57 . 2009-05-26 11:40 231288 c:\windows\ie7updates\KB978207-IE7\spuninst\spuninst.exe
+ 2010-01-23 03:57 . 2009-10-29 07:46 102912 c:\windows\ie7updates\KB978207-IE7\occache.dll
+ 2010-01-23 03:57 . 2009-10-29 07:46 671232 c:\windows\ie7updates\KB978207-IE7\mstime.dll
+ 2010-01-23 03:57 . 2009-10-29 07:46 193024 c:\windows\ie7updates\KB978207-IE7\msrating.dll
+ 2010-01-23 03:57 . 2009-10-29 07:46 477696 c:\windows\ie7updates\KB978207-IE7\mshtmled.dll
+ 2010-01-23 03:57 . 2009-10-29 07:46 459264 c:\windows\ie7updates\KB978207-IE7\msfeeds.dll
+ 2010-01-23 03:57 . 2009-10-28 06:54 634632 c:\windows\ie7updates\KB978207-IE7\iexplore.exe
+ 2010-01-23 03:57 . 2009-10-29 07:46 268288 c:\windows\ie7updates\KB978207-IE7\iertutil.dll
+ 2010-01-23 03:57 . 2007-08-13 18:54 191488 c:\windows\ie7updates\KB978207-IE7\iepeers.dll
+ 2010-01-23 03:57 . 2009-10-29 07:46 385024 c:\windows\ie7updates\KB978207-IE7\iedkcs32.dll
+ 2010-01-23 03:57 . 2009-10-29 07:46 380928 c:\windows\ie7updates\KB978207-IE7\ieapfltr.dll
+ 2010-01-23 03:57 . 2009-10-28 06:52 161792 c:\windows\ie7updates\KB978207-IE7\ieakui.dll
+ 2010-01-23 03:57 . 2009-10-29 07:46 230400 c:\windows\ie7updates\KB978207-IE7\ieaksie.dll
+ 2010-01-23 03:57 . 2009-10-29 07:46 153088 c:\windows\ie7updates\KB978207-IE7\ieakeng.dll
+ 2010-01-23 03:57 . 2009-10-29 07:46 133120 c:\windows\ie7updates\KB978207-IE7\extmgr.dll
+ 2010-01-23 03:57 . 2009-10-29 07:46 214528 c:\windows\ie7updates\KB978207-IE7\dxtrans.dll
+ 2010-01-23 03:57 . 2009-10-29 07:46 347136 c:\windows\ie7updates\KB978207-IE7\dxtmsft.dll
+ 2010-01-23 03:57 . 2009-10-29 07:46 124928 c:\windows\ie7updates\KB978207-IE7\advpack.dll
+ 2009-12-09 02:55 . 2009-08-29 07:36 832512 c:\windows\ie7updates\KB976325-IE7\wininet.dll
+ 2009-12-09 02:55 . 2009-08-29 07:36 233472 c:\windows\ie7updates\KB976325-IE7\webcheck.dll
+ 2009-12-09 02:55 . 2009-08-29 07:36 105984 c:\windows\ie7updates\KB976325-IE7\url.dll
+ 2009-12-09 02:55 . 2009-05-26 11:40 382840 c:\windows\ie7updates\KB976325-IE7\spuninst\updspapi.dll
+ 2009-12-09 02:55 . 2009-05-26 11:40 231288 c:\windows\ie7updates\KB976325-IE7\spuninst\spuninst.exe
+ 2009-12-09 02:55 . 2009-08-29 07:36 102912 c:\windows\ie7updates\KB976325-IE7\occache.dll
+ 2009-12-09 02:55 . 2009-08-29 07:36 671232 c:\windows\ie7updates\KB976325-IE7\mstime.dll
+ 2009-12-09 02:55 . 2009-08-29 07:36 193024 c:\windows\ie7updates\KB976325-IE7\msrating.dll
+ 2009-12-09 02:55 . 2009-08-29 07:36 477696 c:\windows\ie7updates\KB976325-IE7\mshtmled.dll
+ 2009-12-09 02:55 . 2009-08-29 07:36 459264 c:\windows\ie7updates\KB976325-IE7\msfeeds.dll
+ 2009-12-09 02:55 . 2009-08-27 05:18 634648 c:\windows\ie7updates\KB976325-IE7\iexplore.exe
+ 2009-12-09 02:55 . 2009-08-29 07:36 268288 c:\windows\ie7updates\KB976325-IE7\iertutil.dll
+ 2009-12-09 02:55 . 2009-08-29 07:36 385024 c:\windows\ie7updates\KB976325-IE7\iedkcs32.dll
+ 2009-12-09 02:55 . 2009-08-29 07:36 380928 c:\windows\ie7updates\KB976325-IE7\ieapfltr.dll
+ 2009-12-09 02:55 . 2009-08-27 05:18 161792 c:\windows\ie7updates\KB976325-IE7\ieakui.dll
+ 2009-12-09 02:55 . 2009-08-29 07:36 230400 c:\windows\ie7updates\KB976325-IE7\ieaksie.dll
+ 2009-12-09 02:55 . 2009-08-29 07:36 153088 c:\windows\ie7updates\KB976325-IE7\ieakeng.dll
+ 2009-12-09 02:55 . 2009-08-29 07:36 133120 c:\windows\ie7updates\KB976325-IE7\extmgr.dll
+ 2009-12-09 02:55 . 2009-08-29 07:36 214528 c:\windows\ie7updates\KB976325-IE7\dxtrans.dll
+ 2009-12-09 02:55 . 2009-08-29 07:36 347136 c:\windows\ie7updates\KB976325-IE7\dxtmsft.dll
+ 2009-12-09 02:55 . 2009-08-29 07:36 124928 c:\windows\ie7updates\KB976325-IE7\advpack.dll
+ 2009-11-15 15:47 . 2005-10-20 17:02 163328 c:\windows\ERDNT\11-15-2009\ERDNT.EXE
+ 2009-10-20 16:20 . 2009-10-20 16:20 265728 c:\windows\Driver Cache\i386\http.sys
+ 2009-11-13 00:50 . 2009-11-13 00:50 198656 c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\b52cf215d28589e170ab84819e362ec9\WindowsFormsIntegration.Design.ni.dll
+ 2009-11-13 01:27 . 2009-11-13 01:27 353792 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\ddc19c4952179174a8a27ce15c7591be\Microsoft.Windows.Design.ni.dll
+ 2009-11-13 01:27 . 2009-11-13 01:27 438272 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\662f5bf5109d9aaeddf68939f3e90629\Microsoft.Windows.Design.Extensibility.ni.dll
+ 2009-11-13 01:27 . 2009-11-13 01:27 503296 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\00b445612f70892aeeb56a4af93355c8\Microsoft.Windows.Design.Interaction.ni.dll
+ 2009-11-13 01:27 . 2009-11-13 01:27 173568 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fd1903e47da1e0902bc5f2afb86b6c41\Microsoft.VisualStudio.TextTemplating.ni.dll
+ 2009-11-13 01:27 . 2009-11-13 01:27 208384 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f2df37854e754cf1842d42736ee0d5ef\Microsoft.VisualStudio.TextTemplating.VSHost.ni.dll
+ 2009-11-13 01:27 . 2009-11-13 01:27 822272 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f15371ab6657251e781f308c34f522ae\Microsoft.VisualStudio.Shell.ni.dll
+ 2009-11-13 01:27 . 2009-11-13 01:27 802304 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f07c24f446d9766a32e077335aa85c6b\Microsoft.VisualStudio.Tools.Applications.Project.ni.dll
+ 2009-11-13 01:26 . 2009-11-13 01:26 306176 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e3dcc203fe50d0f98c6526b204d1bc73\Microsoft.VisualStudio.OLE.Interop.ni.dll
+ 2009-11-13 01:27 . 2009-11-13 01:27 513024 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\c81cba5bdfa9543356c145ac9b80071b\Microsoft.VisualStudio.Shell.Design.ni.dll
+ 2009-11-13 01:27 . 2009-11-13 01:27 198656 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\a34883fd51212ad25a3ea502b38c40e5\Microsoft.VisualStudio.Tools.Applications.DesignTime.v9.0.ni.dll
+ 2009-11-13 01:26 . 2009-11-13 01:26 861696 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\997b329a2046264888269c406380551f\Microsoft.VisualStudio.Modeling.Sdk.Shell.ni.dll
+ 2009-11-13 01:27 . 2009-11-13 01:27 133120 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\696394263bb68f6dd8ecbf6c269cf41a\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
+ 2009-11-13 01:27 . 2009-11-13 01:27 159744 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\573274038b107f28cbee609f56b0cbab\Microsoft.VisualStudio.WizardFramework.ni.dll
+ 2009-11-13 01:27 . 2009-11-13 01:27 284672 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\504af6559d94f66163ba9002635a24f5\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll
+ 2009-11-13 01:26 . 2009-11-13 01:26 876032 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\3625aa881b591b868f2f7c980f67c9c3\Microsoft.VisualStudio.Shell.9.0.ni.dll
+ 2009-11-13 01:27 . 2009-11-13 01:27 300032 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\34e4f3a34a1f4cae27d2bc6ce01b2268\Microsoft.VisualStudio.Tools.Applications.ProgrammingModel.ni.dll
+ 2009-11-13 01:27 . 2009-11-13 01:27 640512 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\2c85b2bb37a5a631f5ec903db5b659ac\Microsoft.VisualStudio.Xaml.LanguageService.ni.dll
+ 2009-11-13 01:27 . 2009-11-13 01:27 335872 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\27483bf0c29f47ad4ed02660c030dec7\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll
+ 2009-11-13 01:27 . 2009-11-13 01:27 373248 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\217a9775d0153b7cfdd5fdbae40ccd3d\Microsoft.VisualStudio.Shell.Interop.8.0.ni.dll
+ 2009-11-13 01:26 . 2009-11-13 01:26 220672 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\16e892f635c48a70977a496cb8025d91\Microsoft.VisualStudio.Configuration.ni.dll
+ 2009-11-13 00:50 . 2009-11-13 00:50 276480 c:\windows\assembly\NativeImages_v2.0.50727_32\EnvDTE80\c26c0846413c825d98d1cc826bb8dc34\EnvDTE80.ni.dll
+ 2009-11-13 00:50 . 2009-11-13 00:50 573440 c:\windows\assembly\NativeImages_v2.0.50727_32\EnvDTE\1efbdc01fd7106ed540209b5912f4d4a\EnvDTE.ni.dll
+ 2009-11-13 00:40 . 2009-11-13 00:40 901120 c:\windows\assembly\GAC_MSIL\Revit.Proxy\2.0.0.0__4de18433977df731\Revit.Proxy.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 139264 c:\windows\assembly\GAC_MSIL\msddsp\9.0.0.0__b03f5f7f11d50a3a\msddsp.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 106496 c:\windows\assembly\GAC_MSIL\Microsoft.Windows.Design\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Windows.Design.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 774144 c:\windows\assembly\GAC_MSIL\Microsoft.Windows.Design.Markup\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Windows.Design.Markup.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 163840 c:\windows\assembly\GAC_MSIL\Microsoft.Windows.Design.Interaction\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Windows.Design.Interaction.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 114688 c:\windows\assembly\GAC_MSIL\Microsoft.Windows.Design.Extensibility\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Windows.Design.Extensibility.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 991232 c:\windows\assembly\GAC_MSIL\Microsoft.Windows.Design.Developer\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Windows.Design.Developer.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 274432 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio\9.0.0.0__b03f5f7f11d50a3a\microsoft.visualstudio.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 208896 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Xaml.LanguageService\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Xaml.LanguageService.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 552960 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Windows.Forms\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Windows.Forms.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 106496 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 495616 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Project\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Project.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 151552 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ProgrammingModel\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.ProgrammingModel.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 143360 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 282624 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 368640 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Shell\2.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Shell.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 184320 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Shell.Design\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Shell.Design.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 360448 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Shell.9.0\2.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Shell.9.0.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 884736 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Publish\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Publish.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 344064 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Package.LanguageService\2.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Package.LanguageService.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 348160 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Package.LanguageService.9.0\3.5.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Package.LanguageService.9.0.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 430080 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Modeling.Sdk\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Modeling.Sdk.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 372736 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Modeling.Sdk.Shell\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Modeling.Sdk.Shell.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 827392 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Modeling.Sdk.Diagrams\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Modeling.Sdk.Diagrams.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 561152 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Design\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Design.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 200704 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Data.Services\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Data.Services.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 172032 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Data.Framework\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Data.Framework.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 106496 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Configuration\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Configuration.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 671744 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.CommonIDE\9.0.0.0__b03f5f7f11d50a3a\microsoft.visualstudio.commonide.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 595456 c:\windows\assembly\GAC_32\Microsoft.VisualStudio.Modeling.Sdk.Diagrams.GraphObject\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Modeling.Sdk.Diagrams.GraphObject.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 114688 c:\windows\assembly\GAC\Microsoft.VisualStudio.TextManager.Interop\7.1.40304.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.TextManager.Interop.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 259152 c:\windows\assembly\GAC\Microsoft.VisualStudio.Shell.Interop\7.1.40304.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Shell.Interop.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 172032 c:\windows\assembly\GAC\Microsoft.VisualStudio.Shell.Interop.8.0\8.0.0.0__b03f5f7f11d50a3a\microsoft.visualstudio.shell.interop.8.0.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 118784 c:\windows\assembly\GAC\Microsoft.VisualStudio.OLE.Interop\7.1.40304.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.OLE.Interop.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 126976 c:\windows\assembly\GAC\Microsoft.VisualStudio.Debugger.InteropA\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Debugger.InteropA.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 176128 c:\windows\assembly\GAC\Microsoft.VisualStudio.Debugger.Interop\8.0.1.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Debugger.Interop.dll
- 2008-11-30 14:12 . 2008-11-30 14:12 223232 c:\windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
+ 2009-11-13 00:37 . 2009-11-13 00:37 223232 c:\windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
+ 2009-11-13 00:37 . 2009-11-13 00:37 178176 c:\windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
- 2008-11-30 14:12 . 2008-11-30 14:12 178176 c:\windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
+ 2009-11-13 00:37 . 2009-11-13 00:37 364544 c:\windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
- 2008-11-30 14:12 . 2008-11-30 14:12 364544 c:\windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
+ 2009-11-13 00:37 . 2009-11-13 00:37 159232 c:\windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
- 2008-11-30 14:12 . 2008-11-30 14:12 159232 c:\windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
- 2008-11-30 14:12 . 2008-11-30 14:12 145920 c:\windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
+ 2009-11-13 00:37 . 2009-11-13 00:37 145920 c:\windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
- 2008-11-30 14:12 . 2008-11-30 14:12 578560 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-11-13 00:37 . 2009-11-13 00:37 578560 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-11-13 00:37 . 2009-11-13 00:37 578560 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-11-13 00:37 . 2009-11-13 00:37 577536 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-11-13 00:37 . 2009-11-13 00:37 577536 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-11-13 00:37 . 2009-11-13 00:37 577024 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-11-13 00:37 . 2009-11-13 00:37 576000 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-11-13 00:37 . 2009-11-13 00:37 567296 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-11-13 00:37 . 2009-11-13 00:37 563712 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-11-13 00:37 . 2009-11-13 00:37 473600 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
- 2008-11-30 14:12 . 2008-11-30 14:12 473600 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 135168 c:\windows\assembly\GAC\EnvDTE80\8.0.0.0__b03f5f7f11d50a3a\envdte80.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 245760 c:\windows\assembly\GAC\EnvDTE\8.0.0.0__b03f5f7f11d50a3a\envdte.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 110592 c:\windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll
mikekk
2010-01-29, 04:50
+ 2009-11-26 00:31 . 2009-05-26 11:40 382840 c:\windows\$NtUninstallKB976098-v2$\spuninst\updspapi.dll
+ 2009-11-26 00:31 . 2009-05-26 11:40 231288 c:\windows\$NtUninstallKB976098-v2$\spuninst\spuninst.exe
+ 2009-12-09 02:55 . 2009-05-26 11:40 382840 c:\windows\$NtUninstallKB974392$\spuninst\updspapi.dll
+ 2009-12-09 02:55 . 2009-05-26 11:40 231288 c:\windows\$NtUninstallKB974392$\spuninst\spuninst.exe
+ 2009-12-09 02:55 . 2008-04-14 00:12 270336 c:\windows\$NtUninstallKB974392$\oakley.dll
+ 2009-12-09 02:56 . 2009-05-26 11:40 382840 c:\windows\$NtUninstallKB974318$\spuninst\updspapi.dll
+ 2009-12-09 02:56 . 2009-05-26 11:40 231288 c:\windows\$NtUninstallKB974318$\spuninst\spuninst.exe
+ 2009-12-09 02:56 . 2008-04-14 00:12 150016 c:\windows\$NtUninstallKB974318$\rastls.dll
+ 2009-12-09 02:56 . 2009-05-26 11:40 382840 c:\windows\$NtUninstallKB973904$\spuninst\updspapi.dll
+ 2009-12-09 02:56 . 2009-05-26 11:40 231288 c:\windows\$NtUninstallKB973904$\spuninst\spuninst.exe
+ 2009-12-09 02:56 . 2003-07-15 03:51 116288 c:\windows\$NtUninstallKB973904$\msconv97.dll
+ 2009-11-26 00:31 . 2009-05-26 11:40 382840 c:\windows\$NtUninstallKB973687$\spuninst\updspapi.dll
+ 2009-11-26 00:31 . 2008-07-08 13:02 231288 c:\windows\$NtUninstallKB973687$\spuninst\spuninst.exe
+ 2009-12-09 02:55 . 2008-12-16 12:30 354304 c:\windows\$NtUninstallKB971737$\winhttp.dll
+ 2009-12-09 02:55 . 2009-05-26 11:40 382840 c:\windows\$NtUninstallKB971737$\spuninst\updspapi.dll
+ 2009-12-09 02:55 . 2008-07-08 13:02 231288 c:\windows\$NtUninstallKB971737$\spuninst\spuninst.exe
+ 2009-12-09 02:56 . 2009-05-26 11:40 382840 c:\windows\$NtUninstallKB970430$\spuninst\updspapi.dll
+ 2009-12-09 02:56 . 2009-05-26 11:40 231288 c:\windows\$NtUninstallKB970430$\spuninst\spuninst.exe
+ 2009-12-09 02:56 . 2008-04-13 18:53 264832 c:\windows\$NtUninstallKB970430$\http.sys
+ 2009-11-12 02:40 . 2009-05-26 11:40 382840 c:\windows\$NtUninstallKB969947$\spuninst\updspapi.dll
+ 2009-11-12 02:40 . 2008-07-08 13:02 231288 c:\windows\$NtUninstallKB969947$\spuninst\spuninst.exe
+ 2009-11-13 00:32 . 2007-11-30 10:39 382840 c:\windows\$NtUninstallKB942288-v3$\spuninst\updspapi.dll
+ 2009-11-13 00:32 . 2007-11-30 10:39 231288 c:\windows\$NtUninstallKB942288-v3$\spuninst\spuninst.exe
+ 2009-11-13 00:32 . 2008-04-13 15:39 884736 c:\windows\$NtUninstallKB942288-v3$\msimsg.dll
+ 2009-11-13 00:32 . 2008-04-14 00:11 271360 c:\windows\$NtUninstallKB942288-v3$\msihnd.dll
+ 2009-12-09 02:55 . 2009-05-26 11:40 382840 c:\windows\$hf_mig$\KB976325-IE7\update\updspapi.dll
+ 2009-12-09 02:55 . 2009-05-26 11:40 755576 c:\windows\$hf_mig$\KB976325-IE7\update\update.exe
+ 2009-12-09 02:55 . 2009-05-26 11:40 231288 c:\windows\$hf_mig$\KB976325-IE7\spuninst.exe
+ 2009-10-29 07:45 . 2009-10-29 07:45 841216 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\wininet.dll
+ 2009-10-29 07:45 . 2009-10-29 07:45 233472 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\webcheck.dll
+ 2009-10-29 07:45 . 2009-10-29 07:45 105984 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\url.dll
+ 2009-10-29 07:45 . 2009-10-29 07:45 102912 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\occache.dll
+ 2009-10-29 07:45 . 2009-10-29 07:45 671232 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\mstime.dll
+ 2009-10-29 07:45 . 2009-10-29 07:45 193024 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\msrating.dll
+ 2009-10-29 07:45 . 2009-10-29 07:45 477696 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\mshtmled.dll
+ 2009-10-29 07:45 . 2009-10-29 07:45 459264 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\msfeeds.dll
+ 2009-10-28 06:54 . 2009-10-28 06:54 634632 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\iexplore.exe
+ 2009-10-29 07:45 . 2009-10-29 07:45 268288 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\iertutil.dll
+ 2009-10-29 07:45 . 2009-10-29 07:45 388608 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\iedkcs32.dll
+ 2009-10-29 07:45 . 2009-10-29 07:45 380928 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\ieapfltr.dll
+ 2009-10-28 06:52 . 2009-10-28 06:52 161792 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\ieakui.dll
+ 2009-10-29 07:45 . 2009-10-29 07:45 230400 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\ieaksie.dll
+ 2009-10-29 07:45 . 2009-10-29 07:45 153088 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\ieakeng.dll
+ 2009-10-29 07:45 . 2009-10-29 07:45 132608 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\extmgr.dll
+ 2009-10-29 07:45 . 2009-10-29 07:45 214528 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\dxtrans.dll
+ 2009-10-29 07:45 . 2009-10-29 07:45 347136 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\dxtmsft.dll
+ 2009-10-29 07:45 . 2009-10-29 07:45 124928 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\advpack.dll
+ 2009-12-09 02:55 . 2009-05-26 11:40 382840 c:\windows\$hf_mig$\KB974392\update\updspapi.dll
+ 2009-12-09 02:55 . 2009-05-26 11:40 755576 c:\windows\$hf_mig$\KB974392\update\update.exe
+ 2009-12-09 02:55 . 2009-05-26 11:40 231288 c:\windows\$hf_mig$\KB974392\spuninst.exe
+ 2009-10-13 10:38 . 2009-10-13 10:38 270336 c:\windows\$hf_mig$\KB974392\SP3QFE\oakley.dll
+ 2009-12-09 02:56 . 2009-05-26 11:40 382840 c:\windows\$hf_mig$\KB974318\update\updspapi.dll
+ 2009-12-09 02:56 . 2009-05-26 11:40 755576 c:\windows\$hf_mig$\KB974318\update\update.exe
+ 2009-12-09 02:56 . 2009-05-26 11:40 231288 c:\windows\$hf_mig$\KB974318\spuninst.exe
+ 2009-10-12 13:28 . 2009-10-12 13:28 150016 c:\windows\$hf_mig$\KB974318\SP3QFE\rastls.dll
+ 2009-12-09 02:56 . 2009-05-26 11:40 382840 c:\windows\$hf_mig$\KB973904\update\updspapi.dll
+ 2009-12-09 02:56 . 2009-05-26 11:40 755576 c:\windows\$hf_mig$\KB973904\update\update.exe
+ 2009-12-09 02:56 . 2009-05-26 11:40 231288 c:\windows\$hf_mig$\KB973904\spuninst.exe
+ 2009-12-08 22:50 . 2009-07-29 14:01 119648 c:\windows\$hf_mig$\KB973904\SP3QFE\msconv97.dll
+ 2009-11-26 00:31 . 2009-05-26 11:40 382840 c:\windows\$hf_mig$\KB973687\update\updspapi.dll
+ 2009-11-26 00:31 . 2008-07-08 13:02 755576 c:\windows\$hf_mig$\KB973687\update\update.exe
+ 2009-11-26 00:31 . 2008-07-08 13:02 231288 c:\windows\$hf_mig$\KB973687\spuninst.exe
+ 2009-12-09 02:55 . 2009-05-26 11:40 382840 c:\windows\$hf_mig$\KB971737\update\updspapi.dll
+ 2009-12-09 02:55 . 2009-05-26 11:40 755576 c:\windows\$hf_mig$\KB971737\update\update.exe
+ 2009-12-09 02:55 . 2008-07-08 13:02 231288 c:\windows\$hf_mig$\KB971737\spuninst.exe
+ 2009-08-25 09:27 . 2009-08-25 09:27 354816 c:\windows\$hf_mig$\KB971737\SP3QFE\winhttp.dll
+ 2009-12-09 02:56 . 2009-05-26 11:40 382840 c:\windows\$hf_mig$\KB970430\update\updspapi.dll
+ 2009-12-09 02:56 . 2009-05-26 11:40 755576 c:\windows\$hf_mig$\KB970430\update\update.exe
+ 2009-12-09 02:56 . 2009-05-26 11:40 231288 c:\windows\$hf_mig$\KB970430\spuninst.exe
+ 2009-10-20 15:21 . 2009-10-20 15:21 265728 c:\windows\$hf_mig$\KB970430\SP3QFE\http.sys
+ 2009-11-12 02:40 . 2009-05-26 11:40 382840 c:\windows\$hf_mig$\KB969947\update\updspapi.dll
+ 2009-11-12 02:40 . 2009-05-26 11:40 755576 c:\windows\$hf_mig$\KB969947\update\update.exe
+ 2009-11-12 02:40 . 2008-07-08 13:02 231288 c:\windows\$hf_mig$\KB969947\spuninst.exe
+ 2009-07-21 05:03 . 2009-07-21 05:03 1348432 c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9876.0_x-ww_a621d1d5\msxml4.dll
+ 2008-05-03 12:00 . 2009-08-14 13:21 1850624 c:\windows\system32\win32k.sys
+ 2008-05-03 12:00 . 2010-01-05 10:00 1168384 c:\windows\system32\urlmon.dll
- 2008-05-03 12:00 . 2009-08-29 07:36 1168384 c:\windows\system32\urlmon.dll
+ 2008-05-03 12:00 . 2009-07-31 15:05 1372672 c:\windows\system32\msxml6.dll
+ 2009-07-21 05:05 . 2009-07-21 05:05 1348432 c:\windows\system32\msxml4.dll
+ 2008-05-03 12:00 . 2009-07-31 04:35 1172480 c:\windows\system32\msxml3.dll
+ 2008-05-03 12:00 . 2008-05-19 11:33 4445184 c:\windows\system32\msi.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 3599360 c:\windows\system32\mshtml.dll
+ 2009-10-28 03:40 . 2009-10-28 03:40 3885984 c:\windows\system32\Macromed\Flash\NPSWF32.dll
+ 2007-08-13 18:54 . 2010-01-05 10:00 6067200 c:\windows\system32\ieframe.dll
- 2007-08-13 18:54 . 2009-08-29 07:36 6067200 c:\windows\system32\ieframe.dll
+ 2008-11-22 17:06 . 2009-08-14 13:21 1850624 c:\windows\system32\dllcache\win32k.sys
- 2007-08-13 18:54 . 2009-08-29 07:36 1168384 c:\windows\system32\dllcache\urlmon.dll
+ 2007-08-13 18:54 . 2010-01-05 10:00 1168384 c:\windows\system32\dllcache\urlmon.dll
+ 2008-05-03 12:00 . 2009-07-31 15:05 1372672 c:\windows\system32\dllcache\msxml6.dll
+ 2008-11-22 17:05 . 2009-07-31 04:35 1172480 c:\windows\system32\dllcache\msxml3.dll
+ 2008-05-19 11:33 . 2008-05-19 11:33 4445184 c:\windows\system32\dllcache\msi.dll
+ 2008-05-03 12:00 . 2010-01-05 10:00 3599360 c:\windows\system32\dllcache\mshtml.dll
- 2008-10-03 17:41 . 2009-08-29 07:36 6067200 c:\windows\system32\dllcache\ieframe.dll
+ 2008-10-03 17:41 . 2010-01-05 10:00 6067200 c:\windows\system32\dllcache\ieframe.dll
+ 2009-11-13 00:37 . 2008-03-05 20:56 3786760 c:\windows\system32\D3DX9_37.dll
+ 2009-11-13 00:37 . 2004-12-01 20:53 2846720 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2903.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-11-13 00:37 . 2004-09-29 17:38 2676224 c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3DX.dll
+ 2009-11-13 00:42 . 2009-11-13 00:42 9874944 c:\windows\Installer\2d86a6d.msi
+ 2009-11-13 00:39 . 2009-11-13 00:39 3986432 c:\windows\Installer\2d86a5a.msi
+ 2009-11-13 00:38 . 2009-11-13 00:38 2948096 c:\windows\Installer\2d86a50.msi
+ 2009-11-28 19:52 . 2009-11-28 19:52 1522176 c:\windows\Installer\13a6d92.msi
+ 2009-11-28 19:51 . 2009-11-28 19:51 2722816 c:\windows\Installer\13a6d8c.msi
+ 2010-01-23 03:57 . 2009-10-29 07:46 1168384 c:\windows\ie7updates\KB978207-IE7\urlmon.dll
+ 2010-01-23 03:57 . 2009-10-29 07:46 3598336 c:\windows\ie7updates\KB978207-IE7\mshtml.dll
+ 2010-01-23 03:57 . 2009-10-29 07:46 6067200 c:\windows\ie7updates\KB978207-IE7\ieframe.dll
+ 2009-12-09 02:55 . 2009-08-29 07:36 1168384 c:\windows\ie7updates\KB976325-IE7\urlmon.dll
+ 2009-12-09 02:55 . 2009-10-21 04:08 3598336 c:\windows\ie7updates\KB976325-IE7\mshtml.dll
+ 2009-12-09 02:55 . 2009-08-29 07:36 6067200 c:\windows\ie7updates\KB976325-IE7\ieframe.dll
+ 2009-11-13 01:27 . 2009-11-13 01:27 2855424 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\d3cce054b5cfe96bc7674152c902dc5d\Microsoft.Windows.Design.Developer.ni.dll
+ 2009-11-13 01:27 . 2009-11-13 01:27 3152384 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\6a026bd9e82c00fc673c2f160bd4d510\Microsoft.Windows.Design.Markup.ni.dll
+ 2009-11-13 01:26 . 2009-11-13 01:26 1515008 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8fdca03250f1eb4559fc785ec7931ddb\Microsoft.VisualStudio.Modeling.Sdk.ni.dll
+ 2009-11-13 01:26 . 2009-11-13 01:26 1338880 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\4e1473e326094543113428145cb51742\Microsoft.VisualStudio.Modeling.Sdk.Diagrams.GraphObject.ni.dll
+ 2009-11-13 01:27 . 2009-11-13 01:27 1298944 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\412e24576e4b33b18273083cb28bef95\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll
+ 2009-11-13 01:26 . 2009-11-13 01:26 2383360 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\365e4a6f3bf601db3d44659370e7aeb9\Microsoft.VisualStudio.Modeling.Sdk.Diagrams.ni.dll
+ 2009-11-13 00:51 . 2009-11-13 00:51 1873920 c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\19c7e7b9b1232519379c8e1f1b9e9e54\Microsoft.VisualStudio.CommonIDE.ni.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 4419584 c:\windows\assembly\GAC_MSIL\Microsoft.VSDesigner\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VSDesigner.dll
+ 2009-11-13 00:39 . 2009-11-13 00:39 1355776 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Xaml\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Xaml.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 2879488 c:\windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Editors\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Editors.dll
+ 2009-11-13 00:38 . 2009-11-13 00:38 1712128 c:\windows\assembly\GAC_32\mscorcfg\3.5.0.0__b03f5f7f11d50a3a\mscorcfg.dll
+ 2009-11-13 00:37 . 2009-11-13 00:37 2846720 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-11-13 00:37 . 2009-11-13 00:37 2676224 c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-11-26 00:31 . 2008-09-10 01:14 1307648 c:\windows\$NtUninstallKB973687$\msxml6.dll
+ 2009-11-26 00:31 . 2008-09-04 17:15 1106944 c:\windows\$NtUninstallKB973687$\msxml3.dll
+ 2009-11-12 02:40 . 2009-04-17 12:26 1847168 c:\windows\$NtUninstallKB969947$\win32k.sys
+ 2009-11-13 00:32 . 2008-04-14 00:11 2843136 c:\windows\$NtUninstallKB942288-v3$\msi.dll
+ 2009-10-29 07:45 . 2009-10-29 07:45 1170944 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\urlmon.dll
+ 2009-10-29 07:45 . 2009-10-29 07:45 3602432 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\mshtml.dll
+ 2009-10-29 07:45 . 2009-10-29 07:45 6070784 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\ieframe.dll
+ 2009-12-08 22:51 . 2009-06-29 08:33 2452872 c:\windows\$hf_mig$\KB976325-IE7\SP3QFE\ieapfltr.dat
+ 2009-11-25 11:41 . 2009-07-31 04:24 1447424 c:\windows\$hf_mig$\KB973687\SP3QFE\msxml6.dll
+ 2009-11-25 11:41 . 2009-07-31 04:24 1172480 c:\windows\$hf_mig$\KB973687\SP3QFE\msxml3.dll
+ 2009-08-14 12:19 . 2009-08-14 12:19 1859712 c:\windows\$hf_mig$\KB969947\SP3QFE\win32k.sys
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-10-08 21:18 77824 ----a-w- c:\documents and settings\mkristiansen\Application Data\Dropbox\bin\DropboxExt.3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-10-08 21:18 77824 ----a-w- c:\documents and settings\mkristiansen\Application Data\Dropbox\bin\DropboxExt.3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-10-08 21:18 77824 ----a-w- c:\documents and settings\mkristiansen\Application Data\Dropbox\bin\DropboxExt.3.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2008-08-15 30003200]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-12-12 2043160]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-11-12 13672448]
"nwiz"="nwiz.exe" [2008-11-12 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-11-12 86016]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-10-20 286720]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"StatusClient"="c:\program files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe" [2002-12-16 36864]
"TomcatStartup"="c:\program files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe" [2003-04-01 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"NokiaMusic FastStart"="c:\program files\Nokia\Nokia Music\NokiaMusic.exe" [2009-07-22 2331936]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2009-04-07 642856]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2010-01-05 124928]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 1 (0x1)
"StartMenuFavorites"= 0 (0x0)
"Start_ShowMyComputer"= 1 (0x1)
"Start_ShowMyDocs"= 1 (0x1)
"Start_ShowMyMusic"= 0 (0x0)
"Start_ShowRun"= 1 (0x1)
"Start_ShowSearch"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-28 10:36 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 -c----w- c:\program files\Messenger\msmsgs.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\Graphisoft\\ArchiCAD 12\\ArchiCAD.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Hewlett-Packard\\Toolbox2.0\\Javasoft\\JRE\\1.3.1\\bin\\javaw.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [8/14/2009 4:42 PM 64160]
R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [5/3/2008 7:00 AM 143360]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [11/22/2008 12:06 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [11/22/2008 12:06 PM 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [11/22/2008 12:06 PM 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [11/22/2008 12:06 PM 297752]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [11/22/2008 7:44 PM 845184]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/3/2009 9:49 AM 1028432]
.
Contents of the 'Scheduled Tasks' folder

2010-01-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 19:57]

2010-01-28 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-05-12 02:18]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = <local>
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\mkristiansen\Application Data\Mozilla\Firefox\Profiles\xfzcj4ap.default\
FF - prefs.js: browser.startup.homepage - hxxp://ca.yahoo.com/
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-28 21:35
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3816)
c:\windows\system32\WININET.dll
c:\documents and settings\mkristiansen\Application Data\Dropbox\bin\DropboxExt.3.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-01-28 21:36:28
ComboFix-quarantined-files.txt 2010-01-29 02:36
ComboFix2.txt 2009-11-05 21:00

Pre-Run: 86,618,619,904 bytes free
Post-Run: 86,606,925,824 bytes free

- - End Of File - - 0C6CA8079D4769BDFB5BEE07A4445673
mikekk
2010-01-29, 04:50
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:43:04 PM, on 1/28/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O1 - Hosts: 74.125.45.100 test1111.com
O1 - Hosts: 74.125.45.100 test1112.com
O1 - Hosts: 74.125.45.100 4-open-davinci.com
O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com
O1 - Hosts: 74.125.45.100 privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getavplusnow.com
O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com
O1 - Hosts: 64.86.17.32 google.ae
O1 - Hosts: 64.86.17.32 google.as
O1 - Hosts: 64.86.17.32 google.at
O1 - Hosts: 64.86.17.32 google.az
O1 - Hosts: 64.86.17.32 google.ba
O1 - Hosts: 64.86.17.32 google.be
O1 - Hosts: 64.86.17.32 google.bg
O1 - Hosts: 64.86.17.32 google.bs
O1 - Hosts: 64.86.17.32 google.ca
O1 - Hosts: 64.86.17.32 google.cd
O1 - Hosts: 64.86.17.32 google.com.gh
O1 - Hosts: 64.86.17.32 google.com.hk
O1 - Hosts: 64.86.17.32 google.com.jm
O1 - Hosts: 64.86.17.32 google.com.mx
O1 - Hosts: 64.86.17.32 google.com.my
O1 - Hosts: 64.86.17.32 google.com.na
O1 - Hosts: 64.86.17.32 google.com.nf
O1 - Hosts: 64.86.17.32 google.com.ng
O1 - Hosts: 64.86.17.32 google.ch
O1 - Hosts: 64.86.17.32 google.com.np
O1 - Hosts: 64.86.17.32 google.com.pr
O1 - Hosts: 64.86.17.32 google.com.qa
O1 - Hosts: 64.86.17.32 google.com.sg
O1 - Hosts: 64.86.17.32 google.com.tj
O1 - Hosts: 64.86.17.32 google.com.tw
O1 - Hosts: 64.86.17.32 google.dj
O1 - Hosts: 64.86.17.32 google.de
O1 - Hosts: 64.86.17.32 google.dk
O1 - Hosts: 64.86.17.32 google.dm
O1 - Hosts: 64.86.17.32 google.ee
O1 - Hosts: 64.86.17.32 google.fi
O1 - Hosts: 64.86.17.32 google.fm
O1 - Hosts: 64.86.17.32 google.fr
O1 - Hosts: 64.86.17.32 google.ge
O1 - Hosts: 64.86.17.32 google.gg
O1 - Hosts: 64.86.17.32 google.gm
O1 - Hosts: 64.86.17.32 google.gr
O1 - Hosts: 64.86.17.32 google.ht
O1 - Hosts: 64.86.17.32 google.ie
O1 - Hosts: 64.86.17.32 google.im
O1 - Hosts: 64.86.17.32 google.in
O1 - Hosts: 64.86.17.32 google.it
O1 - Hosts: 64.86.17.32 google.ki
O1 - Hosts: 64.86.17.32 google.la
O1 - Hosts: 64.86.17.32 google.li
O1 - Hosts: 64.86.17.32 google.lv
O1 - Hosts: 64.86.17.32 google.ma
O1 - Hosts: 64.86.17.32 google.ms
O1 - Hosts: 64.86.17.32 google.mu
O1 - Hosts: 64.86.17.32 google.mw
O1 - Hosts: 64.86.17.32 google.nl
O1 - Hosts: 64.86.17.32 google.no
O1 - Hosts: 64.86.17.32 google.nr
O1 - Hosts: 64.86.17.32 google.nu
O1 - Hosts: 64.86.17.32 google.pl
O1 - Hosts: 64.86.17.32 google.pn
O1 - Hosts: 64.86.17.32 google.ro
O1 - Hosts: 64.86.17.32 google.ru
O1 - Hosts: 64.86.17.32 google.rw
O1 - Hosts: 64.86.17.32 google.sc
O1 - Hosts: 64.86.17.32 google.se
O1 - Hosts: 64.86.17.32 google.sh
O1 - Hosts: 64.86.17.32 google.si
O1 - Hosts: 64.86.17.32 google.sm
O1 - Hosts: 64.86.17.32 google.sn
O1 - Hosts: 64.86.17.32 google.tl
O1 - Hosts: 64.86.17.32 google.tm
O1 - Hosts: 64.86.17.32 google.tt
O1 - Hosts: 64.86.17.32 google.us
O1 - Hosts: 64.86.17.32 google.vu
O1 - Hosts: 64.86.17.32 google.ws
O1 - Hosts: 64.86.17.32 google.co.ck
O1 - Hosts: 64.86.17.32 google.co.id
O1 - Hosts: 64.86.17.32 google.co.il
O1 - Hosts: 64.86.17.32 google.co.in
O1 - Hosts: 64.86.17.32 google.co.jp
O1 - Hosts: 64.86.17.32 google.co.kr
O1 - Hosts: 64.86.17.32 google.co.ls
O1 - Hosts: 64.86.17.32 google.co.ma
O1 - Hosts: 64.86.17.32 google.co.nz
O1 - Hosts: 64.86.17.32 google.co.tz
O1 - Hosts: 64.86.17.32 google.co.ug
O1 - Hosts: 64.86.17.32 google.co.uk
O1 - Hosts: 64.86.17.32 google.co.za
O1 - Hosts: 64.86.17.32 google.co.zm
O1 - Hosts: 64.86.17.32 google.com
O1 - Hosts: 64.86.17.32 google.com.af
O1 - Hosts: 64.86.17.32 google.com.ag
O1 - Hosts: 64.86.17.32 google.com.ar
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [StatusClient] C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup] C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles
O4 - HKLM\..\Run: [NokiaMusic FastStart] "C:\Program Files\Nokia\Nokia Music\NokiaMusic.exe" /command:faststart
O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Autodesk Network Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskNetSrv.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 10309 bytes
Shaba
2010-01-30, 08:25
Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:


File::
c:\windows\system32\drivers\etc\hosts


Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
mikekk
2010-01-30, 18:00
I hope I'm doing everything right! Kiitos again!

ComboFix 10-01-28.04 - mkristiansen 01/30/2010 10:54:06.3.4 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1498 [GMT -5:00]
Running from: c:\documents and settings\mkristiansen\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\mkristiansen\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Windows System Suite *On-access scanning enabled* (Updated) {9A6E0301-2079-4983-9D9D-43A137D9EE47}
FW: Windows System Suite *enabled* {B864796F-4B26-47DE-AA02-E7FC76536C2A}

FILE ::
"c:\windows\system32\drivers\etc\hosts"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\etc\hosts

.
((((((((((((((((((((((((( Files Created from 2009-12-28 to 2010-01-30 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-30 13:42 . 2009-11-16 20:40 79488 ----a-w- c:\documents and settings\mkristiansen\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-01-28 02:40 . 2009-09-28 23:10 612048 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-01-05 10:00 . 2008-05-03 12:00 832512 ------w- c:\windows\system32\wininet.dll
2010-01-05 10:00 . 2008-05-03 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-01-05 10:00 . 2008-05-03 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-12-14 23:58 . 2009-12-14 23:58 664 ----a-w- c:\windows\system32\d3d9caps.dat
2009-11-28 19:52 . 2009-11-28 19:52 8892928 ----a-w- c:\documents and settings\All Users\Application Data\atscie.msi
2009-11-27 22:42 . 2009-10-02 21:42 3695616 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2009-11-21 15:51 . 2008-05-03 12:00 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-14 19:53 . 2009-08-04 22:16 4045528 -c--a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-11-13 01:08 . 2008-11-22 17:49 118248 -c--a-w- c:\documents and settings\mkristiansen\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-13 00:42 . 2009-11-13 00:42 348256 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VSTAHost\Architecture2010\9.0\1033\ResourceCache.dll
2009-11-13 00:39 . 2009-11-13 00:39 416 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\MSDN\9.0\1033\ResourceCache.dll
2009-11-12 01:20 . 2009-11-12 01:20 89962 ----a-w- c:\documents and settings\mkristiansen\Application Data\Dropbox\bin\Uninstall.exe
.

((((((((((((((((((((((((((((( SnapShot_2010-01-29_02.35.39 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-30 13:35 . 2010-01-30 13:35 16384 c:\windows\Temp\Perflib_Perfdata_6c0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-10-08 21:18 77824 ----a-w- c:\documents and settings\mkristiansen\Application Data\Dropbox\bin\DropboxExt.3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-10-08 21:18 77824 ----a-w- c:\documents and settings\mkristiansen\Application Data\Dropbox\bin\DropboxExt.3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-10-08 21:18 77824 ----a-w- c:\documents and settings\mkristiansen\Application Data\Dropbox\bin\DropboxExt.3.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2008-08-15 30003200]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-12-12 2043160]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-11-12 13672448]
"nwiz"="nwiz.exe" [2008-11-12 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-11-12 86016]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-10-20 286720]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"StatusClient"="c:\program files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe" [2002-12-16 36864]
"TomcatStartup"="c:\program files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe" [2003-04-01 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"NokiaMusic FastStart"="c:\program files\Nokia\Nokia Music\NokiaMusic.exe" [2009-07-22 2331936]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2009-04-07 642856]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2010-01-05 124928]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 1 (0x1)
"StartMenuFavorites"= 0 (0x0)
"Start_ShowMyComputer"= 1 (0x1)
"Start_ShowMyDocs"= 1 (0x1)
"Start_ShowMyMusic"= 0 (0x0)
"Start_ShowRun"= 1 (0x1)
"Start_ShowSearch"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-28 10:36 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 -c----w- c:\program files\Messenger\msmsgs.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\Graphisoft\\ArchiCAD 12\\ArchiCAD.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Hewlett-Packard\\Toolbox2.0\\Javasoft\\JRE\\1.3.1\\bin\\javaw.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [8/14/2009 4:42 PM 64160]
R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [5/3/2008 7:00 AM 143360]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [11/22/2008 12:06 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [11/22/2008 12:06 PM 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [11/22/2008 12:06 PM 908056]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [11/22/2008 7:44 PM 845184]
R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [11/22/2008 12:06 PM 297752]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/3/2009 9:49 AM 1028432]
.
Contents of the 'Scheduled Tasks' folder

2010-01-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 19:57]

2010-01-30 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-05-12 02:18]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = <local>
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\mkristiansen\Application Data\Mozilla\Firefox\Profiles\xfzcj4ap.default\
FF - prefs.js: browser.startup.homepage - hxxp://ca.yahoo.com/
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-30 10:56
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-01-30 10:56:56
ComboFix-quarantined-files.txt 2010-01-30 15:56
ComboFix2.txt 2010-01-29 02:36
ComboFix3.txt 2009-11-05 21:00

Pre-Run: 86,587,719,680 bytes free
Post-Run: 86,561,185,792 bytes free

- - End Of File - - DCA87EE4466F687C21C11CA77A2A010B
mikekk
2010-02-02, 04:04
I think it might be working properly now. I can access google, and the google search bar. Do you see any indications that this is true?
Shaba
2010-02-02, 16:04
Sorry, I got no email notification from your previous reply.

Please post a fresh HijackThis log as well :)
mikekk
2010-02-05, 00:21
Hey,
Here is my HJT log. A friend also suggested that while i ran the ComboFix, i should have had my internet connection unplugged, is this true? Just wondering because i didn't!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:18:33 PM, on 2/4/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [StatusClient] C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup] C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles
O4 - HKLM\..\Run: [NokiaMusic FastStart] "C:\Program Files\Nokia\Nokia Music\NokiaMusic.exe" /command:faststart
O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Autodesk Network Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskNetSrv.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 6680 bytes
Shaba
2010-02-05, 19:37
No combofix disconnects computer automatically from internet.

Please go to Kaspersky website (http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html) and perform an online antivirus scan.

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply along with a fresh HijackThis log.

If you need a tutorial, see here (http://i275.photobucket.com/albums/jj285/Bleeping/KAS/KAS9.gif)
mikekk
2010-02-06, 19:12
Here they are!

kaspersky

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Saturday, February 6, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Saturday, February 06, 2010 14:02:35
Records in database: 3440093
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\

Scan statistics:
Objects scanned: 78527
Threats found: 2
Infected objects found: 2
Suspicious objects found: 0
Scan duration: 01:54:05


File name / Threat / Threats count
C:\Documents and Settings\mkristiansen\Application Data\Sun\Java\Deployment\cache\6.0\44\d188a2c-22b779dd Infected: Trojan-Downloader.Java.Agent.af 1
E:\My_Stuff\mkristiansen documents\My Music\My Shared Folder\two chicks lost boyz.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1

Selected area has been scanned.


HJT

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:11:06 PM, on 2/6/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [StatusClient] C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup] C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles
O4 - HKLM\..\Run: [NokiaMusic FastStart] "C:\Program Files\Nokia\Nokia Music\NokiaMusic.exe" /command:faststart
O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Autodesk Network Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskNetSrv.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 6669 bytes
Shaba
2010-02-06, 20:21
Empty these folders:

C:\Documents and Settings\mkristiansen\Application Data\Sun\Java\Deployment\cache\6.0\

E:\My_Stuff\mkristiansen documents\My Music\My Shared Folder

Empty Recycle Bin.

Still problems?
mikekk
2010-02-09, 00:06
Just before i do it, the My Shared Folder is all my music, and there's a lot. Can i just delete the file 'two chicks.....' I wanted to see if there was any other alternative that's all,
The other folder would be fine to delete.
Thanks,
Mike
mikekk
2010-02-09, 00:08
Should i delete the folder, or go inside and delete everything?
Thanks,
Mike
Shaba
2010-02-09, 07:08
Well where all music inside that folder has been originated?
mikekk
2010-02-10, 20:50
Various places. But from the scan log, it said which specific file was the infected one.
Whatever you tell me to do i'll do, I was just wondering. And should I delete the folder, or just the files inside?
Shaba
2010-02-10, 22:26
So have you purchased them or downloaded from somewhere?
mikekk
2010-02-11, 01:47
Some of both. Mostly purchased, but some downloaded.
Shaba
2010-02-11, 20:48
OK then.

Please delete this file instead:

E:\My_Stuff\mkristiansen documents\My Music\My Shared Folder\two chicks lost boyz.mp3

Still problems?
mikekk
2010-02-12, 03:51
I think it worked, I did a scan with an updated spybot and no problems found.
Thank you so much for taking the time to help me, it was much appreciated.
Shaba
2010-02-13, 09:43
Glad to hear :)

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Looking over your log, it seems you don't have any evidence of a third party firewall.

As the term conveys, a firewall is an extra layer of security installed onto computers, which restricts access to systems from the outside world. Firewalls protect against hackers and malicious intruders. I want you to download a free firewall NOW from one of these excellent vendors:

1) Comodo (http://www.personalfirewall.comodo.com/download_firewall.html) (Uncheck during installation "Install COMODO Antivirus (Recommended)"!, "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage")
2) Online Armor (http://www.tallemu.com/online_armor_free.html)
3) PC Tools (http://www.pctools.com/firewall/download/)
4) Sunbelt/Kerio (http://www.sunbelt-software.com/Kerio-Download.cfm)
5) ZoneAlarm (http://www.zonelabs.com/store/content/catalog/products/sku_list_za.jsp?dc=12bms&ctry=US&lang=en&lid=nav_za) (uncheck ZoneAlarm Spy Blocker during installation if you choose this one)

If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.

Now lets uninstall ComboFix:

Click START then RUN
Now type Combofix /uninstall in the runbox and click OK

Next we remove all used tools.

Please download OTCleanIt (http://oldtimer.geekstogo.com/OTC.exe) and save it to desktop.

Double-click OTC.exe.
Click the CleanUp! button.
Select Yes when the "Begin cleanup Process?" prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes, if not delete it by yourself.


Note: If you receive a warning from your firewall or other security programs regarding OTCleanIt attempting to contact the internet, please allow it to do so.

Disable and Enable System Restore. - If you are using Windows XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.

You can find instructions on how to enable and re-enable system restore here:

Windows XP System Restore Guide (http://www.bleepingcomputer.com/forums/tutorial56.html)

Re-enable system restore with instructions from tutorial above

Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt

Change the Download unsigned ActiveX controls to Disable

Change the Initialize and script ActiveX controls not marked as safe to Disable

Change the Installation of desktop items to Prompt

Change the Launching programs and files in an IFRAME to Prompt

Change the Navigate sub-frames across different domains to Prompt

When all these settings have been made, click on the OK button.

If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

Update your AntiVirus Software and keep your other programs up-to-date Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector (http://secunia.com/software_inspector/)
F-secure Health Check (http://www.f-secure.com/weblog/archives/00001356.html)

Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com (http://www.windowsupdate.com) regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Install Malwarebytes' Anti-Malware - Malwarebytes''Anti-Malware is a new and powerful anti-malware tool. It is
totally free but for real-time protection you will have to pay a small one-time fee. Tutorial on installing & using this product can be found below:

Malwarebytes' Anti-Malware Setup Guide (http://www.lognrock.com/forum/index.php?showtopic=6926)

Malwarebytes' Anti-Malware Scanning Guide (http://www.lognrock.com/forum/index.php?showtopic=6913)


Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware (http://www.bleepingcomputer.com/tutorials/tutorial49.html)


Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.

Here are some additional utilities that will enhance your safety

MVPS Hosts file (http://mvps.org/winhelp2002/hosts.htm) <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer. See also a hosts file tutorial here (http://malwareremoval.com/forum/viewtopic.php?t=22187)
Winpatrol (http://www.winpatrol.com/) <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
Using Winpatrol to protect your computer from malicious software (http://www.winpatrol.com/features.html)

Stand Up and Be Counted ---> Malware Complaints (http://www.malwarecomplaints.info/index.php) <--- where you can make difference!

The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.

Also, please read this great article by Tony Klein So How Did I Get Infected In First Place (http://forums.spybot.info/showthread.php?t=279)

Happy surfing and stay clean! :bigthumb:
mikekk
2010-02-21, 16:22
Hey,
I'm trying to remove ComboFix and am having a hard time. I'm typing combofix /uninstall, with the space after the x, no space before the u. It keeps asking me to disable the spyware and the computer does the beeping, like when it was going to do a scan. I stop it before the scan. Should I have kept going?
mikekk
2010-02-21, 17:06
Now, after i run combofix /uninstall, i get a message from Combofix:
'some files could be created. Please close all applications, reboot windows and restart the installation'.
Shaba
2010-02-21, 23:23
In that case, just delete combofix.exe and run OTCleanIt and you should be good to go :)
mikekk
2010-02-23, 01:16
All done, thanks again!!:D::D:
Shaba
2010-02-28, 19:36
Since this issue appears to be resolved ... this Topic has been closed. Glad I could help.

Note: If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than four days since your last response and you need the thread re-opened, please send me or your helper a private message (pm). A valid, working link to the closed topic is required. Please do not add any logs that might have been requested in the closed topic, you would be starting fresh.