Author Topic: Key logger, email virus and potentially more (Read 690 times)

LordJecks · « **on:** January 25, 2011, 01:40:13 AM »

First and foremost thank you for taking the time to look and this and help me

I was notified of the problem via Blizzard as I'm a subscribed to WoW that my account was up for sale (i've already got in touch with them in that regard), thus leading me to believe that my computer has been infected with a key logger. I've run multiple scans with AVG, AdAware, and Malawarebytes with no real effect to fixing the problem. Shortly after, a day or so, my hotmail account automatically sent out an email to all of my contact containing what i can only assume was a url to another site to infect their systems.

I run zone alarm for my firewall with high internet security and medium trusted zone security. So i'm contacting you in hopes that information provided below will help resolve the situation.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Results of screen317's Security Check version 0.99.8
Windows Vista Service Pack 2 (UAC is disabled!)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
AVG 2011
ZoneAlarm
ZoneAlarm Toolbar
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Ad-Aware
Malwarebytes' Anti-Malware
Java(TM) 6 Update 23
Adobe Flash Player 10.1.102.64
Adobe Reader X
Mozilla Firefox (3.6.13)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Ad-Aware AAWService.exe
Ad-Aware AAWTray.exe
AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
Zone Labs ZoneAlarm zlclient.exe
``````````End of Log````````````

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time:      2011/01/24 21:27
Program Version:      Version 1.3.5.0
Windows Version:      Windows Vista SP2
==================================================

Drivers
-------------------
Name: dump_dumpata.sys
Image Path: C:\Windows\System32\Drivers\dump_dumpata.sys
Address: 0x917D1000   Size: 45056   File Visible: No   Signed: -
Status: -

Name: dump_msahci.sys
Image Path: C:\Windows\System32\Drivers\dump_msahci.sys
Address: 0x917DC000   Size: 40960   File Visible: No   Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\Windows\system32\drivers\rootrepeal.sys
Address: 0x9D3EF000   Size: 49152   File Visible: No   Signed: -
Status: -

Processes
-------------------
Path: System
PID: 4   Status: Locked to the Windows API!

Path: C:\Windows\System32\audiodg.exe
PID: 1364   Status: Locked to the Windows API!

SSDT
-------------------
#: 021   Function Name: NtAlpcConnectPort
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x91631570

#: 022   Function Name: NtAlpcCreatePort
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x91631e46

#: 054   Function Name: NtConnectPort
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x91630fc6

#: 060   Function Name: NtCreateFile
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x9162a884

#: 064   Function Name: NtCreateKey
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x9164bfa8

#: 071   Function Name: NtCreatePort
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x91631ad0

#: 072   Function Name: NtCreateProcess
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x91645e42

#: 073   Function Name: NtCreateProcessEx
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x9164626a

#: 075   Function Name: NtCreateSection
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x916506fe

#: 115   Function Name: NtCreateWaitablePort
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x91631c2e

#: 122   Function Name: NtDeleteFile
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x9162b5b4

#: 123   Function Name: NtDeleteKey
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x9164da50

#: 126   Function Name: NtDeleteValueKey
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x9164d346

#: 129   Function Name: NtDuplicateObject
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x91644c26

#: 166   Function Name: NtLoadKey
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x9164e41a

#: 167   Function Name: NtLoadKey2
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x9164e658

#: 168   Function Name: NtLoadKeyEx
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x9164eb0a

#: 186   Function Name: NtOpenFile
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x9162b16c

#: 194   Function Name: NtOpenProcess
Status: Hooked by "C:\Windows\system32\DRIVERS\AVGIDSShim.Sys" at address 0xa08e3780

#: 201   Function Name: NtOpenThread
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x91647f46

#: 267   Function Name: NtRenameKey
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x9164f4e0

#: 268   Function Name: NtReplaceKey
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x9164edd4

#: 276   Function Name: NtRequestWaitReplyPort
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x91630b5e

#: 280   Function Name: NtRestoreKey
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x9164ff40

#: 286   Function Name: NtSecureConnectPort
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x91631292

#: 301   Function Name: NtSetInformationFile
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x9162b9be

#: 314   Function Name: NtSetSecurityObject
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x9164fa68

#: 324   Function Name: NtSetValueKey
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x9164ca6a

#: 332   Function Name: NtSystemDebugControl
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x91646f66

#: 334   Function Name: NtTerminateProcess
Status: Hooked by "C:\Windows\system32\DRIVERS\AVGIDSShim.Sys" at address 0xa08e3830

#: 335   Function Name: NtTerminateThread
Status: Hooked by "C:\Windows\system32\DRIVERS\AVGIDSShim.Sys" at address 0xa08e38d0

#: 358   Function Name: NtWriteVirtualMemory
Status: Hooked by "C:\Windows\system32\DRIVERS\AVGIDSShim.Sys" at address 0xa08e3970

#: 383   Function Name: NtCreateUserProcess
Status: Hooked by "C:\Windows\system32\DRIVERS\vsdatant.sys" at address 0x916466de

==EOF==

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Logfile of random's system information tool 1.08 (written by random/random)
Run by Owner at 2011-01-24 21:46:19
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 137 GB (45%) free of 305 GB
Total RAM: 3069 MB (41% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:46:27 PM, on 24/01/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18999)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\PLFSetI.exe
C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
C:\Program Files\Pure Networks\Network Magic\nmapp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Users\Owner\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Owner\Downloads\RSIT(2).exe
C:\Program Files\trend micro\Owner.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ZoneAlarm Security Toolbar - {91da5e8a-3318-4f8c-b67e-5964de3ab546} - C:\Program Files\ZoneAlarm_Security\tbZone.dll
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll
O2 - BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O2 - BHO: ZoneAlarm Security Toolbar - {91da5e8a-3318-4f8c-b67e-5964de3ab546} - C:\Program Files\ZoneAlarm_Security\tbZone.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: ZoneAlarm Security Toolbar - {91da5e8a-3318-4f8c-b67e-5964de3ab546} - C:\Program Files\ZoneAlarm_Security\tbZone.dll
O3 - Toolbar: ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [PLFSetI] C:\Windows\PLFSetI.exe
O4 - HKLM\..\Run: [ZPdtWzdVitaKey MC3000] "C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe" show
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ISW] "C:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"
O4 - HKCU\..\Run: [Wowhead_Client] "C:\Users\Public\Games\World of Warcraft\Interface\Wowhead_Client.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll
O20 - Winlogon Notify: AWinNotifyVitaKey MC3000 - C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: WebEx Service Host for Support Center (atashost) - WebEx Communications, Inc. - C:\Windows\system32\atashost.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Validity Fingerprint Service (vfsFPService) - Validity Sensors, Inc. - C:\Windows\system32\vfsFPService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe

--
End of file - 7348 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-11-10 62376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search - C:\Program Files\AVG\AVG10\avgssie.dll [2011-01-07 2731872]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3}]
ZoneAlarm Security Engine Registrar - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll [2010-11-05 599544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
ZoneAlarm Security Toolbar - C:\Program Files\ZoneAlarm_Security\tbZone.dll [2010-12-01 2735200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-12-28 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{91da5e8a-3318-4f8c-b67e-5964de3ab546} - ZoneAlarm Security Toolbar - C:\Program Files\ZoneAlarm_Security\tbZone.dll [2010-12-01 2735200]
{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - ZoneAlarm Security Engine - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll [2010-11-05 599544]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-20 1008184]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-08-12 6265376]
"PLFSetI"=C:\Windows\PLFSetI.exe [2007-10-23 200704]
"ZPdtWzdVitaKey MC3000"=C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe [2010-12-26 3642368]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-01-18 1033512]
"AVG_TRAY"=C:\Program Files\AVG\AVG10\avgtray.exe [2011-01-07 2747744]
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552]
"nmctxth"=C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe [2009-07-07 647216]
"nmapp"=C:\Program Files\Pure Networks\Network Magic\nmapp.exe [2011-01-10 472112]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe [2010-11-10 35736]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-11-10 932288]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2010-11-29 421888]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2010-12-13 421160]
"ZoneAlarm Client"=C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe [2010-11-16 1043968]
"ISW"=C:\Program Files\CheckPoint\ZAForceField\ForceField.exe [2010-11-05 738808]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Wowhead_Client"=C:\Users\Public\Games\World of Warcraft\Interface\Wowhead_Client.exe [2011-01-22 422400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AWinNotifyVitaKey MC3000]
C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll [2010-12-26 3024384]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"notification packages"=scecli
C:\Program Files\Acer\Acer Bio Protection\PwdFilter

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\atashost]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDesktopCleanupWizard"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2011-01-24 21:27:32 ----A---- C:\RootRepeal report 01-24-11 (21-27-32).txt
2011-01-24 21:22:51 ----D---- C:\Program Files\trend micro
2011-01-24 21:22:46 ----D---- C:\rsit
2011-01-24 09:25:46 ----SHD---- C:\Config.Msi
2011-01-24 01:47:53 ----A---- C:\Windows\system32\lsdelete.exe
2011-01-23 13:27:50 ----D---- C:\Users\Owner\AppData\Roaming\CheckPoint
2011-01-23 13:27:01 ----D---- C:\Program Files\Conduit
2011-01-23 13:27:00 ----D---- C:\Program Files\ZoneAlarm_Security
2011-01-23 13:26:48 ----D---- C:\Program Files\CheckPoint
2011-01-23 13:26:39 ----A---- C:\Windows\system32\vsregexp.dll
2011-01-23 13:26:10 ----A---- C:\Windows\system32\drivers\netio.sys
2011-01-23 13:25:45 ----A---- C:\Windows\system32\zlcommdb.dll
2011-01-23 13:25:45 ----A---- C:\Windows\system32\zlcomm.dll
2011-01-23 13:25:33 ----A---- C:\Windows\system32\vswmi.dll
2011-01-23 13:25:27 ----A---- C:\Windows\system32\zpeng25.dll
2011-01-23 13:25:27 ----A---- C:\Windows\system32\vsxml.dll
2011-01-23 13:25:24 ----A---- C:\Windows\system32\vspubapi.dll
2011-01-23 13:25:24 ----A---- C:\Windows\system32\vsmonapi.dll
2011-01-23 13:25:22 ----A---- C:\Windows\system32\vsdata.dll
2011-01-23 13:25:12 ----D---- C:\Windows\system32\ZoneLabs
2011-01-23 13:25:12 ----A---- C:\Windows\system32\drivers\vsdatant.sys
2011-01-23 13:25:08 ----D---- C:\Program Files\Zone Labs
2011-01-23 13:24:44 ----D---- C:\ProgramData\CheckPoint
2011-01-23 13:24:43 ----D---- C:\Windows\Internet Logs
2011-01-23 13:24:43 ----A---- C:\Windows\system32\vsinit.dll
2011-01-23 13:24:42 ----A---- C:\Windows\system32\vsutil.dll
2011-01-23 13:19:09 ----D---- C:\Users\Owner\AppData\Roaming\Malwarebytes
2011-01-23 13:19:02 ----D---- C:\ProgramData\Malwarebytes
2011-01-23 13:19:02 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys
2011-01-23 13:18:58 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2011-01-23 13:18:58 ----A---- C:\Windows\system32\drivers\mbam.sys
2011-01-22 19:41:36 ----D---- C:\ProgramData\Wowhead
2011-01-22 00:17:10 ----A---- C:\Windows\jestertb.dll
2011-01-18 20:51:48 ----D---- C:\Windows\Sun
2011-01-17 15:50:47 ----D---- C:\Users\Owner\AppData\Roaming\WinRAR
2011-01-17 15:50:44 ----D---- C:\Program Files\WinRAR
2011-01-12 11:47:33 ----A---- C:\Windows\system32\odbc32.dll
2011-01-12 11:47:29 ----A---- C:\Windows\system32\sdclt.exe
2011-01-11 21:28:49 ----D---- C:\Users\Owner\AppData\Roaming\Apple Computer
2011-01-11 21:27:56 ----A---- C:\Windows\system32\GEARAspi.dll
2011-01-11 21:27:56 ----A---- C:\Windows\system32\drivers\GEARAspiWDM.sys
2011-01-11 21:27:01 ----D---- C:\Program Files\iPod
2011-01-11 21:26:56 ----D---- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2011-01-11 21:26:56 ----D---- C:\Program Files\iTunes
2011-01-11 21:25:12 ----D---- C:\Program Files\QuickTime
2011-01-11 21:25:07 ----D---- C:\ProgramData\Apple Computer
2011-01-11 21:24:35 ----D---- C:\Program Files\Apple Software Update
2011-01-11 21:21:49 ----D---- C:\Program Files\Bonjour
2011-01-11 21:21:21 ----D---- C:\ProgramData\Apple
2011-01-11 21:21:21 ----D---- C:\Program Files\Common Files\Apple
2011-01-08 13:40:45 ----D---- C:\Windows\Minidump
2011-01-04 20:41:09 ----D---- C:\Program Files\Common Files\Adobe
2011-01-04 20:40:05 ----D---- C:\ProgramData\Adobe
2011-01-04 20:40:04 ----D---- C:\Program Files\Adobe
2011-01-04 20:40:02 ----D---- C:\Program Files\Common Files\Adobe AIR
2011-01-04 20:36:24 ----D---- C:\Program Files\uTorrent
2011-01-04 20:35:28 ----D---- C:\Users\Owner\AppData\Roaming\uTorrent
2011-01-02 17:59:31 ----A---- C:\Windows\system32\drivers\Lbd.sys
2011-01-02 17:59:27 ----A---- C:\Windows\system32\drivers\SBREDrv.sys
2011-01-02 17:58:06 ----HDC---- C:\ProgramData\{2162CCC0-3A5F-4887-B51F-CE5F195B3620}
2011-01-02 17:57:44 ----D---- C:\ProgramData\Lavasoft
2011-01-02 17:57:44 ----D---- C:\Program Files\Lavasoft
2011-01-02 17:47:01 ----D---- C:\Program Files\Linksys
2011-01-02 17:43:35 ----D---- C:\Program Files\Pure Networks
2011-01-02 17:43:16 ----A---- C:\Windows\system32\atsckernel.exe
2011-01-02 17:43:10 ----A---- C:\Windows\system32\atashost.exe
2011-01-02 17:42:59 ----D---- C:\ProgramData\webex
2011-01-02 17:41:31 ----A---- C:\Windows\system32\drivers\pnarp.sys
2011-01-02 17:40:37 ----DC---- C:\Windows\system32\DRVSTORE
2011-01-02 17:40:37 ----A---- C:\Windows\system32\drivers\purendis.sys
2011-01-02 17:40:34 ----D---- C:\Program Files\Common Files\Pure Networks Shared
2011-01-02 17:39:25 ----D---- C:\ProgramData\Pure Networks
2010-12-28 15:47:28 ----D---- C:\Users\Owner\AppData\Roaming\.minecraft
2010-12-28 15:45:11 ----D---- C:\ProgramData\Sun
2010-12-28 15:45:10 ----D---- C:\Program Files\Common Files\Java
2010-12-28 15:44:01 ----A---- C:\Windows\system32\javaws.exe
2010-12-28 15:44:01 ----A---- C:\Windows\system32\javaw.exe
2010-12-28 15:44:01 ----A---- C:\Windows\system32\java.exe
2010-12-28 15:44:01 ----A---- C:\Windows\system32\deployJava1.dll
2010-12-28 15:43:44 ----D---- C:\Program Files\Java
2010-12-28 12:58:55 ----D---- C:\Users\Owner\AppData\Roaming\vlc
2010-12-28 12:56:58 ----D---- C:\Program Files\VideoLAN
2010-12-27 22:52:00 ----ASH---- C:\hiberfil.sys
2010-12-27 22:47:27 ----D---- C:\ProgramData\NVIDIA Corporation
2010-12-27 22:43:18 ----A---- C:\Windows\system32\nvwgf2um.dll
2010-12-27 22:43:17 ----A---- C:\Windows\system32\nvoglv32.dll
2010-12-27 22:43:17 ----A---- C:\Windows\system32\nvgenco322030.dll
2010-12-27 22:43:17 ----A---- C:\Windows\system32\drivers\nvlddmkm.sys
2010-12-27 22:43:16 ----A---- C:\Windows\system32\nvdispco322050.dll
2010-12-27 22:43:13 ----A---- C:\Windows\system32\nvd3dum.dll
2010-12-27 22:43:13 ----A---- C:\Windows\system32\nvcuvenc.dll
2010-12-27 22:43:12 ----A---- C:\Windows\system32\OpenCL.dll
2010-12-27 22:43:12 ----A---- C:\Windows\system32\nvcuda.dll
2010-12-27 22:43:12 ----A---- C:\Windows\system32\nvcompiler.dll
2010-12-27 22:43:11 ----A---- C:\Windows\system32\nvcuvid.dll
2010-12-27 22:42:50 ----D---- C:\Program Files\NVIDIA Corporation
2010-12-27 22:42:21 ----D---- C:\NVIDIA
2010-12-27 19:55:33 ----D---- C:\Users\Owner\AppData\Roaming\AVG10
2010-12-27 19:51:50 ----HD---- C:\ProgramData\Common Files
2010-12-27 19:49:51 ----D---- C:\Windows\system32\drivers\AVG
2010-12-27 19:49:51 ----D---- C:\ProgramData\AVG10
2010-12-27 19:48:39 ----D---- C:\Program Files\AVG
2010-12-27 19:43:23 ----D---- C:\ProgramData\MFAData
2010-12-26 21:27:27 ----D---- C:\ProgramData\Blizzard Entertainment
2010-12-26 21:26:48 ----D---- C:\Program Files\Common Files\Blizzard Entertainment
2010-12-26 20:52:41 ----D---- C:\Users\Owner\AppData\Roaming\Macromedia
2010-12-26 20:52:41 ----D---- C:\Users\Owner\AppData\Roaming\Adobe
2010-12-26 20:52:36 ----D---- C:\Windows\system32\Macromed
2010-12-26 20:43:24 ----D---- C:\Users\Owner\AppData\Roaming\Mozilla
2010-12-26 20:43:19 ----D---- C:\Program Files\Mozilla Firefox
2010-12-26 17:22:55 ----D---- C:\Users\Owner\AppData\Roaming\Webroot
2010-12-26 17:05:30 ----A---- C:\Windows\system32\inetcomm.dll
2010-12-26 17:05:21 ----A---- C:\Windows\system32\winhttp.dll
2010-12-26 17:03:39 ----A---- C:\Windows\system32\srvsvc.dll
2010-12-26 17:03:39 ----A---- C:\Windows\system32\netevent.dll
2010-12-26 17:03:39 ----A---- C:\Windows\system32\drivers\srvnet.sys
2010-12-26 17:03:39 ----A---- C:\Windows\system32\drivers\srv2.sys
2010-12-26 17:03:39 ----A---- C:\Windows\system32\drivers\srv.sys
2010-12-26 16:54:32 ----D---- C:\Program Files\Windows Portable Devices
2010-12-26 16:53:47 ----N---- C:\Windows\system32\MpSigStub.exe
2010-12-26 16:51:25 ----A---- C:\Windows\system32\t2embed.dll
2010-12-26 16:50:54 ----A---- C:\Windows\system32\ole32.dll
2010-12-26 16:50:23 ----A---- C:\Windows\system32\mfc40u.dll
2010-12-26 16:50:23 ----A---- C:\Windows\system32\mfc40.dll
2010-12-26 16:49:52 ----A---- C:\Windows\system32\comctl32.dll
2010-12-26 16:49:22 ----A---- C:\Windows\system32\wmpmde.dll
2010-12-26 16:48:53 ----A---- C:\Windows\system32\schannel.dll
2010-12-26 16:45:59 ----A---- C:\Windows\system32\msxml3.dll
2010-12-26 16:43:17 ----A---- C:\Windows\system32\wmp.dll
2010-12-26 16:43:15 ----A---- C:\Windows\system32\wmploc.DLL
2010-12-26 16:42:42 ----A---- C:\Windows\system32\spoolsv.exe
2010-12-26 16:42:11 ----A---- C:\Windows\system32\MP4SDECD.DLL
2010-12-26 16:41:40 ----A---- C:\Windows\system32\usp10.dll
2010-12-26 16:41:09 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-12-26 16:41:09 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-12-26 16:40:36 ----A---- C:\Windows\system32\drivers\tcpipreg.sys
2010-12-26 16:40:35 ----A---- C:\Windows\system32\drivers\tcpip.sys
2010-12-26 16:38:53 ----A---- C:\Windows\system32\iccvid.dll
2010-12-26 16:38:23 ----A---- C:\Windows\system32\rtutils.dll
2010-12-26 16:37:52 ----D---- C:\Windows\Panther
2010-12-26 16:37:50 ----A---- C:\Windows\system32\shell32.dll
2010-12-26 16:36:51 ----A---- C:\Windows\system32\UIRibbonRes.dll
2010-12-26 16:36:51 ----A---- C:\Windows\system32\UIRibbon.dll
2010-12-26 16:36:51 ----A---- C:\Windows\system32\UIAnimation.dll
2010-12-26 16:36:19 ----A---- C:\Windows\system32\XpsRasterService.dll
2010-12-26 16:36:19 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2010-12-26 16:36:19 ----A---- C:\Windows\system32\WMPhoto.dll
2010-12-26 16:36:19 ----A---- C:\Windows\system32\printfilterpipelineprxy.dll
2010-12-26 16:36:19 ----A---- C:\Windows\system32\drivers\dxgkrnl.sys
2010-12-26 16:36:19 ----A---- C:\Windows\system32\d3d10warp.dll
2010-12-26 16:36:19 ----A---- C:\Windows\system32\cdd.dll
2010-12-26 16:36:18 ----A---- C:\Windows\system32\xpsservices.dll
2010-12-26 16:36:18 ----A---- C:\Windows\system32\XpsPrint.dll
2010-12-26 16:36:18 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2010-12-26 16:36:18 ----A---- C:\Windows\system32\WindowsCodecs.dll
2010-12-26 16:36:18 ----A---- C:\Windows\system32\printfilterpipelinesvc.exe
2010-12-26 16:36:18 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll
2010-12-26 16:36:18 ----A---- C:\Windows\system32\OpcServices.dll
2010-12-26 16:36:18 ----A---- C:\Windows\system32\FntCache.dll
2010-12-26 16:36:18 ----A---- C:\Windows\system32\dxgi.dll
2010-12-26 16:36:18 ----A---- C:\Windows\system32\dxdiagn.dll
2010-12-26 16:36:18 ----A---- C:\Windows\system32\dxdiag.exe
2010-12-26 16:36:18 ----A---- C:\Windows\system32\DWrite.dll
2010-12-26 16:36:18 ----A---- C:\Windows\system32\d3d11.dll
2010-12-26 16:36:18 ----A---- C:\Windows\system32\d3d10level9.dll
2010-12-26 16:36:18 ----A---- C:\Windows\system32\d3d10core.dll
2010-12-26 16:36:18 ----A---- C:\Windows\system32\d3d10_1core.dll
2010-12-26 16:36:18 ----A---- C:\Windows\system32\d3d10_1.dll
2010-12-26 16:36:18 ----A---- C:\Windows\system32\d3d10.dll
2010-12-26 16:36:18 ----A---- C:\Windows\system32\d2d1.dll
2010-12-26 16:35:49 ----A---- C:\Windows\system32\WPDShextAutoplay.exe
2010-12-26 16:35:49 ----A---- C:\Windows\system32\wpdbusenum.dll
2010-12-26 16:35:49 ----A---- C:\Windows\system32\BthMtpContextHandler.dll
2010-12-26 16:35:48 ----A---- C:\Windows\system32\PortableDeviceConnectApi.dll
2010-12-26 16:35:47 ----A---- C:\Windows\system32\WPDSp.dll
2010-12-26 16:35:47 ----A---- C:\Windows\system32\WPDShServiceObj.dll
2010-12-26 16:35:47 ----A---- C:\Windows\system32\wpdshext.dll
2010-12-26 16:35:47 ----A---- C:\Windows\system32\wpd_ci.dll
2010-12-26 16:35:47 ----A---- C:\Windows\system32\PortableDeviceWMDRM.dll
2010-12-26 16:35:47 ----A---- C:\Windows\system32\PortableDeviceTypes.dll
2010-12-26 16:35:47 ----A---- C:\Windows\system32\PortableDeviceClassExtension.dll
2010-12-26 16:35:47 ----A---- C:\Windows\system32\PortableDeviceApi.dll
2010-12-26 16:35:09 ----A---- C:\Windows\system32\UIAutomationCore.dll
2010-12-26 16:35:09 ----A---- C:\Windows\system32\oleaccrc.dll
2010-12-26 16:35:09 ----A---- C:\Windows\system32\oleacc.dll
2010-12-26 16:32:41 ----A---- C:\Windows\system32\asycfilt.dll
2010-12-26 16:30:45 ----A---- C:\Windows\system32\vbscript.dll
2010-12-26 16:30:16 ----A---- C:\Windows\system32\drivers\mrxsmb20.sys
2010-12-26 16:30:16 ----A---- C:\Windows\system32\drivers\mrxsmb10.sys
2010-12-26 16:30:16 ----A---- C:\Windows\system32\drivers\mrxsmb.sys
2010-12-26 16:29:49 ----A---- C:\Windows\system32\nshhttp.dll
2010-12-26 16:29:49 ----A---- C:\Windows\system32\httpapi.dll
2010-12-26 16:29:49 ----A---- C:\Windows\system32\drivers\http.sys
2010-12-26 16:29:31 ----A---- C:\Windows\system32\RMActivate_ssp.exe
2010-12-26 16:29:31 ----A---- C:\Windows\system32\RMActivate_isv.exe
2010-12-26 16:29:31 ----A---- C:\Windows\system32\RMActivate.exe
2010-12-26 16:29:31 ----A---- C:\Windows\system32\msdrm.dll
2010-12-26 16:29:30 ----A---- C:\Windows\system32\secproc_ssp_isv.dll
2010-12-26 16:29:30 ----A---- C:\Windows\system32\secproc_ssp.dll
2010-12-26 16:29:30 ----A---- C:\Windows\system32\secproc_isv.dll
2010-12-26 16:29:30 ----A---- C:\Windows\system32\secproc.dll
2010-12-26 16:29:30 ----A---- C:\Windows\system32\RMActivate_ssp_isv.exe
2010-12-26 16:28:58 ----A---- C:\Windows\system32\jscript.dll
2010-12-26 16:28:36 ----A---- C:\Windows\system32\tsbyuv.dll
2010-12-26 16:28:36 ----A---- C:\Windows\system32\quartz.dll
2010-12-26 16:28:36 ----A---- C:\Windows\system32\msyuv.dll
2010-12-26 16:28:36 ----A---- C:\Windows\system32\msvidc32.dll
2010-12-26 16:28:36 ----A---- C:\Windows\system32\msvfw32.dll
2010-12-26 16:28:36 ----A---- C:\Windows\system32\msrle32.dll
2010-12-26 16:28:36 ----A---- C:\Windows\system32\mciavi32.dll
2010-12-26 16:28:36 ----A---- C:\Windows\system32\iyuv_32.dll
2010-12-26 16:28:36 ----A---- C:\Windows\system32\avifil32.dll
2010-12-26 16:28:22 ----A---- C:\Windows\system32\lpk.dll
2010-12-26 16:28:22 ----A---- C:\Windows\system32\dciman32.dll
2010-12-26 16:28:09 ----A---- C:\Windows\system32\rastls.dll
2010-12-26 16:27:39 ----A---- C:\Windows\system32\WSDApi.dll
2010-12-26 16:27:08 ----A---- C:\Windows\system32\unregmp2.exe
2010-12-26 16:26:45 ----A---- C:\Windows\system32\msasn1.dll
2010-12-26 16:26:31 ----A---- C:\Windows\system32\WMSPDMOD.DLL
2010-12-26 16:26:22 ----D---- C:\Windows.old.000
2010-12-26 16:26:19 ----A---- C:\Windows\system32\msv1_0.dll
2010-12-26 16:26:06 ----A---- C:\Windows\system32\mf.dll
2010-12-26 16:26:05 ----A---- C:\Windows\system32\WMVCORE.DLL
2010-12-26 16:25:40 ----A---- C:\Windows\system32\wlansvc.dll
2010-12-26 16:25:40 ----A---- C:\Windows\system32\wlansec.dll
2010-12-26 16:25:40 ----A---- C:\Windows\system32\wlanmsm.dll
2010-12-26 16:25:40 ----A---- C:\Windows\system32\wlanapi.dll
2010-12-26 16:25:40 ----A---- C:\Windows\system32\L2SecHC.dll
2010-12-26 16:25:04 ----A---- C:\Windows\system32\MRINFO.EXE
2010-12-26 16:25:03 ----A---- C:\Windows\system32\NETSTAT.EXE
2010-12-26 16:25:03 ----A---- C:\Windows\system32\finger.exe
2010-12-26 16:25:02 ----A---- C:\Windows\system32\ROUTE.EXE
2010-12-26 16:25:02 ----A---- C:\Windows\system32\HOSTNAME.EXE
2010-12-26 16:25:02 ----A---- C:\Windows\system32\ARP.EXE
2010-12-26 16:24:59 ----A---- C:\Windows\system32\netiohlp.dll
2010-12-26 16:24:58 ----A---- C:\Windows\system32\TCPSVCS.EXE
2010-12-26 16:24:09 ----A---- C:\Windows\system32\wkssvc.dll
2010-12-26 16:24:01 ----A---- C:\Windows\system32\atl.dll
2010-12-26 16:23:50 ----A---- C:\Windows\system32\mstscax.dll
2010-12-26 16:23:34 ----A---- C:\Windows\system32\spwmp.dll
2010-12-26 16:23:34 ----A---- C:\Windows\system32\dxmasf.dll
2010-12-26 16:23:31 ----A---- C:\Windows\system32\wmpdxm.dll
2010-12-26 16:23:12 ----A---- C:\Windows\system32\kerberos.dll
2010-12-26 16:23:11 ----A---- C:\Windows\system32\lsass.exe
2010-12-26 16:23:11 ----A---- C:\Windows\system32\lsasrv.dll
2010-12-26 16:23:11 ----A---- C:\Windows\system32\drivers\ksecdd.sys
2010-12-26 16:23:10 ----A---- C:\Windows\system32\wdigest.dll
2010-12-26 16:23:10 ----A---- C:\Windows\system32\secur32.dll
2010-12-26 16:22:03 ----A---- C:\Windows\system32\rpcrt4.dll
2010-12-26 16:21:52 ----A---- C:\Windows\system32\localspl.dll
2010-12-26 16:19:51 ----A---- C:\Windows\system32\tzres.dll
2010-12-26 16:19:24 ----A---- C:\Windows\system32\fontsub.dll
2010-12-26 16:19:24 ----A---- C:\Windows\system32\atmlib.dll
2010-12-26 16:19:24 ----A---- C:\Windows\system32\atmfd.dll
2010-12-26 16:18:02 ----A---- C:\Windows\system32\msshsq.dll
2010-12-26 16:17:29 ----A---- C:\Windows\system32\consent.exe
2010-12-26 16:17:16 ----A---- C:\Windows\system32\win32k.sys
2010-12-26 16:16:51 ----A---- C:\Windows\system32\wmicmiplugin.dll
2010-12-26 16:16:51 ----A---- C:\Windows\system32\taskschd.dll
2010-12-26 16:16:51 ----A---- C:\Windows\system32\schedsvc.dll
2010-12-26 16:16:50 ----A---- C:\Windows\system32\taskeng.exe
2010-12-26 16:16:50 ----A---- C:\Windows\system32\taskcomp.dll
2010-12-26 16:16:13 ----A---- C:\Windows\system32\gameux.dll
2010-12-26 16:16:13 ----A---- C:\Windows\system32\Apphlpdm.dll
2010-12-26 16:16:12 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll
2010-12-26 16:15:24 ----A---- C:\Windows\system32\msxml6.dll
2010-12-26 16:07:00 ----D---- C:\Program Files\Microsoft.NET
2010-12-26 16:05:48 ----A---- C:\Windows\system32\PresentationHostProxy.dll
2010-12-26 16:05:48 ----A---- C:\Windows\system32\PresentationHost.exe
2010-12-26 16:05:48 ----A---- C:\Windows\system32\netfxperf.dll
2010-12-26 16:05:48 ----A---- C:\Windows\system32\mscoree.dll
2010-12-26 16:05:48 ----A---- C:\Windows\system32\dfshim.dll
2010-12-26 15:58:03 ----D---- C:\ProgramData\Geek Squad
2010-12-26 15:55:59 ----A---- C:\Windows\system32\mshtmled.dll
2010-12-26 15:55:58 ----A---- C:\Windows\system32\occache.dll
2010-12-26 15:55:58 ----A---- C:\Windows\system32\mstime.dll
2010-12-26 15:55:58 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-12-26 15:55:58 ----A---- C:\Windows\system32\msfeeds.dll
2010-12-26 15:55:58 ----A---- C:\Windows\system32\licmgr10.dll
2010-12-26 15:55:58 ----A---- C:\Windows\system32\jsproxy.dll
2010-12-26 15:55:58 ----A---- C:\Windows\system32\iepeers.dll
2010-12-26 15:55:57 ----A---- C:\Windows\system32\wininet.dll
2010-12-26 15:55:57 ----A---- C:\Windows\system32\ieui.dll
2010-12-26 15:55:57 ----A---- C:\Windows\system32\iesetup.dll
2010-12-26 15:55:57 ----A---- C:\Windows\system32\iernonce.dll
2010-12-26 15:55:57 ----A---- C:\Windows\system32\iedkcs32.dll
2010-12-26 15:55:56 ----A---- C:\Windows\system32\msfeedssync.exe
2010-12-26 15:55:56 ----A---- C:\Windows\system32\ieUnatt.exe
2010-12-26 15:55:56 ----A---- C:\Windows\system32\iesysprep.dll
2010-12-26 15:55:56 ----A---- C:\Windows\system32\iertutil.dll
2010-12-26 15:55:56 ----A---- C:\Windows\system32\ie4uinit.exe
2010-12-26 15:55:55 ----A---- C:\Windows\system32\urlmon.dll
2010-12-26 15:55:55 ----A---- C:\Windows\system32\ieframe.dll
2010-12-26 15:55:54 ----A---- C:\Windows\system32\mshtml.dll
2010-12-26 15:52:16 ----A---- C:\Windows\system32\icardie.dll
2010-12-26 15:52:15 ----A---- C:\Windows\system32\msls31.dll
2010-12-26 15:52:15 ----A---- C:\Windows\system32\mshtmler.dll
2010-12-26 15:52:15 ----A---- C:\Windows\system32\ieakeng.dll
2010-12-26 15:52:15 ----A---- C:\Windows\system32\corpol.dll
2010-12-26 15:52:15 ----A---- C:\Windows\system32\admparse.dll
2010-12-26 15:52:14 ----A---- C:\Windows\system32\webcheck.dll
2010-12-26 15:52:14 ----A---- C:\Windows\system32\msrating.dll
2010-12-26 15:52:14 ----A---- C:\Windows\system32\inseng.dll
2010-12-26 15:52:14 ----A---- C:\Windows\system32\imgutil.dll
2010-12-26 15:52:14 ----A---- C:\Windows\system32\ieaksie.dll
2010-12-26 15:52:14 ----A---- C:\Windows\system32\dxtrans.dll
2010-12-26 15:52:14 ----A---- C:\Windows\system32\dxtmsft.dll
2010-12-26 15:52:13 ----A---- C:\Windows\system32\WinFXDocObj.exe
2010-12-26 15:52:13 ----A---- C:\Windows\system32\wextract.exe
2010-12-26 15:52:13 ----A---- C:\Windows\system32\pngfilt.dll
2010-12-26 15:52:13 ----A---- C:\Windows\system32\ieakui.dll
2010-12-26 15:52:13 ----A---- C:\Windows\system32\advpack.dll
2010-12-26 15:52:12 ----A---- C:\Windows\system32\url.dll
2010-12-26 15:52:12 ----A---- C:\Windows\system32\ieapfltr.dll
2010-12-26 15:52:11 ----A---- C:\Windows\system32\SetIEInstalledDate.exe
2010-12-26 15:52:11 ----A---- C:\Windows\system32\SetDepNx.exe
2010-12-26 15:52:11 ----A---- C:\Windows\system32\RegisterIEPKEYs.exe
2010-12-26 15:52:11 ----A---- C:\Windows\system32\PDMSetup.exe
2010-12-26 15:52:11 ----A---- C:\Windows\system32\mshta.exe
2010-12-26 15:52:11 ----A---- C:\Windows\system32\iexpress.exe
2010-12-26 15:25:40 ----D---- C:\Windows\system32\eu-ES
2010-12-26 15:25:40 ----D---- C:\Windows\system32\ca-ES
2010-12-26 15:25:39 ----D---- C:\Windows\system32\vi-VN
2010-12-26 15:22:09 ----D---- C:\Windows\system32\SPReview
2010-12-26 15:14:02 ----A---- C:\Windows\system32\scavenge.dll
2010-12-26 15:13:56 ----A---- C:\Windows\system32\compcln.exe
2010-12-26 15:10:52 ----A---- C:\Windows\system32\SearchProtocolHost.exe
2010-12-26 15:10:52 ----A---- C:\Windows\system32\SearchIndexer.exe
2010-12-26 15:10:52 ----A---- C:\Windows\system32\SearchFilterHost.exe
2010-12-26 15:10:52 ----A---- C:\Windows\system32\sdohlp.dll
2010-12-26 15:10:51 ----A---- C:\Windows\system32\scrrun.dll
2010-12-26 15:10:51 ----A---- C:\Windows\system32\scansetting.dll
2010-12-26 15:10:51 ----A---- C:\Windows\system32\samlib.dll
2010-12-26 15:10:51 ----A---- C:\Windows\system32\rtffilt.dll
2010-12-26 15:10:51 ----A---- C:\Windows\system32\rsaenh.dll
2010-12-26 15:10:51 ----A---- C:\Windows\system32\rrinstaller.exe
2010-12-26 15:10:51 ----A---- C:\Windows\system32\rpcss.dll
2010-12-26 15:10:51 ----A---- C:\Windows\system32\rpchttp.dll
2010-12-26 15:10:51 ----A---- C:\Windows\system32\riched20.dll
2010-12-26 15:10:51 ----A---- C:\Windows\system32\drivers\RNDISMP.sys
2010-12-26 15:10:51 ----A---- C:\Windows\system32\drivers\rmcast.sys
2010-12-26 15:10:50 ----A---- C:\Windows\system32\SCardSvr.dll
2010-12-26 15:10:50 ----A---- C:\Windows\system32\samsrv.dll
2010-12-26 15:10:49 ----A---- C:\Windows\system32\scrobj.dll
2010-12-26 15:10:49 ----A---- C:\Windows\system32\scksp.dll
2010-12-26 15:10:49 ----A---- C:\Windows\system32\scesrv.dll
2010-12-26 15:10:49 ----A---- C:\Windows\system32\scecli.dll
2010-12-26 15:10:48 ----A---- C:\Windows\system32\perfdisk.dll
2010-12-26 15:10:48 ----A---- C:\Windows\system32\PerfCenterCPL.dll
2010-12-26 15:10:48 ----A---- C:\Windows\system32\pdh.dll
2010-12-26 15:10:48 ----A---- C:\Windows\system32\drivers\pacer.sys
2010-12-26 15:10:47 ----A---- C:\Windows\system32\powercpl.dll
2010-12-26 15:10:47 ----A---- C:\Windows\system32\PNPXAssoc.dll
2010-12-26 15:10:47 ----A---- C:\Windows\system32\PnPutil.exe
2010-12-26 15:10:47 ----A---- C:\Windows\system32\PnPUnattend.exe
2010-12-26 15:10:47 ----A---- C:\Windows\system32\pnpui.dll
2010-12-26 15:10:47 ----A---- C:\Windows\system32\pnpsetup.dll
2010-12-26 15:10:47 ----A---- C:\Windows\system32\pnidui.dll
2010-12-26 15:10:47 ----A---- C:\Windows\system32\PkgMgr.exe
2010-12-26 15:10:47 ----A---- C:\Windows\system32\pidgenx.dll
2010-12-26 15:10:47 ----A---- C:\Windows\system32\photowiz.dll
2010-12-26 15:10:47 ----A---- C:\Windows\system32\pcaui.dll
2010-12-26 15:10:47 ----A---- C:\Windows\system32\p2psvc.dll
2010-12-26 15:10:47 ----A---- C:\Windows\system32\P2PGraph.dll
2010-12-26 15:10:47 ----A---- C:\Windows\system32\ntdll.dll
2010-12-26 15:10:47 ----A---- C:\Windows\system32\nslookup.exe
2010-12-26 15:10:47 ----A---- C:\Windows\system32\drivers\portcls.sys
2010-12-26 15:10:47 ----A---- C:\Windows\system32\drivers\pciidex.sys
2010-12-26 15:10:47 ----A---- C:\Windows\system32\drivers\pci.sys
2010-12-26 15:10:47 ----A---- C:\Windows\system32\drivers\partmgr.sys
2010-12-26 15:10:47 ----A---- C:\Windows\system32\drivers\npfs.sys
2010-12-26 15:10:46 ----A---- C:\Windows\system32\oleaut32.dll
2010-12-26 15:10:46 ----A---- C:\Windows\system32\offfilt.dll
2010-12-26 15:10:46 ----A---- C:\Windows\system32\odbccp32.dll
2010-12-26 15:10:46 ----A---- C:\Windows\system32\NlsLexicons0009.dll
2010-12-26 15:10:46 ----A---- C:\Windows\system32\NlsLexicons0007.dll
2010-12-26 15:10:46 ----A---- C:\Windows\system32\nlhtml.dll
2010-12-26 15:10:46 ----A---- C:\Windows\system32\drivers\ntfs.sys
2010-12-26 15:10:45 ----A---- C:\Windows\system32\osk.exe
2010-12-26 15:10:45 ----A---- C:\Windows\system32\oobefldr.dll
2010-12-26 15:10:45 ----A---- C:\Windows\system32\onex.dll
2010-12-26 15:10:45 ----A---- C:\Windows\system32\olepro32.dll
2010-12-26 15:10:45 ----A---- C:\Windows\system32\oleprn.dll
2010-12-26 15:10:45 ----A---- C:\Windows\system32\odbcconf.dll
2010-12-26 15:10:45 ----A---- C:\Windows\system32\ocsetup.exe
2010-12-26 15:10:45 ----A---- C:\Windows\system32\ntprint.dll
2010-12-26 15:10:45 ----A---- C:\Windows\system32\ntmarta.dll
2010-12-26 15:10:45 ----A---- C:\Windows\system32\drivers\nwifi.sys
2010-12-26 15:10:44 ----A---- C:\Windows\system32\rastapi.dll
2010-12-26 15:10:44 ----A---- C:\Windows\system32\rasmontr.dll
2010-12-26 15:10:44 ----A---- C:\Windows\system32\rasmans.dll
2010-12-26 15:10:44 ----A---- C:\Windows\system32\rasgcw.dll
2010-12-26 15:10:44 ----A---- C:\Windows\system32\rasdlg.dll
2010-12-26 15:10:44 ----A---- C:\Windows\system32\rasdial.exe
2010-12-26 15:10:44 ----A---- C:\Windows\system32\rasdiag.dll
2010-12-26 15:10:44 ----A---- C:\Windows\system32\raschap.dll
2010-12-26 15:10:44 ----A---- C:\Windows\system32\rasapi32.dll
2010-12-26 15:10:43 ----A---- C:\Windows\system32\rasppp.dll
2010-12-26 15:10:43 ----A---- C:\Windows\system32\rasplap.dll
2010-12-26 15:10:43 ----A---- C:\Windows\system32\Query.dll
2010-12-26 15:10:43 ----A---- C:\Windows\system32\qmgr.dll
2010-12-26 15:10:43 ----A---- C:\Windows\system32\qedit.dll
2010-12-26 15:10:43 ----A---- C:\Windows\system32\drivers\rassstp.sys
2010-12-26 15:10:43 ----A---- C:\Windows\system32\drivers\raspppoe.sys
2010-12-26 15:10:42 ----A---- C:\Windows\system32\RelMon.dll
2010-12-26 15:10:42 ----A---- C:\Windows\system32\rekeywiz.exe
2010-12-26 15:10:42 ----A---- C:\Windows\system32\regsvc.dll
2010-12-26 15:10:42 ----A---- C:\Windows\system32\regapi.dll
2010-12-26 15:10:42 ----A---- C:\Windows\system32\reg.exe
2010-12-26 15:10:42 ----A---- C:\Windows\system32\rdpwsx.dll
2010-12-26 15:10:42 ----A---- C:\Windows\system32\rdpencom.dll
2010-12-26 15:10:42 ----A---- C:\Windows\system32\RacEngn.dll
2010-12-26 15:10:42 ----A---- C:\Windows\system32\PresentationSettings.exe
2010-12-26 15:10:42 ----A---- C:\Windows\system32\PresentationNative_v0300.dll
2010-12-26 15:10:42 ----A---- C:\Windows\system32\drivers\rfcomm.sys
2010-12-26 15:10:42 ----A---- C:\Windows\system32\drivers\rdpwd.sys
2010-12-26 15:10:42 ----A---- C:\Windows\system32\drivers\rdbss.sys
2010-12-26 15:10:41 ----A---- C:\Windows\system32\prnntfy.dll
2010-12-26 15:10:41 ----A---- C:\Windows\system32\printui.dll
2010-12-26 15:10:41 ----A---- C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2010-12-26 15:10:41 ----A---- C:\Windows\system32\powrprof.dll
2010-12-26 15:10:38 ----A---- C:\Windows\system32\qdvd.dll
2010-12-26 15:10:38 ----A---- C:\Windows\system32\QAGENTRT.DLL
2010-12-26 15:10:38 ----A---- C:\Windows\system32\puiapi.dll
2010-12-26 15:10:38 ----A---- C:\Windows\system32\psisdecd.dll
2010-12-26 15:10:38 ----A---- C:\Windows\system32\PSHED.DLL
2010-12-26 15:10:38 ----A---- C:\Windows\system32\propsys.dll
2010-12-26 15:10:38 ----A---- C:\Windows\system32\propdefs.dll
2010-12-26 15:10:38 ----A---- C:\Windows\system32\profsvc.dll
2010-12-26 15:10:35 ----A---- C:\Windows\system32\sendmail.dll
2010-12-26 15:10:33 ----A---- C:\Windows\system32\shlwapi.dll
2010-12-26 15:10:33 ----A---- C:\Windows\system32\shdocvw.dll
2010-12-26 15:10:33 ----A---- C:\Windows\system32\setupapi.dll
2010-12-26 15:10:33 ----A---- C:\Windows\system32\sethc.exe
2010-12-26 15:10:33 ----A---- C:\Windows\system32\services.exe
2010-12-26 15:10:30 ----A---- C:\Windows\system32\EhStorAPI.dll
2010-12-26 15:10:30 ----A---- C:\Windows\system32\eapphost.dll
2010-12-26 15:10:30 ----A---- C:\Windows\system32\eappgnui.dll
2010-12-26 15:10:30 ----A---- C:\Windows\system32\eappcfg.dll
2010-12-26 15:10:30 ----A---- C:\Windows\system32\eapp3hst.dll
2010-12-26 15:10:30 ----A---- C:\Windows\system32\drivers\ecache.sys
2010-12-26 15:10:27 ----A---- C:\Windows\system32\evr.dll
2010-12-26 15:10:27 ----A---- C:\Windows\system32\dwm.exe
2010-12-26 15:10:27 ----A---- C:\Windows\system32\dsprop.dll
2010-12-26 15:10:27 ----A---- C:\Windows\system32\dsound.dll
2010-12-26 15:10:27 ----A---- C:\Windows\system32\drivers\exfat.sys
2010-12-26 15:10:27 ----A---- C:\Windows\system32\drivers\dxg.sys
2010-12-26 15:10:27 ----A---- C:\Windows\system32\drivers\Dumpata.sys
2010-12-26 15:10:26 ----A---- C:\Windows\system32\f3ahvoas.dll
2010-12-26 15:10:26 ----A---- C:\Windows\system32\ExplorerFrame.dll
2010-12-26 15:10:26 ----A---- C:\Windows\system32\eudcedit.exe
2010-12-26 15:10:26 ----A---- C:\Windows\system32\esent.dll
2010-12-26 15:10:26 ----A---- C:\Windows\explorer.exe
2010-12-26 15:10:25 ----A---- C:\Windows\system32\es.dll
2010-12-26 15:10:25 ----A---- C:\Windows\system32\EncDec.dll
2010-12-26 15:10:25 ----A---- C:\Windows\system32\emdmgmt.dll
2010-12-26 15:10:25 ----A---- C:\Windows\system32\EhStorShell.dll
2010-12-26 15:10:25 ----A---- C:\Windows\system32\EhStorPwdMgr.dll
2010-12-26 15:10:25 ----A---- C:\Windows\system32\EhStorAuthn.dll
2010-12-26 15:10:25 ----A---- C:\Windows\system32\dimsroam.dll
2010-12-26 15:10:25 ----A---- C:\Windows\system32\diagperf.dll
2010-12-26 15:10:25 ----A---- C:\Windows\system32\dhcpcsvc6.dll
2010-12-26 15:10:24 ----A---- C:\Windows\system32\drivers\Diskdump.sys
2010-12-26 15:10:24 ----A---- C:\Windows\system32\drivers\disk.sys
2010-12-26 15:10:24 ----A---- C:\Windows\system32\drivers\dfsc.sys
2010-12-26 15:10:24 ----A---- C:\Windows\system32\diskraid.exe
2010-12-26 15:10:24 ----A---- C:\Windows\system32\diskpart.exe
2010-12-26 15:10:24 ----A---- C:\Windows\system32\dfsr.exe
2010-12-26 15:10:24 ----A---- C:\Windows\system32\devmgr.dll
2010-12-26 15:10:23 ----A---- C:\Windows\system32\hbaapi.dll
2010-12-26 15:10:23 ----A---- C:\Windows\system32\drvstore.dll
2010-12-26 15:10:23 ----A---- C:\Windows\system32\drvinst.exe
2010-12-26 15:10:23 ----A---- C:\Windows\system32\drmv2clt.dll
2010-12-26 15:10:23 ----A---- C:\Windows\system32\drmmgrtn.dll
2010-12-26 15:10:23 ----A---- C:\Windows\system32\drivers\hdaudbus.sys
2010-12-26 15:10:23 ----A---- C:\Windows\system32\dpapimig.exe
2010-12-26 15:10:23 ----A---- C:\Windows\system32\dot3svc.dll
2010-12-26 15:10:23 ----A---- C:\Windows\system32\dot3msm.dll
2010-12-26 15:10:23 ----A---- C:\Windows\system32\dot3cfg.dll
2010-12-26 15:10:23 ----A---- C:\Windows\system32\dnsrslvr.dll
2010-12-26 15:10:23 ----A---- C:\Windows\system32\dnsapi.dll
2010-12-26 15:10:23 ----A---- C:\Windows\system32\dmusic.dll
2010-12-26 15:10:23 ----A---- C:\Windows\system32\dmsynth.dll
2010-12-26 15:10:23 ----A---- C:\Windows\system32\dhcpcsvc.dll
2010-12-26 15:10:22 ----A---- C:\Windows\system32\gpresult.exe
2010-12-26 15:10:21 ----A---- C:\Windows\system32\iasnap.dll
2010-12-26 15:10:21 ----A---- C:\Windows\system32\IasMigReader.exe
2010-12-26 15:10:21 ----A---- C:\Windows\system32\IasMigPlugin.dll
2010-12-26 15:10:21 ----A---- C:\Windows\system32\iashlpr.dll
2010-12-26 15:10:21 ----A---- C:\Windows\system32\iasdatastore.dll
2010-12-26 15:10:21 ----A---- C:\Windows\system32\iasads.dll
2010-12-26 15:10:21 ----A---- C:\Windows\system32\iasacct.dll
2010-12-26 15:10:21 ----A---- C:\Windows\system32\hidserv.dll
2010-12-26 15:10:21 ----A---- C:\Windows\system32\hdwwiz.exe
2010-12-26 15:10:21 ----A---- C:\Windows\system32\gpupdate.exe
2010-12-26 15:10:21 ----A---- C:\Windows\system32\gpsvc.dll
2010-12-26 15:10:21 ----A---- C:\Windows\system32\fontext.dll
2010-12-26 15:10:21 ----A---- C:\Windows\system32\findstr.exe
2010-12-26 15:10:21 ----A---- C:\Windows\system32\Faultrep.dll
2010-12-26 15:10:21 ----A---- C:\Windows\system32\drivers\hidusb.sys
2010-12-26 15:10:21 ----A---- C:\Windows\system32\drivers\hidclass.sys
2010-12-26 15:10:21 ----A---- C:\Windows\system32\drivers\fltMgr.sys
2010-12-26 15:10:20 ----A---- C:\Windows\system32\gpapi.dll
2010-12-26 15:10:20 ----A---- C:\Windows\system32\gdi32.dll
2010-12-26 15:10:20 ----A---- C:\Windows\system32\feclient.dll
2010-12-26 15:10:20 ----A---- C:\Windows\system32\fdWSD.dll
2010-12-26 15:10:20 ----A---- C:\Windows\system32\fdWCN.dll
2010-12-26 15:10:20 ----A---- C:\Windows\system32\fdSSDP.dll
2010-12-26 15:10:20 ----A---- C:\Windows\system32\fdProxy.dll
2010-12-26 15:10:20 ----A---- C:\Windows\system32\fdeploy.dll
2010-12-26 15:10:20 ----A---- C:\Windows\system32\fdBthProxy.dll
2010-12-26 15:10:20 ----A---- C:\Windows\system32\fdBth.dll
2010-12-26 15:10:20 ----A---- C:\Windows\system32\fc.exe
2010-12-26 15:10:20 ----A---- C:\Windows\system32\drivers\fastfat.sys
2010-12-26 15:10:19 ----A---- C:\Windows\system32\gpedit.dll
2010-12-26 15:10:18 ----A---- C:\Windows\system32\FwRemoteSvr.dll
2010-12-26 15:10:18 ----A---- C:\Windows\system32\FWPUCLNT.DLL
2010-12-26 15:10:18 ----A---- C:\Windows\system32\fundisc.dll
2010-12-26 15:10:18 ----A---- C:\Windows\system32\FunctionDiscoveryFolder.dll
2010-12-26 15:10:18 ----A---- C:\Windows\system32\ftp.exe
2010-12-26 15:10:18 ----A---- C:\Windows\system32\fsquirt.exe
2010-12-26 15:10:18 ----A---- C:\Windows\system32\drivers\FWPKCLNT.SYS
2010-12-26 15:10:18 ----A---- C:\Windows\system32\audiosrv.dll
2010-12-26 15:10:17 ----A---- C:\Windows\system32\drivers\ataport.sys
2010-12-26 15:10:17 ----A---- C:\Windows\system32\AuxiliaryDisplayServices.dll
2010-12-26 15:10:17 ----A---- C:\Windows\system32\AuxiliaryDisplayDriverLib.dll
2010-12-26 15:10:17 ----A---- C:\Windows\system32\AuxiliaryDisplayCpl.dll
2010-12-26 15:10:17 ----A---- C:\Windows\system32\autoplay.dll
2010-12-26 15:10:17 ----A---- C:\Windows\system32\autofmt.exe
2010-12-26 15:10:17 ----A---- C:\Windows\system32\autoconv.exe
2010-12-26 15:10:17 ----A---- C:\Windows\system32\autochk.exe
2010-12-26 15:10:17 ----A---- C:\Windows\system32\authz.dll
2010-12-26 15:10:17 ----A---- C:\Windows\system32\authui.dll
2010-12-26 15:10:17 ----A---- C:\Windows\system32\AudioSes.dll
2010-12-26 15:10:17 ----A---- C:\Windows\system32\audiodg.exe
2010-12-26 15:10:15 ----A---- C:\Windows\system32\drivers\atapi.sys
2010-12-26 15:10:14 ----A---- C:\Windows\system32\drivers\bthenum.sys
2010-12-26 15:10:14 ----A---- C:\Windows\system32\drivers\bridge.sys
2010-12-26 15:10:14 ----A---- C:\Windows\system32\bthci.dll
2010-12-26 15:10:14 ----A---- C:\Windows\system32\browseui.dll
2010-12-26 15:10:14 ----A---- C:\Windows\system32\brcpl.dll
2010-12-26 15:10:13 ----A---- C:\Windows\system32\drivers\acpi.sys
2010-12-26 15:10:13 ----A---- C:\Windows\system32\blackbox.dll
2010-12-26 15:10:13 ----A---- C:\Windows\system32\bitsigd.dll
2010-12-26 15:10:13 ----A---- C:\Windows\system32\BFE.DLL
2010-12-26 15:10:13 ----A---- C:\Windows\system32\bcrypt.dll
2010-12-26 15:10:13 ----A---- C:\Windows\system32\basecsp.dll
2010-12-26 15:10:13 ----A---- C:\Windows\system32\azroles.dll
2010-12-26 15:10:13 ----A---- C:\Windows\system32\accessibilitycpl.dll
2010-12-26 15:10:12 ----A---- C:\Windows\system32\apphelp.dll
2010-12-26 15:10:12 ----A---- C:\Windows\system32\apds.dll
2010-12-26 15:10:12 ----A---- C:\Windows\system32\aaclient.dll
2010-12-26 15:10:11 ----A---- C:\Windows\system32\drivers\afd.sys
2010-12-26 15:10:11 ----A---- C:\Windows\system32\advapi32.dll
2010-12-26 15:10:11 ----A---- C:\Windows\system32\adtschema.dll
2010-12-26 15:10:11 ----A---- C:\Windows\system32\adsmsext.dll
2010-12-26 15:10:11 ----A---- C:\Windows\system32\adsldpc.dll
2010-12-26 15:10:10 ----A---- C:\Windows\system32\drivers\crashdmp.sys
2010-12-26 15:10:10 ----A---- C:\Windows\system32\crypt32.dll
2010-12-26 15:10:10 ----A---- C:\Windows\system32\credui.dll
2010-12-26 15:10:10 ----A---- C:\Windows\system32\connect.dll
2010-12-26 15:10:10 ----A---- C:\Windows\system32\conime.exe
2010-12-26 15:10:10 ----A---- C:\Windows\system32\comuid.dll
2010-12-26 15:10:10 ----A---- C:\Windows\system32\comsvcs.dll
2010-12-26 15:10:10 ----A---- C:\Windows\system32\cmdial32.dll
2010-12-26 15:10:09 ----A---- C:\Windows\system32\comdlg32.dll
2010-12-26 15:10:08 ----A---- C:\Windows\system32\DevicePairingWizard.exe
2010-12-26 15:10:08 ----A---- C:\Windows\system32\DevicePairingProxy.dll
2010-12-26 15:10:08 ----A---- C:\Windows\system32\DevicePairing.dll
2010-12-26 15:10:08 ----A---- C:\Windows\system32\DeviceEject.exe
2010-12-26 15:10:08 ----A---- C:\Windows\system32\dbgeng.dll
2010-12-26 15:10:08 ----A---- C:\Windows\system32\davclnt.dll
2010-12-26 15:10:08 ----A---- C:\Windows\system32\dataclen.dll
2010-12-26 15:10:08 ----A---- C:\Windows\system32\d3d9.dll
2010-12-26 15:10:08 ----A---- C:\Windows\system32\cmmon32.exe
2010-12-26 15:10:07 ----A---- C:\Windows\system32\drivers\cdrom.sys
2010-12-26 15:10:07 ----A---- C:\Windows\system32\csrstub.exe
2010-12-26 15:10:07 ----A---- C:\Windows\system32\cscript.exe
2010-12-26 15:10:07 ----A---- C:\Windows\system32\cscdll.dll
2010-12-26 15:10:07 ----A---- C:\Windows\system32\cscapi.dll
2010-12-26 15:10:07 ----A---- C:\Windows\system32\cryptui.dll
2010-12-26 15:10:07 ----A---- C:\Windows\system32\cryptsvc.dll
2010-12-26 15:10:07 ----A---- C:\Windows\system32\certmgr.dll
2010-12-26 15:10:07 ----A---- C:\Windows\system32\certcli.dll
2010-12-26 15:10:06 ----A---- C:\Windows\system32\drivers\Classpnp.sys
2010-12-26 15:10:06 ----A---- C:\Windows\system32\drivers\BTHUSB.SYS
2010-12-26 15:10:06 ----A---- C:\Windows\system32\drivers\bthport.sys
2010-12-26 15:10:06 ----A---- C:\Windows\system32\cipher.exe
2010-12-26 15:10:06 ----A---- C:\Windows\system32\ci.dll
2010-12-26 15:10:06 ----A---- C:\Windows\system32\CertEnrollUI.dll
2010-12-26 15:10:06 ----A---- C:\Windows\system32\CertEnroll.dll
2010-12-26 15:10:06 ----A---- C:\Windows\system32\cbsra.exe
2010-12-26 15:10:06 ----A---- C:\Windows\system32\bthudtask.exe
2010-12-26 15:10:06 ----A---- C:\Windows\system32\bthserv.dll
2010-12-26 15:10:05 ----A---- C:\Windows\system32\CHxReadingStringIME.dll
2010-12-26 15:10:05 ----A---- C:\Windows\system32\chtbrkr.dll
2010-12-26 15:10:05 ----A---- C:\Windows\system32\chsbrkr.dll
2010-12-26 15:10:04 ----A---- C:\Windows\system32\msftedit.dll
2010-12-26 15:10:04 ----A---- C:\Windows\system32\msdtctm.dll
2010-12-26 15:10:04 ----A---- C:\Windows\system32\clfs.sys
2010-12-26 15:10:04 ----A---- C:\Windows\system32\certutil.exe
2010-12-26 15:10:04 ----A---- C:\Windows\system32\certreq.exe
2010-12-26 15:10:04 ----A---- C:\Windows\system32\certprop.dll
2010-12-26 15:10:03 ----A---- C:\Windows\system32\msihnd.dll
2010-12-26 15:10:03 ----A---- C:\Windows\system32\msiexec.exe
2010-12-26 15:10:03 ----A---- C:\Windows\system32\msi.dll
2010-12-26 15:10:03 ----A---- C:\Windows\system32\msexcl40.dll
2010-12-26 15:10:03 ----A---- C:\Windows\system32\msexch40.dll
2010-12-26 15:10:00 ----A---- C:\Windows\system32\msimsg.dll
2010-12-26 15:10:00 ----A---- C:\Windows\system32\msdtcprx.dll
2010-12-26 15:10:00 ----A---- C:\Windows\system32\msctfui.dll
2010-12-26 15:10:00 ----A---- C:\Windows\system32\msctfp.dll
2010-12-26 15:10:00 ----A---- C:\Windows\system32\MsCtfMonitor.dll
2010-12-26 15:10:00 ----A---- C:\Windows\system32\msctf.dll
2010-12-26 15:10:00 ----A---- C:\Windows\system32\MPSSVC.dll
2010-12-26 15:10:00 ----A---- C:\Windows\system32\mprapi.dll
2010-12-26 15:10:00 ----A---- C:\Windows\system32\mpr.dll
2010-12-26 15:10:00 ----A---- C:\Windows\system32\modemui.dll
2010-12-26 15:10:00 ----A---- C:\Windows\system32\MMDevAPI.dll
2010-12-26 15:09:58 ----A---- C:\Windows\system32\mscories.dll
2010-12-26 15:09:58 ----A---- C:\Windows\system32\mscorier.dll
2010-12-26 15:09:58 ----A---- C:\Windows\system32\mscms.dll
2010-12-26 15:09:58 ----A---- C:\Windows\system32\mscandui.dll
2010-12-26 15:09:58 ----A---- C:\Windows\system32\drivers\msahci.sys
2010-12-26 15:09:57 ----A---- C:\Windows\system32\newdev.exe
2010-12-26 15:09:57 ----A---- C:\Windows\system32\netshell.dll
2010-12-26 15:09:57 ----A---- C:\Windows\system32\NetProjW.dll
2010-12-26 15:09:57 ----A---- C:\Windows\system32\netplwiz.dll
2010-12-26 15:09:57 ----A---- C:\Windows\system32\netlogon.dll
2010-12-26 15:09:57 ----A---- C:\Windows\system32\netcenter.dll
2010-12-26 15:09:57 ----A---- C:\Windows\system32\netapi32.dll
2010-12-26 15:09:57 ----A---- C:\Windows\system32\ncryptui.dll
2010-12-26 15:09:57 ----A---- C:\Windows\system32\ncrypt.dll
2010-12-26 15:09:57 ----A---- C:\Windows\system32\NcdProp.dll
2010-12-26 15:09:57 ----A---- C:\Windows\system32\NaturalLanguage6.dll
2010-12-26 15:09:57 ----A---- C:\Windows\system32\mtxclu.dll
2010-12-26 15:09:57 ----A---- C:\Windows\system32\drivers\netbt.sys
2010-12-26 15:09:57 ----A---- C:\Windows\system32\drivers\ndiswan.sys
2010-12-26 15:09:57 ----A---- C:\Windows\system32\drivers\ndis.sys
2010-12-26 15:09:57 ----A---- C:\Windows\system32\drivers\mup.sys
2010-12-26 15:09:57 ----A---- C:\Windows\system32\drivers\mrxdav.sys
2010-12-26 15:09:56 ----A---- C:\Windows\system32\newdev.dll
2010-12-26 15:09:56 ----A---- C:\Windows\system32\networkmap.dll
2010-12-26 15:09:56 ----A---- C:\Windows\system32\networkitemfactory.dll
2010-12-26 15:09:56 ----A---- C:\Windows\system32\networkexplorer.dll
2010-12-26 15:09:56 ----A---- C:\Windows\system32\msscntrs.dll
2010-12-26 15:09:56 ----A---- C:\Windows\system32\msscb.dll
2010-12-26 15:09:56 ----A---- C:\Windows\system32\msrepl40.dll
2010-12-26 15:09:56 ----A---- C:\Windows\system32\msrd3x40.dll
2010-12-26 15:09:56 ----A---- C:\Windows\system32\msrd2x40.dll
2010-12-26 15:09:56 ----A---- C:\Windows\system32\mspbde40.dll
2010-12-26 15:09:56 ----A---- C:\Windows\system32\msnetobj.dll
2010-12-26 15:09:56 ----A---- C:\Windows\system32\MSMPEG2VDEC.DLL
2010-12-26 15:09:56 ----A---- C:\Windows\system32\msltus40.dll
2010-12-26 15:09:56 ----A---- C:\Windows\system32\msimtf.dll
2010-12-26 15:09:56 ----A---- C:\Windows\system32\drivers\msrpc.sys
2010-12-26 15:09:55 ----A---- C:\Windows\system32\msinfo32.exe
2010-12-26 15:09:54 ----A---- C:\Windows\system32\mswsock.dll
2010-12-26 15:09:54 ----A---- C:\Windows\system32\msvcp60.dll
2010-12-26 15:09:54 ----A---- C:\Windows\system32\msutb.dll
2010-12-26 15:09:54 ----A---- C:\Windows\system32\msjtes40.dll
2010-12-26 15:09:54 ----A---- C:\Windows\system32\msjter40.dll
2010-12-26 15:09:54 ----A---- C:\Windows\system32\msjint40.dll
2010-12-26 15:09:54 ----A---- C:\Windows\system32\msjetoledb40.dll
2010-12-26 15:09:54 ----A---- C:\Windows\system32\msjet40.dll
2010-12-26 15:09:54 ----A---- C:\Windows\system32\msisip.dll
2010-12-26 15:09:54 ----A---- C:\Windows\system32\drivers\msiscsi.sys
2010-12-26 15:09:53 ----A---- C:\Windows\system32\msxbde40.dll
2010-12-26 15:09:53 ----A---- C:\Windows\system32\mswdat10.dll
2010-12-26 15:09:51 ----A---- C:\Windows\system32\mswstr10.dll
2010-12-26 15:09:51 ----A---- C:\Windows\system32\MSVidCtl.dll
2010-12-26 15:09:51 ----A---- C:\Windows\system32\msvcrt.dll
2010-12-26 15:09:51 ----A---- C:\Windows\system32\mstsc.exe
2010-12-26 15:09:51 ----A---- C:\Windows\system32\mstlsapi.dll
2010-12-26 15:09:51 ----A---- C:\Windows\system32\mssrch.dll
2010-12-26 15:09:51 ----A---- C:\Windows\system32\mssprxy.dll
2010-12-26 15:09:51 ----A---- C:\Windows\system32\mssphtb.dll
2010-12-26 15:09:51 ----A---- C:\Windows\system32\mssph.dll
2010-12-26 15:09:51 ----A---- C:\Windows\system32\mssitlb.dll
2010-12-26 15:09:51 ----A---- C:\Windows\system32\msshooks.dll
2010-12-26 15:09:51 ----A---- C:\Windows\system32\msscp.dll
2010-12-26 15:09:50 ----A---- C:\Windows\system32\mssvp.dll
2010-12-26 15:09:50 ----A---- C:\Windows\system32\msstrc.dll
2010-12-26 15:09:49 ----A---- C:\Windows\system32\mstext40.dll
2010-12-26 15:09:49 ----A---- C:\Windows\system32\InkEd.dll
2010-12-26 15:09:48 ----A---- C:\Windows\system32\infocardapi.dll
2010-12-26 15:09:48 ----A---- C:\Windows\system32\inetppui.dll
2010-12-26 15:09:48 ----A---- C:\Windows\system32\inetpp.dll
2010-12-26 15:09:45 ----A---- C:\Windows\system32\imm32.dll
2010-12-26 15:09:44 ----A---- C:\Windows\system32\iscsilog.dll
2010-12-26 15:09:44 ----A---- C:\Windows\system32\ipsmsnap.dll
2010-12-26 15:09:44 ----A---- C:\Windows\system32\IPSECSVC.DLL
2010-12-26 15:09:43 ----A---- C:\Windows\system32\ipsecsnp.dll
2010-12-26 15:09:43 ----A---- C:\Windows\system32\input.dll
2010-12-26 15:09:42 ----A---- C:\Windows\system32\iphlpsvc.dll
2010-12-26 15:09:42 ----A---- C:\Windows\system32\IPHLPAPI.DLL
2010-12-26 15:09:42 ----A---- C:\Windows\system32\ipconfig.exe
2010-12-26 15:09:40 ----A---- C:\Windows\system32\ifmon.dll
2010-12-26 15:09:40 ----A---- C:\Windows\system32\iassvcs.dll
2010-12-26 15:09:39 ----A---- C:\Windows\system32\icardres.dll
2010-12-26 15:09:39 ----A---- C:\Windows\system32\icardagt.exe
2010-12-26 15:09:39 ----A---- C:\Windows\system32\iassdo.dll
2010-12-26 15:09:39 ----A---- C:\Windows\system32\iassam.dll
2010-12-26 15:09:39 ----A---- C:\Windows\system32\iasrecst.dll
2010-12-26 15:09:39 ----A---- C:\Windows\system32\iasrad.dll
2010-12-26 15:09:39 ----A---- C:\Windows\system32\iaspolcy.dll
2010-12-26 15:09:38 ----A---- C:\Windows\system32\IMJP10K.DLL
2010-12-26 15:09:37 ----A---- C:\Windows\system32\mfplat.dll
2010-12-26 15:09:37 ----A---- C:\Windows\system32\imapi2fs.dll
2010-12-26 15:09:37 ----A---- C:\Windows\system32\imapi2.dll
2010-12-26 15:09:37 ----A---- C:\Windows\system32\imapi.dll
2010-12-26 15:09:37 ----A---- C:\Windows\system32\IKEEXT.DLL
2010-12-26 15:09:36 ----A---- C:\Windows\system32\mmcndmgr.dll
2010-12-26 15:09:36 ----A---- C:\Windows\system32\mmcico.dll
2010-12-26 15:09:36 ----A---- C:\Windows\system32\mmci.dll
2010-12-26 15:09:36 ----A---- C:\Windows\system32\mmc.exe
2010-12-26 15:09:36 ----A---- C:\Windows\system32\mimefilt.dll
2010-12-26 15:09:36 ----A---- C:\Windows\system32\milcore.dll
2010-12-26 15:09:36 ----A---- C:\Windows\system32\midimap.dll
2010-12-26 15:09:36 ----A---- C:\Windows\system32\mfps.dll
2010-12-26 15:09:36 ----A---- C:\Windows\system32\mfpmp.exe
2010-12-26 15:09:36 ----A---- C:\Windows\system32\mferror.dll
2010-12-26 15:09:36 ----A---- C:\Windows\system32\mfc42u.dll
2010-12-26 15:09:36 ----A---- C:\Windows\system32\mfc42.dll
2010-12-26 15:09:36 ----A---- C:\Windows\system32\korwbrkr.dll
2010-12-26 15:09:36 ----A---- C:\Windows\system32\drivers\ks.sys
2010-12-26 15:09:35 ----A---- C:\Windows\system32\wercon.exe
2010-12-26 15:09:35 ----A---- C:\Windows\system32\wer.dll
2010-12-26 15:09:35 ----A---- C:\Windows\system32\WebClnt.dll
2010-12-26 15:09:35 ----A---- C:\Windows\system32\wdscore.dll
2010-12-26 15:09:35 ----A---- C:\Windows\system32\shsetup.dll
2010-12-26 15:09:35 ----A---- C:\Windows\system32\MediaMetadataHandler.dll
2010-12-26 15:09:35 ----A---- C:\Windows\system32\mcupdate_GenuineIntel.dll
2010-12-26 15:09:35 ----A---- C:\Windows\system32\mcmde.dll
2010-12-26 15:09:35 ----A---- C:\Windows\system32\mblctr.exe
2010-12-26 15:09:35 ----A---- C:\Windows\system32\Magnify.exe
2010-12-26 15:09:35 ----A---- C:\Windows\system32\logman.exe
2010-12-26 15:09:35 ----A---- C:\Windows\system32\logagent.exe
2010-12-26 15:09:35 ----A---- C:\Windows\system32\l2nacp.dll
2010-12-26 15:09:35 ----A---- C:\Windows\system32\kernel32.dll
2010-12-26 15:09:35 ----A---- C:\Windows\system32\kdusb.dll
2010-12-26 15:09:35 ----A---- C:\Windows\system32\kdcom.dll
2010-12-26 15:09:35 ----A---- C:\Windows\system32\kd1394.dll
2010-12-26 15:09:35 ----A---- C:\Windows\system32\drivers\kbdhid.sys
2010-12-26 15:09:34 ----A---- C:\Windows\system32\WindowsAnytimeUpgradeCPL.dll
2010-12-26 15:09:34 ----A---- C:\Windows\system32\win32spl.dll
2010-12-26 15:09:34 ----A---- C:\Windows\system32\whealogr.dll
2010-12-26 15:09:34 ----A---- C:\Windows\system32\wevtutil.exe
2010-12-26 15:09:34 ----A---- C:\Windows\system32\wevtsvc.dll
2010-12-26 15:09:34 ----A---- C:\Windows\system32\wevtapi.dll
2010-12-26 15:09:34 ----A---- C:\Windows\system32\wersvc.dll
2010-12-26 15:09:34 ----A---- C:\Windows\system32\WerFaultSecure.exe
2010-12-26 15:09:34 ----A---- C:\Windows\system32\WerFault.exe
2010-12-26 15:09:34 ----A---- C:\Windows\system32\wdc.dll
2010-12-26 15:09:33 ----A---- C:\Windows\system32\wiaservc.dll
2010-12-26 15:09:33 ----A---- C:\Windows\system32\wiaaut.dll
2010-12-26 15:09:33 ----A---- C:\Windows\system32\wcnwiz2.dll
2010-12-26 15:09:33 ----A---- C:\Windows\system32\wcnwiz.dll
2010-12-26 15:09:33 ----A---- C:\Windows\system32\WcnNetsh.dll
2010-12-26 15:09:33 ----A---- C:\Windows\system32\wcncsvc.dll
2010-12-26 15:09:33 ----A---- C:\Windows\system32\version.dll
2010-12-26 15:09:33 ----A---- C:\Windows\system32\vdsutil.dll
2010-12-26 15:09:33 ----A---- C:\Windows\system32\vdsdyn.dll
2010-12-26 15:09:33 ----A---- C:\Windows\system32\vds.exe
2010-12-26 15:09:33 ----A---- C:\Windows\system32\vdmdbg.dll
2010-12-26 15:09:33 ----A---- C:\Windows\system32\uxsms.dll
2010-12-26 15:09:33 ----A---- C:\Windows\system32\Utilman.exe
2010-12-26 15:09:33 ----A---- C:\Windows\system32\userenv.dll
2010-12-26 15:09:33 ----A---- C:\Windows\system32\usercpl.dll
2010-12-26 15:09:33 ----A---- C:\Windows\system32\user32.dll
2010-12-26 15:09:33 ----A---- C:\Windows\system32\drivers\watchdog.sys
2010-12-26 15:09:33 ----A---- C:\Windows\system32\drivers\USBSTOR.SYS
2010-12-26 15:09:33 ----A---- C:\Windows\system32\drivers\usbport.sys
2010-12-26 15:09:32 ----A---- C:\Windows\system32\xmlfilter.dll
2010-12-26 15:09:32 ----A---- C:\Windows\system32\wusa.exe
2010-12-26 15:09:32 ----A---- C:\Windows\system32\wsnmp32.dll
2010-12-26 15:09:32 ----A---- C:\Windows\system32\WsmSvc.dll
2010-12-26 15:09:32 ----A---- C:\Windows\system32\wshext.dll
2010-12-26 15:09:32 ----A---- C:\Windows\system32\wshbth.dll
2010-12-26 15:09:32 ----A---- C:\Windows\system32\wsepno.dll
2010-12-26 15:09:32 ----A---- C:\Windows\system32\WSDMon.dll
2010-12-26 15:09:32 ----A---- C:\Windows\system32\wsdchngr.dll
2010-12-26 15:09:32 ----A---- C:\Windows\system32\wscsvc.dll
2010-12-26 15:09:32 ----A---- C:\Windows\system32\wscript.exe
2010-12-26 15:09:32 ----A---- C:\Windows\system32\wscntfy.dll
2010-12-26 15:09:32 ----A---- C:\Windows\system32\wscisvif.dll
2010-12-26 15:09:32 ----A---- C:\Windows\system32\WscEapPr.dll
2010-12-26 15:09:32 ----A---- C:\Windows\system32\wscapi.dll
2010-12-26 15:09:32 ----A---- C:\Windows\system32\wpcsvc.dll
2010-12-26 15:09:32 ----A---- C:\Windows\system32\wpccpl.dll
2010-12-26 15:09:32 ----A---- C:\Windows\system32\wpcao.dll
2010-12-26 15:09:32 ----A---- C:\Windows\system32\wow32.dll
2010-12-26 15:09:32 ----A---- C:\Windows\system32\WMVXENCD.DLL
2010-12-26 15:09:32 ----A---- C:\Windows\system32\WMVSDECD.DLL
2010-12-26 15:09:32 ----A---- C:\Windows\system32\WMVENCOD.DLL
2010-12-26 15:09:32 ----A---- C:\Windows\system32\w32time.dll
2010-12-26 15:09:32 ----A---- C:\Windows\system32\VSSVC.exe
2010-12-26 15:09:32 ----A---- C:\Windows\system32\vssapi.dll
2010-12-26 15:09:32 ----A---- C:\Windows\system32\drivers\volsnap.sys
2010-12-26 15:09:32 ----A---- C:\Windows\system32\drivers\volmgrx.sys
2010-12-26 15:09:31 ----A---- C:\Windows\system32\wmpeffects.dll
2010-12-26 15:09:31 ----A---- C:\Windows\system32\WMNetMgr.dll
2010-12-26 15:09:31 ----A---- C:\Windows\system32\wlgpclnt.dll
2010-12-26 15:09:31 ----A---- C:\Windows\system32\Wldap32.dll
2010-12-26 15:09:31 ----A---- C:\Windows\system32\wlanui.dll
2010-12-26 15:09:31 ----A---- C:\Windows\system32\wlanpref.dll
2010-12-26 15:09:31 ----A---- C:\Windows\system32\wlanhlp.dll
2010-12-26 15:09:31 ----A---- C:\Windows\system32\wlangpui.dll
2010-12-26 15:09:31 ----A---- C:\Windows\system32\wisptis.exe
2010-12-26 15:09:31 ----A---- C:\Windows\system32\winsrv.dll
2010-12-26 15:09:31 ----A---- C:\Windows\system32\WinSCard.dll
2010-12-26 15:09:31 ----A---- C:\Windows\system32\WinSAT.exe
2010-12-26 15:09:31 ----A---- C:\Windows\system32\winrnr.dll
2010-12-26 15:09:31 ----A---- C:\Windows\system32\winresume.exe
2010-12-26 15:09:31 ----A---- C:\Windows\system32\winmm.dll
2010-12-26 15:09:31 ----A---- C:\Windows\system32\winlogon.exe
2010-12-26 15:09:31 ----A---- C:\Windows\system32\winload.exe
2010-12-26 15:09:30 ----A---- C:\Windows\system32\wmdrmsdk.dll
2010-12-26 15:09:30 ----A---- C:\Windows\system32\sysmain.dll
2010-12-26 15:09:30 ----A---- C:\Windows\system32\sysclass.dll
2010-12-26 15:09:30 ----A---- C:\Windows\system32\swprv.dll
2010-12-26 15:09:30 ----A---- C:\Windows\system32\sud.dll
2010-12-26 15:09:30 ----A---- C:\Windows\system32\Storprop.dll
2010-12-26 15:09:30 ----A---- C:\Windows\system32\stobject.dll
2010-12-26 15:09:30 ----A---- C:\Windows\system32\srcore.dll
2010-12-26 15:09:30 ----A---- C:\Windows\system32\srchadmin.dll
2010-12-26 15:09:30 ----A---- C:\Windows\system32\drivers\stream.sys
2010-12-26 15:09:30 ----A---- C:\Windows\system32\drivers\Storport.sys
2010-12-26 15:09:29 ----A---- C:\Windows\system32\SyncCenter.dll
2010-12-26 15:09:29 ----A---- C:\Windows\system32\sqlsrv32.dll
2010-12-26 15:09:29 ----A---- C:\Windows\system32\spwizui.dll
2010-12-26 15:09:29 ----A---- C:\Windows\system32\spwinsat.dll
2010-12-26 15:09:29 ----A---- C:\Windows\system32\spreview.exe
2010-12-26 15:09:29 ----A---- C:\Windows\system32\spp.dll
2010-12-26 15:09:29 ----A---- C:\Windows\system32\spoolss.dll
2010-12-26 15:09:29 ----A---- C:\Windows\system32\spinstall.exe
2010-12-26 15:09:29 ----A---- C:\Windows\system32\sperror.dll
2010-12-26 15:09:29 ----A---- C:\Windows\system32\spcmsg.dll
2010-12-26 15:09:29 ----A---- C:\Windows\system32\smss.exe
2010-12-26 15:09:29 ----A---- C:\Windows\system32\SmiEngine.dll
2010-12-26 15:09:29 ----A---- C:\Windows\system32\SMBHelperClass.dll
2010-12-26 15:09:29 ----A---- C:\Windows\system32\SmartcardCredentialProvider.dll
2010-12-26 15:09:29 ----A---- C:\Windows\system32\slwmi.dll
2010-12-26 15:09:29 ----A---- C:\Windows\system32\slwga.dll
2010-12-26 15:09:29 ----A---- C:\Windows\system32\SLUINotify.dll
2010-12-26 15:09:29 ----A---- C:\Windows\system32\SLUI.exe
2010-12-26 15:09:29 ----A---- C:\Windows\system32\SLsvc.exe
2010-12-26 15:09:29 ----A---- C:\Windows\system32\slmgr.vbs
2010-12-26 15:09:29 ----A---- C:\Windows\system32\SLLUA.exe
2010-12-26 15:09:29 ----A---- C:\Windows\system32\SLCommDlg.dll
2010-12-26 15:09:29 ----A---- C:\Windows\system32\slcinst.dll
2010-12-26 15:09:29 ----A---- C:\Windows\system32\SLCExt.dll
2010-12-26 15:09:29 ----A---- C:\Windows\system32\slcc.dll
2010-12-26 15:09:29 ----A---- C:\Windows\system32\SLC.dll
2010-12-26 15:09:29 ----A---- C:\Windows\system32\shwebsvc.dll
2010-12-26 15:09:29 ----A---- C:\Windows\system32\shsvcs.dll
2010-12-26 15:09:29 ----A---- C:\Windows\system32\drivers\spsys.sys
2010-12-26 15:09:29 ----A---- C:\Windows\system32\drivers\smb.sys
2010-12-26 15:09:28 ----A---- C:\Windows\system32\softkbd.dll
2010-12-26 15:09:28 ----A---- C:\Windows\system32\SnippingTool.exe
2010-12-26 15:09:28 ----A---- C:\Windows\system32\SndVol.exe
2010-12-26 15:09:27 ----A---- C:\Windows\system32\TsWpfWrp.exe
2010-12-26 15:09:27 ----A---- C:\Windows\system32\TSTheme.exe
2010-12-26 15:09:27 ----A---- C:\Windows\system32\tsgqec.dll
2010-12-26 15:09:27 ----A---- C:\Windows\system32\tscupgrd.exe
2010-12-26 15:09:27 ----A---- C:\Windows\system32\drivers\udfs.sys
2010-12-26 15:09:24 ----A---- C:\Windows\system32\zipfldr.dll
2010-12-26 15:09:24 ----A---- C:\Windows\system32\untfs.dll
2010-12-26 15:09:24 ----A---- C:\Windows\system32\umpnpmgr.dll
2010-12-26 15:09:24 ----A---- C:\Windows\system32\ulib.dll
2010-12-26 15:09:24 ----A---- C:\Windows\system32\uDWM.dll
2010-12-26 15:09:24 ----A---- C:\Windows\system32\systemcpl.dll
2010-12-26 15:09:24 ----A---- C:\Windows\system32\drivers\usbhub.sys
2010-12-26 15:09:24 ----A---- C:\Windows\system32\drivers\usbehci.sys
2010-12-26 15:09:24 ----A---- C:\Windows\system32\drivers\USBCAMD2.sys
2010-12-26 15:09:24 ----A---- C:\Windows\system32\drivers\USBCAMD.sys
2010-12-26 15:09:24 ----A---- C:\Windows\system32\drivers\usb8023.sys
2010-12-26 15:09:23 ----A---- C:\Windows\system32\tquery.dll
2010-12-26 15:09:23 ----A---- C:\Windows\system32\themeui.dll
2010-12-26 15:09:23 ----A---- C:\Windows\system32\themecpl.dll
2010-12-26 15:09:23 ----A---- C:\Windows\system32\thawbrkr.dll
2010-12-26 15:09:23 ----A---- C:\Windows\system32\termsrv.dll
2010-12-26 15:09:23 ----A---- C:\Windows\system32\tcpmon.dll
2010-12-26 15:09:23 ----A---- C:\Windows\system32\tcpipcfg.dll
2010-12-26 15:09:23 ----A---- C:\Windows\system32\tapisrv.dll
2010-12-26 15:09:23 ----A---- C:\Windows\system32\drivers\termdd.sys
2010-12-26 15:09:23 ----A---- C:\Windows\system32\drivers\tdx.sys
2010-12-26 14:51:09 ----D---- C:\Windows\system32\EventProviders
2010-12-26 14:26:53 ----A---- C:\Windows\system32\wintrust.dll
2010-12-26 14:26:52 ----A---- C:\Windows\system32\cabview.dll
2010-12-26 14:16:15 ----D---- C:\Program Files\Hewlett-Packard
2010-12-26 14:07:54 ----A---- C:\Windows\system32\wups2.dll
2010-12-26 14:07:54 ----A---- C:\Windows\system32\wucltux.dll
2010-12-26 14:07:54 ----A---- C:\Windows\system32\wuaueng.dll
2010-12-26 14:07:54 ----A---- C:\Windows\system32\wuauclt.exe
2010-12-26 14:07:35 ----A---- C:\Windows\system32\wups.dll
2010-12-26 14:07:35 ----A---- C:\Windows\system32\wudriver.dll
2010-12-26 14:07:34 ----A---- C:\Windows\system32\wuapi.dll
2010-12-26 14:07:23 ----A---- C:\Windows\system32\wuwebv.dll
2010-12-26 14:07:23 ----A---- C:\Windows\system32\wuapp.exe
2010-12-26 14:05:50 ----D---- C:\Windows\system32\Atheros_L1e
2010-12-26 14:00:21 ----D---- C:\ProgramData\NVIDIA
2010-12-26 13:54:03 ----A---- C:\Windows\system32\nvexpbar.dll
2010-12-26 13:54:03 ----A---- C:\Windows\system32\nvcpluir.dll
2010-12-26 13:54:03 ----A---- C:\Windows\system32\nvcplui.exe
2010-12-26 13:53:29 ----D---- C:\Windows\Debug
2010-12-26 13:53:09 ----A---- C:\Windows\system32\NVUNINST.EXE
2010-12-26 13:52:50 ----D---- C:\Program Files\Synaptics
2010-12-26 13:49:41 ----A---- C:\Windows\system32\VMC3KAPI.dll
2010-12-26 13:49:41 ----A---- C:\Windows\system32\VCryptAPI.dll
2010-12-26 13:49:41 ----A---- C:\Windows\system32\ShlCmd.exe
2010-12-26 13:49:41 ----A---- C:\Windows\system32\biologon.dll
2010-12-26 13:49:39 ----A---- C:\Windows\system32\DrvCrypt.dll
2010-12-26 13:49:39 ----A---- C:\Windows\system32\drivers\AlfaFF.sys
2010-12-26 13:49:39 ----A---- C:\Windows\system32\AlfaFF.dll
2010-12-26 13:49:37 ----D---- C:\Program Files\Acer
2010-12-26 13:49:37 ----A---- C:\Windows\system32\PBAGUI.dll
2010-12-26 13:49:37 ----A---- C:\Windows\system32\BioOne.dll
2010-12-26 13:49:28 ----D---- C:\Users\Owner\AppData\Roaming\Validity
2010-12-26 13:48:36 ----D---- C:\Program Files\Validity Sensors, Inc
2010-12-26 13:46:05 ----D---- C:\Windows\SoftwareDistribution
2010-12-26 13:45:55 ----D---- C:\Windows\ITECIR
2010-12-26 13:45:55 ----A---- C:\Windows\system32\drivers\itecir.sys
2010-12-26 13:45:55 ----A---- C:\Windows\system32\CIRCoInst.dll
2010-12-26 13:43:27 ----D---- C:\Program Files\Intel
2010-12-26 13:42:23 ----A---- C:\Windows\xUninstall.bat
2010-12-26 13:42:03 ----D---- C:\Windows\JMCR_DIR
2010-12-26 13:39:20 ----D---- C:\Windows\Prefetch
2010-12-26 13:37:04 ----D---- C:\ProgramData\InstallShield
2010-12-26 13:37:01 ----A---- C:\Windows\PLFSetI.exe
2010-12-26 13:37:01 ----A---- C:\Windows\PidList.ini
2010-12-26 13:37:01 ----A---- C:\Windows\Image.dll
2010-12-26 13:37:01 ----A---- C:\Windows\Acer Crystal Eye webcam.EXE
2010-12-26 13:36:48 ----D---- C:\Users\Owner\AppData\Roaming\InstallShield
2010-12-26 13:35:48 ----SHD---- C:\Windows\Installer
2010-12-26 13:35:13 ----A---- C:\Windows\RTKVADDA.EXE
2010-12-26 13:34:56 ----D---- C:\Windows\system32\RTCOM
2010-12-26 13:34:30 ----A---- C:\Windows\RtDefLvl.ini
2010-12-26 13:34:30 ----A---- C:\Windows\DIFxAPI.dll
2010-12-26 13:34:29 ----A---- C:\Windows\system32\WavesLib.dll
2010-12-26 13:34:29 ----A---- C:\Windows\system32\SRSWOW.dll
2010-12-26 13:34:29 ----A---- C:\Windows\system32\SRSTSXT.dll
2010-12-26 13:34:29 ----A---- C:\Windows\system32\SRSTSHD.dll
2010-12-26 13:34:29 ----A---- C:\Windows\system32\SRSHP360.dll
2010-12-26 13:34:29 ----A---- C:\Windows\system32\RtkPgExt.dll
2010-12-26 13:34:29 ----A---- C:\Windows\system32\RtkCoInst.dll
2010-12-26 13:34:29 ----A---- C:\Windows\system32\RtkApoApi.dll
2010-12-26 13:34:29 ----A---- C:\Windows\system32\RtkAPO.dll
2010-12-26 13:34:29 ----A---- C:\Windows\system32\MaxxAudioEQ.dll
2010-12-26 13:34:29 ----A---- C:\Windows\system32\MaxxAudioAPO20.dll
2010-12-26 13:34:29 ----A---- C:\Windows\system32\MaxxAudioAPO.dll
2010-12-26 13:34:29 ----A---- C:\Windows\system32\drivers\RTKVHDA.sys
2010-12-26 13:34:29 ----A---- C:\Windows\SkyTel.exe
2010-12-26 13:34:29 ----A---- C:\Windows\RtlUpd.exe
2010-12-26 13:34:29 ----A---- C:\Windows\RtHDVCpl.exe
2010-12-26 13:34:28 ----HD---- C:\Program Files\InstallShield Installation Information
2010-12-26 13:34:28 ----D---- C:\Program Files\Realtek
2010-12-26 13:34:28 ----A---- C:\Windows\system32\FMAPO.dll
2010-12-26 13:33:19 ----A---- C:\Windows\RtlExUpd.dll
2010-12-26 13:33:19 ----A---- C:\Windows\HideWin.exe
2010-12-26 13:33:16 ----D---- C:\Program Files\Common Files\InstallShield
2010-12-26 13:25:59 ----D---- C:\Users\Owner\AppData\Roaming\Identities
2010-12-26 13:25:48 ----SD---- C:\Users\Owner\AppData\Roaming\Microsoft
2010-12-26 13:25:48 ----D---- C:\Users\Owner\AppData\Roaming\Media Center Programs
2010-12-26 12:10:57 ----D---- C:\SWSetup
2010-12-26 11:59:27 ----D---- C:\Intel

======List of files/folders modified in the last 1 months======

2011-01-24 21:45:44 ----D---- C:\Windows\Temp
2011-01-24 21:27:03 ----D---- C:\Windows\system32\drivers
2011-01-24 21:22:51 ----RD---- C:\Program Files
2011-01-24 14:08:49 ----D---- C:\Windows\system32\Tasks
2011-01-24 11:23:03 ----SHD---- C:\System Volume Information
2011-01-24 09:30:58 ----D---- C:\Windows\System32
2011-01-23 13:26:32 ----D---- C:\Windows
2011-01-23 13:26:30 ----D---- C:\Windows\winsxs
2011-01-23 13:26:24 ----D---- C:\Windows\system32\catroot
2011-01-23 13:25:17 ----D---- C:\Windows\inf
2011-01-23 13:24:44 ----HD---- C:\ProgramData
2011-01-23 13:08:47 ----D---- C:\Windows\Tasks
2011-01-20 10:25:54 ----D---- C:\Windows\system32\LogFiles
2011-01-17 14:02:59 ----D---- C:\Windows\LiveKernelReports
2011-01-16 09:52:27 ----A---- C:\Windows\system32\PerfStringBackup.INI
2011-01-13 00:31:01 ----D---- C:\Windows\system32\catroot2
2011-01-13 00:29:28 ----A---- C:\Windows\system32\mrt.exe
2011-01-11 21:25:57 ----D---- C:\Program Files\Internet Explorer
2011-01-11 21:21:21 ----D---- C:\Program Files\Common Files
2011-01-10 16:08:29 ----D---- C:\Windows\system32\NDF
2011-01-09 20:05:51 ----D---- C:\Windows\system32\WDI
2010-12-28 16:30:13 ----D---- C:\Windows\Logs
2010-12-27 19:46:56 ----D---- C:\Program Files\Common Files\microsoft shared
2010-12-27 13:24:57 ----D---- C:\Windows\rescache
2010-12-26 20:42:31 ----SD---- C:\ProgramData\Microsoft
2010-12-26 17:36:50 ----D---- C:\Windows\Microsoft.NET
2010-12-26 17:36:21 ----RSD---- C:\Windows\assembly
2010-12-26 17:06:22 ----D---- C:\Windows\system32\en-US
2010-12-26 17:05:14 ----D---- C:\Windows\system32\drivers\en-US
2010-12-26 16:54:35 ----D---- C:\Program Files\Windows Mail
2010-12-26 16:54:34 ----D---- C:\Windows\AppPatch
2010-12-26 16:54:34 ----D---- C:\Program Files\Windows Media Player
2010-12-26 16:54:33 ----D---- C:\Program Files\Movie Maker
2010-12-26 16:54:32 ----D---- C:\Windows\system32\wbem
2010-12-26 16:54:30 ----D---- C:\Windows\system32\zh-TW
2010-12-26 16:54:30 ----D---- C:\Windows\system32\zh-HK
2010-12-26 16:54:30 ----D---- C:\Windows\system32\zh-CN
2010-12-26 16:54:30 ----D---- C:\Windows\system32\uk-UA
2010-12-26 16:54:30 ----D---- C:\Windows\system32\tr-TR
2010-12-26 16:54:30 ----D---- C:\Windows\system32\th-TH
2010-12-26 16:54:30 ----D---- C:\Windows\system32\sv-SE
2010-12-26 16:54:30 ----D---- C:\Windows\system32\sr-Latn-CS
2010-12-26 16:54:30 ----D---- C:\Windows\system32\sl-SI
2010-12-26 16:54:30 ----D---- C:\Windows\system32\sk-SK
2010-12-26 16:54:30 ----D---- C:\Windows\system32\ru-RU
2010-12-26 16:54:30 ----D---- C:\Windows\system32\ro-RO
2010-12-26 16:54:30 ----D---- C:\Windows\system32\pt-PT
2010-12-26 16:54:30 ----D---- C:\Windows\system32\pt-BR
2010-12-26 16:54:30 ----D---- C:\Windows\system32\pl-PL
2010-12-26 16:54:30 ----D---- C:\Windows\system32\nl-NL
2010-12-26 16:54:30 ----D---- C:\Windows\system32\nb-NO
2010-12-26 16:54:30 ----D---- C:\Windows\system32\lv-LV
2010-12-26 16:54:30 ----D---- C:\Windows\system32\lt-LT
2010-12-26 16:54:30 ----D---- C:\Windows\system32\ko-KR
2010-12-26 16:54:30 ----D---- C:\Windows\system32\ja-JP
2010-12-26 16:54:30 ----D---- C:\Windows\system32\it-IT
2010-12-26 16:54:30 ----D---- C:\Windows\system32\hu-HU
2010-12-26 16:54:30 ----D---- C:\Windows\system32\hr-HR
2010-12-26 16:54:30 ----D---- C:\Windows\system32\he-IL
2010-12-26 16:54:30 ----D---- C:\Windows\system32\fr-FR
2010-12-26 16:54:30 ----D---- C:\Windows\system32\fi-FI
2010-12-26 16:54:30 ----D---- C:\Windows\system32\et-EE
2010-12-26 16:54:30 ----D---- C:\Windows\system32\es-ES
2010-12-26 16:54:30 ----D---- C:\Windows\system32\el-GR
2010-12-26 16:54:30 ----D---- C:\Windows\system32\de-DE
2010-12-26 16:54:30 ----D---- C:\Windows\system32\da-DK
2010-12-26 16:54:30 ----D---- C:\Windows\system32\cs-CZ
2010-12-26 16:54:30 ----D---- C:\Windows\system32\bg-BG
2010-12-26 16:54:30 ----D---- C:\Windows\system32\ar-SA
2010-12-26 16:54:29 ----D---- C:\Windows\ehome
2010-12-26 16:54:27 ----RSD---- C:\Windows\Fonts
2010-12-26 16:54:14 ----D---- C:\Windows\system32\drivers\UMDF
2010-12-26 16:37:38 ----RAS---- C:\BOOTSECT.BAK
2010-12-26 15:58:19 ----D---- C:\Windows\system32\migration
2010-12-26 15:58:16 ----D---- C:\Windows\PolicyDefinitions
2010-12-26 15:31:55 ----SHD---- C:\Boot
2010-12-26 15:26:03 ----D---- C:\Program Files\Windows Calendar
2010-12-26 15:26:02 ----D---- C:\Program Files\Windows Sidebar
2010-12-26 15:26:02 ----D---- C:\Program Files\Windows Photo Gallery
2010-12-26 15:26:02 ----D---- C:\Program Files\Windows Journal
2010-12-26 15:26:02 ----D---- C:\Program Files\Windows Collaboration
2010-12-26 15:26:02 ----D---- C:\Program Files\Common Files\System
2010-12-26 15:26:01 ----D---- C:\Windows\servicing
2010-12-26 15:26:01 ----D---- C:\Program Files\Windows Defender
2010-12-26 15:25:59 ----D---- C:\Windows\system32\XPSViewer
2010-12-26 15:25:59 ----D---- C:\Windows\IME
2010-12-26 15:25:58 ----D---- C:\Windows\system32\oobe
2010-12-26 15:25:57 ----D---- C:\Windows\system32\SLUI
2010-12-26 15:25:57 ----D---- C:\Windows\system32\setup
2010-12-26 15:25:57 ----D---- C:\Windows\system32\AdvancedInstallers
2010-12-26 15:25:56 ----D---- C:\Windows\system32\manifeststore
2010-12-26 15:25:56 ----D---- C:\Windows\system32\en
2010-12-26 15:25:53 ----D---- C:\Windows\system32\migwiz
2010-12-26 15:25:39 ----D---- C:\Windows\system32\Boot
2010-12-26 15:20:08 ----A---- C:\Windows\fonts\GlobalUserInterface.CompositeFont
2010-12-26 14:02:50 ----A---- C:\Windows\system32\NET11r32.dll
2010-12-26 14:02:50 ----A---- C:\Windows\system32\NET11c32.dll
2010-12-26 13:53:56 ----D---- C:\Windows\Help
2010-12-26 13:36:59 ----SD---- C:\Windows\Downloaded Program Files
2010-12-26 13:34:34 ----D---- C:\Windows\system32\restore
2010-12-26 13:26:15 ----SHD---- C:\$Recycle.Bin
2010-12-26 13:25:48 ----RD---- C:\Users
2010-12-26 13:02:05 ----RD---- C:\Program Files (x86)

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R0 AlfaFF;AlfaFF File System mini-filter; C:\Windows\system32\Drivers\AlfaFF.sys [2010-12-26 43184]
R0 AVGIDSEH;AVGIDSEH; C:\Windows\system32\DRIVERS\AVGIDSEH.Sys [2010-09-13 25680]
R0 Avgrkx86;AVG Anti-Rootkit Driver; C:\Windows\system32\DRIVERS\avgrkx86.sys [2010-09-07 26064]
R0 Lbd;Lbd; C:\Windows\system32\DRIVERS\Lbd.sys [2010-12-03 64288]
R1 Avgldx86;AVG AVI Loader Driver; C:\Windows\system32\DRIVERS\avgldx86.sys [2010-12-08 251728]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield; C:\Windows\system32\DRIVERS\avgmfx86.sys [2010-09-07 34384]
R1 Avgtdix;AVG TDI Driver; C:\Windows\system32\DRIVERS\avgtdix.sys [2010-11-12 299984]
R1 Vsdatant;Zone Alarm Firewall Driver; C:\Windows\system32\DRIVERS\vsdatant.sys [2010-05-15 457304]
R2 Int15;Int 15; \??\C:\Windows\System32\drivers\int15.sys [2007-01-26 69632]
R2 ISWKL;ZoneAlarm Toolbar ISWKL; \??\C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [2010-11-05 26872]
R2 pnarp;Pure Networks Device Discovery Driver; C:\Windows\system32\DRIVERS\pnarp.sys [2009-07-07 26672]
R2 purendis;Pure Networks Wireless Driver; C:\Windows\system32\DRIVERS\purendis.sys [2009-07-07 27696]
R3 AVGIDSDriver;AVGIDSDriver; C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys [2010-08-19 123472]
R3 AVGIDSFilter;AVGIDSFilter; C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys [2010-08-19 30288]
R3 AVGIDSShim;AVGIDSShim; C:\Windows\system32\DRIVERS\AVGIDSShim.Sys [2010-08-19 27216]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-08-12 2159384]
R3 itecir;ITECIR Infrared Receiver; C:\Windows\system32\DRIVERS\itecir.sys [2007-12-18 54784]
R3 L1E;NDIS Miniport Driver for Atheros AR8121/AR8113 PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1E60x86.sys [2010-12-26 48128]
R3 Lavasoft Kernexplorer;Lavasoft helper driver; \??\C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys [2010-12-03 15264]
R3 NETw4v32;Intel(R) Wireless WiFi Link Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw4v32.sys [2010-12-26 2554368]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2010-10-16 10084360]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2008-01-18 196784]
R3 usbvideo;USB Video Device (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-20 134016]
R3 vfs101x;vfs101x; C:\Windows\system32\drivers\vfs101x.sys [2008-02-15 40752]
S3 BthEnum;Bluetooth Request Block Driver; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-04-10 22528]
S3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-20 92160]
S3 BTHPORT;Bluetooth Port Driver; C:\Windows\System32\Drivers\BTHport.sys [2009-04-10 507904]
S3 BTHUSB;Bluetooth Radio USB Driver; C:\Windows\System32\Drivers\BTHUSB.sys [2009-04-10 29696]
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2008-01-20 5632]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-20 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-20 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-20 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-20 6016]
S3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-04-10 148992]
S3 vsdatant7;vsdatant7; C:\Windows\System32\drivers\vsdatant.win7.sys []
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-20 83328]
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-20 6656]
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-20 386616]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2010-10-16 37664]
R2 atashost;WebEx Service Host for Support Center; C:\Windows\system32\atashost.exe [2009-03-06 20376]
R2 AVGIDSAgent;AVGIDSAgent; C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [2011-01-06 6128720]
R2 avgwd;AVG WatchDog; C:\Program Files\AVG\AVG10\avgwdsvc.exe [2010-10-22 265400]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2010-10-07 345376]
R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-20 21504]
R2 IswSvc;ZoneAlarm Toolbar IswSvc; C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe [2010-11-05 488952]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2010-12-22 1402272]
R2 nmservice;Pure Networks Platform Service; C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe [2009-07-07 647216]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2010-10-16 600680]
R2 vfsFPService;Validity Fingerprint Service; C:\Windows\system32\vfsFPService.exe [2008-02-15 595248]
R2 vsmon;TrueVector Internet Monitor; C:\Windows\System32\ZoneLabs\vsmon.exe [2010-11-16 2435592]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2010-12-13 820008]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-20 21504]
S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

-----------------EOF-----------------

Corrine · « **Reply #1 on:** January 25, 2011, 02:26:55 AM »

Hi, LordJecks. Welcome to LandzDown Forum.

We will do our best to assist you. However, in order to do so, please follow all instructions provided in the sequence given. Do not install/re-install any programs or run any fixes or scanners that you have not been instructed to use. This may cause conflicts with the tools being used in the cleanup process.

If you have questions regarding any of the instructions or problems running any tools, please let us know.

Did you do a repair install on December 26 or was SP2 installed then? There were certainly a lot of changes on that date.

As to Hotmail, if you haven't yet, please change the password. Make certain it is not the same as used on any other site. Then follow the instructions at Hotmail Security to Protect and Recover Your Account.

Nothing is standing out in your log but let's see an on-line scan. Please go here to run an on-line scan from ESET.

Note: It is easiest if you use Internet explorer for this scan. (If you use an alternate browser, it will be necessary to download the ESET Smart Installer)
Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the ActiveX control to install
Click Start
Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
Copy and paste that log as a reply to this topic.

LordJecks · « **Reply #2 on:** January 25, 2011, 10:23:58 PM »

Yes a repair installation was done on the 26th including reinstalling service pack 2.

All of my passwords have been changed at least once since issues have begun happening include the hotmail one.

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6419
# api_version=3.0.2
# EOSSerial=75483762dc193e4da2866d0e25f3b022
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-01-25 11:09:17
# local_time=2011-01-25 06:09:17 (-0500, Eastern Standard Time)
# country="Canada"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=1032 16777213 100 95 0 39017365 0 0
# compatibility_mode=5892 16776574 100 100 2477993 132568749 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# compatibility_mode=9217 16777214 75 70 0 5932461 0 0
# scanned=525662
# found=1
# cleaned=0
# scan_time=35735
D:\Users\Owner\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22\539776d6-717e82c1 a variant of Java/TrojanDownloader.Agent.NAN trojan (unable to clean) 00000000000000000000000000000000 I

Corrine · « **Reply #3 on:** January 26, 2011, 12:19:56 AM »

TFC (Temp File Cleaner) by Oldman should take care of the Java Cache. Download TFC by Old Timer from here (direct download): http://www.itxassociates.com/OT-Tools/TFC.exe

First, save any files as TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista/Windows 7 right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

More info:
TFC (Temp File Cleaner) will clear out all temp folders for all user accounts (temp, IE temp, java, FF, Opera, Chrome, Safari), including Administrator, All Users, LocalService, NetworkService, and any other accounts in the user folder. It also cleans out the %systemroot%\temp folder and checks for .tmp files in the %systemdrive% root folder, %systemroot%, and the system32 folder (both 32bit and 64bit on 64bit OSs). It shows the amount removed for each location found (in bytes) and the total removed (in MB).

Before running, it will stop Explorer and all other running applications. When finished, if a reboot is required the user must reboot to finish clearing any in-use temp files.
-- TFC only cleans temp folders.
-- TFC will not clean URL history, prefetch, or cookies. Depending on how often someone cleans their temp folders, their system hardware, and how many accounts are present, it can take anywhere from a few seconds to a minute or more. TFC will completely clear all temp files where other temp file cleaners may fail.

TFC requires a reboot immediately after running. Be sure to save any unsaved work before running TFC.

Have you secured your Hotmail account?

LordJecks · « **Reply #4 on:** January 26, 2011, 12:41:52 AM »

TFC run and system rebooted. Amazed about how much i had in my temporary folder, near on a gigabyte.

If by change the password on the hotmail account, then yes. Otherwise i don't know what i could do to secure it.

Corrine · « **Reply #5 on:** January 26, 2011, 01:07:27 AM »

Yes, TFC does a great job and is safe.

See the instructions provided here: Hotmail Security to Protect and Recover Your Account, which includes information for for verifying your Hotmail credentials.

I'm not into gaming so am not familiar with any security measures for Blizzard and WoW. If you haven't changed your password at those accounts, I suggest doing so. Make sure they are complex and are not the same.

As you have uTorrent on your computer, I need to advise you of the dangers of using P2P programs. P2P programs form a direct conduit on to your computer. They have always been a target of malware writers and are increasingly so of late. P2P security measures are easily circumvented and if your P2P program is not configured correctly, you may be sharing more files than you realize. There have been cases where people's passwords, address books and other personal, private, and financial details have been exposed to the file sharing network by a badly configured program.

With P2P file sharing, what means do you have of identifying or authenticating the source of the download? In addition, a file can be distributed among many hosts, and peers will provide for download the sections that they have already downloaded. This results in the distinct possibility of a distribution method in which malicious bits are mixed with with good files.

Several years ago, Bill Pytlovany added keylogger detection to the free version of WinPatrol. (See Bits from Bill: WinPatrol 14 Enhances Keylogging Detection) As you had that concern, you may want to add WinPatrol to your arsenal: http://www.winpatrol.com/download.html

Now that you have completed the repair install, are you planning on reactivating UAC?

LordJecks · « **Reply #6 on:** January 26, 2011, 03:03:25 AM »

1) Hotmail should be secure now
2) I've been in contact with Blizzard so that issue is resolved
3) I rarely have this program open and the rare occasion its used I'm scanning the torrent files and their future content ahead of time.
4) Added WinPatrol to my arsenal

5) I've no idea on how to reactivate UAC

Any pointers would be much appreciated

Corrine · « **Reply #7 on:** January 26, 2011, 01:57:49 PM »

Excellent!

Here's some additional information about UAC: What is User Account Control?

To turn UAC back on, do the following:

1. Open User Accounts by clicking the Start button, clicking Control Panel, clicking User Accounts and Family Safety and then clicking User Accounts.
2. Click Turn User Account Control on or off. If you are prompted for an administrator password or confirmation, type the password or provide confirmation.
3. Select the Use User Account Control (UAC) to help protect your computer check box to turn on UAC and then click OK.

LordJecks · « **Reply #8 on:** January 26, 2011, 05:02:18 PM »

Thanks. Thats setup and now it would appear everything is running fine now.

Corrine · « **Reply #9 on:** January 26, 2011, 05:04:34 PM »

Great! Please let us know if you have any other questions. We'll do our best to help.

LandzDown Forum

News:

Author Topic: Key logger, email virus and potentially more (Read 690 times)

LordJecks

Key logger, email virus and potentially more

Corrine

Re: Key logger, email virus and potentially more

LordJecks

Re: Key logger, email virus and potentially more

Corrine

Re: Key logger, email virus and potentially more

LordJecks

Re: Key logger, email virus and potentially more

Corrine

Re: Key logger, email virus and potentially more

LordJecks

Re: Key logger, email virus and potentially more

Corrine

Re: Key logger, email virus and potentially more

LordJecks

Re: Key logger, email virus and potentially more

Corrine

Re: Key logger, email virus and potentially more