Google antaa ihmeellisiä hakutuloksia. HJ-loki

Viestiketju Virukset ja haittaohjelmat - HijackThis -logit -osiossa. Ketjun avasi Tigerishk 10.12.2008.

  1. Tigerishk

    Tigerishk Member

    Liittynyt:
    29.05.2008
    Viestejä:
    17
    Kiitokset:
    0
    Pisteet:
    11
    Eli google antaa ihmeellisiä tuloksia pistää hakusanaksi mitä tahansa.


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 20:20:04, on 10.12.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    d:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Executive Software\Diskeeper\DkService.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\MessengerPlus! 3\MsgPlus.exe
    C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Common Files\Nokia\Tools\NclTray.exe
    C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
    C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    d:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
    C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
    C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    D:\Program Files\Azureus\Azureus.exe
    C:\WINDOWS\explorer.exe
    D:\nutty.exe
    d:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
    d:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = planetlab2.eecs.umich.edu:3124
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {D57232E4-4013-4DA9-A497-1601BBEC5052} - (no file)
    O4 - HKLM\..\Run: [Win32 LSA Driver] lsa.exe
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\Tools\NclTray.exe
    O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    O4 - HKLM\..\Run: [Windows svchost] service.exe
    O4 - HKLM\..\Run: [avast!] d:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    O4 - HKLM\..\RunServices: [Win32 LSA Driver] lsa.exe
    O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] d:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Win32 LSA Driver] lsa.exe
    O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
    O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
    O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [Win32 LSA Driver] lsa.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [Win32 LSA Driver] lsa.exe (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123799259608
    O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: avast! Antivirus - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\SupportSoft\bin\ssrc.exe

    --
    End of file - 9472 bytes
     
    Tigerishk, 10.12.2008
    #1
  2.  
  3. Hujo

    Hujo Guest

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.

    ================

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi

    =================

    1.Lataa Combofix.exe työpöydällesi yhdestä linkistä:
    Combofix1
    Combofix2

    2. Tuplaklikkaa Combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

    ============

    Lataa Tästä Ccleaner
    CCleaner v 2.14.750.- Standard Build, ÄLÄ aseenna Yahoo toolbaria!
    Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
    Asennuksen jälkeen aukaise CCleaneri.
    Valitse vasemmalta pystyrivistä Options.
    Valitse viereisestä pystyrivistä Settings.
    Language kohtaan valitse Suomi.

    Puhdistaja
    Valitse vasemmalta pystyrivistä Puhdistaja.
    Paina alhaalta Tutki.
    Nyt CCleaneri tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
    Kun tutkiminen on valmis, paina Aja CCleaner.
    Nyt CCleaneri poistaa löydetyt tempit, cookiessit jne.

    Rekisterin virheiden korjaus
    Valitse vasemmalta pystyrivistä Rekisteri.
    Paina alhaalta Etsi rekisterin virheitä.
    Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
    Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
    Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
    Saat vielä varmistus kysymyksen, paina Ok.
    Kun virheet on korjattu, paina Sulje.
    Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.
     
    Hujo, 10.12.2008
    #2
  4. Tigerishk

    Tigerishk Member

    Liittynyt:
    29.05.2008
    Viestejä:
    17
    Kiitokset:
    0
    Pisteet:
    11
    Nyt toimii paremmin. Kiitos :)
    Tässä vielä uusi HJ loki

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 0:03:50, on 13.12.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    d:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Executive Software\Diskeeper\DkService.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\System32\svchost.exe
    d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    d:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\MessengerPlus! 3\MsgPlus.exe
    C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Common Files\Nokia\Tools\NclTray.exe
    D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
    C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
    C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
    C:\WINDOWS\explorer.exe
    D:\Program Files\Mozilla Firefox 3.1 Beta 2\firefox.exe
    D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = planetlab2.eecs.umich.edu:3124
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\Tools\NclTray.exe
    O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    O4 - HKLM\..\Run: [avast!] d:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
    O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
    O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123799259608
    O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: avast! Antivirus - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\SupportSoft\bin\ssrc.exe

    --
    End of file - 8565 bytes
     
    Tigerishk, 13.12.2008
    #3
  5. Tigerishk

    Tigerishk Member

    Liittynyt:
    29.05.2008
    Viestejä:
    17
    Kiitokset:
    0
    Pisteet:
    11

    SDFix: Version 1.240
    Run by Tigeri on pe 12.12.2008 at 21:42

    Microsoft Windows XP [versio 5.1.2600]
    Running From: D:\SDFix

    Checking Services :


    Restoring Default Security Values
    Restoring Default Hosts File

    Rebooting


    Checking Files :

    Trojan Files Found:

    C:\WINDOWS\SYSTEM32\FTPUPD.EXE - Deleted
    C:\WINDOWS\system32\TFTP2608 - Deleted





    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-12-12 21:49:23
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001583b3b80b]
    "0017b034997e"=hex:d5,04,be,7d,ee,b1,29,39,21,11,c2,f8,e1,33,eb,f2
    "00192d45d129"=hex:3a,4a,d8,8a,55,97,6c,ca,ec,6a,8e,dd,1d,68,9d,7f
    "001d6e8abbf5"=hex:a3,d4,b6,bb,dd,4d,ad,91,e8,98,fc,46,71,dd,19,65
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
    "s1"=dword:1ae35272
    "s2"=dword:1afaf623
    "h0"=dword:00000001

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "h0"=dword:00000000
    "khjeh"=hex:dd,33,0b,de,42,62,eb,a1,9c,31,e1,79,f3,a2,ea,01,81,13,11,be,45,..
    "p0"="C:\Program Files\DAEMON Tools Lite\"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "khjeh"=hex:eb,a0,29,fc,5c,3b,ba,ff,53,19,17,38,26,bc,c1,21,45,33,06,69,af,..
    "a0"=hex:20,01,00,00,9a,b8,16,74,02,5d,06,68,26,4c,9e,4e,aa,b4,03,eb,9c,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:62,38,44,e1,90,b3,3b,c6,19,22,c5,17,dc,ea,6e,e8,6a,ec,91,a2,af,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
    "khjeh"=hex:f5,d8,54,0f,0e,59,8c,41,bd,3f,13,56,26,35,55,92,d8,2f,b6,9f,7a,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="C:\Program Files\DAEMON Tools\"
    "h0"=dword:00000000
    "khjeh"=hex:6a,fa,88,2f,8e,43,75,a3,cc,e3,ce,85,fb,8f,f8,ce,85,66,e0,a6,72,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,e1,ac,5a,f9,0e,dd,63,85,41,fd,dc,ea,ff,e2,7e,bd,67,..
    "khjeh"=hex:89,bd,87,53,02,2b,fc,67,94,c6,8b,86,9e,cc,6a,a8,5c,ee,32,01,43,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:91,15,eb,b2,5c,c4,3b,3f,df,83,cc,9d,a8,76,3b,d9,00,0b,96,41,24,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001583b3b80b]
    "0017b034997e"=hex:d5,04,be,7d,ee,b1,29,39,21,11,c2,f8,e1,33,eb,f2
    "00192d45d129"=hex:3a,4a,d8,8a,55,97,6c,ca,ec,6a,8e,dd,1d,68,9d,7f
    "001d6e8abbf5"=hex:a3,d4,b6,bb,dd,4d,ad,91,e8,98,fc,46,71,dd,19,65
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "h0"=dword:00000000
    "khjeh"=hex:dd,33,0b,de,42,62,eb,a1,9c,31,e1,79,f3,a2,ea,01,81,13,11,be,45,..
    "p0"="C:\Program Files\DAEMON Tools Lite\"

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "khjeh"=hex:eb,a0,29,fc,5c,3b,ba,ff,53,19,17,38,26,bc,c1,21,45,33,06,69,af,..
    "a0"=hex:20,01,00,00,9a,b8,16,74,02,5d,06,68,26,4c,9e,4e,aa,b4,03,eb,9c,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:62,38,44,e1,90,b3,3b,c6,19,22,c5,17,dc,ea,6e,e8,6a,ec,91,a2,af,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
    "khjeh"=hex:f5,d8,54,0f,0e,59,8c,41,bd,3f,13,56,26,35,55,92,d8,2f,b6,9f,7a,..

    scanning hidden registry entries ...

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{7BC895DE-8AC5-C1CF-C72C-64EBC304AFB1}]
    "abmoomhegompcmdgkddbaohblhoogflidg"=hex:61,61,00,00
    "bbmoomhegompcmdgkdibheahmgemgpngdaoc"=hex:61,61,00,00

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0


    Remaining Services :




    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\Java\\jre1.5.0_04\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.5.0_04\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "D:\\Program Files\\Sony\\EverQuest II\\EQ2.exe"="D:\\Program Files\\Sony\\EverQuest II\\EQ2.exe:*:Enabled:EverQuest II"
    "D:\\Program Files\\Azureus\\Azureus.exe"="D:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus"
    "D:\\Program Files\\DC++\\DCPlusPlus.exe"="D:\\Program Files\\DC++\\DCPlusPlus.exe:*:Enabled:DC++"
    "C:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe"="C:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe:*:Enabled:LaunchPad"
    "C:\\Program Files\\Java\\jre1.5.0_06\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "C:\\WINDOWS\\system32\\rtcshare.exe"="C:\\WINDOWS\\system32\\rtcshare.exe:*:Enabled:RTC App Sharing"
    "C:\\Program Files\\NetMeeting\\conf.exe"="C:\\Program Files\\NetMeeting\\conf.exe:*:Enabled:Windows© NetMeeting©"
    "D:\\Program Files\\XiRCON\\Xircon.exe"="D:\\Program Files\\XiRCON\\Xircon.exe:*:Enabled:XiRCON IRC Client"
    "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
    "C:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe"="C:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe:*:Enabled:Et„tuki - Windows Messenger ja „„niyhteys"
    "C:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"="C:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7"
    "C:\\WINDOWS\\system32\\ftp.exe"="C:\\WINDOWS\\system32\\ftp.exe:*:Enabled:FTP-tiedostonsiirto-ohjelma"
    "D:\\Nettimittari_DNALS.exe"="D:\\Nettimittari_DNALS.exe:*:Enabled:Nettimittari_DNALS.exe"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
    "D:\\Klassikkopelikokoelma DVD\\Worms 2\\Worms 2\\frontend.exe"="D:\\Klassikkopelikokoelma DVD\\Worms 2\\Worms 2\\frontend.exe:*:Disabled:Worms 2 Frontend"
    "D:\\Klassikkopelikokoelma DVD\\Worms 2\\Worms 2\\Binaries\\landgen.exe"="D:\\Klassikkopelikokoelma DVD\\Worms 2\\Worms 2\\Binaries\\landgen.exe:*:Disabled:landgen"
    "D:\\Klassikkopelikokoelma DVD\\Worms 2\\Worms 2\\worms2.exe"="D:\\Klassikkopelikokoelma DVD\\Worms 2\\Worms 2\\worms2.exe:*:Disabled:worms2"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "D:\\Program Files\\Logitech\\Harmony Remote\\HarmonyClient"="D:\\Program Files\\Logitech\\Harmony Remote\\HarmonyClient:*:Enabled:Logitech Harmony Remote Software V5"
    "D:\\Program Files\\Logitech\\Harmony Remote\\PatchHelper.exe"="D:\\Program Files\\Logitech\\Harmony Remote\\PatchHelper.exe:*:Enabled:Remote Control Software Patch Helper"
    "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
    "C:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"="C:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

    Remaining Files :


    File Backups: - D:\SDFix\backups\backups.zip

    Files with Hidden Attributes :

    Wed 22 Oct 2008 949,072 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\advcheck.dll"
    Mon 15 Sep 2008 1,562,960 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll"
    Thu 14 Aug 2008 1,429,840 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
    Wed 30 Jul 2008 4,891,984 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
    Tue 16 Sep 2008 1,833,296 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
    Wed 22 Oct 2008 962,896 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\Tools.dll"
    Sat 14 Aug 2004 2,045 ...H. --- "C:\WINDOWS\system32\whlpda32e.dll"
    Wed 11 Apr 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
    Sat 15 Mar 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
    Tue 3 Oct 2006 50,280 ...H. --- "C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe"
    Wed 28 Nov 2007 1,123,880 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\44e979936d19a4e833746e7d6f8e194d\BITBC4.tmp"

    Finished!

    Malwarebytes' Anti-Malware 1.31
    Tietokantaversio: 1494
    Windows 5.1.2600 Service Pack 3

    12.12.2008 23:22:36
    mbam-log-2008-12-12 (23-22-36).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|)
    Tarkistetut kohteet: 126181
    Kulunut aika: 28 minute(s), 38 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 0

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    (Haitallisia kohteita ei löydetty)
     
    Tigerishk, 13.12.2008
    #4
  6. Hujo

    Hujo Guest

    combofix loki
     
    Hujo, 13.12.2008
    #5
  7. Tigerishk

    Tigerishk Member

    Liittynyt:
    29.05.2008
    Viestejä:
    17
    Kiitokset:
    0
    Pisteet:
    11
    Nyt toimii taas. Kiitos :)
    Tässä kumminkin nämä lokit:


    SDFix: Version 1.240
    Run by Tigeri on pe 12.12.2008 at 21:42

    Microsoft Windows XP [versio 5.1.2600]
    Running From: D:\SDFix

    Checking Services :


    Restoring Default Security Values
    Restoring Default Hosts File

    Rebooting


    Checking Files :

    Trojan Files Found:

    C:\WINDOWS\SYSTEM32\FTPUPD.EXE - Deleted
    C:\WINDOWS\system32\TFTP2608 - Deleted





    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-12-12 21:49:23
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001583b3b80b]
    "0017b034997e"=hex:d5,04,be,7d,ee,b1,29,39,21,11,c2,f8,e1,33,eb,f2
    "00192d45d129"=hex:3a,4a,d8,8a,55,97,6c,ca,ec,6a,8e,dd,1d,68,9d,7f
    "001d6e8abbf5"=hex:a3,d4,b6,bb,dd,4d,ad,91,e8,98,fc,46,71,dd,19,65
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
    "s1"=dword:1ae35272
    "s2"=dword:1afaf623
    "h0"=dword:00000001

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "h0"=dword:00000000
    "khjeh"=hex:dd,33,0b,de,42,62,eb,a1,9c,31,e1,79,f3,a2,ea,01,81,13,11,be,45,..
    "p0"="C:\Program Files\DAEMON Tools Lite\"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "khjeh"=hex:eb,a0,29,fc,5c,3b,ba,ff,53,19,17,38,26,bc,c1,21,45,33,06,69,af,..
    "a0"=hex:20,01,00,00,9a,b8,16,74,02,5d,06,68,26,4c,9e,4e,aa,b4,03,eb,9c,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:62,38,44,e1,90,b3,3b,c6,19,22,c5,17,dc,ea,6e,e8,6a,ec,91,a2,af,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
    "khjeh"=hex:f5,d8,54,0f,0e,59,8c,41,bd,3f,13,56,26,35,55,92,d8,2f,b6,9f,7a,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="C:\Program Files\DAEMON Tools\"
    "h0"=dword:00000000
    "khjeh"=hex:6a,fa,88,2f,8e,43,75,a3,cc,e3,ce,85,fb,8f,f8,ce,85,66,e0,a6,72,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,e1,ac,5a,f9,0e,dd,63,85,41,fd,dc,ea,ff,e2,7e,bd,67,..
    "khjeh"=hex:89,bd,87,53,02,2b,fc,67,94,c6,8b,86,9e,cc,6a,a8,5c,ee,32,01,43,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:91,15,eb,b2,5c,c4,3b,3f,df,83,cc,9d,a8,76,3b,d9,00,0b,96,41,24,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001583b3b80b]
    "0017b034997e"=hex:d5,04,be,7d,ee,b1,29,39,21,11,c2,f8,e1,33,eb,f2
    "00192d45d129"=hex:3a,4a,d8,8a,55,97,6c,ca,ec,6a,8e,dd,1d,68,9d,7f
    "001d6e8abbf5"=hex:a3,d4,b6,bb,dd,4d,ad,91,e8,98,fc,46,71,dd,19,65
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "h0"=dword:00000000
    "khjeh"=hex:dd,33,0b,de,42,62,eb,a1,9c,31,e1,79,f3,a2,ea,01,81,13,11,be,45,..
    "p0"="C:\Program Files\DAEMON Tools Lite\"

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "khjeh"=hex:eb,a0,29,fc,5c,3b,ba,ff,53,19,17,38,26,bc,c1,21,45,33,06,69,af,..
    "a0"=hex:20,01,00,00,9a,b8,16,74,02,5d,06,68,26,4c,9e,4e,aa,b4,03,eb,9c,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:62,38,44,e1,90,b3,3b,c6,19,22,c5,17,dc,ea,6e,e8,6a,ec,91,a2,af,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
    "khjeh"=hex:f5,d8,54,0f,0e,59,8c,41,bd,3f,13,56,26,35,55,92,d8,2f,b6,9f,7a,..

    scanning hidden registry entries ...

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{7BC895DE-8AC5-C1CF-C72C-64EBC304AFB1}]
    "abmoomhegompcmdgkddbaohblhoogflidg"=hex:61,61,00,00
    "bbmoomhegompcmdgkdibheahmgemgpngdaoc"=hex:61,61,00,00

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0


    Remaining Services :




    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\Java\\jre1.5.0_04\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.5.0_04\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "D:\\Program Files\\Sony\\EverQuest II\\EQ2.exe"="D:\\Program Files\\Sony\\EverQuest II\\EQ2.exe:*:Enabled:EverQuest II"
    "D:\\Program Files\\Azureus\\Azureus.exe"="D:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus"
    "D:\\Program Files\\DC++\\DCPlusPlus.exe"="D:\\Program Files\\DC++\\DCPlusPlus.exe:*:Enabled:DC++"
    "C:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe"="C:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe:*:Enabled:LaunchPad"
    "C:\\Program Files\\Java\\jre1.5.0_06\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "C:\\WINDOWS\\system32\\rtcshare.exe"="C:\\WINDOWS\\system32\\rtcshare.exe:*:Enabled:RTC App Sharing"
    "C:\\Program Files\\NetMeeting\\conf.exe"="C:\\Program Files\\NetMeeting\\conf.exe:*:Enabled:Windows© NetMeeting©"
    "D:\\Program Files\\XiRCON\\Xircon.exe"="D:\\Program Files\\XiRCON\\Xircon.exe:*:Enabled:XiRCON IRC Client"
    "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
    "C:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe"="C:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe:*:Enabled:Et„tuki - Windows Messenger ja „„niyhteys"
    "C:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"="C:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7"
    "C:\\WINDOWS\\system32\\ftp.exe"="C:\\WINDOWS\\system32\\ftp.exe:*:Enabled:FTP-tiedostonsiirto-ohjelma"
    "D:\\Nettimittari_DNALS.exe"="D:\\Nettimittari_DNALS.exe:*:Enabled:Nettimittari_DNALS.exe"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
    "D:\\Klassikkopelikokoelma DVD\\Worms 2\\Worms 2\\frontend.exe"="D:\\Klassikkopelikokoelma DVD\\Worms 2\\Worms 2\\frontend.exe:*:Disabled:Worms 2 Frontend"
    "D:\\Klassikkopelikokoelma DVD\\Worms 2\\Worms 2\\Binaries\\landgen.exe"="D:\\Klassikkopelikokoelma DVD\\Worms 2\\Worms 2\\Binaries\\landgen.exe:*:Disabled:landgen"
    "D:\\Klassikkopelikokoelma DVD\\Worms 2\\Worms 2\\worms2.exe"="D:\\Klassikkopelikokoelma DVD\\Worms 2\\Worms 2\\worms2.exe:*:Disabled:worms2"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "D:\\Program Files\\Logitech\\Harmony Remote\\HarmonyClient"="D:\\Program Files\\Logitech\\Harmony Remote\\HarmonyClient:*:Enabled:Logitech Harmony Remote Software V5"
    "D:\\Program Files\\Logitech\\Harmony Remote\\PatchHelper.exe"="D:\\Program Files\\Logitech\\Harmony Remote\\PatchHelper.exe:*:Enabled:Remote Control Software Patch Helper"
    "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
    "C:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"="C:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

    Remaining Files :


    File Backups: - D:\SDFix\backups\backups.zip

    Files with Hidden Attributes :

    Wed 22 Oct 2008 949,072 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\advcheck.dll"
    Mon 15 Sep 2008 1,562,960 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll"
    Thu 14 Aug 2008 1,429,840 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
    Wed 30 Jul 2008 4,891,984 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
    Tue 16 Sep 2008 1,833,296 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
    Wed 22 Oct 2008 962,896 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\Tools.dll"
    Sat 14 Aug 2004 2,045 ...H. --- "C:\WINDOWS\system32\whlpda32e.dll"
    Wed 11 Apr 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
    Sat 15 Mar 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
    Tue 3 Oct 2006 50,280 ...H. --- "C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe"
    Wed 28 Nov 2007 1,123,880 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\44e979936d19a4e833746e7d6f8e194d\BITBC4.tmp"

    Finished!


    Malwarebytes' Anti-Malware 1.31
    Tietokantaversio: 1494
    Windows 5.1.2600 Service Pack 3

    12.12.2008 23:22:36
    mbam-log-2008-12-12 (23-22-36).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|)
    Tarkistetut kohteet: 126181
    Kulunut aika: 28 minute(s), 38 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 0

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    (Haitallisia kohteita ei löydetty)

    ComboFix 08-12-12.02 - Tigeri 2008-12-12 23:29:02.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1035.18.1023.557 [GMT 2:00]
    Sijainti: D:\ComboFix.exe
    * Uusi palautuspiste luotu

    VAROITUS - PALAUTUSKONSOLIA EI OLE ASENNETTU !!
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\system32\ntnet.drv

    .
    ((((((((((((((((((((((((((((((((((((((( Ajurit/Palvelut )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_WINDOWS_LSA_SERVICE


    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-11-12 to 2008-12-12 )))))))))))))))))
    .

    2008-12-12 21:52 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
    2008-12-12 21:52 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
    2008-12-12 21:42 . 2008-12-12 21:42 579,072 --a--c--- c:\windows\system32\dllcache\user32.dll
    2008-12-12 21:41 . 2008-12-12 21:41 <KANSIO> d-------- c:\windows\ERUNT
    2008-12-12 10:54 . 2008-12-12 10:56 1,393 --a------ c:\windows\imsins.BAK
    2008-12-10 19:31 . 2008-12-10 19:31 26,448 --ah----- c:\windows\system32\mlfcache.dat
    2008-12-10 19:30 . 2008-12-10 19:30 <KANSIO> d-------- c:\documents and settings\Tigeri\Application Data\Apple Computer
    2008-12-10 16:33 . 2008-12-10 16:33 <KANSIO> d-------- C:\fsaua.data
    2008-12-03 20:37 . 2008-12-03 20:37 268 --ah----- C:\sqmdata14.sqm
    2008-12-03 20:37 . 2008-12-03 20:37 244 --ah----- C:\sqmnoopt14.sqm
    2008-11-30 20:52 . 2008-11-30 20:53 <KANSIO> d-------- c:\documents and settings\Tigeri\Application Data\SPORE
    2008-11-21 21:55 . 2008-11-21 21:55 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\SupportSoft
    2008-11-21 21:48 . 2008-12-07 11:49 <KANSIO> d-------- c:\program files\Sonera
    2008-11-21 21:48 . 2008-11-21 21:48 <KANSIO> d-------- c:\program files\Common Files\SupportSoft
    2008-11-12 19:45 . 2008-09-04 19:16 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
    2008-11-12 19:45 . 2008-10-24 13:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-12-12 19:39 --------- d-----w c:\documents and settings\Tigeri\Application Data\Azureus
    2008-12-10 17:19 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2008-11-30 18:47 --------- d--h--w c:\program files\InstallShield Installation Information
    2008-11-20 08:40 --------- d-----w c:\program files\Spybot - Search & Destroy
    2008-11-10 10:41 --------- d-----w c:\program files\Nokia
    2008-11-10 10:41 --------- d-----w c:\program files\Common Files\PCSuite
    2008-11-10 10:39 --------- d-----w c:\documents and settings\All Users\Application Data\Installations
    2008-10-31 15:22 --------- d-----w c:\documents and settings\All Users\Application Data\Fallout3
    2008-10-31 15:20 --------- d-----w c:\program files\MSBuild
    2008-10-31 15:16 --------- d-----w c:\program files\Reference Assemblies
    2008-10-30 14:42 --------- d-----w c:\documents and settings\Tigeri\Application Data\ATI
    2008-10-30 14:42 --------- d-----w c:\documents and settings\All Users\Application Data\ATI
    2008-10-30 14:40 --------- d-----w c:\program files\ATI Technologies
    2008-10-30 14:34 --------- d-----w c:\program files\Radeon Omega Drivers
    2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
    2008-10-22 09:53 --------- d-----w c:\program files\Microsoft Silverlight
    2008-10-16 13:48 --------- d-----w c:\documents and settings\All Users\Application Data\Azureus
    2008-09-24 13:00 472,576 ----a-w c:\windows\Radeon Omega Drivers v4.8.442 Uninstall.exe
    2006-10-29 11:41 1 -c--a-w c:\documents and settings\Tigeri\SI.bin
    2005-12-07 13:48 20,328 -c--a-w c:\documents and settings\Tigeri\Application Data\GDIPFONTCACHEV1.DAT
    .

    ((((((((((((((((((((((((((((( snapshot@2008-05-30_ 8.22.22.09 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2008-05-02 13:44:42 83,968 ----a-w c:\windows\$hf_mig$\KB946648\SP3QFE\msgsc.dll
    + 2007-11-30 12:39:27 17,272 ----a-w c:\windows\$hf_mig$\KB946648\spmsg.dll
    + 2007-11-30 12:39:27 232,824 ----a-w c:\windows\$hf_mig$\KB946648\spuninst.exe
    + 2007-11-30 12:39:27 26,488 ----a-w c:\windows\$hf_mig$\KB946648\update\spcustom.dll
    + 2007-11-30 11:19:03 757,112 ----a-w c:\windows\$hf_mig$\KB946648\update\update.exe
    + 2007-11-30 12:39:28 392,056 ----a-w c:\windows\$hf_mig$\KB946648\update\updspapi.dll
    + 2008-04-21 06:30:44 3,088,384 -c--a-w c:\windows\$hf_mig$\KB950759\SP3QFE\mshtml.dll
    + 2008-04-21 06:30:45 666,624 -c--a-w c:\windows\$hf_mig$\KB950759\SP3QFE\wininet.dll
    + 2007-11-30 12:39:27 17,272 -c--a-w c:\windows\$hf_mig$\KB950759\spmsg.dll
    + 2007-11-30 12:39:27 232,824 -c--a-w c:\windows\$hf_mig$\KB950759\spuninst.exe
    + 2007-11-30 12:39:27 26,488 -c--a-w c:\windows\$hf_mig$\KB950759\update\spcustom.dll
    + 2007-11-30 12:39:27 757,112 -c--a-w c:\windows\$hf_mig$\KB950759\update\update.exe
    + 2007-11-30 12:39:28 392,056 -c--a-w c:\windows\$hf_mig$\KB950759\update\updspapi.dll
    + 2007-11-30 12:39:27 17,272 -c--a-w c:\windows\$hf_mig$\KB950760\spmsg.dll
    + 2007-11-30 12:39:27 232,824 -c--a-w c:\windows\$hf_mig$\KB950760\spuninst.exe
    + 2007-11-30 12:39:27 26,488 -c--a-w c:\windows\$hf_mig$\KB950760\update\spcustom.dll
    + 2007-11-30 12:39:27 757,112 -c--a-w c:\windows\$hf_mig$\KB950760\update\update.exe
    + 2007-11-30 12:39:28 392,056 -c--a-w c:\windows\$hf_mig$\KB950760\update\updspapi.dll
    + 2008-05-08 13:58:17 203,136 -c--a-w c:\windows\$hf_mig$\KB950762\SP3QFE\rmcast.sys
    + 2007-11-30 12:39:27 17,272 -c--a-w c:\windows\$hf_mig$\KB950762\spmsg.dll
    + 2007-11-30 12:39:27 232,824 -c--a-w c:\windows\$hf_mig$\KB950762\spuninst.exe
    + 2007-11-30 12:39:27 26,488 -c--a-w c:\windows\$hf_mig$\KB950762\update\spcustom.dll
    + 2007-11-30 12:39:27 757,112 -c--a-w c:\windows\$hf_mig$\KB950762\update\update.exe
    + 2007-11-30 12:39:28 392,056 -c--a-w c:\windows\$hf_mig$\KB950762\update\updspapi.dll
    + 2008-07-07 20:25:27 253,952 ----a-w c:\windows\$hf_mig$\KB950974\SP3QFE\es.dll
    + 2007-11-30 12:39:27 17,272 ----a-w c:\windows\$hf_mig$\KB950974\spmsg.dll
    + 2007-11-30 12:39:27 232,824 ----a-w c:\windows\$hf_mig$\KB950974\spuninst.exe
    + 2007-11-30 12:39:27 26,488 ----a-w c:\windows\$hf_mig$\KB950974\update\spcustom.dll
    + 2007-11-30 12:39:25 757,112 ----a-w c:\windows\$hf_mig$\KB950974\update\update.exe
    + 2007-11-30 12:39:25 392,056 ----a-w c:\windows\$hf_mig$\KB950974\update\updspapi.dll
    + 2008-04-11 21:23:30 691,712 ----a-w c:\windows\$hf_mig$\KB951066\SP3QFE\inetcomm.dll
    + 2007-11-30 12:39:27 17,272 ----a-w c:\windows\$hf_mig$\KB951066\spmsg.dll
    + 2007-11-30 12:39:27 232,824 ----a-w c:\windows\$hf_mig$\KB951066\spuninst.exe
    + 2007-11-30 12:39:27 26,488 ----a-w c:\windows\$hf_mig$\KB951066\update\spcustom.dll
    + 2007-12-03 15:25:38 757,112 ----a-w c:\windows\$hf_mig$\KB951066\update\update.exe
    + 2007-11-30 12:39:28 392,056 ----a-w c:\windows\$hf_mig$\KB951066\update\updspapi.dll
    + 2008-07-11 12:51:51 62,976 ----a-w c:\windows\$hf_mig$\KB951072-v2\SP3QFE\tzchange.exe
    + 2007-11-30 11:19:02 17,272 ----a-w c:\windows\$hf_mig$\KB951072-v2\spmsg.dll
    + 2007-11-30 11:19:02 232,824 ----a-w c:\windows\$hf_mig$\KB951072-v2\spuninst.exe
    + 2007-11-30 11:19:02 26,488 ----a-w c:\windows\$hf_mig$\KB951072-v2\update\spcustom.dll
    + 2007-11-30 12:39:27 757,112 ----a-w c:\windows\$hf_mig$\KB951072-v2\update\update.exe
    + 2007-11-30 12:39:28 392,056 ----a-w c:\windows\$hf_mig$\KB951072-v2\update\updspapi.dll
    + 2008-06-14 17:40:21 272,128 ----a-w c:\windows\$hf_mig$\KB951376-v2\SP3QFE\bthport.sys
    + 2007-11-30 11:19:02 17,272 ----a-w c:\windows\$hf_mig$\KB951376-v2\spmsg.dll
    + 2007-11-30 11:19:02 232,824 ----a-w c:\windows\$hf_mig$\KB951376-v2\spuninst.exe
    + 2007-11-30 11:19:02 26,488 ----a-w c:\windows\$hf_mig$\KB951376-v2\update\spcustom.dll
    + 2007-11-30 11:19:03 757,112 ----a-w c:\windows\$hf_mig$\KB951376-v2\update\update.exe
    + 2007-11-30 11:19:03 392,056 ----a-w c:\windows\$hf_mig$\KB951376-v2\update\updspapi.dll
    + 2008-04-14 16:22:36 272,128 -c--a-w c:\windows\$hf_mig$\KB951376\SP3QFE\bthport.sys
    + 2007-11-30 11:19:02 17,272 -c--a-w c:\windows\$hf_mig$\KB951376\spmsg.dll
    + 2007-11-30 11:19:02 232,824 -c--a-w c:\windows\$hf_mig$\KB951376\spuninst.exe
    + 2007-11-30 11:19:02 26,488 -c--a-w c:\windows\$hf_mig$\KB951376\update\spcustom.dll
    + 2007-11-30 11:19:03 757,112 -c--a-w c:\windows\$hf_mig$\KB951376\update\update.exe
    + 2007-11-30 11:19:03 392,056 -c--a-w c:\windows\$hf_mig$\KB951376\update\updspapi.dll
    + 2008-05-07 05:04:48 1,288,704 -c--a-w c:\windows\$hf_mig$\KB951698\SP3QFE\quartz.dll
    + 2007-11-30 11:19:02 17,272 -c--a-w c:\windows\$hf_mig$\KB951698\spmsg.dll
    + 2007-11-30 11:19:02 232,824 -c--a-w c:\windows\$hf_mig$\KB951698\spuninst.exe
    + 2007-11-30 11:19:02 26,488 -c--a-w c:\windows\$hf_mig$\KB951698\update\spcustom.dll
    + 2007-11-30 12:39:27 757,112 -c--a-w c:\windows\$hf_mig$\KB951698\update\update.exe
    + 2007-11-30 12:39:28 392,056 -c--a-w c:\windows\$hf_mig$\KB951698\update\updspapi.dll
    + 2008-06-20 11:48:03 138,496 ----a-w c:\windows\$hf_mig$\KB951748\SP3QFE\afd.sys
    + 2008-06-20 17:44:04 147,968 ----a-w c:\windows\$hf_mig$\KB951748\SP3QFE\dnsapi.dll
    + 2008-06-20 17:44:04 246,784 ----a-w c:\windows\$hf_mig$\KB951748\SP3QFE\mswsock.dll
    + 2008-06-20 11:59:02 361,600 ----a-w c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
    + 2008-06-20 11:16:44 225,856 ----a-w c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip6.sys
    + 2007-11-30 12:39:27 17,272 ----a-w c:\windows\$hf_mig$\KB951748\spmsg.dll
    + 2007-11-30 12:39:27 232,824 ----a-w c:\windows\$hf_mig$\KB951748\spuninst.exe
    + 2007-11-30 12:39:27 26,488 ----a-w c:\windows\$hf_mig$\KB951748\update\spcustom.dll
    + 2007-11-30 12:39:25 757,112 ----a-w c:\windows\$hf_mig$\KB951748\update\update.exe
    + 2007-11-30 12:39:25 392,056 ----a-w c:\windows\$hf_mig$\KB951748\update\updspapi.dll
    + 2008-05-07 09:07:23 135,168 ----a-w c:\windows\$hf_mig$\KB951978\SP3QFE\cscript.exe
    + 2008-05-09 10:51:53 512,000 ----a-w c:\windows\$hf_mig$\KB951978\SP3QFE\jscript.dll
    + 2008-05-09 10:51:53 180,224 ----a-w c:\windows\$hf_mig$\KB951978\SP3QFE\scrobj.dll
    + 2008-05-09 10:51:53 172,032 ----a-w c:\windows\$hf_mig$\KB951978\SP3QFE\scrrun.dll
    + 2008-05-09 10:51:53 430,080 ----a-w c:\windows\$hf_mig$\KB951978\SP3QFE\vbscript.dll
    + 2008-05-08 11:24:44 155,648 ----a-w c:\windows\$hf_mig$\KB951978\SP3QFE\wscript.exe
    + 2008-05-09 10:51:53 90,112 ----a-w c:\windows\$hf_mig$\KB951978\SP3QFE\wshext.dll
    + 2007-11-30 12:39:27 17,272 ----a-w c:\windows\$hf_mig$\KB951978\spmsg.dll
    + 2007-11-30 12:39:27 232,824 ----a-w c:\windows\$hf_mig$\KB951978\spuninst.exe
    + 2007-11-30 12:39:27 26,488 ----a-w c:\windows\$hf_mig$\KB951978\update\spcustom.dll
    + 2007-11-30 12:39:25 757,112 ----a-w c:\windows\$hf_mig$\KB951978\update\update.exe
    + 2007-11-30 12:39:25 392,056 ----a-w c:\windows\$hf_mig$\KB951978\update\updspapi.dll
    + 2008-05-01 14:39:32 331,776 ----a-w c:\windows\$hf_mig$\KB952287\SP3QFE\msadce.dll
    + 2007-11-30 11:19:02 17,272 ----a-w c:\windows\$hf_mig$\KB952287\spmsg.dll
    + 2007-11-30 11:19:02 232,824 ----a-w c:\windows\$hf_mig$\KB952287\spuninst.exe
    + 2007-11-30 11:19:02 26,488 ----a-w c:\windows\$hf_mig$\KB952287\update\spcustom.dll
    + 2007-11-30 11:19:03 757,112 ----a-w c:\windows\$hf_mig$\KB952287\update\update.exe
    + 2007-11-30 11:19:03 392,056 ----a-w c:\windows\$hf_mig$\KB952287\update\updspapi.dll
    + 2008-06-24 16:53:55 74,240 ----a-w c:\windows\$hf_mig$\KB952954\SP3QFE\mscms.dll
    + 2007-11-30 12:39:27 17,272 ----a-w c:\windows\$hf_mig$\KB952954\spmsg.dll
    + 2007-11-30 12:39:27 232,824 ----a-w c:\windows\$hf_mig$\KB952954\spuninst.exe
    + 2007-11-30 12:39:27 26,488 ----a-w c:\windows\$hf_mig$\KB952954\update\spcustom.dll
    + 2007-11-30 12:39:27 757,112 ----a-w c:\windows\$hf_mig$\KB952954\update\update.exe
    + 2007-11-30 12:39:28 392,056 ----a-w c:\windows\$hf_mig$\KB952954\update\updspapi.dll
    + 2008-06-25 04:27:00 3,088,896 ----a-w c:\windows\$hf_mig$\KB953838\SP3QFE\mshtml.dll
    + 2008-06-26 08:00:51 1,498,624 ----a-w c:\windows\$hf_mig$\KB953838\SP3QFE\shdocvw.dll
    + 2008-06-26 08:00:51 619,008 ----a-w c:\windows\$hf_mig$\KB953838\SP3QFE\urlmon.dll
    + 2008-06-23 14:56:58 666,624 ----a-w c:\windows\$hf_mig$\KB953838\SP3QFE\wininet.dll
    + 2007-11-30 12:39:27 17,272 ----a-w c:\windows\$hf_mig$\KB953838\spmsg.dll
    + 2007-11-30 12:39:27 232,824 ----a-w c:\windows\$hf_mig$\KB953838\spuninst.exe
    + 2007-11-30 12:39:27 26,488 ----a-w c:\windows\$hf_mig$\KB953838\update\spcustom.dll
    + 2007-11-30 12:39:25 757,112 ----a-w c:\windows\$hf_mig$\KB953838\update\update.exe
    + 2007-11-30 12:39:25 392,056 ----a-w c:\windows\$hf_mig$\KB953838\update\updspapi.dll
    + 2007-11-30 12:39:27 17,272 ----a-w c:\windows\$hf_mig$\KB953839\spmsg.dll
    + 2007-11-30 12:39:27 232,824 ----a-w c:\windows\$hf_mig$\KB953839\spuninst.exe
    + 2007-11-30 12:39:27 26,488 ----a-w c:\windows\$hf_mig$\KB953839\update\spcustom.dll
    + 2007-11-30 12:39:27 757,112 ----a-w c:\windows\$hf_mig$\KB953839\update\update.exe
    + 2007-11-30 12:39:28 392,056 ----a-w c:\windows\$hf_mig$\KB953839\update\updspapi.dll
    + 2008-09-15 15:21:09 1,847,168 ----a-w c:\windows\$hf_mig$\KB954211\SP3QFE\win32k.sys
    + 2007-11-30 12:39:27 17,272 ----a-w c:\windows\$hf_mig$\KB954211\spmsg.dll
    + 2007-11-30 12:39:27 232,824 ----a-w c:\windows\$hf_mig$\KB954211\spuninst.exe
    + 2007-11-30 12:39:27 26,488 ----a-w c:\windows\$hf_mig$\KB954211\update\spcustom.dll
    + 2008-07-09 07:39:53 757,112 ----a-w c:\windows\$hf_mig$\KB954211\update\update.exe
    + 2007-11-30 12:39:28 392,056 ----a-w c:\windows\$hf_mig$\KB954211\update\updspapi.dll
    + 2008-08-20 05:07:30 3,088,896 ----a-w c:\windows\$hf_mig$\KB956390\SP3QFE\mshtml.dll
    + 2008-08-20 05:07:25 1,498,624 ----a-w c:\windows\$hf_mig$\KB956390\SP3QFE\shdocvw.dll
    + 2008-08-20 05:07:27 619,520 ----a-w c:\windows\$hf_mig$\KB956390\SP3QFE\urlmon.dll
    + 2008-08-20 05:07:26 666,624 ----a-w c:\windows\$hf_mig$\KB956390\SP3QFE\wininet.dll
    + 2007-11-30 11:19:02 17,272 ----a-w c:\windows\$hf_mig$\KB956390\spmsg.dll
    + 2007-11-30 11:19:02 232,824 ----a-w c:\windows\$hf_mig$\KB956390\spuninst.exe
    + 2007-11-30 11:19:02 26,488 ----a-w c:\windows\$hf_mig$\KB956390\update\spcustom.dll
    + 2007-11-30 12:39:27 757,112 ----a-w c:\windows\$hf_mig$\KB956390\update\update.exe
    + 2007-11-30 12:39:28 392,056 ----a-w c:\windows\$hf_mig$\KB956390\update\updspapi.dll
    + 2007-11-30 12:39:27 17,272 ----a-w c:\windows\$hf_mig$\KB956391\spmsg.dll
    + 2007-11-30 12:39:27 232,824 ----a-w c:\windows\$hf_mig$\KB956391\spuninst.exe
    + 2007-11-30 12:39:27 26,488 ----a-w c:\windows\$hf_mig$\KB956391\update\spcustom.dll
    + 2007-11-30 12:39:27 757,112 ----a-w c:\windows\$hf_mig$\KB956391\update\update.exe
    + 2007-11-30 12:39:28 392,056 ----a-w c:\windows\$hf_mig$\KB956391\update\updspapi.dll
    + 2008-08-14 10:34:26 138,496 ----a-w c:\windows\$hf_mig$\KB956803\SP3QFE\afd.sys
    + 2007-11-30 11:19:02 17,272 ----a-w c:\windows\$hf_mig$\KB956803\spmsg.dll
    + 2007-11-30 11:19:02 232,824 ----a-w c:\windows\$hf_mig$\KB956803\spuninst.exe
    + 2007-11-30 11:19:02 26,488 ----a-w c:\windows\$hf_mig$\KB956803\update\spcustom.dll
    + 2007-11-30 11:19:03 757,112 ----a-w c:\windows\$hf_mig$\KB956803\update\update.exe
    + 2007-11-30 11:19:03 392,056 ----a-w c:\windows\$hf_mig$\KB956803\update\updspapi.dll
    + 2008-08-14 13:56:32 2,147,840 ----a-w c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlmp.exe
    + 2008-08-14 16:26:36 2,068,352 ----a-w c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe
    + 2008-08-14 13:56:31 2,026,496 ----a-w c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrpamp.exe
    + 2008-08-14 16:26:38 2,191,488 ----a-w c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe
    + 2007-11-30 11:19:02 17,272 ----a-w c:\windows\$hf_mig$\KB956841\spmsg.dll
    + 2007-11-30 11:19:02 232,824 ----a-w c:\windows\$hf_mig$\KB956841\spuninst.exe
    + 2007-11-30 11:19:02 26,488 ----a-w c:\windows\$hf_mig$\KB956841\update\spcustom.dll
    + 2007-11-30 12:39:27 757,112 ----a-w c:\windows\$hf_mig$\KB956841\update\update.exe
    + 2008-07-09 07:40:02 392,056 ----a-w c:\windows\$hf_mig$\KB956841\update\updspapi.dll
    + 2008-09-08 11:37:19 333,824 ----a-w c:\windows\$hf_mig$\KB957095\SP3QFE\srv.sys
    + 2007-11-30 11:19:02 17,272 ----a-w c:\windows\$hf_mig$\KB957095\spmsg.dll
    + 2007-11-30 11:19:02 232,824 ----a-w c:\windows\$hf_mig$\KB957095\spuninst.exe
    + 2007-11-30 11:19:02 26,488 ----a-w c:\windows\$hf_mig$\KB957095\update\spcustom.dll
    + 2007-11-30 11:19:03 757,112 ----a-w c:\windows\$hf_mig$\KB957095\update\update.exe
    + 2007-11-30 11:19:03 392,056 ----a-w c:\windows\$hf_mig$\KB957095\update\updspapi.dll
    + 2008-10-15 16:31:34 339,456 ----a-w c:\windows\$hf_mig$\KB958644\SP3QFE\netapi32.dll
    + 2007-11-30 11:19:02 17,272 ----a-w c:\windows\$hf_mig$\KB958644\spmsg.dll
    + 2007-11-30 11:19:02 232,824 ----a-w c:\windows\$hf_mig$\KB958644\spuninst.exe
    + 2007-11-30 11:19:02 26,488 ----a-w c:\windows\$hf_mig$\KB958644\update\spcustom.dll
    + 2007-11-30 11:19:03 757,112 ----a-w c:\windows\$hf_mig$\KB958644\update\update.exe
    + 2007-11-30 11:19:03 392,056 ----a-w c:\windows\$hf_mig$\KB958644\update\updspapi.dll
    + 2007-11-30 12:39:27 232,824 -c----w c:\windows\$NtUninstallKB938464$\spuninst\spuninst.exe
    + 2007-11-30 12:39:28 392,056 -c----w c:\windows\$NtUninstallKB938464$\spuninst\updspapi.dll
    + 2008-04-14 06:11:40 82,944 -c----w c:\windows\$NtUninstallKB946648$\msgsc.dll
    + 2007-11-30 12:39:27 232,824 -c----w c:\windows\$NtUninstallKB946648$\spuninst\spuninst.exe
    + 2007-11-30 12:39:28 392,056 -c----w c:\windows\$NtUninstallKB946648$\spuninst\updspapi.dll
    + 2008-04-14 06:11:40 3,066,880 -c----w c:\windows\$NtUninstallKB950759$\mshtml.dll
    + 2007-11-30 12:39:27 232,824 -c----w c:\windows\$NtUninstallKB950759$\spuninst\spuninst.exe
    + 2007-11-30 12:39:28 392,056 -c----w c:\windows\$NtUninstallKB950759$\spuninst\updspapi.dll
    + 2008-04-14 06:11:58 666,112 -c----w c:\windows\$NtUninstallKB950759$\wininet.dll
    + 2007-11-30 12:39:27 232,824 -c----w c:\windows\$NtUninstallKB950760$\spuninst\spuninst.exe
    + 2007-11-30 12:39:28 392,056 -c----w c:\windows\$NtUninstallKB950760$\spuninst\updspapi.dll
    + 2008-04-13 08:55:10 202,624 -c----w c:\windows\$NtUninstallKB950762$\rmcast.sys
    + 2007-11-30 12:39:27 232,824 -c----w c:\windows\$NtUninstallKB950762$\spuninst\spuninst.exe
    + 2007-11-30 12:39:28 392,056 -c----w c:\windows\$NtUninstallKB950762$\spuninst\updspapi.dll
    + 2008-04-14 06:11:36 246,272 -c----w c:\windows\$NtUninstallKB950974$\es.dll
    + 2007-11-30 12:39:27 232,824 -c----w c:\windows\$NtUninstallKB950974$\spuninst\spuninst.exe
    + 2007-11-30 12:39:25 392,056 -c----w c:\windows\$NtUninstallKB950974$\spuninst\updspapi.dll
    + 2008-04-14 06:11:38 691,712 -c----w c:\windows\$NtUninstallKB951066$\inetcomm.dll
    + 2007-11-30 12:39:27 232,824 -c----w c:\windows\$NtUninstallKB951066$\spuninst\spuninst.exe
    + 2007-11-30 12:39:28 392,056 -c----w c:\windows\$NtUninstallKB951066$\spuninst\updspapi.dll
    + 2007-11-30 11:19:02 232,824 -c----w c:\windows\$NtUninstallKB951072-v2$\spuninst\spuninst.exe
    + 2007-11-30 12:39:28 392,056 -c----w c:\windows\$NtUninstallKB951072-v2$\spuninst\updspapi.dll
    + 2008-04-14 06:12:32 60,416 -c----w c:\windows\$NtUninstallKB951072-v2$\tzchange.exe
    + 2008-04-14 15:59:41 272,128 -c----w c:\windows\$NtUninstallKB951376-v2$\bthport.sys
    + 2007-11-30 11:19:02 232,824 -c----w c:\windows\$NtUninstallKB951376-v2$\spuninst\spuninst.exe
    + 2007-11-30 11:19:03 392,056 -c----w c:\windows\$NtUninstallKB951376-v2$\spuninst\updspapi.dll
    + 2008-04-14 05:40:48 272,896 -c----w c:\windows\$NtUninstallKB951376$\bthport.sys
    + 2007-11-30 11:19:02 232,824 -c----w c:\windows\$NtUninstallKB951376$\spuninst\spuninst.exe
    + 2007-11-30 11:19:03 392,056 -c----w c:\windows\$NtUninstallKB951376$\spuninst\updspapi.dll
    + 2008-04-14 06:11:46 1,288,704 -c----w c:\windows\$NtUninstallKB951698$\quartz.dll
    + 2007-11-30 11:19:02 232,824 -c----w c:\windows\$NtUninstallKB951698$\spuninst\spuninst.exe
    + 2007-11-30 12:39:28 392,056 -c----w c:\windows\$NtUninstallKB951698$\spuninst\updspapi.dll
    + 2008-04-13 09:19:24 138,112 -c----w c:\windows\$NtUninstallKB951748$\afd.sys
    + 2008-04-14 06:11:34 147,968 -c----w c:\windows\$NtUninstallKB951748$\dnsapi.dll
    + 2008-04-14 06:11:44 246,784 -c----w c:\windows\$NtUninstallKB951748$\mswsock.dll
    + 2007-11-30 12:39:27 232,824 -c----w c:\windows\$NtUninstallKB951748$\spuninst\spuninst.exe
    + 2007-11-30 12:39:25 392,056 -c----w c:\windows\$NtUninstallKB951748$\spuninst\updspapi.dll
    + 2008-04-13 09:20:18 361,344 -c----w c:\windows\$NtUninstallKB951748$\tcpip.sys
    + 2008-04-13 09:00:04 225,664 -c----w c:\windows\$NtUninstallKB951748$\tcpip6.sys
    + 2008-04-14 06:12:08 139,264 -c----w c:\windows\$NtUninstallKB951978$\cscript.exe
    + 2008-04-14 06:11:38 512,000 -c----w c:\windows\$NtUninstallKB951978$\jscript.dll
    + 2008-04-14 06:11:46 180,224 -c----w c:\windows\$NtUninstallKB951978$\scrobj.dll
    + 2008-04-14 06:11:46 172,032 -c----w c:\windows\$NtUninstallKB951978$\scrrun.dll
    + 2007-11-30 12:39:27 232,824 -c----w c:\windows\$NtUninstallKB951978$\spuninst\spuninst.exe
    + 2007-11-30 12:39:25 392,056 -c----w c:\windows\$NtUninstallKB951978$\spuninst\updspapi.dll
    + 2008-04-14 06:11:56 434,176 -c----w c:\windows\$NtUninstallKB951978$\vbscript.dll
    + 2008-04-14 06:12:36 155,648 -c----w c:\windows\$NtUninstallKB951978$\wscript.exe
    + 2008-04-14 06:12:00 90,112 -c----w c:\windows\$NtUninstallKB951978$\wshext.dll
    + 2008-04-14 06:11:40 331,776 -c----w c:\windows\$NtUninstallKB952287$\msadce.dll
    + 2007-11-30 11:19:02 232,824 -c----w c:\windows\$NtUninstallKB952287$\spuninst\spuninst.exe
    + 2007-11-30 11:19:03 392,056 -c----w c:\windows\$NtUninstallKB952287$\spuninst\updspapi.dll
    + 2008-04-14 06:11:40 73,728 -c----w c:\windows\$NtUninstallKB952954$\mscms.dll
    + 2007-11-30 12:39:27 232,824 -c----w c:\windows\$NtUninstallKB952954$\spuninst\spuninst.exe
    + 2007-11-30 12:39:28 392,056 -c----w c:\windows\$NtUninstallKB952954$\spuninst\updspapi.dll
    + 2008-04-21 06:44:07 3,087,872 -c----w c:\windows\$NtUninstallKB953838$\mshtml.dll
    + 2008-04-14 06:11:46 1,498,624 -c----w c:\windows\$NtUninstallKB953838$\shdocvw.dll
    + 2007-11-30 12:39:27 232,824 -c----w c:\windows\$NtUninstallKB953838$\spuninst\spuninst.exe
    + 2007-11-30 12:39:25 392,056 -c----w c:\windows\$NtUninstallKB953838$\spuninst\updspapi.dll
    + 2008-04-14 06:11:56 620,032 -c----w c:\windows\$NtUninstallKB953838$\urlmon.dll
    + 2008-04-21 06:44:08 666,112 -c----w c:\windows\$NtUninstallKB953838$\wininet.dll
    + 2007-11-30 12:39:27 232,824 -c----w c:\windows\$NtUninstallKB953839$\spuninst\spuninst.exe
    + 2007-11-30 12:39:28 392,056 -c----w c:\windows\$NtUninstallKB953839$\spuninst\updspapi.dll
    + 2007-07-27 05:28:28 232,824 -c----w c:\windows\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe
    + 2007-07-27 07:41:48 382,840 -c----w c:\windows\$NtUninstallKB954154_WM11$\spuninst\updspapi.dll
    + 2006-10-18 19:47:20 295,936 -c----w c:\windows\$NtUninstallKB954154_WM11$\wmpeffects.dll
    + 2007-11-30 12:39:27 232,824 -c----w c:\windows\$NtUninstallKB954211$\spuninst\spuninst.exe
    + 2007-11-30 12:39:28 392,056 -c----w c:\windows\$NtUninstallKB954211$\spuninst\updspapi.dll
    + 2008-04-14 05:41:30 1,845,888 -c----w c:\windows\$NtUninstallKB954211$\win32k.sys
    + 2008-06-23 15:10:15 3,088,384 -c----w c:\windows\$NtUninstallKB956390$\mshtml.dll
    + 2008-06-26 08:14:07 1,498,624 -c----w c:\windows\$NtUninstallKB956390$\shdocvw.dll
    + 2007-11-30 11:19:02 232,824 -c----w c:\windows\$NtUninstallKB956390$\spuninst\spuninst.exe
    + 2007-11-30 12:39:28 392,056 -c----w c:\windows\$NtUninstallKB956390$\spuninst\updspapi.dll
    + 2008-06-26 08:14:07 619,008 -c----w c:\windows\$NtUninstallKB956390$\urlmon.dll
    + 2008-06-23 15:10:15 666,112 -c----w c:\windows\$NtUninstallKB956390$\wininet.dll
    + 2007-11-30 12:39:27 232,824 -c----w c:\windows\$NtUninstallKB956391$\spuninst\spuninst.exe
    + 2007-11-30 12:39:28 392,056 -c----w c:\windows\$NtUninstallKB956391$\spuninst\updspapi.dll
    + 2008-06-20 11:40:08 138,496 -c----w c:\windows\$NtUninstallKB956803$\afd.sys
    + 2007-11-30 11:19:02 232,824 -c----w c:\windows\$NtUninstallKB956803$\spuninst\spuninst.exe
    + 2007-11-30 11:19:03 392,056 -c----w c:\windows\$NtUninstallKB956803$\spuninst\updspapi.dll
    + 2008-04-14 05:49:32 2,068,224 -c----w c:\windows\$NtUninstallKB956841$\ntkrnlpa.exe
    + 2008-04-14 05:49:54 2,191,360 -c----w c:\windows\$NtUninstallKB956841$\ntoskrnl.exe
    + 2007-11-30 11:19:02 232,824 -c----w c:\windows\$NtUninstallKB956841$\spuninst\spuninst.exe
    + 2008-07-09 07:40:02 392,056 -c----w c:\windows\$NtUninstallKB956841$\spuninst\updspapi.dll
    + 2007-11-30 11:19:02 232,824 -c----w c:\windows\$NtUninstallKB957095$\spuninst\spuninst.exe
    + 2007-11-30 11:19:03 392,056 -c----w c:\windows\$NtUninstallKB957095$\spuninst\updspapi.dll
    + 2008-04-13 09:15:12 334,848 -c----w c:\windows\$NtUninstallKB957095$\srv.sys
    + 2008-04-14 06:11:44 337,408 -c----w c:\windows\$NtUninstallKB958644$\netapi32.dll
    + 2007-11-30 11:19:02 232,824 -c----w c:\windows\$NtUninstallKB958644$\spuninst\spuninst.exe
    + 2007-11-30 11:19:03 392,056 -c----w c:\windows\$NtUninstallKB958644$\spuninst\updspapi.dll
    + 2008-10-30 14:40:42 135,168 ----a-w c:\windows\assembly\GAC\AxInterop.MSComctlLib\2.0.0.0__90ba9c70f846762e\AxInterop.MSComctlLib.DLL
    + 2008-10-30 14:40:42 212,992 ----a-w c:\windows\assembly\GAC\AxInterop.MSForms\2.0.0.0__90ba9c70f846762e\AxInterop.MSForms.DLL
    + 2008-10-30 14:40:38 143,360 ----a-w c:\windows\assembly\GAC\ICSharpCode.SharpZipLib\0.84.0.0__1b03e6acf1164f73\ICSharpCode.SharpZipLib.DLL
    + 2008-10-30 14:40:42 225,280 ----a-w c:\windows\assembly\GAC\Interop.MSComctlLib\2.0.0.0__90ba9c70f846762e\Interop.MSComctlLib.DLL
    + 2008-10-30 14:40:42 360,448 ----a-w c:\windows\assembly\GAC\Interop.MSForms\2.0.0.0__90ba9c70f846762e\Interop.MSForms.DLL
    + 2008-10-30 14:40:42 49,152 ----a-w c:\windows\assembly\GAC\Interop.NewIWshRuntimeLibrary\1.0.0.0__90ba9c70f846762e\Interop.NewIWshRuntimeLibrary.DLL
    + 2008-10-30 14:40:38 13,312 ----a-w c:\windows\assembly\GAC\Interop.WBOCXLib\1.0.0.0__90ba9c70f846762e\Interop.WBOCXLib.DLL
    - 2007-04-24 06:44:50 53,248 -c--a-w c:\windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
    + 2008-10-31 15:21:55 53,248 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
    - 2007-04-24 06:44:50 12,800 -c--a-w c:\windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
    + 2008-10-31 15:21:55 12,800 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
    - 2007-04-24 06:44:50 473,600 -c--a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
    + 2008-10-31 15:21:55 473,600 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
    + 2008-10-31 15:21:49 2,676,224 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2008-10-31 15:21:50 2,846,720 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2008-10-31 15:21:51 563,712 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    - 2006-06-05 20:54:17 567,296 -c--a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2008-10-31 15:21:51 567,296 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    - 2006-08-15 13:53:22 576,000 -c--a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2008-10-31 15:21:52 576,000 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    - 2007-04-24 06:44:50 577,024 -c--a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2008-10-31 15:21:52 577,024 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2008-10-31 15:21:53 577,536 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2008-10-31 15:21:53 577,536 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2008-10-31 15:21:53 578,560 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2008-10-31 15:21:55 578,560 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    - 2007-04-24 06:44:51 145,920 -c--a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
    + 2008-10-31 15:21:56 145,920 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
    - 2007-04-24 06:44:51 159,232 -c--a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
    + 2008-10-31 15:21:56 159,232 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
    - 2007-04-24 06:44:51 364,544 -c--a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
    + 2008-10-31 15:21:56 364,544 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
    - 2007-04-24 06:44:51 178,176 -c--a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
    + 2008-10-31 15:21:56 178,176 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
    - 2007-04-24 06:44:50 223,232 -c--a-w c:\windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
    + 2008-10-31 15:21:54 223,232 ----a-w c:\windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
    + 2008-10-31 15:16:57 151,552 ----a-w c:\windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll
    + 2008-10-31 15:17:19 3,915,776 ----a-w c:\windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.dll
    + 2008-10-31 15:17:21 344,064 ----a-w c:\windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\System.Printing.dll
    + 2008-10-30 14:40:38 24,576 ----a-w c:\windows\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.DLL
    + 2008-10-30 14:40:42 20,480 ----a-w c:\windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3156.17689__90ba9c70f846762e\AEM.Actions.CCAA.Shared.DLL
    + 2008-10-30 14:40:42 16,384 ----a-w c:\windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3156.17721__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.DLL
    + 2008-10-30 14:40:42 16,384 ----a-w c:\windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.3156.17701__90ba9c70f846762e\AEM.Plugin.EEU.Shared.DLL
    + 2008-10-30 14:40:42 16,384 ----a-w c:\windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3156.17722__90ba9c70f846762e\AEM.Plugin.GD.Shared.DLL
    + 2008-10-30 14:40:42 20,480 ----a-w c:\windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3156.17694__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.DLL
    + 2008-10-30 14:40:42 16,384 ----a-w c:\windows\assembly\GAC_MSIL\AEM.Plugin.REG.Shared\2.0.3156.17716__90ba9c70f846762e\AEM.Plugin.REG.Shared.DLL
    + 2008-10-30 14:40:42 16,384 ----a-w c:\windows\assembly\GAC_MSIL\AEM.Plugin.Source.EEU.Shared\2.0.3156.17720__90ba9c70f846762e\AEM.Plugin.Source.EEU.Shared.DLL
    + 2008-10-30 14:40:42 16,384 ----a-w c:\windows\assembly\GAC_MSIL\AEM.Plugin.Source.GD.Shared\2.0.3156.17720__90ba9c70f846762e\AEM.Plugin.Source.GD.Shared.DLL
    + 2008-10-30 14:40:38 45,056 ----a-w c:\windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3188.37126__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.DLL
    + 2008-10-30 14:40:42 16,384 ----a-w c:\windows\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3156.17698__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.DLL
    + 2008-10-30 14:40:38 16,384 ----a-w c:\windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3156.17695__90ba9c70f846762e\AEM.Server.Shared.DLL
    + 2008-10-30 14:40:33 45,056 ----a-w c:\windows\assembly\GAC_MSIL\AEM.Server\2.0.3188.36934__90ba9c70f846762e\AEM.Server.DLL
    + 2008-10-30 14:40:39 20,480 ----a-w c:\windows\assembly\GAC_MSIL\AEM.UI.Shared\2.0.3156.17716__90ba9c70f846762e\AEM.UI.Shared.DLL
    + 2008-10-30 14:40:33 61,440 ----a-w c:\windows\assembly\GAC_MSIL\AEM.UI\2.0.3188.37097__90ba9c70f846762e\AEM.UI.DLL
    + 2008-10-30 14:40:39 20,480 ----a-w c:\windows\assembly\GAC_MSIL\APM.Foundation\2.0.3156.17700__90ba9c70f846762e\APM.Foundation.DLL
    + 2008-10-30 14:40:33 57,344 ----a-w c:\windows\assembly\GAC_MSIL\APM.Server\2.0.3188.36935__90ba9c70f846762e\APM.Server.DLL
    + 2008-10-30 14:40:33 32,768 ----a-w c:\windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.DLL
    + 2008-10-30 14:40:33 69,632 ----a-w c:\windows\assembly\GAC_MSIL\ATIDEMOS\2.0.3188.36937__90ba9c70f846762e\ATIDEMOS.DLL
    + 2008-10-30 14:40:42 6,656 ----a-w c:\windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.DLL
    + 2008-10-30 14:40:42 45,056 ----a-w c:\windows\assembly\GAC_MSIL\AxInterop.SHDocVw\1.1.0.0__90ba9c70f846762e\AxInterop.SHDocVw.DLL
    + 2008-10-30 14:40:38 14,848 ----a-w c:\windows\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.DLL
    + 2008-10-30 14:40:33 28,672 ----a-w c:\windows\assembly\GAC_MSIL\CCC.Implementation\2.0.3188.37098__90ba9c70f846762e\CCC.Implementation.DLL
    + 2008-10-30 14:40:41 49,152 ----a-w c:\windows\assembly\GAC_MSIL\CCC\2.0.0.0__90ba9c70f846762e\CCC.EXE
    + 2008-10-30 14:40:32 262,144 ----a-w c:\windows\assembly\GAC_MSIL\CLI.AIB.TutorialInfoCentre.Tutorial.Dashboard\1.2.2600.29179__90ba9c70f846762e\CLI.AIB.TutorialInfoCentre.Tutorial.Dashboard.DLL
    + 2008-10-30 14:40:42 90,112 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.AForce.Graphics.Dashboard\2.0.3188.37125__90ba9c70f846762e\CLI.Aspect.AForce.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:42 12,288 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.AForce.Graphics.Runtime\2.0.3188.37124__90ba9c70f846762e\CLI.Aspect.AForce.Graphics.Runtime.DLL
    + 2008-10-30 14:40:39 20,480 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.AForce.Graphics.Shared\2.0.3156.17721__90ba9c70f846762e\CLI.Aspect.AForce.Graphics.Shared.DLL
    + 2008-10-30 14:40:39 28,672 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.3156.17702__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.DLL
    + 2008-10-30 14:40:34 20,480 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormatSelection.Graphics.Dashboard.Shared.Private\2.0.3156.17718__90ba9c70f846762e\CLI.Aspect.CustomFormatSelection.Graphics.Dashboard.Shared.Private.DLL
    + 2008-10-30 14:40:42 98,304 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormatSelection.Graphics.Dashboard\2.0.3188.37006__90ba9c70f846762e\CLI.Aspect.CustomFormatSelection.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:42 438,272 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3188.37020__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:42 40,960 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3188.37021__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.DLL
    + 2008-10-30 14:40:39 53,248 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.3156.17708__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.DLL
    + 2008-10-30 14:40:42 675,840 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Dashboard\2.0.3188.37047__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:46 69,632 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3188.37045__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.DLL
    + 2008-10-30 14:40:39 40,960 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.3156.17710__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.DLL
    + 2008-10-30 14:40:46 692,224 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Wizard\2.0.3188.37062__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Wizard.DLL
    + 2008-10-30 14:40:43 450,560 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.3188.37013__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:43 61,440 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3188.37019__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.DLL
    + 2008-10-30 14:40:39 49,152 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.3156.17707__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.DLL
    + 2008-10-30 14:40:43 401,408 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Dashboard\2.0.3188.37042__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:43 32,768 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3188.37041__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.DLL
    + 2008-10-30 14:40:39 28,672 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.3156.17704__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.DLL
    + 2008-10-30 14:40:43 307,200 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Wizard\2.0.3188.36972__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Wizard.DLL
    + 2008-10-30 14:40:43 286,720 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Dashboard.Shared\2.0.3188.37007__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Dashboard.Shared.DLL
    + 2008-10-30 14:40:46 36,864 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3188.37018__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.DLL
    + 2008-10-30 14:40:39 32,768 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.3156.17701__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.DLL
    + 2008-10-30 14:40:43 798,720 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Dashboard\2.0.3188.37078__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:46 77,824 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3188.37076__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.DLL
    + 2008-10-30 14:40:39 65,536 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.3156.17710__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.DLL
    + 2008-10-30 14:40:46 364,544 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Wizard\2.0.3188.37084__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Wizard.DLL
    + 2008-10-30 14:40:43 589,824 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.3188.36966__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:43 40,960 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.3188.36971__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.DLL
    + 2008-10-30 14:40:39 28,672 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.3156.17706__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.DLL
    + 2008-10-30 14:40:43 442,368 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.3188.36951__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:46 1,691,648 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.3188.36961__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.DLL
    + 2008-10-30 14:40:43 122,880 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.3188.37039__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:43 36,864 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.3188.37038__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.DLL
    + 2008-10-30 14:40:39 24,576 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.3156.17709__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.DLL
    + 2008-10-30 14:40:47 20,480 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3188.36949__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.DLL
    + 2008-10-30 14:40:40 20,480 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.3156.17704__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.DLL
    + 2008-10-30 14:40:43 225,280 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3188.36965__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:47 204,800 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3188.36964__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.DLL
    + 2008-10-30 14:40:44 245,760 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.IntegratedUMAFrameBuffer.Graphics.Dashboard\2.0.3188.36977__90ba9c70f846762e\CLI.Aspect.IntegratedUMAFrameBuffer.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:44 20,480 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.IntegratedUMAFrameBuffer.Graphics.Runtime\2.0.3188.36978__90ba9c70f846762e\CLI.Aspect.IntegratedUMAFrameBuffer.Graphics.Runtime.DLL
    + 2008-10-30 14:40:40 20,480 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.IntegratedUMAFrameBuffer.Graphics.Shared\2.0.3156.17706__90ba9c70f846762e\CLI.Aspect.IntegratedUMAFrameBuffer.Graphics.Shared.DLL
    + 2008-10-30 14:40:44 811,008 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.3188.37023__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:44 77,824 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.3188.37021__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.DLL
    + 2008-10-30 14:40:40 53,248 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.3156.17708__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.DLL
    + 2008-10-30 14:40:44 405,504 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.3188.37067__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.DLL
    + 2008-10-30 14:40:44 204,800 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU.Graphics.Dashboard\2.0.3188.37026__90ba9c70f846762e\CLI.Aspect.MultiVPU.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:44 40,960 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU.Graphics.Runtime\2.0.3188.37024__90ba9c70f846762e\CLI.Aspect.MultiVPU.Graphics.Runtime.DLL
    + 2008-10-30 14:40:40 24,576 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU.Graphics.Shared\2.0.3156.17707__90ba9c70f846762e\CLI.Aspect.MultiVPU.Graphics.Shared.DLL
    + 2008-10-30 14:40:44 204,800 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU2.Graphics.Dashboard\2.0.3188.37033__90ba9c70f846762e\CLI.Aspect.MultiVPU2.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:44 40,960 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU2.Graphics.Runtime\2.0.3188.37031__90ba9c70f846762e\CLI.Aspect.MultiVPU2.Graphics.Runtime.DLL
    + 2008-10-30 14:40:40 24,576 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU2.Graphics.Shared\2.0.3156.17708__90ba9c70f846762e\CLI.Aspect.MultiVPU2.Graphics.Shared.DLL
    + 2008-10-30 14:40:44 208,896 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU3.Graphics.Dashboard\2.0.3188.37102__90ba9c70f846762e\CLI.Aspect.MultiVPU3.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:44 45,056 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU3.Graphics.Runtime\2.0.3188.37099__90ba9c70f846762e\CLI.Aspect.MultiVPU3.Graphics.Runtime.DLL
    + 2008-10-30 14:40:40 24,576 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU3.Graphics.Shared\2.0.3156.17717__90ba9c70f846762e\CLI.Aspect.MultiVPU3.Graphics.Shared.DLL
    + 2008-10-30 14:40:44 151,552 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU4.Graphics.Dashboard\2.0.3188.37143__90ba9c70f846762e\CLI.Aspect.MultiVPU4.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:44 40,960 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU4.Graphics.Runtime\2.0.3188.37141__90ba9c70f846762e\CLI.Aspect.MultiVPU4.Graphics.Runtime.DLL
    + 2008-10-30 14:40:40 28,672 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU4.Graphics.Shared\2.0.3156.17707__90ba9c70f846762e\CLI.Aspect.MultiVPU4.Graphics.Shared.DLL
    + 2008-10-30 14:40:44 479,232 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive2.Graphics.Dashboard\2.0.3188.36980__90ba9c70f846762e\CLI.Aspect.OverDrive2.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:44 28,672 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive2.Graphics.Runtime\2.0.3188.36979__90ba9c70f846762e\CLI.Aspect.OverDrive2.Graphics.Runtime.DLL
    + 2008-10-30 14:40:40 24,576 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive2.Graphics.Shared\2.0.3156.17707__90ba9c70f846762e\CLI.Aspect.OverDrive2.Graphics.Shared.DLL
    + 2008-10-30 14:40:45 1,032,192 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive3.Graphics.Dashboard\2.0.3188.36994__90ba9c70f846762e\CLI.Aspect.OverDrive3.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:45 65,536 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive3.Graphics.Runtime\2.0.3188.36986__90ba9c70f846762e\CLI.Aspect.OverDrive3.Graphics.Runtime.DLL
    + 2008-10-30 14:40:40 24,576 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive3.Graphics.Shared\2.0.3156.17707__90ba9c70f846762e\CLI.Aspect.OverDrive3.Graphics.Shared.DLL
    + 2008-10-30 14:40:45 671,744 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Dashboard\2.0.3188.37134__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:45 77,824 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Runtime\2.0.3188.37133__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Runtime.DLL
    + 2008-10-30 14:40:40 61,440 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Shared\2.0.3156.17721__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Shared.DLL
    + 2008-10-30 14:40:45 172,032 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlay3.Graphics.Dashboard\2.0.3188.37043__90ba9c70f846762e\CLI.Aspect.PowerPlay3.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:45 49,152 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlay3.Graphics.Runtime\2.0.3188.37044__90ba9c70f846762e\CLI.Aspect.PowerPlay3.Graphics.Runtime.DLL
    + 2008-10-30 14:40:40 28,672 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlay3.Graphics.Shared\2.0.3156.17709__90ba9c70f846762e\CLI.Aspect.PowerPlay3.Graphics.Shared.DLL
    + 2008-10-30 14:40:45 147,456 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlay4.Graphics.Dashboard\2.0.3188.37116__90ba9c70f846762e\CLI.Aspect.PowerPlay4.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:45 45,056 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlay4.Graphics.Runtime\2.0.3188.37115__90ba9c70f846762e\CLI.Aspect.PowerPlay4.Graphics.Runtime.DLL
    + 2008-10-30 14:40:40 28,672 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlay4.Graphics.Shared\2.0.3156.17719__90ba9c70f846762e\CLI.Aspect.PowerPlay4.Graphics.Shared.DLL
    + 2008-10-30 14:40:45 147,456 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard\2.0.3188.37108__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:45 45,056 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime\2.0.3188.37107__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime.DLL
    + 2008-10-30 14:40:40 28,672 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Shared\2.0.3156.17718__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Shared.DLL
    + 2008-10-30 14:40:45 172,032 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.PowerXpress.Graphics.Dashboard\2.0.3188.37131__90ba9c70f846762e\CLI.Aspect.PowerXpress.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:45 28,672 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.PowerXpress.Graphics.Runtime\2.0.3188.37132__90ba9c70f846762e\CLI.Aspect.PowerXpress.Graphics.Runtime.DLL
    + 2008-10-30 14:40:40 24,576 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.PowerXpress.Graphics.Shared\2.0.3156.17722__90ba9c70f846762e\CLI.Aspect.PowerXpress.Graphics.Shared.DLL
    + 2008-10-30 14:40:45 356,352 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.3188.37054__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:45 61,440 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.3188.37053__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.DLL
    + 2008-10-30 14:40:41 53,248 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.3156.17710__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.DLL
    + 2008-10-30 14:40:45 90,112 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3188.37055__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.DLL
    + 2008-10-30 14:40:45 286,720 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.SmartGart.Graphics.Dashboard\2.0.3188.36976__90ba9c70f846762e\CLI.Aspect.SmartGart.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:45 28,672 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.SmartGart.Graphics.Runtime\2.0.3188.36977__90ba9c70f846762e\CLI.Aspect.SmartGart.Graphics.Runtime.DLL
    + 2008-10-30 14:40:41 24,576 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.SmartGart.Graphics.Shared\2.0.3156.17706__90ba9c70f846762e\CLI.Aspect.SmartGart.Graphics.Shared.DLL
    + 2008-10-30 14:40:41 40,960 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.3156.17718__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.DLL
    + 2008-10-30 14:40:46 483,328 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3188.37109__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.DLL
    + 2008-10-30 14:40:46 135,168 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3188.37111__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:46 167,936 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.VeryLargeDesktop.Graphics.Dashboard\2.0.3188.37041__90ba9c70f846762e\CLI.Aspect.VeryLargeDesktop.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:46 32,768 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.VeryLargeDesktop.Graphics.Runtime\2.0.3188.37040__90ba9c70f846762e\CLI.Aspect.VeryLargeDesktop.Graphics.Runtime.DLL
    + 2008-10-30 14:40:41 24,576 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.VeryLargeDesktop.Graphics.Shared\2.0.3156.17709__90ba9c70f846762e\CLI.Aspect.VeryLargeDesktop.Graphics.Shared.DLL
    + 2008-10-30 14:40:46 98,304 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.WorkstationConfig2.Graphics.Dashboard\2.0.3188.37144__90ba9c70f846762e\CLI.Aspect.WorkstationConfig2.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:46 28,672 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.WorkstationConfig2.Graphics.Runtime\2.0.3188.37145__90ba9c70f846762e\CLI.Aspect.WorkstationConfig2.Graphics.Runtime.DLL
    + 2008-10-30 14:40:41 20,480 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.WorkstationConfig2.Graphics.Shared\2.0.3156.17705__90ba9c70f846762e\CLI.Aspect.WorkstationConfig2.Graphics.Shared.DLL
    + 2008-10-30 14:40:46 106,496 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.VPURecover.Graphics.Dashboard\2.0.3188.36962__90ba9c70f846762e\CLI.Aspect.VPURecover.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:46 28,672 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.VPURecover.Graphics.Runtime\2.0.3188.36962__90ba9c70f846762e\CLI.Aspect.VPURecover.Graphics.Runtime.DLL
    + 2008-10-30 14:40:41 20,480 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Aspect.VPURecover.Graphics.Shared\2.0.3156.17706__90ba9c70f846762e\CLI.Aspect.VPURecover.Graphics.Shared.DLL
    + 2008-10-30 14:40:41 16,384 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.3156.17704__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.DLL
    + 2008-10-30 14:40:46 73,728 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3188.36948__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.DLL
    + 2008-10-30 14:40:34 20,480 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.3156.17711__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.DLL
    + 2008-10-30 14:40:47 266,240 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3188.36940__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.DLL
    + 2008-10-30 14:40:41 53,248 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3156.17695__90ba9c70f846762e\CLI.Caste.Graphics.Shared.DLL
    + 2008-10-30 14:40:41 16,384 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.3156.17706__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.DLL
    + 2008-10-30 14:40:47 40,960 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3188.36957__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.DLL
    + 2008-10-30 14:40:34 24,576 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.AutoRemoval\2.0.3188.37075__90ba9c70f846762e\CLI.Component.Autoremoval.DLL
    + 2008-10-30 14:40:34 40,960 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3156.17692__90ba9c70f846762e\CLI.Component.Client.Shared.Private.DLL
    + 2008-10-30 14:40:41 20,480 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3156.17689__90ba9c70f846762e\CLI.Component.Client.Shared.DLL
    + 2008-10-30 14:40:35 65,536 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.Dashboard.HotKeyManager.Resources\2.0.3188.37000__90ba9c70f846762e\CLI.Component.Dashboard.HotKeyManager.Resources.DLL
    + 2008-10-30 14:40:34 147,456 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.Dashboard.HotKeyManager\2.0.3188.37000__90ba9c70f846762e\CLI.Component.Dashboard.HotKeyManager.DLL
    + 2008-10-30 14:40:35 65,536 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.Dashboard.ProfileManager.Resources\2.0.3188.37005__90ba9c70f846762e\CLI.Component.Dashboard.ProfileManager.Resources.DLL
    + 2008-10-30 14:40:35 208,896 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.Dashboard.ProfileManager\2.0.3188.37001__90ba9c70f846762e\CLI.Component.Dashboard.ProfileManager.DLL
    + 2008-10-30 14:40:35 20,480 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3156.17702__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.DLL
    + 2008-10-30 14:40:41 20,480 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3156.17695__90ba9c70f846762e\CLI.Component.Dashboard.Shared.DLL
    + 2008-10-30 14:40:34 1,032,192 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3188.36945__90ba9c70f846762e\CLI.Component.Dashboard.DLL
    + 2008-10-30 14:40:35 704,512 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.Eeu\2.0.3188.37070__90ba9c70f846762e\CLI.Component.Eeu.DLL
    + 2008-10-30 14:40:35 61,440 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.Erecord\2.0.3188.36985__90ba9c70f846762e\CLI.Component.Erecord.DLL
    + 2008-10-30 14:40:36 20,480 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.Help\2.0.3188.37094__90ba9c70f846762e\CLI.Component.Help.DLL
    + 2008-10-30 14:40:36 20,480 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.Icomponent\2.0.3188.36963__90ba9c70f846762e\CLI.Component.Icomponent.DLL
    + 2008-10-30 14:40:36 258,048 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.Launchpad\2.0.3188.37132__90ba9c70f846762e\CLI.Component.Launchpad.DLL
    + 2008-10-30 14:40:36 20,480 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.Load\2.0.3188.37095__90ba9c70f846762e\CLI.Component.Load.DLL
    + 2008-10-30 14:40:46 122,880 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.PowerXpressHybrid\2.0.3188.37151__90ba9c70f846762e\CLI.Component.PowerXpressHybrid.DLL
    + 2008-10-30 14:40:38 7,168 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3188.36933__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.DLL
    + 2008-10-30 14:40:36 45,056 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3156.17698__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.DLL
    + 2008-10-30 14:40:41 16,384 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3156.17694__90ba9c70f846762e\CLI.Component.Runtime.Shared.DLL
    + 2008-10-30 14:40:36 65,536 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3188.36936__90ba9c70f846762e\CLI.Component.Runtime.DLL
    + 2008-10-30 14:40:36 53,248 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3188.36938__90ba9c70f846762e\CLI.Component.SkinFactory.DLL
    + 2008-10-30 14:40:36 483,328 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3188.37089__90ba9c70f846762e\CLI.Component.Systemtray.DLL
    + 2008-10-30 14:40:36 24,576 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3156.17698__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.DLL
    + 2008-10-30 14:40:41 20,480 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3156.17697__90ba9c70f846762e\CLI.Component.Wizard.Shared.DLL
    + 2008-10-30 14:40:36 397,312 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3188.36956__90ba9c70f846762e\CLI.Component.Wizard.DLL
    + 2008-10-30 14:40:37 40,960 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3156.17686__90ba9c70f846762e\CLI.Foundation.Private.DLL
    + 2008-10-30 14:40:41 28,672 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3156.17747__90ba9c70f846762e\CLI.Foundation.XManifest.DLL
    + 2008-10-30 14:40:41 57,344 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Foundation\2.0.3156.17682__90ba9c70f846762e\CLI.Foundation.DLL
    + 2008-10-30 14:40:37 20,480 ----a-w c:\windows\assembly\GAC_MSIL\CLI.Implementation\2.0.3188.36932__90ba9c70f846762e\CLI.Implementation.DLL
    + 2008-10-30 14:40:41 49,152 ----a-w c:\windows\assembly\GAC_MSIL\CLI\2.0.0.0__90ba9c70f846762e\CLI.EXE
    + 2008-10-30 14:40:41 16,384 ----a-w c:\windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.DLL
    + 2008-10-30 14:40:41 45,056 ----a-w c:\windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.DLL
    + 2008-10-30 14:40:41 16,384 ----a-w c:\windows\assembly\GAC_MSIL\DEM.Graphics.I0702\2.0.2594.25693__90ba9c70f846762e\DEM.Graphics.I0702.DLL
    + 2008-10-30 14:40:41 20,480 ----a-w c:\windows\assembly\GAC_MSIL\DEM.Graphics.I0703\2.0.2651.18802__90ba9c70f846762e\DEM.Graphics.I0703.DLL
    + 2008-10-30 14:40:41 16,384 ----a-w c:\windows\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.DLL
    + 2008-10-30 14:40:41 16,384 ----a-w c:\windows\assembly\GAC_MSIL\DEM.Graphics\2.0.3156.17703__90ba9c70f846762e\DEM.Graphics.DLL
    + 2008-10-30 14:40:41 20,480 ----a-w c:\windows\assembly\GAC_MSIL\DEM.OS.I0602\2.0.3156.17703__90ba9c70f846762e\DEM.OS.I0602.DLL
    + 2008-10-30 14:40:41 16,384 ----a-w c:\windows\assembly\GAC_MSIL\DEM.OS\2.0.3156.17703__90ba9c70f846762e\DEM.OS.DLL
    + 2008-10-30 14:40:42 131,072 ----a-w c:\windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__90ba9c70f846762e\Interop.SHDocVw.DLL
    + 2008-10-30 14:40:38 11,264 ----a-w c:\windows\assembly\GAC_MSIL\LOCALIZATION.Foundation.Implementation\2.0.3188.37139__90ba9c70f846762e\LOCALIZATION.Foundation.Implementation.DLL
    + 2008-10-30 14:40:37 16,384 ----a-w c:\windows\assembly\GAC_MSIL\LOCALIZATION.Foundation.Private\2.0.3156.17686__90ba9c70f846762e\LOCALIZATION.Foundation.Private.DLL
    + 2008-10-30 14:40:37 20,480 ----a-w c:\windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3156.17702__90ba9c70f846762e\LOG.Foundation.Implementation.Private.DLL
    + 2008-10-30 14:40:37 61,440 ----a-w c:\windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3188.37095__90ba9c70f846762e\LOG.Foundation.Implementation.DLL
    + 2008-10-30 14:40:37 32,768 ----a-w c:\windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3156.17689__90ba9c70f846762e\LOG.Foundation.Private.DLL
    + 2008-10-30 14:40:41 32,768 ----a-w c:\windows\assembly\GAC_MSIL\LOG.Foundation\2.0.3156.17681__90ba9c70f846762e\LOG.Foundation.DLL
    + 2008-10-30 14:40:37 86,016 ----a-w c:\windows\assembly\GAC_MSIL\LOG\2.0.3188.37096__90ba9c70f846762e\LOG.EXE
    + 2008-10-31 15:16:57 352,256 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.dll
    + 2008-10-30 14:40:41 16,384 ----a-w c:\windows\assembly\GAC_MSIL\MOM.Foundation\2.0.3156.17699__90ba9c70f846762e\MOM.Foundation.DLL
    + 2008-10-30 14:40:37 106,496 ----a-w c:\windows\assembly\GAC_MSIL\MOM.Implementation\2.0.3188.37099__90ba9c70f846762e\MOM.Implementation.DLL
    + 2008-10-30 14:40:41 49,152 ----a-w c:\windows\assembly\GAC_MSIL\MOM\2.0.0.0__90ba9c70f846762e\MOM.EXE
    + 2008-10-30 14:40:41 28,672 ----a-w c:\windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3156.17682__90ba9c70f846762e\NEWAEM.Foundation.DLL
    + 2008-10-30 14:40:38 19,456 ----a-w c:\windows\assembly\GAC_MSIL\PCKGHLP.Foundation.Implementation\2.0.3188.37126__90ba9c70f846762e\PCKGHLP.Foundation.Implementation.DLL
    + 2008-10-30 14:40:37 16,384 ----a-w c:\windows\assembly\GAC_MSIL\PCKGHLP.Foundation.Private\2.0.3156.17717__90ba9c70f846762e\PCKGHLP.Foundation.Private.DLL
    + 2008-10-31 15:17:19 593,920 ----a-w c:\windows\assembly\GAC_MSIL\PresentationBuildTasks\3.0.0.0__31bf3856ad364e35\PresentationBuildTasks.dll
    + 2008-10-31 15:17:19 32,768 ----a-w c:\windows\assembly\GAC_MSIL\PresentationCFFRasterizer\3.0.0.0__31bf3856ad364e35\PresentationCFFRasterizer.dll
    + 2008-10-31 15:17:21 184,320 ----a-w c:\windows\assembly\GAC_MSIL\PresentationFramework.Aero\3.0.0.0__31bf3856ad364e35\PresentationFramework.Aero.dll
    + 2008-10-31 15:17:20 126,976 ----a-w c:\windows\assembly\GAC_MSIL\PresentationFramework.Classic\3.0.0.0__31bf3856ad364e35\PresentationFramework.Classic.dll
    + 2008-10-31 15:17:20 376,832 ----a-w c:\windows\assembly\GAC_MSIL\PresentationFramework.Luna\3.0.0.0__31bf3856ad364e35\PresentationFramework.Luna.dll
    + 2008-10-31 15:17:20 151,552 ----a-w c:\windows\assembly\GAC_MSIL\PresentationFramework.Royale\3.0.0.0__31bf3856ad364e35\PresentationFramework.Royale.dll
    + 2008-10-31 15:17:20 4,972,544 ----a-w c:\windows\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\PresentationFramework.dll
    + 2008-10-31 15:17:20 897,024 ----a-w c:\windows\assembly\GAC_MSIL\PresentationUI\3.0.0.0__31bf3856ad364e35\PresentationUI.dll
    + 2008-10-31 15:17:21 528,384 ----a-w c:\windows\assembly\GAC_MSIL\ReachFramework\3.0.0.0__31bf3856ad364e35\ReachFramework.dll
    + 2008-10-31 15:16:58 94,208 ----a-w c:\windows\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\SMdiagnostics.dll
    + 2008-10-31 15:16:58 126,976 ----a-w c:\windows\assembly\GAC_MSIL\System.IdentityModel.Selectors\3.0.0.0__b77a5c561934e089\System.IdentityModel.Selectors.dll
    + 2008-10-31 15:16:58 401,408 ----a-w c:\windows\assembly\GAC_MSIL\System.IdentityModel\3.0.0.0__b77a5c561934e089\System.IdentityModel.dll
    + 2008-10-31 15:16:58 131,072 ----a-w c:\windows\assembly\GAC_MSIL\System.IO.Log\3.0.0.0__b03f5f7f11d50a3a\System.IO.Log.dll
    + 2008-10-31 15:16:58 884,736 ----a-w c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll
    + 2008-10-31 15:17:00 159,744 ----a-w c:\windows\assembly\GAC_MSIL\System.ServiceModel.Install\3.0.0.0__b77a5c561934e089\System.ServiceModel.Install.dll
    + 2008-10-31 15:17:00 16,384 ----a-w c:\windows\assembly\GAC_MSIL\System.ServiceModel.WasHosting\3.0.0.0__b77a5c561934e089\System.ServiceModel.WasHosting.dll
    + 2008-10-31 15:16:59 5,623,808 ----a-w c:\windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll
    + 2008-10-31 15:17:21 688,128 ----a-w c:\windows\assembly\GAC_MSIL\System.Speech\3.0.0.0__31bf3856ad364e35\System.Speech.dll
    + 2008-10-31 15:20:24 1,108,784 ----a-w c:\windows\assembly\GAC_MSIL\System.Workflow.Activities\3.0.0.0__31bf3856ad364e35\System.Workflow.Activities.dll
    + 2008-10-31 15:20:24 1,641,272 ----a-w c:\windows\assembly\GAC_MSIL\System.Workflow.ComponentModel\3.0.0.0__31bf3856ad364e35\System.Workflow.ComponentModel.dll
    + 2008-10-31 15:20:24 588,592 ----a-w c:\windows\assembly\GAC_MSIL\System.Workflow.Runtime\3.0.0.0__31bf3856ad364e35\System.Workflow.Runtime.dll
    + 2008-10-31 15:17:20 163,840 ----a-w c:\windows\assembly\GAC_MSIL\UIAutomationClient\3.0.0.0__31bf3856ad364e35\UIAutomationClient.dll
    + 2008-10-31 15:17:20 372,736 ----a-w c:\windows\assembly\GAC_MSIL\UIAutomationClientsideProviders\3.0.0.0__31bf3856ad364e35\UIAutomationClientsideProviders.dll
    + 2008-10-31 15:17:20 32,768 ----a-w c:\windows\assembly\GAC_MSIL\UIAutomationProvider\3.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll
    + 2008-10-31 15:17:20 86,016 ----a-w c:\windows\assembly\GAC_MSIL\UIAutomationTypes\3.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll
    + 2008-10-31 15:17:18 1,167,360 ----a-w c:\windows\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\WindowsBase.dll
    + 2008-10-31 15:17:21 81,920 ----a-w c:\windows\assembly\GAC_MSIL\WindowsFormsIntegration\3.0.0.0__31bf3856ad364e35\WindowsFormsIntegration.dll
    + 2008-10-31 17:56:32 499,712 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\ComSvcConfig\b5888f091fb2a49786bae4f1d8b8d8d9\ComSvcConfig.ni.exe
    + 2008-10-31 17:56:34 1,118,208 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\ac1483ed6b514e619fa30c2901e2b95f\Microsoft.Transactions.Bridge.ni.dll
    + 2008-10-31 17:56:35 405,504 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Transacti#\dc73e35717d0c5bbf51cbdce512b056f\Microsoft.Transactions.Bridge.Dtc.ni.dll
    + 2008-10-31 15:17:48 17,920 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\60f42a298fe40aff21aa1fbbbf6eaa5f\Microsoft.VisualC.ni.dll
    + 2008-10-31 17:57:01 1,568,768 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\2398914efb9120c97d947611f25afb3c\PresentationBuildTasks.ni.dll
    + 2008-10-31 15:18:40 40,448 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCFFRast#\007db923a103cc8512c84b72e6b7cad4\PresentationCFFRasterizer.ni.dll
    + 2008-10-31 15:18:39 11,984,896 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\050c1254ba0ed9167f391f4a41fedc8e\PresentationCore.ni.dll
    + 2008-10-31 15:20:19 48,640 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFontCac#\ad2afdb9df1b61e02a702abeeb5d5e10\PresentationFontCache.ni.exe
    + 2008-10-31 15:19:51 14,680,064 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\0debe01baea839f6f292419cc3ca5813\PresentationFramework.ni.dll
    + 2008-10-31 15:20:12 548,864 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\20944b472c57de45708151d0448cc786\PresentationFramework.Luna.ni.dll
    + 2008-10-31 15:20:18 393,216 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\5827216ffe838fc2f56788c4a8c9c284\PresentationFramework.Aero.ni.dll
    + 2008-10-31 15:20:10 241,664 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\81df21e0efd2c68dfb2d75d834983fe8\PresentationFramework.Classic.ni.dll
    + 2008-10-31 15:20:13 270,336 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\bd1760002cb045cc16176ff2b09291f4\PresentationFramework.Royale.ni.dll
    + 2008-10-31 15:19:57 1,982,464 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\206c38f5d6c612f5574b2ffb902bec86\PresentationUI.ni.dll
    + 2008-10-31 15:20:05 2,396,160 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\ReachFramework\c63c4e19886e73ed9f363554c32a202f\ReachFramework.ni.dll
    + 2008-10-31 17:56:35 135,168 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\ServiceModelReg\e5053543ff8607b8047e8b31806b1a6e\ServiceModelReg.ni.exe
    + 2008-10-31 17:56:35 286,720 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\e5a9aef2acaac40a462e604aabf9f493\SMDiagnostics.ni.dll
    + 2008-10-31 17:56:36 323,584 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\e17c1177ba9678b7c6fc9e9e52484da3\SMSvcHost.ni.exe
    + 2008-10-31 17:57:04 262,144 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\sysglobl\eafde2f09544733eee1475d9ba354519\sysglobl.ni.dll
    + 2008-10-31 15:17:53 163,840 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuratio#\8b5c3e58b8a22fb937ddf3a7505b6142\System.Configuration.Install.ni.dll
    + 2008-10-31 15:17:52 1,179,648 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.OracleC#\27ebfa268209da90f3da8dba35f9a0b6\System.Data.OracleClient.ni.dll
    + 2008-10-31 15:17:47 2,695,168 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\82ccca460399edd9e15c08fab7db6ac8\System.Data.SqlXml.ni.dll
    + 2008-10-31 17:56:01 241,664 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\080450ac89954dd4c5e422ba951017d5\System.IdentityModel.Selectors.ni.dll
    + 2008-10-31 17:56:00 987,136 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\5a99b2c9c96b015d3cf54f28f3127b6b\System.IdentityModel.ni.dll
    + 2008-10-31 17:56:02 421,888 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.IO.Log\f37ed99b08e414a0e545f31b609ed44e\System.IO.Log.ni.dll
    + 2008-10-31 15:20:43 655,360 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Messaging\cb886a368ae85d1974664520680434e6\System.Messaging.ni.dll
    + 2008-10-31 15:20:07 1,118,208 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Printing\a3fd17a18a2defd7006c6e71a54ecda4\System.Printing.ni.dll
    + 2008-10-31 15:17:49 815,104 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5f6d690d9c437e866ed68d3bf776dbf7\System.Runtime.Remoting.ni.dll
    + 2008-10-31 15:17:50 339,968 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\0df7577b4171c764f689de50708c2421\System.Runtime.Serialization.Formatters.Soap.ni.dll
    + 2008-10-31 17:56:05 2,363,392 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\5870012f37a2b8a07d564c86d79e46ea\System.Runtime.Serialization.ni.dll
    + 2008-10-31 17:56:30 17,534,976 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\cadef89e896e029b5e33a0ff2470bb03\System.ServiceModel.ni.dll
    + 2008-10-31 15:17:53 229,376 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\3ca8406064b17f7b8587e88b9dc8854c\System.ServiceProcess.ni.dll
    + 2008-10-31 17:57:03 2,031,616 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Speech\8332e4e7bc41b8c8f4bf61cfc67b4789\System.Speech.ni.dll
    + 2008-10-31 15:20:31 2,994,176 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Act#\527be05ef8f001be98eee29368cdb86e\System.Workflow.Activities.ni.dll
    + 2008-10-31 15:20:37 4,587,520 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Com#\0c5f71e91ad2427add3f9426943665f7\System.Workflow.ComponentModel.ni.dll
    + 2008-10-31 15:20:41 2,101,248 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Workflow.Run#\a67d0a142f7eceae7b62df346956888f\System.Workflow.Runtime.ni.dll
    + 2008-10-31 17:57:05 483,328 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClient\4a4ab627e0bcbf35d95ec8878c315324\UIAutomationClient.ni.dll
    + 2008-10-31 17:57:07 1,118,208 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationClients#\8df6121a4680f5f77ad107140e9f7bec\UIAutomationClientsideProviders.ni.dll
    + 2008-10-31 15:18:40 50,688 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\2421c730fad33a19908a77519f57fa5c\UIAutomationProvider.ni.dll
    + 2008-10-31 15:18:40 196,608 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\f5ce861e5994d9a82817364a85e4eaf8\UIAutomationTypes.ni.dll
    + 2008-10-31 15:17:42 3,272,704 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\65e93c229afc2e5cbf654da8b3249819\WindowsBase.ni.dll
    + 2008-10-31 17:57:10 274,432 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\daf162eef2f4bb96b952ba108d01a18d\WindowsFormsIntegration.ni.dll
    + 2008-10-31 17:56:37 380,928 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\WsatConfig\544f6b6770ebdbb2a31a72cd7ae7a412\WsatConfig.ni.exe
    + 2008-02-27 13:59:28 290,816 ----a-w c:\windows\Downloaded Program Files\auc_lib.dll
    + 2008-02-27 13:59:28 495,616 ----a-w c:\windows\Downloaded Program Files\daas_s.dll
    + 2008-02-27 14:00:12 262,144 ----a-w c:\windows\Downloaded Program Files\fscax.dll
    + 2008-02-27 13:59:16 588,392 ----a-w c:\windows\Downloaded Program Files\gatelauncher.exe
    + 2008-06-14 17:34:47 272,128 ------w c:\windows\Driver Cache\i386\bthport.sys
    + 2008-10-24 11:21:09 455,296 ------w c:\windows\Driver Cache\i386\mrxsmb.sys
    + 2008-08-14 13:25:40 2,147,840 ------w c:\windows\Driver Cache\i386\ntkrnlmp.exe
    + 2008-08-14 13:25:43 2,068,352 ------w c:\windows\Driver Cache\i386\ntkrnlpa.exe
    + 2008-08-14 13:24:57 2,026,496 ------w c:\windows\Driver Cache\i386\ntkrpamp.exe
    + 2008-08-14 13:25:41 2,191,488 ------w c:\windows\Driver Cache\i386\ntoskrnl.exe
    - 2005-10-20 17:02:28 163,328 ----a-w c:\windows\erdnt\Hiv-backup\ERDNT.EXE
    + 2005-10-20 18:02:28 163,328 ----a-w c:\windows\erdnt\Hiv-backup\ERDNT.EXE
    - 2005-10-20 17:02:28 163,328 ----a-w c:\windows\erdnt\subs\ERDNT.EXE
    + 2005-10-20 18:02:28 163,328 ----a-w c:\windows\erdnt\subs\ERDNT.EXE
    + 2008-08-07 13:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE
    + 2008-12-12 19:41:35 10,203,136 ----a-w c:\windows\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
    + 2008-12-12 19:41:35 282,624 ----a-w c:\windows\ERUNT\SDFIX\Users\00000002\UsrClass.dat
    + 2008-08-07 13:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE
    + 2008-12-12 19:41:33 10,203,136 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
    + 2008-12-12 19:41:33 282,624 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
    + 2006-10-27 11:26:40 16,870,712 -c--a-r c:\windows\Installer\$PatchCache$\Managed\000021090200B0400000000000F01FEC\12.0.4518\MSO.DLL
    + 2006-10-27 11:18:36 1,658,152 ----a-r c:\windows\Installer\$PatchCache$\Managed\000021090200B0400000000000F01FEC\12.0.4518\OGL.DLL
    + 2008-08-23 16:44:43 10,134 ----a-r c:\windows\Installer\{1A524CFE-DF85-4555-8BC2-0C89DBD8BC2C}\ARPPRODUCTICON.exe
    + 2008-10-30 14:40:25 10,134 ----a-r c:\windows\Installer\{22F358CE-610B-A033-0D36-4FADA6E8F67A}\ARPPRODUCTICON.exe
    + 2008-10-30 14:40:22 10,134 ----a-r c:\windows\Installer\{255F566C-3F57-15AD-2CA5-E7EA41F9904F}\ARPPRODUCTICON.exe
    + 2008-10-30 14:40:27 10,134 ----a-r c:\windows\Installer\{4287A29F-EA4C-24E4-4AAE-3E6CDC9C965A}\ARPPRODUCTICON.exe
    + 2008-10-30 14:40:09 10,134 ----a-r c:\windows\Installer\{4FEEDAA3-0D0C-7584-63F2-0F216D3426C9}\ARPPRODUCTICON.exe
    + 2008-10-30 14:40:23 10,134 ----a-r c:\windows\Installer\{80AE66E6-E9FA-0CAC-C9F1-4E5A144886F0}\ARPPRODUCTICON.exe
    + 2008-11-12 19:00:23 32,768 ----a-r c:\windows\Installer\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}\icon.exe
    + 2008-10-30 14:40:19 10,134 ----a-r c:\windows\Installer\{8D6EC7D6-E71D-8743-1396-591F4195F347}\ARPPRODUCTICON.exe
    + 2008-10-30 14:40:30 10,134 ----a-r c:\windows\Installer\{8FD697DD-C94F-22BE-6EFD-AA4CA7CF2B33}\ARPPRODUCTICON.exe
    + 2008-10-30 14:40:30 9,158 ----a-r c:\windows\Installer\{8FD697DD-C94F-22BE-6EFD-AA4CA7CF2B33}\NewShortcut11_EAB9635D261D49BE88DDE71A7C809B2D.exe
    - 2008-05-16 14:53:02 35,600 ----a-r c:\windows\Installer\{90120000-0020-040B-0000-0000000FF1CE}\O12ConvIcon.exe
    + 2008-11-12 19:00:57 35,600 ----a-r c:\windows\Installer\{90120000-0020-040B-0000-0000000FF1CE}\O12ConvIcon.exe
    + 2008-11-10 10:40:43 3,262 ----a-r c:\windows\Installer\{B3164E9E-BE08-4F3B-94BC-C6D09C0205E1}\ARPPRODUCTICON.exe
    + 2008-10-30 14:40:29 10,134 ----a-r c:\windows\Installer\{B38C3184-F573-CDC2-9452-FA9C576AB010}\ARPPRODUCTICON.exe
    + 2008-11-10 10:41:37 15,086 ----a-r c:\windows\Installer\{D5577624-0626-4C4B-87AA-D966DA1739D6}\ARPPRODUCTICON.exe
    + 2008-10-30 14:40:24 10,134 ----a-r c:\windows\Installer\{DB6901C6-E8B7-F5F0-F0C6-9028AFCD5A74}\ARPPRODUCTICON.exe
    + 2008-10-30 14:40:18 10,134 ----a-r c:\windows\Installer\{E068CD0F-E631-17E7-9A01-05C2B2B54C84}\ARPPRODUCTICON.exe
    + 2008-10-30 14:40:16 10,134 ----a-r c:\windows\Installer\{FA3A247D-437A-455E-A88F-7EB6E5F9E799}\ARPPRODUCTICON.exe
    + 2008-07-08 15:09:55 52,736 ----a-w c:\windows\ipuninst.exe
    + 2008-08-24 08:03:12 32,549 ----a-w c:\windows\king-uninstall.exe
    + 2008-07-04 11:12:12 316,672 ----a-w c:\windows\KingComIE.dll
    + 2004-09-29 10:38:58 2,676,224 ----a-w c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3DX.dll
    + 2004-12-01 13:53:06 2,846,720 ----a-w c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2903.0\Microsoft.DirectX.Direct3DX.dll
    + 2005-02-05 17:32:54 563,712 ----a-w c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2904.0\Microsoft.DirectX.Direct3DX.dll
    - 2005-03-18 14:23:14 567,296 -c--a-w c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2905.0\Microsoft.DirectX.Direct3DX.dll
    + 2005-03-18 15:23:14 567,296 -c--a-w c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2905.0\Microsoft.DirectX.Direct3DX.dll
    - 2005-05-26 12:15:56 576,000 -c--a-w c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2906.0\Microsoft.DirectX.Direct3DX.dll
    + 2005-05-26 13:15:56 576,000 -c--a-w c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2906.0\Microsoft.DirectX.Direct3DX.dll
    - 2005-07-22 14:21:34 577,024 -c--a-w c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2907.0\Microsoft.DirectX.Direct3DX.dll
    + 2005-07-22 15:21:34 577,024 -c--a-w c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2907.0\Microsoft.DirectX.Direct3DX.dll
    + 2005-09-28 12:11:52 577,536 ----a-w c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2908.0\Microsoft.DirectX.Direct3DX.dll
    + 2005-12-05 15:20:50 577,536 ----a-w c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2909.0\Microsoft.DirectX.Direct3DX.dll
    + 2006-02-03 05:40:48 578,560 ----a-w c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2910.0\Microsoft.DirectX.Direct3DX.dll
    + 2006-03-31 09:27:50 578,560 ----a-w c:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2911.0\Microsoft.DirectX.Direct3DX.dll
    + 2006-10-30 02:06:24 74,012 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\baseline.dat
    + 2006-10-30 01:25:56 99,600 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\DeleteTemp.exe
    + 2006-10-29 21:15:06 220,672 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\dlmgr.dll
    + 2006-10-29 21:17:56 1,054,720 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\gencomp.dll
    + 2006-10-29 21:14:26 163,328 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\HtmlLite.dll
    + 2006-10-30 01:25:54 194,320 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\RebootStub.exe
    + 2006-10-30 01:25:56 167,176 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\runmsi.exe
    + 2006-10-30 01:25:56 365,320 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setup.exe
    + 2006-10-30 01:17:12 80,384 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1025.dll
    + 2006-10-30 01:17:30 80,384 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1028.dll
    + 2006-10-30 01:17:36 86,016 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1029.dll
    + 2006-10-30 01:17:44 87,040 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1030.dll
    + 2006-10-30 01:17:50 89,600 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1031.dll
    + 2006-10-30 01:17:56 94,208 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1032.dll
    + 2006-10-30 01:18:10 82,944 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1035.dll
    + 2006-10-30 01:18:16 91,648 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1036.dll
    + 2006-10-30 01:18:22 80,384 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1037.dll
    + 2006-10-30 01:18:30 89,600 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1038.dll
    + 2006-10-30 01:18:36 88,064 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1040.dll
    + 2006-10-30 01:18:42 80,384 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1041.dll
    + 2006-10-30 01:18:48 80,384 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1042.dll
    + 2006-10-30 01:18:56 87,040 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1043.dll
    + 2006-10-30 01:19:02 83,968 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1044.dll
    + 2006-10-30 01:19:08 86,528 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1045.dll
    + 2006-10-30 01:19:14 84,480 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1046.dll
    + 2006-10-30 01:19:28 82,944 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1049.dll
    + 2006-10-30 01:19:34 83,968 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1053.dll
    + 2006-10-30 01:19:42 82,432 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.1055.dll
    + 2006-10-30 01:17:24 80,384 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.2052.dll
    + 2006-10-30 01:19:22 90,624 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.2070.dll
    + 2006-10-30 01:18:02 90,112 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.3082.dll
    + 2006-10-29 21:15:20 80,384 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setupres.dll
    + 2006-10-29 21:15:22 1,621,504 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\SITSetup.dll
    + 2006-10-30 01:17:14 98,816 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1025.dll
    + 2006-10-30 01:17:30 98,816 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1028.dll
    + 2006-10-30 01:17:38 99,840 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1029.dll
    + 2006-10-30 01:17:44 99,840 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1030.dll
    + 2006-10-30 01:17:50 102,400 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1031.dll
    + 2006-10-30 01:17:58 104,448 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1032.dll
    + 2006-10-30 01:18:10 98,816 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1035.dll
    + 2006-10-30 01:18:16 103,424 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1036.dll
    + 2006-10-30 01:18:24 98,816 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1037.dll
    + 2006-10-30 01:18:30 102,400 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1038.dll
    + 2006-10-30 01:18:36 101,376 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1040.dll
    + 2006-10-30 01:18:42 98,816 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1041.dll
    + 2006-10-30 01:18:50 98,816 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1042.dll
    + 2006-10-30 01:18:56 99,840 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1043.dll
    + 2006-10-30 01:19:02 98,816 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1044.dll
    + 2006-10-30 01:19:08 99,840 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1045.dll
    + 2006-10-30 01:19:16 99,328 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1046.dll
    + 2006-10-30 01:19:28 98,816 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1049.dll
    + 2006-10-30 01:19:36 98,816 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1053.dll
    + 2006-10-30 01:19:42 98,816 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.1055.dll
    + 2006-10-30 01:17:24 98,816 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.2052.dll
    + 2006-10-30 01:19:22 101,376 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.2070.dll
    + 2006-10-30 01:18:04 102,400 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.3082.dll
    + 2006-10-29 21:18:36 98,816 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapRes.dll
    + 2006-10-29 21:19:30 1,103,872 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\WapUI.dll
    + 2006-10-29 21:16:52 1,139,712 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\vs_setup.dll
    + 2006-10-29 21:18:26 590,848 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\vs70uimgr.dll
    + 2006-10-29 21:20:20 541,184 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\vsbasereqs.dll
    + 2006-10-29 21:18:12 816,128 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\vsscenario.dll
    + 2006-10-30 01:34:02 159,744 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe
    + 2006-10-30 01:33:58 741,376 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
    + 2008-10-31 15:16:54 626,440 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\install.exe
    + 2008-10-31 15:16:54 80,896 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\install.res.1033.dll
    + 2006-10-30 01:34:00 352,256 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\Microsoft.Transactions.Bridge.dll
    + 2006-10-30 01:34:00 151,552 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\Microsoft.Transactions.Bridge.Dtc.dll
    + 2006-10-30 01:34:02 2,560 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelEvents.dll
    + 2006-10-30 01:34:02 61,440 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe
    + 2006-10-30 01:34:02 11,264 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceMonikerSupport.dll
    + 2006-10-30 01:34:00 94,208 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMDiagnostics.dll
    + 2006-10-30 01:34:02 122,880 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
    + 2006-10-30 01:34:02 884,736 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.Runtime.Serialization.dll
    + 2006-10-30 01:34:02 5,623,808 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.dll
    + 2006-10-30 01:34:00 159,744 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.Install.dll
    + 2006-10-30 01:34:00 16,384 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.WasHosting.dll
    + 2006-10-30 01:34:02 143,360 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe
    + 2006-07-25 19:32:00 14,648 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\PerformanceCounterInstaller.exe
    + 2006-10-20 14:08:52 797,696 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\NaturalLanguage6.dll
    + 2006-10-20 14:09:02 4,874,240 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\NlsData0009.dll
    + 2006-10-20 12:03:40 2,628,608 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\NlsLexicons0009.dll
    + 2006-10-20 19:29:46 72,992 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PenIMC.dll
    + 2006-10-20 19:21:24 32,768 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationCFFRasterizer.dll
    + 2006-10-20 19:21:24 36,864 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
    + 2006-10-20 19:29:52 106,272 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationHostDLL.dll
    + 2006-10-20 19:21:26 897,024 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationUI.dll
    + 2006-10-20 19:21:26 14,848 ----a-w c:\windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe
    - 2000-08-31 05:00:00 28,160 ----a-w c:\windows\Nircmd.exe
    + 2000-08-31 06:00:00 28,672 ----a-w c:\windows\Nircmd.exe
    + 2003-02-19 06:32:38 360,448 ----a-w c:\windows\Resources\Themes\NightShades\Shell\NormalColor\shellstyle.dll
    - 2000-08-31 05:00:00 161,792 ----a-w c:\windows\swreg.exe
    + 2000-08-31 06:00:00 161,792 ----a-w c:\windows\swreg.exe
    + 2008-08-06 13:22:02 114,688 ----a-w c:\windows\system32\Adobe\Director\np32dsw.dll
    + 2008-08-06 13:30:48 202,168 ----a-w c:\windows\system32\Adobe\Director\SwDir.dll
    + 2008-08-06 13:22:42 499,712 ----a-w c:\windows\system32\Adobe\Shockwave 11\Control.dll
    + 2008-08-06 12:45:40 1,798,144 ----a-w c:\windows\system32\Adobe\Shockwave 11\dirapi.dll
    + 2008-08-06 13:22:44 9,216 ----a-w c:\windows\system32\Adobe\Shockwave 11\DynaPlayer.dll
    + 2008-08-06 12:35:52 706,048 ----a-w c:\windows\system32\Adobe\Shockwave 11\gi.dll
    + 2008-08-06 12:35:52 1,145,896 ----a-w c:\windows\system32\Adobe\Shockwave 11\gt.exe
    + 2008-08-06 12:35:52 52,288 ----a-w c:\windows\system32\Adobe\Shockwave 11\gtapi.dll
    + 2008-08-06 12:42:04 892,928 ----a-w c:\windows\system32\Adobe\Shockwave 11\iml32.dll
    + 2008-08-06 12:35:52 54,656 ----a-w c:\windows\system32\Adobe\Shockwave 11\pccuapi.dll
    + 2008-08-06 13:21:14 266,240 ----a-w c:\windows\system32\Adobe\Shockwave 11\Plugin.dll
    + 2008-08-06 13:24:14 446,464 ----a-w c:\windows\system32\Adobe\Shockwave 11\Proj.dll
    + 2008-06-17 13:22:46 439,736 ----a-w c:\windows\system32\Adobe\Shockwave 11\SwHelper_1100458.exe
    + 2008-08-06 13:30:30 447,928 ----a-w c:\windows\system32\Adobe\Shockwave 11\SwHelper_1100465.exe
    + 2008-08-06 13:24:56 114,688 ----a-w c:\windows\system32\Adobe\Shockwave 11\SwInit.exe
    + 2008-08-06 13:21:04 94,208 ----a-w c:\windows\system32\Adobe\Shockwave 11\SwMenu.dll
    + 2008-08-06 12:35:52 50,808 ----a-w c:\windows\system32\Adobe\Shockwave 11\SYMCCHECKER.DLL
    + 1999-06-25 07:55:30 149,504 ----a-w c:\windows\system32\Adobe\Shockwave 11\UNWISE.EXE
    + 2008-09-24 01:24:26 48,640 ----a-w c:\windows\system32\amdpcom32.dll
    + 2008-07-19 14:43:08 1,163,960 ----a-w c:\windows\system32\aswBoot.exe
    - 2006-07-19 02:22:06 286,720 ----a-w c:\windows\system32\ati2cqag.dll
    + 2008-09-24 01:12:34 573,440 ----a-w c:\windows\system32\ati2cqag.dll
    - 2006-07-19 02:58:29 258,048 ----a-w c:\windows\system32\ati2dvag.dll
    + 2008-09-24 02:17:07 311,296 ----a-w c:\windows\system32\ati2dvag.dll
    - 2006-07-19 02:52:57 41,984 ----a-w c:\windows\system32\ati2edxx.dll
    + 2008-09-24 02:06:36 43,520 ----a-w c:\windows\system32\ati2edxx.dll
    - 2006-07-19 02:52:47 86,016 ----a-w c:\windows\system32\ati2evxx.dll
    + 2008-09-24 02:06:19 143,360 ----a-w c:\windows\system32\ati2evxx.dll
    - 2006-07-19 02:51:42 401,408 ----a-w c:\windows\system32\ati2evxx.exe
    + 2008-09-24 02:04:49 581,632 ----a-w c:\windows\system32\ati2evxx.exe
    - 2006-07-19 02:53:03 26,112 -c--a-w c:\windows\system32\Ati2mdxx.exe
    + 2008-09-24 02:06:44 26,112 ----a-w c:\windows\system32\Ati2mdxx.exe
    - 2004-09-15 18:10:00 516,096 ------w c:\windows\system32\ati2sgag.exe
    + 2008-09-23 19:05:00 593,920 ------w c:\windows\system32\ati2sgag.exe
    - 2006-07-19 02:44:35 2,732,608 ----a-w c:\windows\system32\ati3duag.dll
    + 2008-09-24 01:54:16 4,008,864 ----a-w c:\windows\system32\ati3duag.dll
    + 2008-09-24 01:19:08 39,424 ----a-w c:\windows\system32\atiadlxx.dll
    + 2008-07-30 17:00:51 90,112 ----a-w c:\windows\system32\atibrtmon.exe
    - 2006-07-19 02:51:09 53,248 -c--a-w c:\windows\system32\ATIDDC.DLL
    + 2008-09-24 02:03:30 53,248 ----a-w c:\windows\system32\ATIDDC.DLL
    + 2008-09-24 02:18:25 425,984 ----a-w c:\windows\system32\ATIDEMGX.dll
    - 2006-06-21 15:01:00 129,084 ----a-w c:\windows\system32\atiicdxx.dat
    + 2008-09-17 19:17:19 176,918 ----a-w c:\windows\system32\atiicdxx.dat
    - 2006-07-19 02:23:48 307,200 ----a-w c:\windows\system32\atiiiexx.dll
    + 2008-09-24 01:56:46 307,200 ----a-w c:\windows\system32\atiiiexx.dll
    - 2006-07-19 02:27:56 204,800 ----a-w c:\windows\system32\atikvmag.dll
    + 2008-09-24 01:20:30 380,928 ----a-w c:\windows\system32\atikvmag.dll
    - 2006-07-19 02:13:44 5,136,384 ----a-w c:\windows\system32\atioglxx.dll
    + 2008-09-24 02:09:12 10,772,480 ----a-w c:\windows\system32\atioglxx.dll
    + 2008-09-24 01:18:17 253,952 ----a-w c:\windows\system32\atiok3x2.dll
    - 2006-07-19 02:53:26 114,688 ----a-w c:\windows\system32\atipdlxx.dll
    + 2008-09-24 02:07:05 188,416 ----a-w c:\windows\system32\atipdlxx.dll
    - 2006-07-19 02:26:48 17,408 -c--a-w c:\windows\system32\atitvo32.dll
    + 2008-09-24 01:18:59 17,408 ----a-w c:\windows\system32\atitvo32.dll
    - 2001-11-09 14:01:04 24,064 -c--a-w c:\windows\system32\ativcoxx.dll
    + 2001-11-09 15:01:04 24,064 ----a-w c:\windows\system32\ativcoxx.dll
    + 2008-09-24 01:38:02 3,107,788 ----a-w c:\windows\system32\ativva5x.dat
    + 2008-09-24 01:38:02 887,724 ----a-w c:\windows\system32\ativva6x.dat
    + 2008-09-24 01:38:02 3,107,788 ----a-w c:\windows\system32\ativvaxx.dat
    - 2006-07-19 02:39:07 1,744,416 ----a-w c:\windows\system32\ativvaxx.dll
    + 2008-09-24 01:38:32 2,399,744 ----a-w c:\windows\system32\ativvaxx.dll
    + 2008-07-19 14:30:53 94,392 ----a-w c:\windows\system32\AvastSS.scr
    - 2005-04-05 19:19:20 9,728 -c--a-w c:\windows\system32\bdco1.dll
    + 2008-08-01 08:34:00 9,216 ----a-w c:\windows\system32\bdco1.dll
    - 2005-04-06 00:19:20 9,728 -c--a-w c:\windows\system32\bdco1ins.dll
    + 2008-08-01 08:34:00 9,216 ----a-w c:\windows\system32\bdco1ins.dll
    - 2007-03-29 20:00:40 203,264 ----a-r c:\windows\system32\CddbCdda.dll
    + 2007-03-29 21:00:40 203,264 ----a-r c:\windows\system32\CddbCdda.dll
    - 2007-07-30 16:19:20 92,504 ----a-w c:\windows\system32\cdm.dll
    + 2008-10-16 12:09:44 92,696 ----a-w c:\windows\system32\cdm.dll
    - 2008-04-14 06:12:08 139,264 ----a-w c:\windows\system32\cscript.exe
    + 2008-05-07 09:07:23 135,168 ----a-w c:\windows\system32\cscript.exe
    + 2007-03-12 14:42:30 1,123,696 ----a-w c:\windows\system32\D3DCompiler_33.dll
    + 2007-05-16 14:45:16 1,124,720 ----a-w c:\windows\system32\D3DCompiler_34.dll
    + 2007-07-19 16:14:42 1,358,192 ----a-w c:\windows\system32\D3DCompiler_35.dll
    + 2007-10-12 13:14:00 1,374,232 ----a-w c:\windows\system32\D3DCompiler_36.dll
    + 2008-03-05 13:56:58 1,420,824 ----a-w c:\windows\system32\D3DCompiler_37.dll
    + 2008-05-30 12:11:46 1,491,992 ----a-w c:\windows\system32\D3DCompiler_38.dll
    + 2007-03-15 14:57:58 443,752 ----a-w c:\windows\system32\d3dx10_33.dll
    + 2007-05-16 14:45:16 443,752 ----a-w c:\windows\system32\d3dx10_34.dll
    + 2007-07-19 16:14:42 444,776 ----a-w c:\windows\system32\d3dx10_35.dll
    + 2007-10-02 07:56:34 444,776 ----a-w c:\windows\system32\d3dx10_36.dll
    + 2008-02-05 21:07:36 462,864 ----a-w c:\windows\system32\d3dx10_37.dll
    + 2008-05-30 12:11:46 467,984 ----a-w c:\windows\system32\d3dx10_38.dll
    + 2005-02-05 17:45:26 2,222,800 ----a-w c:\windows\system32\d3dx9_24.dll
    - 2005-03-18 14:19:58 2,337,488 -c--a-w c:\windows\system32\d3dx9_25.dll
    + 2005-03-18 15:19:58 2,337,488 ----a-w c:\windows\system32\d3dx9_25.dll
    - 2005-05-26 12:34:52 2,297,552 -c--a-w c:\windows\system32\d3dx9_26.dll
    + 2005-05-26 13:34:52 2,297,552 ----a-w c:\windows\system32\d3dx9_26.dll
    - 2005-07-22 16:59:04 2,319,568 -c--a-w c:\windows\system32\d3dx9_27.dll
    + 2005-07-22 17:59:04 2,319,568 ----a-w c:\windows\system32\d3dx9_27.dll
    + 2005-12-05 16:09:18 2,323,664 ----a-w c:\windows\system32\d3dx9_28.dll
    + 2006-02-03 06:43:16 2,332,368 ----a-w c:\windows\system32\d3dx9_29.dll
    + 2006-03-31 10:40:58 2,388,176 ----a-w c:\windows\system32\d3dx9_30.dll
    + 2006-09-28 14:05:20 2,414,360 ----a-w c:\windows\system32\d3dx9_31.dll
    + 2006-11-29 11:06:18 3,426,072 ----a-w c:\windows\system32\d3dx9_32.dll
    + 2007-03-12 14:42:30 3,495,784 ----a-w c:\windows\system32\d3dx9_33.dll
    + 2007-05-16 14:45:16 3,497,832 ----a-w c:\windows\system32\d3dx9_34.dll
    + 2007-07-19 16:14:42 3,727,720 ----a-w c:\windows\system32\d3dx9_35.dll
    + 2007-10-12 13:14:00 3,734,536 ----a-w c:\windows\system32\d3dx9_36.dll
    + 2008-03-05 13:56:58 3,786,760 ----a-w c:\windows\system32\D3DX9_37.dll
    + 2008-05-30 12:11:46 3,850,760 ----a-w c:\windows\system32\D3DX9_38.dll
    + 2008-04-14 06:11:32 141,312 -c--a-w c:\windows\system32\dllcache\aclua.dll
    + 2008-04-14 06:11:32 245,248 -c--a-w c:\windows\system32\dllcache\acspecfc.dll
    + 2008-04-14 06:11:32 116,224 -c--a-w c:\windows\system32\dllcache\acxtrnal.dll
    + 2008-04-14 06:11:32 4,255 -c--a-w c:\windows\system32\dllcache\adv01nt5.dll
    + 2008-04-14 06:11:32 3,967 -c--a-w c:\windows\system32\dllcache\adv02nt5.dll
    + 2008-04-14 06:11:32 3,615 -c--a-w c:\windows\system32\dllcache\adv05nt5.dll
    + 2008-04-14 06:11:32 3,647 -c--a-w c:\windows\system32\dllcache\adv07nt5.dll
    + 2008-04-14 06:11:32 3,135 -c--a-w c:\windows\system32\dllcache\adv08nt5.dll
    + 2008-04-14 06:11:32 3,711 -c--a-w c:\windows\system32\dllcache\adv09nt5.dll
    + 2008-04-14 06:11:32 3,775 -c--a-w c:\windows\system32\dllcache\adv11nt5.dll
    + 2008-08-14 10:04:36 138,496 -c----w c:\windows\system32\dllcache\afd.sys
    + 2008-04-14 06:11:32 24,064 -c--a-w c:\windows\system32\dllcache\agentanm.dll
    + 2008-04-14 06:11:32 214,016 -c--a-w c:\windows\system32\dllcache\agentctl.dll
    + 2008-04-14 06:11:32 57,344 -c--a-w c:\windows\system32\dllcache\agentdpv.dll
    + 2008-04-14 06:11:32 49,152 -c--a-w c:\windows\system32\dllcache\agentmpx.dll
    + 2008-04-14 06:11:32 44,032 -c--a-w c:\windows\system32\dllcache\agentsr.dll
    + 2008-04-14 06:12:02 256,512 -c--a-w c:\windows\system32\dllcache\agentsvr.exe
    + 2007-04-02 08:26:00 19,456 -c--a-w c:\windows\system32\dllcache\agt0405.dll
    + 2007-04-02 08:26:00 19,456 -c--a-w c:\windows\system32\dllcache\agt0406.dll
    + 2007-04-02 08:26:02 21,504 -c--a-w c:\windows\system32\dllcache\agt0407.dll
    + 2007-04-02 08:26:02 22,016 -c--a-w c:\windows\system32\dllcache\agt0408.dll
    + 2008-04-13 07:32:30 19,968 -c--a-w c:\windows\system32\dllcache\agt0409.dll
    + 2007-04-02 08:26:02 19,456 -c--a-w c:\windows\system32\dllcache\agt040b.dll
    + 2007-04-02 08:26:02 21,504 -c--a-w c:\windows\system32\dllcache\agt040c.dll
    + 2007-04-02 08:26:02 19,968 -c--a-w c:\windows\system32\dllcache\agt040e.dll
    + 2007-04-02 08:26:02 20,992 -c--a-w c:\windows\system32\dllcache\agt0410.dll
    + 2007-04-02 08:26:02 20,992 -c--a-w c:\windows\system32\dllcache\agt0413.dll
    + 2007-04-02 08:26:02 19,456 -c--a-w c:\windows\system32\dllcache\agt0414.dll
    + 2007-04-02 08:26:02 19,456 -c--a-w c:\windows\system32\dllcache\agt0415.dll
    + 2007-04-02 08:26:02 20,480 -c--a-w c:\windows\system32\dllcache\agt0416.dll
    + 2007-04-02 08:26:02 19,456 -c--a-w c:\windows\system32\dllcache\agt0419.dll
    + 2007-04-02 08:26:02 19,456 -c--a-w c:\windows\system32\dllcache\agt041d.dll
    + 2007-04-02 08:26:02 19,456 -c--a-w c:\windows\system32\dllcache\agt041f.dll
    + 2007-04-02 08:26:04 20,992 -c--a-w c:\windows\system32\dllcache\agt0816.dll
    + 2007-04-02 08:26:04 20,480 -c--a-w c:\windows\system32\dllcache\agt0c0a.dll
    + 2008-04-14 06:11:32 24,064 -c--a-w c:\windows\system32\dllcache\agtintl.dll
    + 2008-04-14 05:37:36 41,344 -c--a-w c:\windows\system32\dllcache\amdk6.sys
    + 2008-04-13 08:51:26 60,800 -c--a-w c:\windows\system32\dllcache\arp1394.sys
    - 2005-06-29 01:57:38 208,896 -c--a-w c:\windows\system32\dllcache\ati2cqag.dll
    + 2008-09-24 01:12:34 573,440 -c--a-w c:\windows\system32\dllcache\ati2cqag.dll
    - 2005-06-29 03:02:16 232,960 -c--a-w c:\windows\system32\dllcache\ati2dvag.dll
    + 2008-09-24 02:17:07 311,296 -c--a-w c:\windows\system32\dllcache\ati2dvag.dll
    - 2006-03-22 03:56:22 1,522,688 -c--a-w c:\windows\system32\dllcache\ati2mtag.sys
    + 2008-09-24 03:09:07 3,331,072 -c--a-w c:\windows\system32\dllcache\ati2mtag.sys
    - 2005-06-29 02:47:51 2,360,736 -c--a-w c:\windows\system32\dllcache\ati3duag.dll
    + 2008-09-24 01:54:16 4,008,864 -c--a-w c:\windows\system32\dllcache\ati3duag.dll
    - 2005-06-29 02:41:41 648,000 -c--a-w c:\windows\system32\dllcache\ativvaxx.dll
    + 2008-09-24 01:38:32 2,399,744 -c--a-w c:\windows\system32\dllcache\ativvaxx.dll
    + 2008-04-14 06:11:34 21,183 -c--a-w c:\windows\system32\dllcache\atv01nt5.dll
    + 2008-04-14 06:11:34 11,359 -c--a-w c:\windows\system32\dllcache\atv02nt5.dll
    + 2008-04-14 06:11:34 25,471 -c--a-w c:\windows\system32\dllcache\atv04nt5.dll
    + 2008-04-14 06:11:34 14,143 -c--a-w c:\windows\system32\dllcache\atv06nt5.dll
    + 2008-04-14 06:11:34 17,279 -c--a-w c:\windows\system32\dllcache\atv10nt5.dll
    + 2008-04-13 08:46:22 11,776 -c--a-w c:\windows\system32\dllcache\bdasup.sys
    + 2008-04-13 08:53:24 71,552 -c--a-w c:\windows\system32\dllcache\bridge.sys
    + 2008-04-13 08:46:34 37,888 -c--a-w c:\windows\system32\dllcache\bthmodem.sys
    + 2008-06-14 17:34:47 272,128 -c----w c:\windows\system32\dllcache\bthport.sys
    + 2008-04-13 08:46:32 36,480 -c--a-w c:\windows\system32\dllcache\bthprint.sys
    + 2008-04-14 06:11:34 385,024 -c--a-w c:\windows\system32\dllcache\callcont.dll
    - 2007-07-30 16:19:20 92,504 -c--a-w c:\windows\system32\dllcache\cdm.dll
    + 2008-10-16 12:09:44 92,696 -c--a-w c:\windows\system32\dllcache\cdm.dll
    + 2008-04-14 06:11:34 15,423 -c--a-w c:\windows\system32\dllcache\ch7xxnt5.dll
    + 2008-04-13 06:44:18 17,920 -c--a-w c:\windows\system32\dllcache\cobramsg.dll
    + 2008-04-14 06:11:34 195,072 -c--a-w c:\windows\system32\dllcache\comadmin.dll
    + 2008-04-14 06:12:06 9,728 -c--a-w c:\windows\system32\dllcache\comrepl.exe
    + 2008-04-14 06:12:06 6,144 -c--a-w c:\windows\system32\dllcache\comrereg.exe
    + 2008-04-14 06:11:34 45,056 -c--a-w c:\windows\system32\dllcache\confmrsl.dll
    + 2008-04-14 05:45:20 40,704 -c--a-w c:\windows\system32\dllcache\crusoe.sys
    + 2008-05-07 09:07:23 135,168 -c----w c:\windows\system32\dllcache\cscript.exe
    + 2008-04-14 06:11:34 40,960 -c--a-w c:\windows\system32\dllcache\dcap32.dll
    + 2008-04-14 06:12:08 542,208 -c--a-w c:\windows\system32\dllcache\dialer.exe
    + 2008-04-13 08:40:46 14,208 -c--a-w c:\windows\system32\dllcache\diskdump.sys
    + 2008-06-20 17:47:56 147,968 -c----w c:\windows\system32\dllcache\dnsapi.dll
    + 2008-07-07 20:28:49 253,952 -c----w c:\windows\system32\dllcache\es.dll
    + 2008-04-14 06:11:36 21,504 -c--a-w c:\windows\system32\dllcache\evntrprv.dll
    + 2008-04-14 06:11:36 45,056 -c--a-w c:\windows\system32\dllcache\evtgprov.dll
    + 2006-10-14 14:43:18 27,648 -c----w c:\windows\system32\dllcache\FilterPipelinePrintProc.dll
    + 2008-04-14 06:11:36 618,605 -c--a-w c:\windows\system32\dllcache\fp4autl.dll
    + 2008-10-23 12:38:22 286,720 -c----w c:\windows\system32\dllcache\gdi32.dll
    + 2008-04-14 06:11:36 133,632 -c--a-w c:\windows\system32\dllcache\guitrn.dll
    + 2008-04-14 06:11:36 115,200 -c--a-w c:\windows\system32\dllcache\guitrna.dll
    + 2008-04-14 06:11:36 57,344 -c--a-w c:\windows\system32\dllcache\h323cc.dll
    + 2008-04-14 05:42:06 25,600 -c--a-w c:\windows\system32\dllcache\hidbth.sys
    + 2008-04-13 08:45:28 36,864 -c--a-w c:\windows\system32\dllcache\hidclass.sys
    + 2008-04-13 08:45:28 19,200 -c--a-w c:\windows\system32\dllcache\hidir.sys
    + 2008-04-13 08:45:24 24,960 -c--a-w c:\windows\system32\dllcache\hidparse.sys
    + 2008-04-14 06:11:36 38,912 -c--a-w c:\windows\system32\dllcache\hmmapi.dll
    + 2008-04-14 06:12:16 18,432 -c--a-w c:\windows\system32\dllcache\hscupd.exe
    + 2008-04-14 06:11:38 61,440 -c--a-w c:\windows\system32\dllcache\icwconn.dll
    + 2008-04-14 06:12:16 215,552 -c--a-w c:\windows\system32\dllcache\icwconn1.exe
    + 2008-04-14 06:12:16 86,016 -c--a-w c:\windows\system32\dllcache\icwconn2.exe
    + 2008-04-14 06:11:38 32,768 -c--a-w c:\windows\system32\dllcache\icwdl.dll
    + 2008-04-14 06:11:38 176,128 -c--a-w c:\windows\system32\dllcache\icwhelp.dll
    + 2008-04-14 06:12:16 24,576 -c--a-w c:\windows\system32\dllcache\icwrmind.exe
    + 2008-04-14 06:11:38 49,152 -c--a-w c:\windows\system32\dllcache\icwutil.dll
    + 2008-04-14 06:12:16 18,432 -c--a-w c:\windows\system32\dllcache\iedw.exe
    + 2008-04-11 19:05:25 691,712 -c----w c:\windows\system32\dllcache\inetcomm.dll
    + 2008-04-14 06:12:16 20,480 -c--a-w c:\windows\system32\dllcache\inetwiz.exe
    + 2008-04-14 05:45:04 40,320 -c--a-w c:\windows\system32\dllcache\intelppm.sys
    + 2008-05-09 10:55:19 512,000 -c----w c:\windows\system32\dllcache\jscript.dll
    + 2002-08-28 18:23:06 42,537 -c--a-w c:\windows\system32\dllcache\keyboard.sys
    + 2008-04-14 06:11:38 24,576 -c--a-w c:\windows\system32\dllcache\krnlprov.dll
    + 2008-04-14 06:11:40 19,968 -c--a-w c:\windows\system32\dllcache\log.dll
    - 2006-10-18 19:03:58 100,864 -c--a-w c:\windows\system32\dllcache\logagent.exe
    + 2008-06-17 23:09:22 100,864 -c--a-w c:\windows\system32\dllcache\logagent.exe
    + 2008-04-13 08:36:42 63,744 -c--a-w c:\windows\system32\dllcache\mf.sys
    + 2008-04-14 06:11:40 274,432 -c--a-w c:\windows\system32\dllcache\migism.dll
    + 2008-04-14 06:11:40 261,120 -c--a-w c:\windows\system32\dllcache\migisma.dll
    + 2008-04-14 06:12:18 104,448 -c--a-w c:\windows\system32\dllcache\migload.exe
    + 2008-04-14 06:12:20 241,152 -c--a-w c:\windows\system32\dllcache\migwiza.exe
    + 2004-09-14 13:06:08 68,768 -c--a-w c:\windows\system32\dllcache\mmsystem.dll
    + 2008-04-14 06:12:20 16,896 -c--a-w c:\windows\system32\dllcache\mofcomp.exe
    + 2008-04-13 08:46:24 15,232 -c--a-w c:\windows\system32\dllcache\mpe.sys
    + 2008-04-13 08:39:46 92,544 -c--a-w c:\windows\system32\dllcache\mqac.sys
    + 2008-05-01 14:35:56 331,776 -c--a-w c:\windows\system32\dllcache\msadce.dll
    + 2008-02-23 04:23:00 20,480 -c--a-w c:\windows\system32\dllcache\msadcer.dll
    + 2008-04-14 06:11:40 61,440 -c--a-w c:\windows\system32\dllcache\msadcf.dll
    + 2008-02-23 04:23:00 16,384 -c--a-w c:\windows\system32\dllcache\msadcfr.dll
    + 2008-04-14 06:11:40 143,360 -c--a-w c:\windows\system32\dllcache\msadco.dll
    + 2008-02-23 04:23:00 16,384 -c--a-w c:\windows\system32\dllcache\msadcor.dll
    + 2008-04-14 06:11:40 53,248 -c--a-w c:\windows\system32\dllcache\msadcs.dll
    + 2008-04-14 06:11:40 155,648 -c--a-w c:\windows\system32\dllcache\msadds.dll
    + 2008-02-23 04:23:00 24,576 -c--a-w c:\windows\system32\dllcache\msaddsr.dll
    + 2008-02-23 04:23:00 28,672 -c--a-w c:\windows\system32\dllcache\msader15.dll
    + 2008-04-14 06:11:40 536,576 -c--a-w c:\windows\system32\dllcache\msado15.dll
    + 2008-04-14 06:11:40 180,224 -c--a-w c:\windows\system32\dllcache\msadomd.dll
    + 2008-04-14 06:11:40 57,344 -c--a-w c:\windows\system32\dllcache\msador15.dll
    + 2008-04-14 06:11:40 200,704 -c--a-w c:\windows\system32\dllcache\msadox.dll
    + 2008-04-14 06:11:40 57,344 -c--a-w c:\windows\system32\dllcache\msadrh15.dll
    + 2008-04-14 06:11:40 220,160 -c--a-w c:\windows\system32\dllcache\mscandui.dll
    + 2008-06-24 16:44:24 74,240 -c----w c:\windows\system32\dllcache\mscms.dll
    + 2008-04-14 06:12:20 171,008 -c--a-w c:\windows\system32\dllcache\msconfig.exe
    + 2008-04-14 06:11:40 4,096 -c--a-w c:\windows\system32\dllcache\msdadc.dll
    + 2008-04-14 06:11:40 4,096 -c--a-w c:\windows\system32\dllcache\msdaenum.dll
    + 2008-04-14 06:11:40 4,096 -c--a-w c:\windows\system32\dllcache\msdaer.dll
    + 2008-04-14 06:11:40 233,472 -c--a-w c:\windows\system32\dllcache\msdaora.dll
    + 2008-02-23 04:23:00 16,384 -c--a-w c:\windows\system32\dllcache\msdaorar.dll
    + 2008-04-14 06:11:40 77,824 -c--a-w c:\windows\system32\dllcache\msdaosp.dll
    + 2008-02-23 04:23:02 16,384 -c--a-w c:\windows\system32\dllcache\msdaprsr.dll
    + 2008-04-14 06:11:40 200,704 -c--a-w c:\windows\system32\dllcache\msdaprst.dll
    + 2008-04-14 06:11:40 204,800 -c--a-w c:\windows\system32\dllcache\msdaps.dll
    + 2008-04-14 06:11:40 118,784 -c--a-w c:\windows\system32\dllcache\msdarem.dll
    + 2008-02-23 04:23:02 16,384 -c--a-w c:\windows\system32\dllcache\msdaremr.dll
    + 2008-04-14 06:11:40 4,096 -c--a-w c:\windows\system32\dllcache\msdasc.dll
    + 2008-04-14 06:11:40 315,392 -c--a-w c:\windows\system32\dllcache\msdasql.dll
    + 2008-02-23 04:23:02 16,384 -c--a-w c:\windows\system32\dllcache\msdasqlr.dll
    + 2008-04-14 06:11:40 94,208 -c--a-w c:\windows\system32\dllcache\msdatl3.dll
    + 2008-04-14 06:11:40 20,480 -c--a-w c:\windows\system32\dllcache\msdatt.dll
    + 2008-04-14 06:11:40 4,096 -c--a-w c:\windows\system32\dllcache\msdaurl.dll
    + 2008-04-14 06:11:40 36,864 -c--a-w c:\windows\system32\dllcache\msdfmap.dll
    + 2008-04-14 06:11:40 3,166,208 -c--a-w c:\windows\system32\dllcache\msgr3en.dll
    + 2008-10-16 01:01:58 3,088,896 -c----w c:\windows\system32\dllcache\mshtml.dll
    + 2008-04-14 06:11:42 102,400 -c--a-w c:\windows\system32\dllcache\msjro.dll
    + 2008-04-14 06:11:44 39,936 -c--a-w c:\windows\system32\dllcache\mslwvtts.dll
    + 2008-04-14 06:11:44 122,368 -c--a-w c:\windows\system32\dllcache\msobcomm.dll
    + 2008-04-14 06:11:44 16,384 -c--a-w c:\windows\system32\dllcache\msobdl.dll
    + 2008-04-14 06:11:44 565,760 -c--a-w c:\windows\system32\dllcache\msobmain.dll
    + 2008-04-14 06:11:44 30,720 -c--a-w c:\windows\system32\dllcache\msobshel.dll
    + 2008-04-14 06:11:44 19,456 -c--a-w c:\windows\system32\dllcache\msobweb.dll
    + 2008-04-14 06:12:22 29,184 -c--a-w c:\windows\system32\dllcache\msoobe.exe
    + 2008-04-14 06:11:44 274,432 -c--a-w c:\windows\system32\dllcache\mst120.dll
    + 2008-04-14 06:11:44 57,344 -c--a-w c:\windows\system32\dllcache\mst123.dll
    + 2008-06-20 17:47:56 246,784 -c----w c:\windows\system32\dllcache\mswsock.dll
    + 2008-04-14 06:11:44 24,576 -c--a-w c:\windows\system32\dllcache\msxactps.dll
    - 2008-04-14 06:11:44 1,306,624 -c----w c:\windows\system32\dllcache\msxml6.dll
    + 2008-09-10 01:15:51 1,307,648 -c----w c:\windows\system32\dllcache\msxml6.dll
    + 2008-04-13 08:43:56 12,672 -c--a-w c:\windows\system32\dllcache\mutohpen.sys
    + 2008-04-14 06:11:44 221,184 -c--a-w c:\windows\system32\dllcache\nac.dll
    + 2008-04-14 06:11:44 57,344 -c--a-w c:\windows\system32\dllcache\ndisnpp.dll
    + 2008-10-15 16:37:15 337,408 -c----w c:\windows\system32\dllcache\netapi32.dll
    + 2008-04-13 08:51:26 61,824 -c--a-w c:\windows\system32\dllcache\nic1394.sys
    + 2008-04-14 06:11:44 229,376 -c--a-w c:\windows\system32\dllcache\nmas.dll
    + 2008-04-14 06:11:44 28,672 -c--a-w c:\windows\system32\dllcache\nmasnt.dll
    + 2008-04-14 06:11:44 81,920 -c--a-w c:\windows\system32\dllcache\nmchat.dll
    + 2008-04-14 06:11:44 77,824 -c--a-w c:\windows\system32\dllcache\nmcom.dll
    + 2008-04-14 06:11:44 151,552 -c--a-w c:\windows\system32\dllcache\nmft.dll
    + 2008-04-13 08:53:10 40,320 -c--a-w c:\windows\system32\dllcache\nmnt.sys
    + 2008-04-14 06:11:44 172,032 -c--a-w c:\windows\system32\dllcache\nmoldwb.dll
    + 2008-04-14 06:12:24 15,360 -c--a-w c:\windows\system32\dllcache\nppagent.exe
    + 2008-04-14 06:11:44 212,992 -c--a-w c:\windows\system32\dllcache\ntevt.dll
    + 2004-08-03 19:45:26 33,920 -c--a-w c:\windows\system32\dllcache\ntio.sys
    + 2008-08-14 13:25:40 2,147,840 -c----w c:\windows\system32\dllcache\ntkrnlmp.exe
    + 2008-08-14 13:25:43 2,068,352 -c----w c:\windows\system32\dllcache\ntkrnlpa.exe
    + 2008-08-14 13:24:57 2,026,496 -c----w c:\windows\system32\dllcache\ntkrpamp.exe
    + 2008-08-14 13:25:41 2,191,488 -c----w c:\windows\system32\dllcache\ntoskrnl.exe
    + 2008-04-13 08:56:08 88,320 -c--a-w c:\windows\system32\dllcache\nwlnkipx.sys
    + 2008-04-13 08:34:14 163,584 -c--a-w c:\windows\system32\dllcache\nwrdr.sys
    + 2008-04-14 06:11:46 104,448 -c--a-w c:\windows\system32\dllcache\oeimport.dll
    + 2008-04-14 06:12:24 60,416 -c--a-w c:\windows\system32\dllcache\oemig50.exe
    + 2008-04-14 06:11:46 35,328 -c--a-w c:\windows\system32\dllcache\oemiglib.dll
    + 2008-04-14 06:11:46 65,536 -c--a-w c:\windows\system32\dllcache\oledb32r.dll
    + 2008-04-14 06:12:24 51,712 -c--a-w c:\windows\system32\dllcache\oobebaln.exe
    + 2008-04-14 06:11:46 92,672 -c--a-w c:\windows\system32\dllcache\policman.dll
    + 2006-10-14 14:44:44 671,744 -c----w c:\windows\system32\dllcache\PrintFilterPipelineSvc.exe
    + 2008-04-14 06:11:46 237,056 -c--a-w c:\windows\system32\dllcache\provthrd.dll
    + 2008-05-07 05:12:01 1,288,704 -c----w c:\windows\system32\dllcache\quartz.dll
    + 2008-05-08 14:02:52 203,136 -c----w c:\windows\system32\dllcache\rmcast.sys
    + 2008-04-13 08:56:50 30,592 -c--a-w c:\windows\system32\dllcache\rndismp.sys
    + 2008-04-13 08:56:50 30,592 -c--a-w c:\windows\system32\dllcache\rndismpx.sys
    + 2008-04-14 06:11:46 61,440 -c--a-w c:\windows\system32\dllcache\rrcm.dll
    + 2008-04-14 06:11:46 741,376 -c--a-w c:\windows\system32\dllcache\sapi.dll
    + 2008-04-14 06:12:28 36,352 -c--a-w c:\windows\system32\dllcache\scrcons.exe
    + 2008-04-14 06:11:46 216,576 -c--a-w c:\windows\system32\dllcache\script.dll
    + 2008-04-14 06:11:46 199,680 -c--a-w c:\windows\system32\dllcache\scripta.dll
    + 2008-05-09 10:55:19 180,224 -c----w c:\windows\system32\dllcache\scrobj.dll
    + 2008-05-09 10:55:19 172,032 -c----w c:\windows\system32\dllcache\scrrun.dll
    + 2008-04-13 08:36:46 79,232 -c--a-w c:\windows\system32\dllcache\sdbus.sys
    + 2008-04-14 06:11:46 221,696 -c--a-w c:\windows\system32\dllcache\seo.dll
    + 2008-04-14 06:12:28 23,040 -c--a-w c:\windows\system32\dllcache\setup.exe
    + 2008-04-13 08:40:48 11,904 -c--a-w c:\windows\system32\dllcache\sffdisk.sys
    + 2008-04-13 08:40:48 11,008 -c--a-w c:\windows\system32\dllcache\sffp_sd.sys
    + 2008-10-16 01:01:57 1,498,624 -c----w c:\windows\system32\dllcache\shdocvw.dll
    + 2008-04-14 06:11:46 3,901 -c--a-w c:\windows\system32\dllcache\siint5.dll
    + 2008-04-13 08:36:40 40,960 -c--a-w c:\windows\system32\dllcache\sisagp.sys
    + 2008-04-13 08:36:36 5,888 -c--a-w c:\windows\system32\dllcache\smbali.sys
    + 2008-04-14 06:11:46 189,440 -c--a-w c:\windows\system32\dllcache\smtpadm.dll
    + 2008-04-14 06:11:46 2,134,528 -c--a-w c:\windows\system32\dllcache\smtpsnap.dll
    + 2008-04-14 06:11:46 34,816 -c--a-w c:\windows\system32\dllcache\sniffpol.dll
    + 2008-04-14 06:11:46 130,048 -c--a-w c:\windows\system32\dllcache\softkbd.dll
    + 2008-04-13 08:46:08 25,344 -c--a-w c:\windows\system32\dllcache\sonydcam.sys
    + 2008-04-13 06:43:20 62,976 -c--a-w c:\windows\system32\dllcache\spgrmr.dll
    + 2008-04-14 06:11:54 151,552 -c--a-w c:\windows\system32\dllcache\sqldb20.dll
    + 2008-04-14 06:11:54 462,848 -c--a-w c:\windows\system32\dllcache\sqlqp20.dll
    + 2008-04-14 06:11:54 110,592 -c--a-w c:\windows\system32\dllcache\sqlse20.dll
    + 2008-04-14 06:11:54 217,088 -c--a-w c:\windows\system32\dllcache\sqlxmlx.dll
    + 2008-09-08 10:41:42 333,824 -c----w c:\windows\system32\dllcache\srv.sys
    + 2008-04-14 06:11:56 33,280 -c--a-w c:\windows\system32\dllcache\sstub.dll
    + 2008-04-14 06:11:56 86,528 -c--a-w c:\windows\system32\dllcache\stdprov.dll
    - 2008-04-14 06:11:56 246,814 -c----w c:\windows\system32\dllcache\strmdll.dll
    + 2008-10-03 10:03:58 247,326 -c----w c:\windows\system32\dllcache\strmdll.dll
    + 2008-04-14 06:11:56 193,536 -c--a-w c:\windows\system32\dllcache\sysmod.dll
    + 2008-04-14 06:11:56 173,568 -c--a-w c:\windows\system32\dllcache\sysmoda.dll
    + 2008-04-13 08:40:52 14,976 -c--a-w c:\windows\system32\dllcache\tape.sys
    + 2008-06-20 11:51:12 361,600 -c----w c:\windows\system32\dllcache\tcpip.sys
    + 2008-06-20 11:08:27 225,856 -c----w c:\windows\system32\dllcache\tcpip6.sys
    + 2008-04-14 06:11:56 153,088 -c--a-w c:\windows\system32\dllcache\triedit.dll
    + 2008-04-14 06:11:56 279,040 -c--a-w c:\windows\system32\dllcache\tshoot.dll
    + 2008-04-13 08:56:02 12,288 -c--a-w c:\windows\system32\dllcache\tunmp.sys
    + 2008-04-14 06:12:32 151,040 -c--a-w c:\windows\system32\dllcache\uploadm.exe
    + 2008-10-16 01:01:57 619,008 -c----w c:\windows\system32\dllcache\urlmon.dll
    + 2008-04-13 08:56:50 12,800 -c--a-w c:\windows\system32\dllcache\usb8023.sys
    + 2008-04-13 08:56:50 12,800 -c--a-w c:\windows\system32\dllcache\usb8023x.sys
    + 2008-04-13 08:45:42 25,600 -c--a-w c:\windows\system32\dllcache\usbcamd.sys
    + 2008-04-13 08:45:42 25,728 -c--a-w c:\windows\system32\dllcache\usbcamd2.sys
    + 2008-04-13 08:45:44 15,872 -c--a-w c:\windows\system32\dllcache\usbintel.sys
    + 2008-04-13 08:46:22 121,984 -c--a-w c:\windows\system32\dllcache\usbvideo.sys
    + 2008-04-25 16:41:40 218,624 -c--a-w c:\windows\system32\dllcache\uxtheme.dll
    + 2008-04-14 06:11:56 85,504 -c--a-w c:\windows\system32\dllcache\wabimp.dll
    + 2008-04-14 06:12:34 30,208 -c--a-w c:\windows\system32\dllcache\wabmig.exe
    + 2008-04-13 08:43:56 14,208 -c--a-w c:\windows\system32\dllcache\wacompen.sys
    + 2008-04-14 06:11:58 197,632 -c--a-w c:\windows\system32\dllcache\wbemcntl.dll
    + 2008-04-14 06:11:58 178,176 -c--a-w c:\windows\system32\dllcache\wbemdisp.dll
    + 2008-04-14 06:11:58 42,496 -c--a-w c:\windows\system32\dllcache\wbemperf.dll
    + 2008-04-14 06:12:34 117,248 -c--a-w c:\windows\system32\dllcache\wbemtest.exe
    + 2008-04-14 06:11:58 197,120 -c--a-w c:\windows\system32\dllcache\wbemupgd.dll
    + 2008-05-09 10:55:19 430,080 -c----w c:\windows\system32\dllcache\vbscript.dll
    + 2008-04-14 06:11:56 11,325 -c--a-w c:\windows\system32\dllcache\vchnt5.dll
    + 2008-04-14 06:11:56 851,968 -c--a-w c:\windows\system32\dllcache\vgx.dll
    + 2008-04-14 06:11:56 131,584 -c--a-w c:\windows\system32\dllcache\viewprov.dll
    + 2008-09-15 15:27:14 1,846,656 -c----w c:\windows\system32\dllcache\win32k.sys
    + 2008-10-16 01:01:57 666,112 -c----w c:\windows\system32\dllcache\wininet.dll
    + 2008-04-14 06:12:38 146,944 -c--a-w c:\windows\system32\dllcache\winspool.drv
    + 2008-04-14 06:11:58 88,576 -c--a-w c:\windows\system32\dllcache\wmiaprpl.dll
    + 2008-04-14 06:12:36 358,912 -c--a-w c:\windows\system32\dllcache\wmic.exe
    + 2008-04-14 06:11:58 60,928 -c--a-w c:\windows\system32\dllcache\wmicookr.dll
    + 2008-04-14 06:11:58 140,800 -c--a-w c:\windows\system32\dllcache\wmidcprv.dll
    + 2008-04-14 06:11:58 132,096 -c--a-w c:\windows\system32\dllcache\wmipdskq.dll
    + 2008-04-14 06:11:58 61,952 -c--a-w c:\windows\system32\dllcache\wmipiprt.dll
    + 2008-04-14 06:11:58 62,464 -c--a-w c:\windows\system32\dllcache\wmipjobj.dll
    + 2008-04-14 06:11:58 41,472 -c--a-w c:\windows\system32\dllcache\wmipsess.dll
    + 2008-04-14 06:11:58 167,936 -c--a-w c:\windows\system32\dllcache\wmm2ae.dll
    + 2008-04-14 06:11:58 4,096 -c--a-w c:\windows\system32\dllcache\wmm2eres.dll
    + 2008-04-14 06:11:58 7,680 -c--a-w c:\windows\system32\dllcache\wmm2ext.dll
    + 2008-04-14 06:11:58 402,432 -c--a-w c:\windows\system32\dllcache\wmm2filt.dll
    + 2008-04-14 06:11:58 502,272 -c--a-w c:\windows\system32\dllcache\wmm2fxa.dll
    + 2008-04-14 06:11:58 325,632 -c--a-w c:\windows\system32\dllcache\wmm2fxb.dll
    + 2008-04-14 06:11:58 4,268,032 -c--a-w c:\windows\system32\dllcache\wmm2res.dll
    + 2008-04-14 06:11:58 5,632 -c--a-w c:\windows\system32\dllcache\wmm2res2.dll
    - 2006-10-18 20:47:20 937,984 -c--a-w c:\windows\system32\dllcache\WMNetMgr.dll
    + 2008-06-18 03:03:08 938,496 -c--a-w c:\windows\system32\dllcache\WMNetmgr.dll
    - 2006-10-18 20:47:22 2,450,944 -c--a-w c:\windows\system32\dllcache\wmvcore.dll
    + 2008-06-18 03:03:14 2,458,112 -c--a-w c:\windows\system32\dllcache\WMVCore.dll
    + 2008-05-08 11:24:44 155,648 -c----w c:\windows\system32\dllcache\wscript.exe
    + 2008-05-09 10:55:19 90,112 -c----w c:\windows\system32\dllcache\wshext.dll
    - 2007-07-30 16:19:36 549,720 -c--a-w c:\windows\system32\dllcache\wuapi.dll
    + 2008-10-16 12:12:20 561,688 -c--a-w c:\windows\system32\dllcache\wuapi.dll
    - 2007-07-30 16:19:16 53,080 -c--a-w c:\windows\system32\dllcache\wuauclt.exe
    + 2008-10-16 12:09:44 51,224 -c--a-w c:\windows\system32\dllcache\wuauclt.exe
    - 2007-07-30 16:19:42 1,712,984 -c--a-w c:\windows\system32\dllcache\wuaueng.dll
    + 2008-10-16 12:13:40 1,809,944 -c--a-w c:\windows\system32\dllcache\wuaueng.dll
    - 2007-07-30 16:19:32 325,976 -c--a-w c:\windows\system32\dllcache\wucltui.dll
    + 2008-10-16 12:12:22 323,608 -c--a-w c:\windows\system32\dllcache\wucltui.dll
    - 2007-07-30 16:18:40 33,624 -c--a-w c:\windows\system32\dllcache\wups.dll
    + 2008-10-16 12:08:58 34,328 -c--a-w c:\windows\system32\dllcache\wups.dll
    - 2007-07-30 16:19:28 203,096 -c--a-w c:\windows\system32\dllcache\wuweb.dll
    + 2008-10-16 12:13:40 202,776 -c--a-w c:\windows\system32\dllcache\wuweb.dll
    + 2006-10-14 18:21:58 580,352 -c----w c:\windows\system32\dllcache\XPSSHHDR.dll
    + 2006-10-14 18:22:00 1,698,048 -c----w c:\windows\system32\dllcache\XpsSvcs.dll
    - 2008-04-14 06:11:34 147,968 ----a-w c:\windows\system32\dnsapi.dll
    + 2008-06-20 17:47:56 147,968 ----a-w c:\windows\system32\dnsapi.dll
    + 2008-07-19 14:32:15 26,944 ----a-w c:\windows\system32\drivers\aavmker4.sys
    - 2008-04-13 09:19:24 138,112 ----a-w c:\windows\system32\drivers\afd.sys
    + 2008-08-14 10:04:36 138,496 ----a-w c:\windows\system32\drivers\afd.sys
    + 2008-07-19 14:37:42 20,560 ----a-w c:\windows\system32\drivers\aswFsBlk.sys
    + 2008-01-17 16:34:01 93,264 ----a-w c:\windows\system32\drivers\aswmon.sys
    + 2008-07-19 14:37:21 94,416 ----a-w c:\windows\system32\drivers\aswmon2.sys
    + 2008-07-19 14:33:42 23,152 ----a-w c:\windows\system32\drivers\aswRdr.sys
    + 2008-07-19 14:35:18 78,416 ----a-w c:\windows\system32\drivers\aswSP.sys
    + 2008-07-19 14:32:36 42,912 ----a-w c:\windows\system32\drivers\aswTdi.sys
    - 2006-07-19 02:26:11 45,056 -c--a-w c:\windows\system32\drivers\ati2erec.dll
    + 2008-09-24 01:18:10 53,248 ----a-w c:\windows\system32\drivers\ati2erec.dll
    - 2006-07-19 02:58:14 1,621,504 ----a-w c:\windows\system32\drivers\ati2mtag.sys
    + 2008-09-24 03:09:07 3,331,072 ----a-w c:\windows\system32\drivers\ati2mtag.sys
    - 2007-07-11 11:37:26 6,272 ----a-w c:\windows\system32\drivers\AWRTPD.sys
    + 2008-04-29 08:19:50 12,960 ----a-w c:\windows\system32\drivers\Awrtpd.sys
    - 2007-08-07 10:58:08 8,320 ----a-w c:\windows\system32\drivers\AWRTRD.sys
    + 2008-04-29 08:19:54 15,648 ----a-w c:\windows\system32\drivers\Awrtrd.sys
    + 2005-06-08 15:44:20 20,608 ----a-w c:\windows\system32\drivers\BRGSp50.sys
    + 2005-06-08 15:44:42 29,184 ----a-w c:\windows\system32\drivers\BRGSp50a64.sys
    - 2008-04-14 05:40:48 272,896 ------w c:\windows\system32\drivers\bthport.sys
    + 2008-06-14 17:34:47 272,128 ------w c:\windows\system32\drivers\bthport.sys
    - 2007-08-07 10:56:58 9,344 ----a-w c:\windows\system32\drivers\NSDriver.sys
    + 2008-04-29 08:20:00 15,648 ----a-w c:\windows\system32\drivers\NSDriver.sys
    - 2005-04-06 00:22:28 33,536 ----a-w c:\windows\system32\drivers\NVENETFD.sys
    + 2008-08-01 08:36:00 54,784 ----a-w c:\windows\system32\drivers\NVENETFD.sys
    + 2008-08-18 15:54:00 145,952 ----a-w c:\windows\system32\drivers\nvgts.sys
    - 2005-04-06 00:22:30 12,928 ----a-w c:\windows\system32\drivers\nvnetbus.sys
    + 2008-08-01 08:36:00 22,016 ----a-w c:\windows\system32\drivers\nvnetbus.sys
    - 2005-04-06 00:22:12 261,888 ----a-w c:\windows\system32\drivers\nvnrm.sys
    + 2008-08-01 08:35:00 955,520 ----a-w c:\windows\system32\drivers\nvnrm.sys
    + 2008-07-07 22:45:00 4,984 ----a-w c:\windows\system32\drivers\nvphy.bin
    - 2008-04-13 08:55:10 202,624 ----a-w c:\windows\system32\drivers\rmcast.sys
    + 2008-05-08 14:02:52 203,136 ----a-w c:\windows\system32\drivers\rmcast.sys
    - 2006-10-28 07:43:13 611,064 ----a-w c:\windows\system32\drivers\sptd.sys
    + 2008-07-08 14:56:40 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
    - 2008-04-13 09:15:12 334,848 ----a-w c:\windows\system32\drivers\srv.sys
    + 2008-09-08 10:41:42 333,824 ----a-w c:\windows\system32\drivers\srv.sys
    - 2008-04-13 09:20:18 361,344 ----a-w c:\windows\system32\drivers\tcpip.sys
    + 2008-06-20 11:51:12 361,600 ----a-w c:\windows\system32\drivers\tcpip.sys
    - 2008-04-13 09:00:04 225,664 ----a-w c:\windows\system32\drivers\tcpip6.sys
    + 2008-06-20 11:08:27 225,856 ----a-w c:\windows\system32\drivers\tcpip6.sys
    - 2008-03-06 08:19:36 534,016 ----a-w c:\windows\system32\drivers\UMDF\PCCSWpdDriver.dll
    + 2008-05-20 07:37:00 525,824 ----a-w c:\windows\system32\drivers\UMDF\PCCSWpdDriver.dll
    + 2004-10-25 10:40:58 17,664 ----a-w c:\windows\system32\drivers\ZDPSp50.sys
    + 2005-03-18 12:35:28 31,744 ----a-w c:\windows\system32\drivers\ZDPSp50a64.sys
    + 2008-05-07 05:38:20 17,536 -c--a-w c:\windows\system32\DRVSTORE\ccdcmb_8BBEC91EFF51E4A1A9EC754A696F267BFDD220D5\ccdcmb.sys
    + 2008-05-07 05:38:24 90,624 -c--a-w c:\windows\system32\DRVSTORE\ccdcmb_8BBEC91EFF51E4A1A9EC754A696F267BFDD220D5\nmwcdcls.dll
    + 2008-05-07 05:38:34 659,968 -c--a-w c:\windows\system32\DRVSTORE\ccdcmb_8BBEC91EFF51E4A1A9EC754A696F267BFDD220D5\nmwcdcocls.dll
    + 2008-05-07 05:39:22 1,419,232 -c--a-w c:\windows\system32\DRVSTORE\ccdcmb_8BBEC91EFF51E4A1A9EC754A696F267BFDD220D5\wdfcoinstaller01005.dll
    + 2008-05-07 05:38:36 8,064 -c--a-w c:\windows\system32\DRVSTORE\ccdcmbcj_8BBEC91EFF51E4A1A9EC754A696F267BFDD220D5\usbser_lowerfltj.sys
    + 2008-06-06 07:24:44 8,064 -c--a-w c:\windows\system32\DRVSTORE\ccdcmbm_8BBEC91EFF51E4A1A9EC754A696F267BFDD220D5\usbser_lowerflt.sys
    + 2008-05-07 05:38:20 20,864 -c--a-w c:\windows\system32\DRVSTORE\ccdcmbo_8BBEC91EFF51E4A1A9EC754A696F267BFDD220D5\ccdcmbo.sys
    + 2008-05-20 07:37:00 525,824 -c--a-w c:\windows\system32\DRVSTORE\pccswpddri_66268C3E0C6968D7F539EAEAD801C68E0DB54FE9\PCCSWpdDriver.dll
    + 2008-05-20 07:32:30 831,048 -c--a-w c:\windows\system32\DRVSTORE\pccswpddri_66268C3E0C6968D7F539EAEAD801C68E0DB54FE9\WudfUpdate_01005.dll
    + 2006-10-20 19:29:46 69,408 ----a-w c:\windows\system32\dxva2.dll
    - 2008-04-14 06:11:36 246,272 ----a-w c:\windows\system32\es.dll
    + 2008-07-07 20:28:49 253,952 ----a-w c:\windows\system32\es.dll
    + 2006-10-20 19:30:00 478,496 ----a-w c:\windows\system32\evr.dll
    - 2005-04-05 19:19:30 201,728 -c--a-w c:\windows\system32\fdco1.dll
    + 2008-08-01 08:35:00 200,704 ----a-w c:\windows\system32\fdco1.dll
    - 2005-04-06 00:19:30 201,728 -c--a-w c:\windows\system32\fdco1ins.dll
    + 2008-08-01 08:35:00 200,704 ----a-w c:\windows\system32\fdco1ins.dll
    - 2008-05-26 07:34:14 223,224 ----a-w c:\windows\system32\FNTCACHE.DAT
    + 2008-11-01 06:47:01 153,976 ----a-w c:\windows\system32\FNTCACHE.DAT
    - 2008-04-14 06:11:36 285,184 ----a-w c:\windows\system32\gdi32.dll
    + 2008-10-23 12:38:22 286,720 ----a-w c:\windows\system32\gdi32.dll
    + 2006-10-30 01:33:58 556,296 ----a-w c:\windows\system32\icardagt.exe
    + 2006-10-30 01:33:58 9,480 ----a-w c:\windows\system32\icardres.dll
    - 2008-04-14 06:11:38 691,712 ----a-w c:\windows\system32\inetcomm.dll
    + 2008-04-11 19:05:25 691,712 ----a-w c:\windows\system32\inetcomm.dll
    + 2006-10-30 01:33:58 83,968 ----a-w c:\windows\system32\infocardapi.dll
    + 2004-03-23 13:38:00 28,672 ----a-w c:\windows\system32\InsDrvZD.dll
    + 2005-07-12 11:44:42 15,872 ----a-w c:\windows\system32\InsDrvZD64.DLL
    - 2008-02-21 23:23:35 135,168 ----a-w c:\windows\system32\java.exe
    + 2008-06-09 22:21:01 135,168 ----a-w c:\windows\system32\java.exe
    - 2008-02-21 23:23:39 135,168 ----a-w c:\windows\system32\javaw.exe
    + 2008-06-09 22:21:04 135,168 ----a-w c:\windows\system32\javaw.exe
    - 2008-02-22 00:33:32 139,264 ----a-w c:\windows\system32\javaws.exe
    + 2008-06-09 23:32:34 139,264 ----a-w c:\windows\system32\javaws.exe
    - 2008-04-14 06:11:38 512,000 ----a-w c:\windows\system32\jscript.dll
    + 2008-05-09 10:55:19 512,000 ----a-w c:\windows\system32\jscript.dll
    - 2006-10-18 19:03:58 100,864 ----a-w c:\windows\system32\logagent.exe
    + 2008-06-17 23:09:22 100,864 ----a-w c:\windows\system32\logagent.exe
    - 2007-12-14 09:32:52 12,632 ----a-w c:\windows\system32\lsdelete.exe
    + 2008-05-16 08:58:04 12,632 ----a-w c:\windows\system32\lsdelete.exe
    - 2007-11-21 00:52:38 2,884,992 ----a-w c:\windows\system32\Macromed\Flash\NPSWF32.dll
    + 2008-03-25 03:21:18 2,889,088 ----a-w c:\windows\system32\Macromed\Flash\NPSWF32.dll
    - 2007-11-21 00:52:40 218,496 -c--a-w c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
    + 2008-03-25 03:21:20 218,496 -c--a-w c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
    - 2008-02-08 08:40:25 70,264 ----a-w c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
    + 2008-06-10 16:01:09 70,264 ----a-w c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
    - 2007-08-07 11:35:56 585,728 -c--a-w c:\windows\system32\Macromed\Shockwave 10\Control.dll
    + 2008-03-14 20:29:22 581,632 ----a-w c:\windows\system32\Macromed\Shockwave 10\Control.dll
    + 2008-03-14 20:12:30 1,490,944 ----a-w c:\windows\system32\Macromed\Shockwave 10\dirapiX.dll
    - 2007-08-07 11:36:32 24,576 -c--a-w c:\windows\system32\Macromed\Shockwave 10\DynaPlayer.dll
    + 2008-03-14 20:29:58 24,576 ----a-w c:\windows\system32\Macromed\Shockwave 10\DynaPlayer.dll
    + 2008-03-14 20:10:06 606,208 ----a-w c:\windows\system32\Macromed\Shockwave 10\iml32X.dll
    - 2007-08-07 11:35:22 339,968 -c--a-w c:\windows\system32\Macromed\Shockwave 10\Plugin.dll
    + 2008-03-14 20:28:48 339,968 ----a-w c:\windows\system32\Macromed\Shockwave 10\Plugin.dll
    - 2007-08-07 11:35:32 483,328 -c--a-w c:\windows\system32\Macromed\Shockwave 10\PluginPing.dll
    + 2008-03-14 20:28:56 475,136 ----a-w c:\windows\system32\Macromed\Shockwave 10\PluginPing.dll
    - 2007-08-07 11:28:38 180,224 -c--a-w c:\windows\system32\Macromed\Shockwave 10\Proj.dll
    + 2008-03-14 20:21:52 180,224 ----a-w c:\windows\system32\Macromed\Shockwave 10\Proj.dll
    - 2007-08-07 11:37:56 77,824 -c--a-w c:\windows\system32\Macromed\Shockwave 10\SwInit.exe
    + 2008-03-14 20:31:28 77,824 ----a-w c:\windows\system32\Macromed\Shockwave 10\SwInit.exe
    + 2008-03-15 08:38:08 86,016 ----a-w c:\windows\system32\Macromed\Shockwave 10\SwMenuX.dll
    - 2007-08-07 11:37:58 98,304 -c--a-w c:\windows\system32\Macromed\Shockwave 10\SwOnce.dll
    + 2008-03-14 20:31:28 98,304 ----a-w c:\windows\system32\Macromed\Shockwave 10\SwOnce.dll
    + 2006-10-20 19:30:06 1,980,704 ----a-w c:\windows\system32\milcore.dll
    - 2008-05-09 21:35:04 16,863,864 ----a-w c:\windows\system32\MRT.exe
    + 2008-12-09 23:24:37 17,593,280 ----a-w c:\windows\system32\MRT.exe
    - 2008-04-14 06:11:40 73,728 ----a-w c:\windows\system32\mscms.dll
    + 2008-06-24 16:44:24 74,240 ----a-w c:\windows\system32\mscms.dll
    - 2008-04-14 06:11:40 3,066,880 ----a-w c:\windows\system32\mshtml.dll
    + 2008-10-16 01:01:58 3,088,896 ----a-w c:\windows\system32\mshtml.dll
    + 2007-04-30 14:50:50 903,072 ----a-w c:\windows\system32\msidcrl40.dll
    - 2008-04-14 06:11:44 246,784 ----a-w c:\windows\system32\mswsock.dll
    + 2008-06-20 17:47:56 246,784 ----a-w c:\windows\system32\mswsock.dll
    - 2008-04-14 06:11:44 1,104,896 ----a-w c:\windows\system32\msxml3.dll
    + 2008-09-04 17:16:38 1,106,944 ----a-w c:\windows\system32\msxml3.dll
    - 2007-05-08 12:03:04 1,275,392 ----a-w c:\windows\system32\msxml4.dll
    + 2008-09-30 14:43:34 1,286,152 ----a-w c:\windows\system32\msxml4.dll
    - 2008-04-14 06:11:44 1,306,624 ----a-w c:\windows\system32\msxml6.dll
    + 2008-09-10 01:15:51 1,307,648 ----a-w c:\windows\system32\msxml6.dll
    - 2007-07-30 17:19:10 271,224 ----a-w c:\windows\system32\mucltui.dll
    + 2008-10-16 12:06:48 268,648 ----a-w c:\windows\system32\mucltui.dll
    - 2007-07-30 17:19:04 207,736 ----a-w c:\windows\system32\muweb.dll
    + 2008-10-16 12:06:48 208,744 ----a-w c:\windows\system32\muweb.dll
    - 2008-04-14 06:11:44 337,408 ----a-w c:\windows\system32\netapi32.dll
    + 2008-10-15 16:37:15 337,408 ----a-w c:\windows\system32\netapi32.dll
    - 2007-11-29 07:32:38 48,128 ----a-w c:\windows\system32\nmwcdcls.dll
    + 2008-05-07 05:38:24 90,624 ----a-w c:\windows\system32\nmwcdcls.dll
    - 2008-04-14 05:49:32 2,068,224 ----a-w c:\windows\system32\ntkrnlpa.exe
    + 2008-08-14 13:25:43 2,068,352 ----a-w c:\windows\system32\ntkrnlpa.exe
    - 2008-04-14 05:49:54 2,191,360 ----a-w c:\windows\system32\ntoskrnl.exe
    + 2008-08-14 13:25:41 2,191,488 ----a-w c:\windows\system32\ntoskrnl.exe
    - 2005-04-04 11:00:26 32,256 -c--a-w c:\windows\system32\nvconrm.dll
    + 2008-07-29 10:33:00 122,880 ----a-w c:\windows\system32\nvconrm.dll
    + 2008-08-20 15:35:00 122,880 ----a-w c:\windows\system32\NVCOSMB.DLL
    + 2008-08-18 15:54:00 372,256 ----a-w c:\windows\system32\nvraidco.dll
    + 2008-08-18 15:54:00 372,256 ----a-w c:\windows\system32\nvraiins.dll
    + 2008-08-18 15:54:00 15,904 ----a-w c:\windows\system32\NvRCoAr.dll
    + 2008-08-18 15:54:00 15,904 ----a-w c:\windows\system32\NvRCoCs.dll
    + 2008-08-18 15:54:00 16,416 ----a-w c:\windows\system32\NvRCoDa.dll
    + 2008-08-18 15:54:00 16,416 ----a-w c:\windows\system32\NvRCoDe.dll
    + 2008-08-18 15:54:00 16,928 ----a-w c:\windows\system32\NvRCoEl.dll
    + 2008-08-18 15:54:00 15,904 ----a-w c:\windows\system32\NvRCoEng.dll
    + 2008-08-18 15:54:00 15,904 ----a-w c:\windows\system32\NvRCoENU.dll
    + 2008-08-18 15:54:00 16,928 ----a-w c:\windows\system32\NvRCoEs.dll
    + 2008-08-18 15:54:00 16,928 ----a-w c:\windows\system32\NvRCoEsm.dll
    + 2008-08-18 15:54:00 16,416 ----a-w c:\windows\system32\NvRCoFi.dll
    + 2008-08-18 15:54:00 16,928 ----a-w c:\windows\system32\NvRCoFr.dll
    + 2008-08-18 15:54:00 15,392 ----a-w c:\windows\system32\NvRCoHe.dll
    + 2008-08-18 15:54:00 16,416 ----a-w c:\windows\system32\NvRCoHu.dll
    + 2008-08-18 15:54:00 16,928 ----a-w c:\windows\system32\NvRCoIt.dll
    + 2008-08-18 15:54:00 14,880 ----a-w c:\windows\system32\NvRCoJa.dll
    + 2008-08-18 15:54:00 14,368 ----a-w c:\windows\system32\NvRCoKo.dll
    + 2008-08-18 15:54:00 16,416 ----a-w c:\windows\system32\NvRCoNl.dll
    + 2008-08-18 15:54:00 16,416 ----a-w c:\windows\system32\NvRCoNo.dll
    + 2008-08-18 15:54:00 16,416 ----a-w c:\windows\system32\NvRCoPl.dll
    + 2008-08-18 15:54:00 16,928 ----a-w c:\windows\system32\NvRCoPt.dll
    + 2008-08-18 15:54:00 16,928 ----a-w c:\windows\system32\NvRCoPtb.dll
    + 2008-08-18 15:54:00 16,416 ----a-w c:\windows\system32\NvRCoRu.dll
    + 2008-08-18 15:54:00 16,416 ----a-w c:\windows\system32\NvRCoSk.dll
    + 2008-08-18 15:54:00 16,416 ----a-w c:\windows\system32\NvRCoSl.dll
    + 2008-08-18 15:54:00 16,416 ----a-w c:\windows\system32\NvRCoSv.dll
    + 2008-08-18 15:54:00 15,904 ----a-w c:\windows\system32\NvRCoTh.dll
    + 2008-08-18 15:54:00 16,416 ----a-w c:\windows\system32\NvRCoTr.dll
    + 2008-08-18 15:54:00 13,856 ----a-w c:\windows\system32\NvRCoZhc.dll
    + 2008-08-18 15:54:00 13,856 ----a-w c:\windows\system32\NvRCoZht.dll
    - 2005-09-28 08:08:08 176,128 ----a-w c:\windows\system32\NVUNINST.EXE
    + 2008-08-27 10:58:46 453,152 ----a-w c:\windows\system32\NVUNINST.EXE
    - 2005-09-28 08:08:08 176,128 -c--a-w c:\windows\system32\nvunrm.exe
    + 2008-07-29 10:33:00 446,464 ----a-w c:\windows\system32\nvunrm.exe
    - 2005-09-28 08:08:08 176,128 -c--a-w c:\windows\system32\nvusmb.exe
    + 2008-08-20 15:35:00 453,152 ----a-w c:\windows\system32\nvusmb.exe
    - 2006-07-19 02:53:09 77,824 -c--a-w c:\windows\system32\Oemdspif.dll
    + 2008-09-24 02:06:53 143,360 ----a-w c:\windows\system32\Oemdspif.dll
    - 2008-05-30 04:27:14 58,596 ----a-w c:\windows\system32\perfc009.dat
    + 2008-12-12 19:49:18 66,376 ----a-w c:\windows\system32\perfc009.dat
    - 2008-05-30 04:27:14 70,990 ----a-w c:\windows\system32\perfc00B.dat
    + 2008-12-12 19:49:18 78,770 ----a-w c:\windows\system32\perfc00B.dat
    - 2008-05-30 04:27:14 392,296 ----a-w c:\windows\system32\perfh009.dat
    + 2008-12-12 19:49:18 427,592 ----a-w c:\windows\system32\perfh009.dat
    - 2008-05-30 04:27:14 366,492 ----a-w c:\windows\system32\perfh00B.dat
    + 2008-12-12 19:49:18 401,328 ----a-w c:\windows\system32\perfh00B.dat
    + 2006-10-20 19:29:52 104,224 ----a-w c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
    + 2006-10-20 19:29:58 344,352 ----a-w c:\windows\system32\PresentationHost.exe
    + 2006-10-20 19:29:46 20,768 ----a-w c:\windows\system32\PresentationHostProxy.dll
    + 2006-10-20 19:30:02 769,312 ----a-w c:\windows\system32\PresentationNative_v0300.dll
    + 2006-10-14 14:43:38 124,416 ------w c:\windows\system32\prntvpt.dll
    - 2008-04-14 06:11:46 1,288,704 ----a-w c:\windows\system32\quartz.dll
    + 2008-05-07 05:12:01 1,288,704 ----a-w c:\windows\system32\quartz.dll
    + 2006-02-22 00:05:00 1,830,912 ----a-w c:\windows\system32\ReinstallBackups\0000\DriverFiles\atiadaxx.exe
    + 2006-02-22 07:13:48 348,160 ----a-w c:\windows\system32\ReinstallBackups\0000\DriverFiles\aticds10.dll
    + 2006-02-22 07:14:59 380,928 ----a-w c:\windows\system32\ReinstallBackups\0000\DriverFiles\atiicdxx.dll
    + 2006-02-22 07:13:55 6,144 ----a-w c:\windows\system32\ReinstallBackups\0000\DriverFiles\atiicdxx.sys
    + 2006-02-22 00:05:00 36,864 ----a-w c:\windows\system32\ReinstallBackups\0000\DriverFiles\Atiiprxx.exe
    + 2006-02-22 00:05:00 274,432 ----a-w c:\windows\system32\ReinstallBackups\0000\DriverFiles\atipdsxx.dll
    + 2006-02-22 00:05:00 61,440 ----a-w c:\windows\system32\ReinstallBackups\0000\DriverFiles\atiphexx.exe
    + 2006-02-22 00:05:00 114,688 ----a-w c:\windows\system32\ReinstallBackups\0000\DriverFiles\atippaxx.dll
    + 2006-02-22 00:05:00 139,264 ----a-w c:\windows\system32\ReinstallBackups\0000\DriverFiles\atiprbxx.exe
    + 2006-02-22 00:05:00 344,064 ----a-w c:\windows\system32\ReinstallBackups\0000\DriverFiles\atiptaxx.exe
    + 2006-02-22 00:05:00 2,060,288 ----a-w c:\windows\system32\ReinstallBackups\0000\DriverFiles\atipuixx.dll
    + 2006-02-22 01:05:00 1,830,912 ----a-w c:\windows\system32\ReinstallBackups\0001\DriverFiles\atiadaxx.exe
    + 2006-02-22 08:13:48 348,160 ----a-w c:\windows\system32\ReinstallBackups\0001\DriverFiles\aticds10.dll
    + 2006-02-22 08:14:58 380,928 ----a-w c:\windows\system32\ReinstallBackups\0001\DriverFiles\atiicdxx.dll
    + 2006-02-22 08:13:54 6,144 ----a-w c:\windows\system32\ReinstallBackups\0001\DriverFiles\atiicdxx.sys
    + 2006-02-22 01:05:00 36,864 ----a-w c:\windows\system32\ReinstallBackups\0001\DriverFiles\Atiiprxx.exe
    + 2006-02-22 01:05:00 274,432 ----a-w c:\windows\system32\ReinstallBackups\0001\DriverFiles\atipdsxx.dll
    + 2006-02-22 01:05:00 61,440 ----a-w c:\windows\system32\ReinstallBackups\0001\DriverFiles\atiphexx.exe
    + 2006-02-22 01:05:00 114,688 ----a-w c:\windows\system32\ReinstallBackups\0001\DriverFiles\atippaxx.dll
    + 2006-02-22 01:05:00 139,264 ----a-w c:\windows\system32\ReinstallBackups\0001\DriverFiles\atiprbxx.exe
    + 2006-02-22 01:05:00 344,064 ----a-w c:\windows\system32\ReinstallBackups\0001\DriverFiles\atiptaxx.exe
    + 2006-02-22 01:05:00 2,060,288 ----a-w c:\windows\system32\ReinstallBackups\0001\DriverFiles\atipuixx.dll
    + 2008-04-13 08:46:34 37,888 ----a-w c:\windows\system32\ReinstallBackups\0015\DriverFiles\i386\bthmodem.sys
    + 2006-08-24 05:44:14 477,696 ----a-r c:\windows\system32\ReinstallBackups\0028\DriverFiles\ZD11BUXP.sys
    + 2008-08-01 08:35:00 200,704 ----a-w c:\windows\system32\ReinstallBackups\0048\DriverFiles\fdco1.dll
    + 2008-08-01 08:36:00 54,784 ----a-w c:\windows\system32\ReinstallBackups\0048\DriverFiles\nvefdxp.sys
    + 2005-08-18 14:52:08 289,792 ----a-w c:\windows\system32\ReinstallBackups\0049\DriverFiles\idecoi.dll
    + 2005-08-18 14:52:06 93,568 ----a-w c:\windows\system32\ReinstallBackups\0049\DriverFiles\nvata.sys
    + 2005-08-03 11:52:08 33,280 ----a-w c:\windows\system32\ReinstallBackups\0049\DriverFiles\NVCOI.DLL
    + 2005-08-18 14:52:08 289,792 ----a-w c:\windows\system32\ReinstallBackups\0050\DriverFiles\idecoi.dll
    + 2005-08-18 14:52:06 93,568 ----a-w c:\windows\system32\ReinstallBackups\0050\DriverFiles\nvata.sys
    + 2005-08-03 11:52:08 33,280 ----a-w c:\windows\system32\ReinstallBackups\0050\DriverFiles\NVCOI.DLL
    + 2008-04-13 08:45:40 26,368 ----a-w c:\windows\system32\ReinstallBackups\0051\DriverFiles\i386\USBSTOR.SYS
    + 2006-08-24 14:15:06 150,808 ----a-w c:\windows\system32\rgb9rast_2.dll
    - 2008-04-14 06:11:46 180,224 ----a-w c:\windows\system32\scrobj.dll
    + 2008-05-09 10:55:19 180,224 ----a-w c:\windows\system32\scrobj.dll
    - 2008-04-14 06:11:46 172,032 ----a-w c:\windows\system32\scrrun.dll
    + 2008-05-09 10:55:19 172,032 ----a-w c:\windows\system32\scrrun.dll
    - 2008-04-14 06:11:46 1,498,624 ----a-w c:\windows\system32\shdocvw.dll
    + 2008-10-16 01:01:57 1,498,624 ----a-w c:\windows\system32\shdocvw.dll
    + 2008-07-18 19:10:20 36,552 ----a-w c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.2.6001.784\wups.dll
    + 2008-10-16 12:08:58 34,328 ----a-w c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.2.6001.788\wups.dll
    + 2008-07-18 19:10:40 45,768 ----a-w c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.2.6001.784\wups2.dll
    + 2008-10-16 12:09:44 43,544 ----a-w c:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.2.6001.788\wups2.dll
    - 2007-08-10 05:17:40 17,272 ------w c:\windows\system32\spmsg.dll
    + 2007-11-30 12:39:27 17,272 ------w c:\windows\system32\spmsg.dll
    + 2006-06-29 11:07:36 14,048 ------w c:\windows\system32\spmsg2.dll
    + 2006-10-14 14:43:18 751,104 ----a-w c:\windows\system32\spool\drivers\w32x86\3\mxdwdrv.dll
    + 2006-10-14 14:42:40 131,584 ----a-w c:\windows\system32\spool\drivers\w32x86\3\mxdwdui.dll
    + 2006-10-14 14:42:18 376,320 ----a-w c:\windows\system32\spool\drivers\w32x86\3\unidrv.dll
    + 2006-10-14 14:42:28 510,464 ----a-w c:\windows\system32\spool\drivers\w32x86\3\unidrvui.dll
    + 2006-10-14 14:40:36 619,008 ----a-w c:\windows\system32\spool\drivers\w32x86\3\unires.dll
    + 2006-10-14 18:22:00 1,698,048 ----a-w c:\windows\system32\spool\drivers\w32x86\3\XpsSvcs.dll
    + 2006-10-14 14:43:18 27,648 ----a-w c:\windows\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
    + 2006-10-14 14:44:44 671,744 ------w c:\windows\system32\spool\prtprocs\w32x86\PrintFilterPipelineSvc.exe
    + 2006-10-14 15:13:02 34,304 ----a-w c:\windows\system32\spool\prtprocs\x64\filterpipelineprintproc.dll
    + 2006-10-14 15:12:14 737,792 ----a-w c:\windows\system32\spool\XPSEP\amd64\amd64\mxdwdrv.dll
    + 2006-10-14 18:09:04 2,946,304 ----a-w c:\windows\system32\spool\XPSEP\amd64\amd64\xpssvcs.dll
    + 2006-10-14 15:12:14 737,792 ----a-w c:\windows\system32\spool\XPSEP\amd64\mxdwdrv.dll
    + 2006-10-14 18:09:04 2,946,304 ----a-w c:\windows\system32\spool\XPSEP\amd64\xpssvcs.dll
    + 2006-10-14 14:43:18 751,104 ----a-w c:\windows\system32\spool\XPSEP\i386\i386\mxdwdrv.dll
    + 2006-10-14 18:22:00 1,698,048 ----a-w c:\windows\system32\spool\XPSEP\i386\i386\xpssvcs.dll
    + 2006-10-14 14:43:18 751,104 ----a-w c:\windows\system32\spool\XPSEP\i386\mxdwdrv.dll
    + 2006-10-14 18:22:00 1,698,048 ----a-w c:\windows\system32\spool\XPSEP\i386\xpssvcs.dll
    - 2008-04-14 06:11:56 246,814 ----a-w c:\windows\system32\strmdll.dll
    + 2008-10-03 10:03:58 247,326 ----a-w c:\windows\system32\strmdll.dll
    - 2008-04-14 06:12:32 60,416 ------w c:\windows\system32\tzchange.exe
    + 2008-10-23 10:06:59 62,976 ------w c:\windows\system32\tzchange.exe
    + 2006-10-20 19:29:54 159,008 ----a-w c:\windows\system32\UIAutomationCore.dll
    - 2008-04-14 06:11:56 620,032 ----a-w c:\windows\system32\urlmon.dll
    + 2008-10-16 01:01:57 619,008 ----a-w c:\windows\system32\urlmon.dll
    - 2008-04-14 06:11:56 218,624 ----a-w c:\windows\system32\uxtheme.dll
    + 2008-04-25 16:41:40 218,624 ----a-w c:\windows\system32\uxtheme.dll
    - 2008-04-14 06:11:56 434,176 ----a-w c:\windows\system32\vbscript.dll
    + 2008-05-09 10:55:19 430,080 ----a-w c:\windows\system32\vbscript.dll
    - 2008-04-14 05:41:30 1,845,888 ----a-w c:\windows\system32\win32k.sys
    + 2008-09-15 15:27:14 1,846,656 ----a-w c:\windows\system32\win32k.sys
    - 2008-04-14 06:11:58 666,112 ----a-w c:\windows\system32\wininet.dll
    + 2008-10-16 01:01:57 666,112 ----a-w c:\windows\system32\wininet.dll
    - 2006-10-18 20:47:20 937,984 ----a-w c:\windows\system32\WMNetMgr.dll
    + 2008-06-18 03:03:08 938,496 ----a-w c:\windows\system32\WMNetmgr.dll
    - 2006-10-18 19:47:20 295,936 ------w c:\windows\system32\wmpeffects.dll
    + 2008-06-24 15:12:58 295,936 ------w c:\windows\system32\wmpeffects.dll
    - 2006-10-18 20:47:22 2,450,944 ----a-w c:\windows\system32\wmvcore.dll
    + 2008-06-18 03:03:14 2,458,112 ----a-w c:\windows\system32\WMVCore.dll
    - 2008-04-14 06:12:36 155,648 ----a-w c:\windows\system32\wscript.exe
    + 2008-05-08 11:24:44 155,648 ----a-w c:\windows\system32\wscript.exe
    - 2008-04-14 06:12:00 90,112 ----a-w c:\windows\system32\wshext.dll
    + 2008-05-09 10:55:19 90,112 ----a-w c:\windows\system32\wshext.dll
    - 2007-07-30 16:19:36 549,720 ----a-w c:\windows\system32\wuapi.dll
    + 2008-10-16 12:12:20 561,688 ----a-w c:\windows\system32\wuapi.dll
    - 2007-07-30 16:19:16 53,080 ----a-w c:\windows\system32\wuauclt.exe
    + 2008-10-16 12:09:44 51,224 ----a-w c:\windows\system32\wuauclt.exe
    - 2007-07-30 16:19:42 1,712,984 ----a-w c:\windows\system32\wuaueng.dll
    + 2008-10-16 12:13:40 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
    - 2007-07-30 16:19:32 325,976 ----a-w c:\windows\system32\wucltui.dll
    + 2008-10-16 12:12:22 323,608 ----a-w c:\windows\system32\wucltui.dll
    - 2008-03-06 08:14:58 831,048 ----a-w c:\windows\system32\WudfUpdate_01005.dll
    + 2008-05-20 07:32:30 831,048 ----a-w c:\windows\system32\WudfUpdate_01005.dll
    - 2007-07-30 16:18:40 33,624 ----a-w c:\windows\system32\wups.dll
    + 2008-10-16 12:08:58 34,328 ----a-w c:\windows\system32\wups.dll
    - 2007-07-30 16:19:12 43,352 ----a-w c:\windows\system32\wups2.dll
    + 2008-10-16 12:09:44 43,544 ----a-w c:\windows\system32\wups2.dll
    - 2007-07-30 16:19:28 203,096 ----a-w c:\windows\system32\wuweb.dll
    + 2008-10-16 12:13:40 202,776 ----a-w c:\windows\system32\wuweb.dll
    + 2006-02-03 06:41:26 14,032 ----a-w c:\windows\system32\x3daudio1_0.dll
    + 2007-03-05 10:42:18 15,128 ----a-w c:\windows\system32\x3daudio1_1.dll
    + 2007-10-22 01:37:16 17,928 ----a-w c:\windows\system32\X3DAudio1_2.dll
    + 2008-03-05 14:00:06 25,608 ----a-w c:\windows\system32\X3DAudio1_3.dll
    + 2008-05-30 12:17:00 25,608 ----a-w c:\windows\system32\X3DAudio1_4.dll
    + 2006-02-03 06:42:06 230,096 ----a-w c:\windows\system32\xactengine2_0.dll
    + 2006-03-31 10:39:48 229,584 ----a-w c:\windows\system32\xactengine2_1.dll
    + 2007-10-22 01:39:54 267,272 ----a-w c:\windows\system32\xactengine2_10.dll
    + 2006-05-31 05:24:16 230,168 ----a-w c:\windows\system32\xactengine2_2.dll
    + 2006-07-28 07:30:32 236,824 ----a-w c:\windows\system32\xactengine2_3.dll
    + 2006-09-28 14:05:56 237,848 ----a-w c:\windows\system32\xactengine2_4.dll
    + 2006-12-08 10:02:00 251,672 ----a-w c:\windows\system32\xactengine2_5.dll
    + 2007-01-24 13:27:30 255,848 ----a-w c:\windows\system32\xactengine2_6.dll
    + 2007-04-04 16:55:00 261,480 ----a-w c:\windows\system32\xactengine2_7.dll
    + 2007-06-20 18:46:04 266,088 ----a-w c:\windows\system32\xactengine2_8.dll
    + 2007-07-19 22:57:12 267,112 ----a-w c:\windows\system32\xactengine2_9.dll
    + 2008-03-05 14:03:20 238,088 ----a-w c:\windows\system32\xactengine3_0.dll
    + 2008-05-30 12:18:52 238,088 ----a-w c:\windows\system32\xactengine3_1.dll
    + 2008-05-30 12:17:30 65,032 ----a-w c:\windows\system32\XAPOFX1_0.dll
    + 2008-03-05 14:03:54 479,752 ----a-w c:\windows\system32\XAudio2_0.dll
    + 2008-05-30 12:19:18 507,400 ----a-w c:\windows\system32\XAudio2_1.dll
    + 2006-03-31 10:39:24 62,672 ----a-w c:\windows\system32\xinput1_1.dll
    + 2006-07-28 07:30:14 62,744 ----a-w c:\windows\system32\xinput1_2.dll
    + 2007-04-04 16:53:42 81,768 ----a-w c:\windows\system32\xinput1_3.dll
    + 2005-12-05 16:07:30 61,136 ----a-w c:\windows\system32\xinput9_1_0.dll
    + 2007-11-26 19:56:20 10,155,840 ----a-w c:\windows\system32\xlive.dll
    + 2007-09-18 13:01:02 134,144 ----a-w c:\windows\system32\xlive\sqmapi.dll
    + 2007-11-26 19:56:20 13,653,824 ----a-w c:\windows\system32\xlivefnt.dll
    + 2006-10-14 18:21:58 580,352 ------w c:\windows\system32\XPSSHHDR.dll
    + 2006-10-14 18:22:00 1,698,048 ------w c:\windows\system32\XpsSvcs.dll
    + 2006-10-20 19:29:54 304,928 ----a-w c:\windows\system32\XPSViewer\XPSViewer.exe
    + 2004-01-14 08:25:00 81,920 ----a-w c:\windows\system32\ZDPN50.DLL
    + 2004-01-14 08:30:00 17,151 ----a-w c:\windows\system32\ZDPNDIS5.SYS
    + 2003-03-14 09:24:00 24,576 ----a-w c:\windows\system32\ZyDelReg.exe
    + 2008-12-12 19:45:13 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_768.dat
    + 2008-09-30 14:42:08 1,286,152 ----a-w c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9870.0_x-ww_a32d74cf\msxml4.dll
    + 2008-09-30 14:45:12 91,656 ----a-w c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.1.0_x-ww_2a41bceb\msxml4r.dll
    + 2008-04-15 17:49:33 1,724,416 ----a-w c:\windows\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.5581_x-ww_dfbc4fc4\GdiPlus.dll
    .
    -- Snapshot nollattu tähän hetkeen --
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
    "MessengerPlus3"="c:\program files\MessengerPlus! 3\MsgPlus.exe" [2006-01-21 190024]
    "LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-09-19 67128]
    "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
    "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-04 486856]
    "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-10-02 1124352]
    "Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 7\PCSync2.exe" [2008-06-17 1249280]
    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MessengerPlus3"="c:\program files\MessengerPlus! 3\MsgPlus.exe" [2006-01-21 190024]
    "NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 131072]
    "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
    "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
    "Nokia Tray Application"="c:\program files\Common Files\Nokia\Tools\NclTray.exe" [2003-12-19 425984]
    "DataLayer"="c:\program files\Common Files\PCSuite\DataLayer\DataLayer.exe" [2006-03-22 851968]
    "avast!"="d:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
    "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-01 61440]
    "BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 c:\windows\system32\bthprops.cpl]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

    c:\documents and settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
    Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-09-19 67128]
    Microsoft Office.lnk - d:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "aux"= sysaudio.sys

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Java\\jre1.5.0_04\\bin\\javaw.exe"=
    "d:\\Program Files\\Sony\\EverQuest II\\EQ2.exe"=
    "d:\\Program Files\\Azureus\\Azureus.exe"=
    "d:\\Program Files\\DC++\\DCPlusPlus.exe"=
    "c:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe"=
    "c:\\Program Files\\Java\\jre1.5.0_06\\bin\\javaw.exe"=
    "c:\\WINDOWS\\system32\\rtcshare.exe"=
    "c:\\Program Files\\NetMeeting\\conf.exe"=
    "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
    "c:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe"=
    "c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
    "c:\\WINDOWS\\system32\\ftp.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "1412:TCP"= 1412:TCP:joo
    "1412:UDP"= 1412:UDP:joo1
    "1420:TCP"= 1420:TCP:azu
    "1420:UDP"= 1420:UDP:azu1
    "16531:TCP"= 16531:TCP:fgfg
    "16531:UDP"= 16531:UDP:ghgfhfgh
    "56909:TCP"= 56909:TCP:56909
    "56909:UDP"= 56909:UDP:56909

    R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-08-03 78416]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-08-03 20560]
    S0 d344bus;d344bus;c:\windows\system32\DRIVERS\d344bus.sys [2005-08-22 137216]
    S0 d344prt;d344prt;c:\windows\system32\Drivers\d344prt.sys [2005-08-22 5248]
    S1 atitray;atitray;\??\c:\program files\Radeon Omega Drivers\v3.8.273\ATI Tray Tools\atitray.sys []

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8dc514b9-e651-11da-a9cd-806d6172696f}]
    \Shell\AutoRun\command - G:\ASUSACPI.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b24f3515-a75f-11dd-b729-001583b3b80b}]
    \Shell\AutoRun\command - G:\setup.exe AUTORUN=1
    .
    - - - - POISTETUT JÄMÄRIVIT - - - -

    BHO-{D57232E4-4013-4DA9-A497-1601BBEC5052} - (no file)
    HKLM-Run-WMC_AutoUpdate - (no file)
    HKU-Default-Run-Nokia.PCSync - c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe
    HKU-Default-Run-Win32 LSA Driver - lsa.exe
    HKU-Default-RunOnce-Win32 LSA Driver - lsa.exe
    Notify-WgaLogon - (no file)


    .
    ------- Täydentävä tarkistus -------
    .
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyServer = planetlab2.eecs.umich.edu:3124
    IE: Vie Microsoft E&xceliin - d:\progra~1\MICROS~1\Office10\EXCEL.EXE/3000
    Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    FF - ProfilePath - c:\documents and settings\Tigeri\Application Data\Mozilla\Firefox\Profiles\qs21u745.default\
    FF - plugin: c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
    FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.30401.0.dll
    FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
    FF - plugin: d:\program files\Mozilla Firefox 3.1 Beta 2\plugins\npnul32.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-12-12 23:32:18
    Windows 5.1.2600 Service Pack 3 NTFS

    tarkistaa piilotettuja prosesseja ...

    tarkistaa piilotettuja käynnistysarvoja ...

    tarkistaa piilotettuja tiedostoja ...

    tarkistus on valmis
    piilotetut tiedostot: 0

    **************************************************************************
    .
    --------------------- Prosesseihin ladatut DLLt ---------------------

    - - - - - - - > 'winlogon.exe'(968)
    c:\windows\system32\Ati2evxx.dll
    .
    ------------------------ Muut prosessit ------------------------
    .
    c:\windows\system32\ati2evxx.exe
    c:\windows\system32\ati2evxx.exe
    c:\program files\Lavasoft\Ad-Aware\aawservice.exe
    d:\program files\Alwil Software\Avast4\aswUpdSv.exe
    d:\program files\Alwil Software\Avast4\ashServ.exe
    c:\program files\Executive Software\Diskeeper\DkService.exe
    c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    d:\program files\Alwil Software\Avast4\ashMaiSv.exe
    d:\program files\Alwil Software\Avast4\ashWebSv.exe
    c:\windows\system32\rundll32.exe
    c:\program files\PC Connectivity Solution\ServiceLayer.exe
    c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    c:\progra~1\WINDOW~4\MESSEN~1\msnmsgr.exe
    c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe
    c:\program files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
    c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    c:\program files\Common Files\Nokia\MPAPI\MPAPI3s.exe
    .
    **************************************************************************
    .
    Valmistumisajankohta: 2008-12-12 23:34:20 - kone käynnistettiin uudelleen
    ComboFix-quarantined-files.txt 2008-12-12 21:34:15
    ComboFix2.txt 2008-05-30 05:22:38

    Ennen ajoa: 2 473 709 568 tavua vapaana
    Ajon jälkeen: 2,398,629,888 tavua vapaana

    1614 --- E O F --- 2008-12-12 08:56:25
     
    Tigerishk, 13.12.2008
    #6
  8. Tigerishk

    Tigerishk Member

    Liittynyt:
    29.05.2008
    Viestejä:
    17
    Kiitokset:
    0
    Pisteet:
    11
    ..
     
    Viimeksi muokattu: 14.12.2008
    Tigerishk, 13.12.2008
    #7
  9. Tigerishk

    Tigerishk Member

    Liittynyt:
    29.05.2008
    Viestejä:
    17
    Kiitokset:
    0
    Pisteet:
    11
    ...
     
    Viimeksi muokattu: 14.12.2008
    Tigerishk, 13.12.2008
    #8
  10. Tigerishk

    Tigerishk Member

    Liittynyt:
    29.05.2008
    Viestejä:
    17
    Kiitokset:
    0
    Pisteet:
    11
    Oho. Oli tullu näköjään muutaman kerran liikaa postaus :O
     
    Tigerishk, 13.12.2008
    #9
  11. Hujo

    Hujo Guest

    joo ja loppua ei meinannut näkyä

    ===================

    scannaa uusi hjt:n loki
     
    Hujo, 14.12.2008
    #10
  12. Tigerishk

    Tigerishk Member

    Liittynyt:
    29.05.2008
    Viestejä:
    17
    Kiitokset:
    0
    Pisteet:
    11
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:10:45, on 14.12.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    d:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Executive Software\Diskeeper\DkService.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\System32\svchost.exe
    d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    d:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\MessengerPlus! 3\MsgPlus.exe
    C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Common Files\Nokia\Tools\NclTray.exe
    C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
    C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
    C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    D:\Program Files\Azureus\Azureus.exe
    D:\Program Files\Mozilla Firefox 3.1 Beta 2\firefox.exe
    D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = planetlab2.eecs.umich.edu:3124
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\Tools\NclTray.exe
    O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    O4 - HKLM\..\Run: [avast!] d:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
    O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
    O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123799259608
    O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: avast! Antivirus - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\SupportSoft\bin\ssrc.exe

    --
    End of file - 8775 bytes
     
    Tigerishk, 14.12.2008
    #11
  13. Hujo

    Hujo Guest

    Luo poistolista:
    • Avaa HiJackThis
    • Klikkaa "Configure" valintaa oikealla alhaalla
    • Klikkaa "Misc Tools"
    • Klikkaa boxia joka sanoo "Uninstall Manager"
    • Klikkaa valintaa "Save list"
    • Kopioi ja liitä kyseinen lista muistiosta ketjuusi
     
    Hujo, 14.12.2008
    #12
  14. Tigerishk

    Tigerishk Member

    Liittynyt:
    29.05.2008
    Viestejä:
    17
    Kiitokset:
    0
    Pisteet:
    11
    2007 Office Systemin yhteensopivuuspaketti
    Ad-Aware
    Adobe Download Manager 2.2 (Poista ainoastaan)
    Adobe Flash Player ActiveX
    Adobe Flash Player Plugin
    Adobe Reader 7.0.5 Language Support
    Adobe Reader 7.0.9 - Suomi
    Adobe Shockwave Player 11
    ATI - Software Uninstall Utility
    ATI Catalyst Control Center
    ATI Display Driver
    avast! Antivirus
    AVIcodec (remove only)
    Azureus
    BSPlayer
    Catalyst Control Center - Branding
    CCleaner (remove only)
    CDisplay 1.8
    DC++ 0.698
    Diskeeper Professional Edition
    DivX
    EQ2 Item Database 1.1
    EQ2MAP Updater 1.0.6
    EuroTranslator
    EverQuest II
    EverQuest II: Desert of Flames
    EverQuest II: Kingdom of Sky
    ExtraFilm Kotona 2
    Fallout 3
    ffdshow
    GSpot Codec Information Appliance
    HijackThis 2.0.2
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Format SDK (KB902344)
    Hotfix-korjauspäivitys Windows Media Player 11:lle (KB939683)
    Hotfix-päivitys Windows XP:lle (KB952287)
    J2SE Runtime Environment 5.0 Update 10
    J2SE Runtime Environment 5.0 Update 11
    J2SE Runtime Environment 5.0 Update 4
    J2SE Runtime Environment 5.0 Update 6
    J2SE Runtime Environment 5.0 Update 9
    Java(TM) 6 Update 2
    Java(TM) 6 Update 3
    Java(TM) 6 Update 5
    Java(TM) 6 Update 7
    Java(TM) SE Runtime Environment 6 Update 1
    king.com (remove only)
    Logitech Desktop Messenger
    Logitech Harmony Remote Software 7
    LucasArts' Curse of Monkey Island
    Macromedia Flash Player 8
    Malwarebytes' Anti-Malware
    Marvell Miniport Driver
    Messenger Plus! 3
    Microsoft .NET Framework 2.0
    Microsoft .NET Framework 2.0 Language Pack - FIN
    Microsoft .NET Framework 2.0 -tuotteen Security Update (KB928365)
    Microsoft .NET Framework 3.0
    Microsoft .NET Framework 3.0
    Microsoft Base Smart Card Cryptographic Service Provider Package
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Games for Windows - LIVE Redistributable
    Microsoft Office XP Professional ja FrontPage
    Microsoft Silverlight
    Microsoft User-Mode Driver Framework Feature Pack 1.5
    Mozilla Firefox (3.1b2)
    MSVC80_x86
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 6.0 Parser (KB933579)
    MultiRes (remove only)
    Nero 6 Enterprise Edition
    Nokia CA-42 USB
    Nokia Connectivity Cable Driver
    Nokia Multimedia Factory
    Nokia Multimedia Factory
    Nokia PC Connectivity SDK 3.0
    Nokia PC Suite
    Nokia PC Suite
    NVIDIA Drivers
    NvMixer
    PC Connectivity Solution
    Päivitys Windows XP:lle (KB951072-v2)
    Päivitys Windows XP:lle (KB951978)
    Päivitys Windows XP:lle (KB955839)
    QuickTime
    RealPlayer
    Remote Control USB Driver
    ScummVM 0.11.1
    SPORE™
    Spybot - Search & Destroy
    Spybot - Search & Destroy 1.4
    Subtitle Workshop 2.51
    Suojauspäivitys ohjelmistolle Windows XP (KB941569)
    Suojauspäivitys Windows Media Player 10:lle (KB911565)
    Suojauspäivitys Windows Media Player 10:lle (KB917734)
    Suojauspäivitys Windows Media Player 10:lle (KB936782)
    Suojauspäivitys Windows Media Player 11:lle (KB936782)
    Suojauspäivitys Windows Media Player 11:lle (KB954154)
    Suojauspäivitys Windows Media Playerille (KB952069)
    Suojauspäivitys Windows XP:lle (KB938464)
    Suojauspäivitys Windows XP:lle (KB946648)
    Suojauspäivitys Windows XP:lle (KB950759)
    Suojauspäivitys Windows XP:lle (KB950760)
    Suojauspäivitys Windows XP:lle (KB950762)
    Suojauspäivitys Windows XP:lle (KB950974)
    Suojauspäivitys Windows XP:lle (KB951066)
    Suojauspäivitys Windows XP:lle (KB951376)
    Suojauspäivitys Windows XP:lle (KB951376-v2)
    Suojauspäivitys Windows XP:lle (KB951698)
    Suojauspäivitys Windows XP:lle (KB951748)
    Suojauspäivitys Windows XP:lle (KB952954)
    Suojauspäivitys Windows XP:lle (KB953838)
    Suojauspäivitys Windows XP:lle (KB953839)
    Suojauspäivitys Windows XP:lle (KB954211)
    Suojauspäivitys Windows XP:lle (KB954459)
    Suojauspäivitys Windows XP:lle (KB954600)
    Suojauspäivitys Windows XP:lle (KB955069)
    Suojauspäivitys Windows XP:lle (KB956390)
    Suojauspäivitys Windows XP:lle (KB956391)
    Suojauspäivitys Windows XP:lle (KB956802)
    Suojauspäivitys Windows XP:lle (KB956803)
    Suojauspäivitys Windows XP:lle (KB956841)
    Suojauspäivitys Windows XP:lle (KB957095)
    Suojauspäivitys Windows XP:lle (KB957097)
    Suojauspäivitys Windows XP:lle (KB958215)
    Suojauspäivitys Windows XP:lle (KB958644)
    VideoLAN VLC media player 0.8.5
    Winamp
    Windows Communication Foundation
    Windows Live installer
    Windows Live Messenger
    Windows Live Sign-in Assistant
    Windows Media Format 11 runtime
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows Media Player 11
    Windows Presentation Foundation
    Windows Workflow Foundation
    Windows XP Service Pack 3
    Windowsin ohjainpaketti - Nokia Modem (03/05/2008 3.7)
    Windowsin ohjainpaketti - Nokia Modem (03/13/2008 6.86.0.1)
    Windowsin ohjainpaketti - Nokia Modem (05/22/2008 3.8)
    Windowsin ohjainpaketti - Nokia Modem (05/22/2008 7.00.0.1)
    Windowsin ohjainpaketti - Nokia Modem (08/03/2007 6.84.0.2)
    Windowsin ohjainpaketti - Nokia Modem (10/12/2007 3.6)
    Windowsin ohjainpaketti - Nokia pccsmcfd (10/12/2007 6.85.4.0)
    WinRAR archiver
    VobSub v2.23 (Remove Only)
    Vuze
    XviD Decoder 1.0-Beta3

     
    Tigerishk, 14.12.2008
    #13
  15. Hujo

    Hujo Guest

    Poista lisää poista sovelutuksesta

    J2SE Runtime Environment 5.0 Update 10
    J2SE Runtime Environment 5.0 Update 11
    J2SE Runtime Environment 5.0 Update 4
    J2SE Runtime Environment 5.0 Update 6
    J2SE Runtime Environment 5.0 Update 9
    Java(TM) 6 Update 2
    Java(TM) 6 Update 3
    Java(TM) 6 Update 5
    Java(TM) 6 Update 7
    Java(TM) SE Runtime Environment 6 Update 1
    Logitech Desktop Messenger
    Spybot - Search & Destroy
    Spybot - Search & Destroy 1.4

    Poista kansio vikasiedossa

    C:\Program Files\Java

    =================

    scannaa hjt:llä merkkaa paina Fix checked

    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
    O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

    ==========================
    Lataa JavaRa ja pura se työpöydällesi.

    ***Sulje kaikki päällä olevat Internet Explorerin ikkunat ennen jatkamista!***

    * Tuplaklikkaa JavaRa.exeä käynnistääksesi ohjelma.
    * Valitse English pudotusvalikosta valitaksesi kieleksi englannin ja klikkaa Select.
    * Klikkaa Remove Older Versions poistaaksesi vanhat Java-versiot koneeltasi.
    * Klikkaa Yes kun pyydetään. Kun JavaRa on valmis, se ilmoittaa, että lokitiedosto on luotu. Klikkaa OK.
    * Lokitiedosto avautuu. Lähetä sen sisältö seuraavassa viestissäsi.


    ===============

    Lataa täältä uusi java

    Rullaa alas kohteeseen Java Runtime Environment (JRE) 6 Update 11
    Paina Download
    Laita Platform -kohtaan Windows
    Ruksaa I agree to the Java SE Runtime Environment 6 License Agreement ja paina Continue
    Paina Windows Offline Installationin alapuolella jre-6u4-windows-i586-p.exe

    Tallenna tiedosto vaikka työpöydälle ja asenna se.

    5. Käynnistä kone uudelleen asennuksen jälkeen.
    6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).
    7. General-välilehdellä klikkaa Settings. Vedä liukusäädintä (Disk Space) pienemmälle.

    (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
    Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).

    8. Klikkaa Delete Files -nappia. Varmista että kaikki kaksi valintaa ovat rastitettuja:
    * Applications and Applets
    * Trace and Log Files

    Ja paina OK -nappia
    Huomaa: Tämä poistaa kaikki ladatut sovellukset ja appletit VÄLIMUISTISTA.

    9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.
    10. Välilehti Update: ota ruksi pois kohdasta Check for Updates automatically
    Valitse Never check
    11. Klikkaa Apply ja OK jättääksesi Java asetusikkunasi.



     
    Hujo, 14.12.2008
    #14
  16. Tigerishk

    Tigerishk Member

    Liittynyt:
    29.05.2008
    Viestejä:
    17
    Kiitokset:
    0
    Pisteet:
    11
    JavaRa 1.11 Removal Log.

    Report follows after line.

    ------------------------------------

    The JavaRa removal process was started on Sun Dec 14 14:09:40 2008

    Found and removed: Software\JavaSoft\Java2D\1.5.0_04

    Found and removed: Software\JavaSoft\Java2D\1.5.0_06

    Found and removed: Software\JavaSoft\Java2D\1.5.0_09

    Found and removed: Software\JavaSoft\Java2D\1.5.0_10

    Found and removed: Software\JavaSoft\Java2D\1.5.0_11

    Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}

    Found and removed: SOFTWARE\Classes\JavaPlugin.150_04

    Found and removed: SOFTWARE\Classes\JavaPlugin.150_06

    Found and removed: SOFTWARE\Classes\JavaPlugin.150_09

    Found and removed: SOFTWARE\Classes\JavaPlugin.150_10

    Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.5.0.0

    Found and removed: Software\Classes\JavaPlugin.160_01

    ------------------------------------

    Finished reporting.
     
    Tigerishk, 14.12.2008
    #15
  17. Hujo

    Hujo Guest

    ajas tuo ccleaner puhdistaja ja rekisteri

    ================

    scannaa uusi hjt:n loki
     
    Hujo, 14.12.2008
    #16
  18. Tigerishk

    Tigerishk Member

    Liittynyt:
    29.05.2008
    Viestejä:
    17
    Kiitokset:
    0
    Pisteet:
    11
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:27:40, on 14.12.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    d:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Executive Software\Diskeeper\DkService.exe
    D:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\System32\svchost.exe
    d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    d:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Common Files\Nokia\Tools\NclTray.exe
    C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
    C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    D:\Program Files\Azureus\Azureus.exe
    D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = planetlab2.eecs.umich.edu:3124
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [Nokia Tray Application] C:\Program Files\Common Files\Nokia\Tools\NclTray.exe
    O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
    O4 - HKLM\..\Run: [avast!] d:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
    O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123799259608
    O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - d:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: avast! Antivirus - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - d:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\SupportSoft\bin\ssrc.exe

    --
    End of file - 7861 bytes
     
    Tigerishk, 14.12.2008
    #17
  19. Hujo

    Hujo Guest

    No mites koneella pätkytteleee menemään

    Lataa OTMoveIt
    OTMoveIt ja tallenna se työpöydällesi.

    Tuplaklikkaa OTMoveIt.exe.
    Klikkaa CleanUp!.
    Valitse Yes kun kysytään "Begin cleanup Process?".
    Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.

    HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.
     
    Hujo, 14.12.2008
    #18
  20. Tigerishk

    Tigerishk Member

    Liittynyt:
    29.05.2008
    Viestejä:
    17
    Kiitokset:
    0
    Pisteet:
    11
    Paljon juohevammin toimii kone ja oikeat sivutkin aukeaa.
    Kiitoksia :)
     
    Tigerishk, 14.12.2008
    #19

Jaa tämä sivu