Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

Заразен лаптоп

10 март 201214 г.

По точка 1, знам че го има файла, но аз исках да го заместя с моето копие, но това сега не е важно.

По точка 2, изтрийте цялата папка C:\Program Files\Windows Defender (да не изтриете и Program Files - тя не е за триене).

След това изтеглете този архив и го разархивирайте на десктопа. С бутона Cut изрежете папката и я поставете в C:\Program Files.

След това продължете с деинсталирането на AVG (тази стъпка е необходима за да сработи Combofix-a).

Отговори 69
Прегледи 11,1k
Създадено 14 г.14 г.
Последен отговор 14 г.14 г.

10 март 201214 г.

Автор

Изтрих папката мн. трудно, казваше, че трябва да искам разрешение от System, че няма достъп до bg-BG...От Properties/Security не стана разрешението, изтрих я принудително с Unlocker... Забравих да спомена, че след вчерашните процедури, при включване на лаптопа, за малко долу излиза съобщение, че уиндоуса не може да се свърже с Group Policy Client service... Исках да прикача принт скреен да се види цялото съобщение, вижда се и DU метъра, но казва, че файла е голям (500KB, *.doc)...

10 март 201214 г.

Папката явно е била с омазани права от рууткита или просто самата папка си е била наред, а е бил изтрит само един файл от Windows Defender. Аз реших да играя на сигурно и да копирам цялата папка за всеки случай. Трябваше може би да уточня да копирате файловете от архива в C:\Program Files\Windows Defender, вместо да я триете цялата, но го направих за ваше улеснение. Както и да е. Това не е особен проблем.

Колкото до втория проблем, няма логика...инструкциите ми са съвсем точни...освен ако не сте инсталирали ERUNT в свободната директория на C:\Users\вашето потребителско име.

ERUNT изтрива всички файлове в посочената папка, за да създаде архива на регистрите (и затова споменах да се оставят настройките по-подразбиране от инсталатора).

Тази грешка ми прилича на изтрит ntuser.dat или повреден потребителски акаунт.

След почисващия процес, може да се наложи да си създадете нов потребителски акаунт, да копирате файловете си от стария в новия и след това спокойно да изтриете стария.

Сега продължете с останалите инструкции.

10 март 201214 г.

Автор

Тази грешка ми прилича на изтрит ntuser.dat или повреден потребителски акаунт.

Бях споменал,че на десктопа се появи MBR.dat...Пратил съм го в рисайкъл бина, но мисля, че беше след това.

ОК, ще продължавам по инструкциите.

10 март 201214 г.

Бях споменал,че на десктопа се появи MBR.dat...Пратил съм го в рисайкъл бина, но мисля, че беше след това.
ОК, ще продължавам по инструкциите.

Да, знам. Само че mbr.dat няма нищо общо с ntuser.dat. Първия файл е създаден от aswMBR и служи за анализ на MBR-то при нужда. Вашия MBR запис е чист, така че дори можете да изтриете този файл. Втория файл е част от потребителския профил. Карайте подред, после ще се опитаме да оправим и това. Често срещан проблем е и има доста варианти описани из интернет.

11 март 201214 г.

Автор

Не може наведнъж да се пусне, ще разделя посовете.

Изтрих AVG, сканирах с MSSEsential,сканирах с FSS.Ето резултата:

Farbar Service Scanner Version: 01-03-2012

Ran by user (administrator) on 10-03-2012 at 18:54:35

Running from "C:\Users\user\Desktop\Cleening 10.03.12"

Microsoft® Windows 7 Eternity™ 2009 (X86)

Boot Mode: Normal

****************************************************************

Internet Services:

============

Connection Status:

==============

Localhost is accessible.

LAN connected.

Google IP is accessible.

Yahoo IP is accessible.

Windows Firewall:

=============

Firewall Disabled Policy:

==================

System Restore:

============

System Restore Disabled Policy:

========================

Action Center:

============

Windows Update:

============

Windows Defender:

==============

WinDefend Service is not running. Checking service configuration:

The start type of WinDefend service is OK.

The ImagePath of WinDefend service is OK.

The ServiceDll of WinDefend service is OK.

Windows Defender Disabled Policy:

==========================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]

"DisableAntiSpyware"=DWORD:1

File Check:

========

C:\Windows\system32\nsisvc.dll => MD5 is legit

C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit

C:\Windows\system32\dhcpcore.dll => MD5 is legit

C:\Windows\system32\Drivers\afd.sys => MD5 is legit

C:\Windows\system32\Drivers\tdx.sys => MD5 is legit

C:\Windows\system32\Drivers\tcpip.sys

[2011-11-10 18:08] - [2011-09-29 15:43] - 1285488 ____A (Microsoft Corporation) 56C198AC82EFA622DD93E9E43575F79C

C:\Windows\system32\dnsrslvr.dll

[2011-04-29 07:41] - [2011-03-03 05:29] - 0132608 ____A (Microsoft Corporation) B15BE77A2BACF9C3177D27518AFE26A9

C:\Windows\system32\mpssvc.dll

[2009-07-13 23:53] - [2009-07-14 01:15] - 0565760 ____A (Microsoft Corporation) 5CD996CECF45CBC3E8D109C86B82D69E

C:\Windows\system32\bfe.dll

[2009-07-13 23:54] - [2009-07-14 01:14] - 0493568 ____A (Microsoft Corporation) 85AC71C045CEB054ED48A7841AAE0C11

C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit

C:\Windows\system32\SDRSVC.dll

[2009-07-13 23:23] - [2009-07-14 01:16] - 0125952 ____A (Microsoft Corporation) 5FD90ABDBFAEE85986802622CBB03446

C:\Windows\system32\vssvc.exe

[2009-07-13 23:24] - [2009-07-14 01:14] - 1025536 ____A (Microsoft Corporation) 7EA2BCD94D9CFAF4C556F5CC94532A6C

C:\Windows\system32\wscsvc.dll => MD5 is legit

C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit

C:\Windows\system32\wuaueng.dll

[2009-07-14 00:15] - [2009-07-14 01:16] - 1912832 ____A (Microsoft Corporation) A33408CC036F9C08142B11BE5E93F0A1

C:\Windows\system32\qmgr.dll

[2009-07-13 23:30] - [2009-07-14 01:16] - 0589312 ____A (Microsoft Corporation) 53F476476F55A27F580661BDE09C4EC4

C:\Windows\system32\es.dll => MD5 is legit

C:\Windows\system32\cryptsvc.dll => MD5 is legit

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit

C:\Windows\system32\svchost.exe => MD5 is legit

C:\Windows\system32\rpcss.dll => MD5 is legit

**** End of log ****

1. От ComboFix:

ComboFix 12-03-10.02 - user 10/03/2012 19:05:21.5.2 - x86

Microsoft® Windows 7 Eternity™ 2009 6.1.7600.0.1251.359.1033.18.1918.1010 [GMT 0:00]

Running from: c:\users\user\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

---- Previous Run -------

c:\windows\system32\DcLps.dll

-- Previous Run --

c:\windows\system32\drivers\netbt.sys . . . is missing!!

--------

c:\windows\system32\drivers\netbt.sys . . . is missing!!

--------

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

-------\Service_roxwatch9

((((((((((((((((((((((((( Files Created from 2012-02-10 to 2012-03-10 )))))))))))))))))))))))))))))))

2012-03-10 19:13 . 2012-03-10 19:13 -------- d-----w- c:\users\user\AppData\Local\temp

2012-03-10 19:13 . 2012-03-10 19:13 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-03-10 18:24 . 2012-03-10 18:24 56200 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C4F9635D-E857-4EC8-9EA2-695DD8D8AAAF}\offreg.dll

2012-03-10 18:24 . 2012-03-10 18:24 29904 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C4F9635D-E857-4EC8-9EA2-695DD8D8AAAF}\MpKsl85226a61.sys

2012-03-10 18:18 . 2012-02-09 13:17 713784 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll

2012-03-10 18:18 . 2012-02-09 13:17 713784 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CB955983-B570-4869-9BC0-D4149D1D38D3}\gapaengine.dll

2012-03-10 18:18 . 2012-03-01 13:34 6552120 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C4F9635D-E857-4EC8-9EA2-695DD8D8AAAF}\mpengine.dll

2012-03-10 18:18 . 2012-01-31 04:59 237072 ------w- c:\windows\system32\MpSigStub.exe

2012-03-10 18:13 . 2012-03-10 18:13 -------- d-----w- c:\program files\Microsoft Security Client

2012-03-10 13:19 . 2012-03-09 11:14 -------- d-----w- c:\program files\Windows Defender

2012-03-09 22:38 . 2012-03-09 21:41 187904 ----a-w- c:\windows\system32\drivers\netbt.sys

2012-03-09 21:42 . 2012-03-09 21:41 187904 ----a-w- C:\netbt.sys

2012-03-09 21:42 . 2012-03-09 21:40 388096 ----a-w- C:\csc.sys

2012-03-09 21:30 . 2012-03-09 21:30 181064 ----a-w- c:\windows\PSEXESVC.EXE

2012-03-09 21:20 . 2010-04-27 11:04 381816 ----a-w- C:\PsExec.exe

2012-03-09 21:04 . 2012-03-09 21:04 -------- d-----w- c:\program files\ERUNT

2012-03-08 23:17 . 2011-12-10 15:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-03-07 07:23 . 2012-03-08 05:26 -------- d-----w- C:\FRST

2012-02-29 18:38 . 2012-02-29 18:38 -------- d-----w- c:\users\user\AppData\Roaming\AVG2012

2012-02-28 23:05 . 2012-03-04 10:43 0 --sha-w- c:\windows\system32\dds_trash_log.cmd

2012-02-28 23:02 . 2012-02-28 23:02 -------- d-----w- C:\_OTL

2012-02-28 19:06 . 2012-02-28 19:06 -------- dc----w- c:\users\user\AppData\Local\MigWiz

2012-02-27 21:40 . 2009-07-13 23:15 387584 ----a-w- c:\windows\system32\drivers\csc.sys

2012-02-21 00:14 . 2012-02-21 00:14 -------- d-----w- c:\program files\LopeSoft

2012-02-21 00:03 . 2012-02-21 00:03 -------- d-----w- c:\program files\PC Magazine Utilities

2012-02-20 23:10 . 2012-02-20 23:10 -------- d-----w- c:\program files\NirSoft

2012-02-18 23:32 . 2012-02-18 23:32 -------- d-----w- c:\program files\WinPcap

2012-02-15 17:41 . 2012-02-15 17:52 -------- d-----w- C:\e64a0c4b528f8264dfe36f93064430

2012-02-15 17:35 . 2011-12-16 07:59 690688 ----a-w- c:\windows\system32\msvcrt.dll

2012-02-15 17:34 . 2012-01-14 03:48 2340864 ----a-w- c:\windows\system32\win32k.sys

2012-02-10 00:10 . 2012-02-10 00:10 -------- d-----w- c:\program files\Fortop Digital

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2012-01-06 17:42 . 2012-01-06 17:42 20480 ----a-w- c:\windows\system32\EclipseUpdateSpawn.exe

2012-02-18 10:58 . 2011-07-28 21:49 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

[-] 2011-11-02 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385] . . c:\windows\System32\user32.dll

[7] 2009-07-14 . 34B7E222E81FAFA885F0C5F2CFA56861 . 811520 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Win7SharedFolderIcon]

@="{15AB4D5B-4FDB-4F84-B5E2-245E47F2F632}"

[HKEY_CLASSES_ROOT\CLSID\{15AB4D5B-4FDB-4F84-B5E2-245E47F2F632}]

2010-02-27 20:25 180224 ----a-w- c:\program files\Fortop Digital\Win7 Shared Folder Icon\SharedFolderIcon.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

"Welcome Center"="c:\windows\system32\OobeFldr.dll" [2009-09-11 859648]

"DU Meter"="c:\program files\DU Meter\DUMeter.exe" [2007-10-15 2582288]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-09-02 13351304]

"Sticky Pad"="c:\program files\StickyPad\StickyPad.exe" [2012-01-05 520249]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-05-21 61440]

"cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent.exe" [2009-07-20 484920]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-06-12 1533224]

"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2009-08-21 476512]

"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2009-03-09 55160]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"Welcome Center"="c:\windows\system32\OobeFldr.dll" [2009-09-11 859648]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil10b.exe" [2009-02-03 240544]

c:\users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 0 (0x0)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoResolveTrack"= 1 (0x1)

"NoSMBalloonTip"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"NoResolveTrack"= 1 (0x1)

"NoSMBalloonTip"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux1"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Orbit.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Orbit.lnk

backup=c:\windows\pss\Orbit.lnk.CommonStartup

backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^RocketDock.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\RocketDock.lnk

backup=c:\windows\pss\RocketDock.lnk.CommonStartup

backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^user^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]

path=c:\users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk

backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup

backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\00TCrdMain]

2009-08-05 13:04 738616 ----a-w- c:\program files\Toshiba\FlashCards\TCrdMain.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2012-01-02 10:07 843712 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2012-01-03 22:51 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bing Bar]

2010-03-24 16:26 243544 ----a-w- c:\program files\MSN Toolbar\Platform\5.0.1423.0\mswinext.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Camera Assistant Software]

2009-04-10 16:09 417792 ----a-w- c:\program files\Camera Assistant Software for Toshiba\traybar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]

2010-04-01 09:16 357696 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON SX100 Series]

2009-07-29 08:12 188928 ----a-w- c:\windows\System32\spool\drivers\w32x86\3\E_FATIEDE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON SX100 Series (Copy 1)]

2009-07-29 08:12 188928 ----a-w- c:\windows\System32\spool\drivers\w32x86\3\E_FATIEDE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]

2006-10-26 23:47 31016 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Default Manager]

2009-11-11 17:43 288088 ----a-w- c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NSU_agent]

2011-10-19 14:53 190768 ----a-w- c:\program files\Nokia\Nokia Software Updater\nsu3ui_agent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]

2009-08-13 11:31 521528 ----a-w- c:\program files\Toshiba\SmoothView\SmoothView.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center]

2007-05-31 09:21 648072 ----a-w- c:\windows\WindowsMobile\wmdc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-10-06 136176]

R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2011-07-29 14216]

R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2011-07-29 8456]

R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-10-06 136176]

R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2011-04-18 43392]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2011-04-27 65024]

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 208944]

R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2011-08-17 137472]

R3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2011-08-17 8576]

R3 WatAdminSvc;WatAdminSvc;c:\windows\system32\Wat\WatAdminSvc.exe [2011-11-02 1343400]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2011-02-07 691696]

S1 MpKsl85226a61;MpKsl85226a61;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C4F9635D-E857-4EC8-9EA2-695DD8D8AAAF}\MpKsl85226a61.sys [2012-03-10 29904]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]

S2 DUMeterSvc;DU Meter Service;c:\program files\DU Meter\DUMeterSvc.exe [2007-10-15 1382672]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]

S2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2011-02-11 35088]

S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2010-02-25 1047880]

S2 USBSafelyRemoveService;USB Safely Remove Assistant;c:\program files\USB Safely Remove\USBSRService.exe [2009-11-26 261456]

S3 CnxtHdmiAudService;Conexant UAA HDMI Function Driver for High Definition Audio Service;c:\windows\system32\drivers\CHDMI32.sys [2009-06-23 487936]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-10 20464]

S3 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2media.sys [2008-03-04 48600]

S3 QIOMem;Generic IO & Memory Access;c:\windows\system32\DRIVERS\QIOMem.sys [2007-04-09 8192]

S3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys [2010-03-31 379904]

S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]

S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]

S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]

S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [2010-02-25 10064]

S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-13 311296]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

WindowsMobile REG_MULTI_SZ wcescomm rapimgr

LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

lanmangpsvc

UxTuneUp

oracle_load_balancer_60_-forms6ip9

beatjammusicstreamingvaiomediaplatform-integrated-http

mvTermService

Contents of the 'Scheduled Tasks' folder

2012-03-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-06 17:47]

2012-03-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-06 17:47]

------- Supplementary Scan -------

uStart Page = hxxp://www.google.co.uk/

IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201

IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204

IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203

IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.1.254

FF - ProfilePath - c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=DCF3DF&PC=DCF3&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - www.google.co.uk

FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=DCF3DF&PC=DCF3&q=

FF - prefs.js: network.proxy.http - 84.22.23.6

FF - prefs.js: network.proxy.http_port - 8080

FF - prefs.js: network.proxy.type - 0

- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-PC Suite Tray - c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DUMeterSvc]

"ImagePath"="c:\program files\DU Meter\DUMeterSvc.exe /startedbyscm:E1F6D4BE-40E33354-DUMeterService"

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]

@Denied: (2) (LocalSystem)

"{C55BBCD6-41AD-48AD-9953-3609C48EACC7}"=hex:51,66,7a,6c,4c,1d,38,12,b8,bf,48,

c1,9f,0f,c3,0d,e6,45,75,49,c1,d0,e8,d3

"{8DCB7100-DF86-4384-8842-8FA844297B3F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,72,d8,

89,b4,91,ea,06,f7,54,cc,e8,41,77,3f,2b

"{000123B4-9B42-4900-B3F7-F4B073EFC214}"=hex:51,66,7a,6c,4c,1d,38,12,da,20,12,

04,70,d5,6e,0c,cc,e1,b7,f0,76,b1,86,00

"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,

1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7

"{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}"=hex:51,66,7a,6c,4c,1d,38,12,7c,f0,b1,

38,5c,21,3d,0e,d9,78,0d,25,e1,c9,8c,d4

"{6EBF7485-159F-4BFF-A14F-B9E3AAC4465B}"=hex:51,66,7a,6c,4c,1d,38,12,eb,77,ac,

6a,ad,5b,91,0e,de,59,fa,a3,af,9a,02,4f

"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,

76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a

"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,

94,30,02,d1,0f,f1,da,12,24,73,56,27,d2

"{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}"=hex:51,66,7a,6c,4c,1d,38,12,49,4c,04,

a2,cd,51,b8,a4,d6,29,f9,08,a8,03,90,5c

"{D2CE3E00-F94A-4740-988E-03DC2F38C34F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,3d,dd,

d6,78,b7,2e,02,e7,98,40,9c,2a,66,87,5b

"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,38,12,8f,19,47,

2e,c4,15,0b,03,d7,b5,8c,e9,62,70,06,85

"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,

fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17

"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,

b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

@Denied: (2) (LocalSystem)

"Timestamp"=hex:1b,dc,05,32,95,ee,cc,01

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(6048)

c:\program files\Fortop Digital\Win7 Shared Folder Icon\SharedFolderIcon.dll

------------------------ Other Running Processes ------------------------

c:\program files\Microsoft Security Client\Antimalware\MsMpEng.exe

c:\windows\system32\Ati2evxx.exe

c:\windows\system32\AUDIODG.EXE

c:\windows\system32\Ati2evxx.exe

c:\program files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe

c:\programdata\EPSON\EPW!3 SSRP\E_S40ST7.EXE

c:\programdata\EPSON\EPW!3 SSRP\E_S40RP7.EXE

c:\program files\O2Micro Flash Memory Card Driver\o2flash.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\program files\Toshiba\Power Saver\TosCoSrv.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

c:\windows\system32\taskhost.exe

c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

c:\windows\system32\conhost.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

c:\program files\Synaptics\SynTP\SynTPHelper.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

c:\windows\servicing\TrustedInstaller.exe

c:\program files\Windows Media Player\wmpnetwk.exe

**************************************************************************

Completion time: 2012-03-10 19:22:08 - machine was rebooted

ComboFix-quarantined-files.txt 2012-03-10 19:22

Pre-Run: 14,227,980,288 bytes free

Post-Run: 13,743,931,392 bytes free

- - End Of File - - 07A29DF8F33898592FD9592DEE6B5855

2.От OTL- получи се само txt, няма Extras-не може да се прикачи-480KB-много голям (до колко може да се прикачва?) За това го поствам тук:

OTL logfile created on: 10/03/2012 19:30:16 - Run 4

OTL by OldTimer - Version 3.2.36.2 Folder = C:\Users\user\Desktop

Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.87 Gb Total Physical Memory | 0.87 Gb Available Physical Memory | 46.43% Memory free

3.75 Gb Paging File | 2.45 Gb Available in Paging File | 65.45% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 39.41 Gb Total Space | 12.87 Gb Free Space | 32.66% Space Free | Partition Type: NTFS

Drive D: | 146.80 Gb Total Space | 36.82 Gb Free Space | 25.08% Space Free | Partition Type: NTFS

Computer Name: TOSHIBA-EQUIUM | User Name: user | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 90 Days

========== Processes (SafeList) ==========

PRC - [2012/03/10 19:27:59 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe

PRC - [2012/02/18 10:58:08 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe

PRC - [2012/01/13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012/01/13 14:53:18 | 000,460,872 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

PRC - [2012/01/05 10:47:00 | 000,520,249 | ---- | M] (Green Eclipse) -- C:\Program Files\StickyPad\StickyPad.exe

PRC - [2011/06/15 15:16:48 | 000,997,920 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe

PRC - [2011/04/27 15:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

PRC - [2011/02/19 13:17:02 | 000,072,704 | ---- | M] (Autodata Limited) -- C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe

PRC - [2010/02/25 11:21:36 | 000,716,616 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe

PRC - [2010/02/25 11:19:36 | 001,047,880 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe

PRC - [2009/11/26 08:59:56 | 000,261,456 | ---- | M] () -- C:\Program Files\USB Safely Remove\USBSRService.exe

PRC - [2009/10/31 05:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2009/08/21 08:29:40 | 000,464,224 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe

PRC - [2009/08/21 08:29:20 | 000,476,512 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\Power Saver\TPwrMain.exe

PRC - [2009/07/29 08:12:22 | 000,143,872 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40ST7.EXE

PRC - [2009/07/29 08:12:22 | 000,113,664 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE

PRC - [2009/07/20 13:29:00 | 000,484,920 | ---- | M] (Conexant Systems, Inc.) -- C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent.exe

PRC - [2009/07/14 01:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2009/07/14 01:14:28 | 000,031,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\prevhost.exe

PRC - [2009/07/14 01:14:12 | 000,100,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\audiodg.exe

PRC - [2007/10/15 15:19:38 | 001,382,672 | ---- | M] (Hagel Technologies Ltd) -- C:\Program Files\DU Meter\DUMeterSvc.exe

PRC - [2007/10/15 15:19:36 | 002,582,288 | ---- | M] (Hagel Technologies Ltd) -- C:\Program Files\DU Meter\DUMeter.exe

PRC - [2007/02/12 15:43:44 | 000,065,536 | ---- | M] (O2Micro International) -- C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe

========== Modules (No Company Name) ==========

MOD - [2012/02/18 10:58:08 | 001,911,768 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll

MOD - [2012/02/15 18:34:37 | 011,824,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\2df79ab909c782d3796e4107d040327d\System.Web.ni.dll

MOD - [2012/02/15 18:34:28 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0a894f77b9aa64acbd3ce791916357d8\System.Runtime.Remoting.ni.dll

MOD - [2012/02/15 18:33:48 | 012,431,360 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ff30db6905f8ec024fc808ed8779c0f3\System.Windows.Forms.ni.dll

MOD - [2012/02/15 18:33:39 | 001,586,688 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\a09ee392fa90849f2e9313a1ebbe0279\System.Drawing.ni.dll

MOD - [2012/02/15 18:33:14 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d49f4cb0755ccc34cd35ff96dc2ef9e3\System.Xml.ni.dll

MOD - [2012/02/15 18:33:08 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\15742b3597258ce67cbe219005c197e5\System.Configuration.ni.dll

MOD - [2012/02/15 18:33:06 | 007,952,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1f14b3e1ee0847f8662f513e67f92547\System.ni.dll

MOD - [2011/11/21 18:00:15 | 008,527,008 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32.dll

MOD - [2011/10/14 16:37:39 | 000,025,600 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\d71769228ebe7732ae31ac194fe00ff0\Accessibility.ni.dll

MOD - [2011/10/14 16:36:17 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\1b31ced9bb880d94fff1c6d47c16a81e\mscorlib.ni.dll

MOD - [2010/10/04 11:02:20 | 001,728,512 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.3428.38736__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll

MOD - [2010/10/04 11:02:20 | 000,491,520 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3428.38810__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll

MOD - [2010/10/04 11:02:20 | 000,364,544 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Wizard\2.0.3428.38795__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Wizard.dll

MOD - [2010/10/04 11:02:20 | 000,290,816 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3428.38718__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll

MOD - [2010/10/04 11:02:20 | 000,204,800 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3428.38737__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll

MOD - [2010/10/04 11:02:20 | 000,077,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3428.38791__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll

MOD - [2010/10/04 11:02:20 | 000,073,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3428.38726__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll

MOD - [2010/10/04 11:02:20 | 000,069,632 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3428.38773__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll

MOD - [2010/10/04 11:02:20 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3428.38732__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll

MOD - [2010/10/04 11:02:20 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3428.38760__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll

MOD - [2010/10/04 11:02:20 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3428.38726__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll

MOD - [2010/10/04 11:02:19 | 000,811,008 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.3428.38762__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll

MOD - [2010/10/04 11:02:19 | 000,798,720 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Dashboard\2.0.3428.38792__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Dashboard.dll

MOD - [2010/10/04 11:02:19 | 000,712,704 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.3428.38727__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.dll

MOD - [2010/10/04 11:02:19 | 000,589,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.3428.38738__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll

MOD - [2010/10/04 11:02:19 | 000,450,560 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.3428.38757__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll

MOD - [2010/10/04 11:02:19 | 000,405,504 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.3428.38786__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll

MOD - [2010/10/04 11:02:19 | 000,401,408 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Dashboard\2.0.3428.38772__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Dashboard.dll

MOD - [2010/10/04 11:02:19 | 000,364,544 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.3428.38778__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll

MOD - [2010/10/04 11:02:19 | 000,307,200 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Wizard\2.0.3428.38742__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Wizard.dll

MOD - [2010/10/04 11:02:19 | 000,225,280 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3428.38737__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll

MOD - [2010/10/04 11:02:19 | 000,139,264 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3428.38810__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll

MOD - [2010/10/04 11:02:19 | 000,126,976 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.3428.38771__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll

MOD - [2010/10/04 11:02:19 | 000,094,208 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3428.38778__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll

MOD - [2010/10/04 11:02:19 | 000,081,920 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.3428.38762__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll

MOD - [2010/10/04 11:02:19 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3428.38761__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll

MOD - [2010/10/04 11:02:19 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.3428.38777__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll

MOD - [2010/10/04 11:02:19 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime\2.0.3428.38809__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime.dll

MOD - [2010/10/04 11:02:19 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.3428.38741__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll

MOD - [2010/10/04 11:02:19 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.3428.38771__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll

MOD - [2010/10/04 11:02:19 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3428.38772__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll

MOD - [2010/10/04 11:02:18 | 000,438,272 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3428.38761__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll

MOD - [2010/10/04 11:02:18 | 000,073,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.3309.28604__90ba9c70f846762e\CLI.Foundation.dll

MOD - [2010/10/04 11:02:18 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3309.28618__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll

MOD - [2010/10/04 11:02:18 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll

MOD - [2010/10/04 11:02:18 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.3309.28644__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll

MOD - [2010/10/04 11:02:18 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3428.38761__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll

MOD - [2010/10/04 11:02:18 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.3309.28601__90ba9c70f846762e\LOG.Foundation.dll

MOD - [2010/10/04 11:02:18 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3309.28603__90ba9c70f846762e\NEWAEM.Foundation.dll

MOD - [2010/10/04 11:02:18 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3309.28669__90ba9c70f846762e\CLI.Foundation.XManifest.dll

MOD - [2010/10/04 11:02:18 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.OS.I0602\2.0.3309.28630__90ba9c70f846762e\DEM.OS.I0602.dll

MOD - [2010/10/04 11:02:18 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3309.28620__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll

MOD - [2010/10/04 11:02:18 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3309.28617__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll

MOD - [2010/10/04 11:02:18 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3309.28611__90ba9c70f846762e\CLI.Component.Client.Shared.dll

MOD - [2010/10/04 11:02:18 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3309.28617__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll

MOD - [2010/10/04 11:02:18 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3309.28608__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll

MOD - [2010/10/04 11:02:18 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.3309.28626__90ba9c70f846762e\MOM.Foundation.dll

MOD - [2010/10/04 11:02:18 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.OS\2.0.3309.28645__90ba9c70f846762e\DEM.OS.dll

MOD - [2010/10/04 11:02:18 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll

MOD - [2010/10/04 11:02:18 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.3309.28630__90ba9c70f846762e\DEM.Graphics.dll

MOD - [2010/10/04 11:02:18 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll

MOD - [2010/10/04 11:02:18 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3309.28617__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll

MOD - [2010/10/04 11:02:18 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.3309.28631__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll

MOD - [2010/10/04 11:02:18 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.3309.28630__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll

MOD - [2010/10/04 11:02:18 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3309.28629__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll

MOD - [2010/10/04 11:02:18 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.REG.Shared\2.0.3309.28645__90ba9c70f846762e\AEM.Plugin.REG.Shared.dll

MOD - [2010/10/04 11:02:18 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3309.28647__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll

MOD - [2010/10/04 11:02:18 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.3309.28627__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll

MOD - [2010/10/04 11:02:18 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3309.28647__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll

MOD - [2010/10/04 11:02:18 | 000,007,168 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll

MOD - [2010/10/04 11:02:17 | 000,405,504 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3428.38731__90ba9c70f846762e\CLI.Component.Wizard.dll

MOD - [2010/10/04 11:02:17 | 000,106,496 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.3428.38805__90ba9c70f846762e\MOM.Implementation.dll

MOD - [2010/10/04 11:02:17 | 000,081,920 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3428.38716__90ba9c70f846762e\CLI.Component.Runtime.dll

MOD - [2010/10/04 11:02:17 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.3309.28636__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll

MOD - [2010/10/04 11:02:17 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3428.38803__90ba9c70f846762e\LOG.Foundation.Implementation.dll

MOD - [2010/10/04 11:02:17 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3428.38717__90ba9c70f846762e\CLI.Component.SkinFactory.dll

MOD - [2010/10/04 11:02:17 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.3309.28636__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll

MOD - [2010/10/04 11:02:17 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.3309.28634__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll

MOD - [2010/10/04 11:02:17 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.3309.28634__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll

MOD - [2010/10/04 11:02:17 | 000,049,152 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.3309.28634__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll

MOD - [2010/10/04 11:02:17 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3309.28628__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll

MOD - [2010/10/04 11:02:17 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3428.38818__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll

MOD - [2010/10/04 11:02:17 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3309.28608__90ba9c70f846762e\CLI.Foundation.Private.dll

MOD - [2010/10/04 11:02:17 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.3309.28636__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll

MOD - [2010/10/04 11:02:17 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3309.28614__90ba9c70f846762e\LOG.Foundation.Private.dll

MOD - [2010/10/04 11:02:17 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.3309.28624__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll

MOD - [2010/10/04 11:02:17 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Shared\2.0.3309.28644__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Shared.dll

MOD - [2010/10/04 11:02:17 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.3309.28632__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll

MOD - [2010/10/04 11:02:17 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.3309.28630__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll

MOD - [2010/10/04 11:02:17 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.3309.28627__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll

MOD - [2010/10/04 11:02:17 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3309.28627__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll

MOD - [2010/10/04 11:02:17 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.3309.28635__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll

MOD - [2010/10/04 11:02:17 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll

MOD - [2010/10/04 11:02:17 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Private\2.0.3309.28612__90ba9c70f846762e\ResourceManagement.Foundation.Private.dll

MOD - [2010/10/04 11:02:17 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3309.28626__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll

MOD - [2010/10/04 11:02:17 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.3309.28630__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll

MOD - [2010/10/04 11:02:17 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.3309.28626__90ba9c70f846762e\APM.Foundation.dll

MOD - [2010/10/04 11:02:17 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3309.28617__90ba9c70f846762e\AEM.Server.Shared.dll

MOD - [2010/10/04 11:02:17 | 000,014,848 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll

MOD - [2010/10/04 11:02:17 | 000,013,312 | ---- | M] () -- C:\Windows\assembly\GAC\Interop.WBOCXLib\1.0.0.0__90ba9c70f846762e\Interop.WBOCXLib.dll

MOD - [2010/10/04 11:02:17 | 000,007,168 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3428.38714__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll

MOD - [2010/10/04 11:02:16 | 001,142,784 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3428.38722__90ba9c70f846762e\CLI.Component.Dashboard.dll

MOD - [2010/10/04 11:02:16 | 000,081,920 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATIDEMOS\2.0.3428.38716__90ba9c70f846762e\ATIDEMOS.dll

MOD - [2010/10/04 11:02:16 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Server\2.0.3428.38715__90ba9c70f846762e\APM.Server.dll

MOD - [2010/10/04 11:02:16 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.3428.38714__90ba9c70f846762e\AEM.Server.dll

MOD - [2010/10/04 11:02:16 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3309.28621__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll

MOD - [2010/10/04 11:02:16 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll

MOD - [2010/10/04 11:02:16 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.3428.38804__90ba9c70f846762e\CCC.Implementation.dll

MOD - [2010/10/04 11:02:16 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3309.28624__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll

MOD - [2010/10/04 11:02:16 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.3309.28637__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll

MOD - [2010/07/04 21:32:38 | 000,010,752 | ---- | M] () -- C:\Program Files\Unlocker\UnlockerCOM.dll

MOD - [2009/05/04 09:45:14 | 000,016,384 | R--- | M] () -- C:\Program Files\ATI Technologies\ATI.ACE\Branding\Branding.dll

========== Win32 Services (SafeList) ==========

SRV - [2012/01/13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2011/11/02 22:40:32 | 001,343,400 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)

SRV - [2011/10/27 10:34:30 | 000,718,384 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)

SRV - [2011/04/27 15:39:26 | 000,208,944 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)

SRV - [2011/04/27 15:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)

SRV - [2011/02/19 13:17:02 | 000,072,704 | ---- | M] (Autodata Limited) [Auto | Running] -- C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe -- (Autodata Limited License Service)

SRV - [2011/02/09 22:10:07 | 000,435,016 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe -- (TuneUp.Defrag)

SRV - [2010/02/25 11:19:36 | 001,047,880 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)

SRV - [2010/02/25 11:15:16 | 000,030,024 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)

SRV - [2009/11/26 08:59:56 | 000,261,456 | ---- | M] () [Auto | Running] -- C:\Program Files\USB Safely Remove\USBSRService.exe -- (USBSafelyRemoveService)

SRV - [2009/08/21 08:29:40 | 000,464,224 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe -- (TosCoSrv)

SRV - [2009/07/29 08:12:22 | 000,143,872 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40ST7.EXE -- (EPSON_EB_RPCV4_01) EPSON V5 Service4(01)

SRV - [2009/07/29 08:12:22 | 000,113,664 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE -- (EPSON_PM_RPCV4_01) EPSON V3 Service4(01)

SRV - [2009/07/14 03:15:42 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2009/07/14 01:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009/07/14 01:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)

SRV - [2007/10/15 15:19:38 | 001,382,672 | ---- | M] (Hagel Technologies Ltd) [Auto | Running] -- C:\Program Files\DU Meter\DUMeterSvc.exe -- (DUMeterSvc)

SRV - [2007/05/31 09:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)

SRV - [2007/05/31 09:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)

SRV - [2007/02/12 15:43:44 | 000,065,536 | ---- | M] (O2Micro International) [Auto | Running] -- C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe -- (O2FLASH)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (catchme)

DRV - File not found [Kernel | On_Demand | Unknown] -- -- (avf8q72s)

DRV - [2012/03/10 18:24:29 | 000,029,904 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{C4F9635D-E857-4EC8-9EA2-695DD8D8AAAF}\MpKsl85226a61.sys -- (MpKsl85226a61)

DRV - [2011/12/10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)

DRV - [2011/08/17 13:03:58 | 000,137,472 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcdnsu.sys -- (nmwcdnsu)

DRV - [2011/08/17 13:03:50 | 000,008,576 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcdnsuc.sys -- (nmwcdnsuc)

DRV - [2011/08/17 12:56:32 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)

DRV - [2011/08/17 12:56:30 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)

DRV - [2011/08/17 12:56:26 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)

DRV - [2011/08/17 12:56:22 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)

DRV - [2011/07/29 13:54:56 | 000,014,216 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\epmntdrv.sys -- (epmntdrv)

DRV - [2011/07/29 13:54:56 | 000,008,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\EuGdiDrv.sys -- (EuGdiDrv)

DRV - [2011/04/27 15:25:24 | 000,065,024 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)

DRV - [2011/04/18 13:18:50 | 000,043,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)

DRV - [2011/02/11 21:23:34 | 000,035,088 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\npf.sys -- (npf)

DRV - [2011/02/07 21:09:32 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)

DRV - [2010/07/12 14:49:18 | 000,060,104 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ftdibus.sys -- (FTDIBUS)

DRV - [2010/07/12 14:48:56 | 000,073,032 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ftser2k.sys -- (FTSER2K)

DRV - [2010/03/31 02:13:28 | 000,379,904 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTL8187B.sys -- (RTL8187B)

DRV - [2010/02/25 10:18:08 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)

DRV - [2009/07/14 14:28:42 | 000,023,512 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS -- (TVALZ)

DRV - [2009/07/14 01:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vmbus.sys -- (vmbus)

DRV - [2009/07/14 01:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vmstorfl.sys -- (storflt)

DRV - [2009/07/14 01:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\storvsc.sys -- (storvsc)

DRV - [2009/07/13 23:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WINUSB)

DRV - [2009/07/13 23:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vms3cap.sys -- (s3cap)

DRV - [2009/07/13 23:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\VMBusHID.sys -- (VMBusHID)

DRV - [2009/07/13 22:02:53 | 000,311,296 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\yk62x86.sys -- (yukonw7)

DRV - [2009/06/23 15:27:14 | 000,487,936 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CHDMI32.sys -- (CnxtHdmiAudService)

DRV - [2009/06/23 00:27:14 | 000,487,936 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CHDRT32.sys -- (CnxtHdAudService)

DRV - [2009/05/22 03:52:38 | 004,450,816 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)

DRV - [2009/04/10 16:09:40 | 000,017,960 | ---- | M] (Chicony Electronics Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\UVCFTR_S.SYS -- (UVCFTR)

DRV - [2008/08/26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)

DRV - [2008/03/04 08:12:06 | 000,048,600 | ---- | M] (O2Micro ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\o2media.sys -- (O2MDRDR)

DRV - [2007/04/09 15:13:00 | 000,008,192 | ---- | M] (TOSHIBA) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\QIOMem.sys -- (QIOMem)

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)

IE - HKU\S-1-5-20\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)

IE - HKU\S-1-5-21-2995013604-1872015273-495233695-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm

IE - HKU\S-1-5-21-2995013604-1872015273-495233695-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

IE - HKU\S-1-5-21-2995013604-1872015273-495233695-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/

IE - HKU\S-1-5-21-2995013604-1872015273-495233695-1001\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)

IE - HKU\S-1-5-21-2995013604-1872015273-495233695-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-2995013604-1872015273-495233695-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?FORM=DCF3DF&PC=DCF3&q={searchTerms}&src=IE-SearchBox

IE - HKU\S-1-5-21-2995013604-1872015273-495233695-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Bing"

FF - prefs.js..browser.search.defaulturl: "http://www.bing.com/search?FORM=DCF3DF&PC=DCF3&q="

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "www.google.co.uk"

FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.872

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.9

FF - prefs.js..extensions.enabledItems: {3d7eb24f-2740-49df-8937-200b1cc08f8a}:1.5.15.1

FF - prefs.js..extensions.enabledItems: [email protected]:4.3

FF - prefs.js..extensions.enabledItems: [email protected]:5.0.1

FF - prefs.js..extensions.enabledItems: {37fa1426-b82d-11db-8314-0800200c9a66}:2.7.9

FF - prefs.js..extensions.enabledItems: [email protected]:0.9.8

FF - prefs.js..extensions.enabledItems: [email protected]:4.0.1

FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.3.0.7280

FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.15

FF - prefs.js..keyword.URL: "http://www.bing.com/search?FORM=DCF3DF&PC=DCF3&q="

FF - prefs.js..network.proxy.http: "84.22.23.6"

FF - prefs.js..network.proxy.http_port: 8080

FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpWinExt,version=5.0: C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2852: C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.46: C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1662: C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.46: C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\Firefox [2010/10/31 18:50:45 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2011/09/13 21:13:53 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/02/18 10:58:08 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/02/03 23:45:57 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[email protected]: C:\Program Files\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_7.0 [2011/11/28 00:11:24 | 000,000,000 | ---D | M]

[2010/10/04 10:47:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\Mozilla\Extensions

[2010/10/04 10:47:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

[2012/02/28 22:47:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\extensions

[2012/02/17 18:39:17 | 000,000,000 | ---D | M] (WebMail Notifier) -- C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\extensions\{37fa1426-b82d-11db-8314-0800200c9a66}

[2011/07/26 18:16:34 | 000,000,000 | ---D | M] (Flashblock) -- C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}

[2011/02/06 20:36:50 | 000,000,000 | ---D | M] (ABV Notifier) -- C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\extensions\[email protected]

[2011/02/06 20:17:14 | 000,000,000 | ---D | M] (Bulgarian Dictionary) -- C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\extensions\[email protected]

[2011/02/06 20:19:35 | 000,000,000 | ---D | M] (United States English Spellchecker) -- C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\extensions\[email protected]

[2011/12/31 18:54:22 | 000,000,000 | ---D | M] ("Xmarks") -- C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\extensions\[email protected]

[2011/04/29 08:09:05 | 000,001,832 | ---- | M] () -- C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\searchplugins\bing.xml

[2011/08/22 21:57:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2012/02/18 10:58:08 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

() (No name found) -- C:\USERS\USER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2ZAME245.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

[2012/02/18 10:58:08 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2006/10/26 19:12:16 | 000,016,192 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL

[2012/01/03 08:22:02 | 000,103,864 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\mozilla firefox\plugins\nppdf32.dll

[2012/02/03 16:32:50 | 000,001,394 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml

[2012/02/03 16:32:50 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2012/02/03 16:32:50 | 000,001,131 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml

[2012/02/03 16:32:50 | 000,002,364 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml

[2012/02/03 16:32:50 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

[2012/02/03 16:32:50 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml

[2012/02/03 16:32:50 | 000,001,096 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}

CHR - plugin: Shockwave Flash (Disabled) = C:\Users\user\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.56\gcswf32.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.56\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\17.0.963.56\pdf.dll

CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll

CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL

CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll

CHR - plugin: RealPlayer G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

CHR - plugin: Bing Bar (Enabled) = C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll

CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll

CHR - plugin: Default Plug-in (Enabled) = default_plugin

O1 HOSTS File: ([2012/03/10 19:16:07 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (@C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\npwinext.dll (Microsoft Corporation)

O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll ()

O3 - HKU\S-1-5-21-2995013604-1872015273-495233695-1001\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll ()

O4 - HKLM..\Run: [cAudioFilterAgent] C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent.exe (Conexant Systems, Inc.)

O4 - HKLM..\Run: [HSON] C:\Program Files\Toshiba\TBS\HSON.exe (TOSHIBA Corporation)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4 - HKLM..\Run: [startCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKLM..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated)

O4 - HKLM..\Run: [TPwrMain] C:\Program Files\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation)

O4 - HKU\.DEFAULT..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)

O4 - HKU\.DEFAULT..\Run: [Welcome Center] C:\Windows\System32\OobeFldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-18..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-18..\Run: [Welcome Center] C:\Windows\System32\OobeFldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-21-2995013604-1872015273-495233695-1001..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe (Hagel Technologies Ltd)

O4 - HKU\S-1-5-21-2995013604-1872015273-495233695-1001..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-2995013604-1872015273-495233695-1001..\Run: [skype] C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)

O4 - HKU\S-1-5-21-2995013604-1872015273-495233695-1001..\Run: [sticky Pad] C:\Program Files\StickyPad\StickyPad.exe (Green Eclipse)

O4 - HKU\S-1-5-21-2995013604-1872015273-495233695-1001..\Run: [Welcome Center] C:\Windows\System32\OobeFldr.dll (Microsoft Corporation)

O4 - HKU\.DEFAULT..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil10b.exe (Adobe Systems, Inc.)

O4 - HKU\S-1-5-18..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil10b.exe (Adobe Systems, Inc.)

O4 - Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: VerboseStatus = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2 [2012/03/10 19:24:59 | 000,000,000 | ---D | M]

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMBalloonTip = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMBalloonTip = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-2995013604-1872015273-495233695-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-2995013604-1872015273-495233695-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O7 - HKU\S-1-5-21-2995013604-1872015273-495233695-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O7 - HKU\S-1-5-21-2995013604-1872015273-495233695-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O7 - HKU\S-1-5-21-2995013604-1872015273-495233695-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O7 - HKU\S-1-5-21-2995013604-1872015273-495233695-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O7 - HKU\S-1-5-21-2995013604-1872015273-495233695-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-2995013604-1872015273-495233695-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMBalloonTip = 1 [2012/03/10 19:24:43 | 000,000,000 | ---D | M]

O7 - HKU\S-1-5-21-2995013604-1872015273-495233695-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: &Download by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)

O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\System32\winrnr.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\System32\NapiNSP.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0E274011-6A2A-45A3-9209-228241F04437}: DhcpNameServer = 192.168.1.254

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B589127D-B22B-48FA-A96B-752382F8290D}: DhcpNameServer = 192.168.1.254

O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)

O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)

O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\System32\inetcomm.dll (Microsoft Corporation)

O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)

O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\System32\credssp.dll (Microsoft Corporation)

O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (kerberos) - C:\Windows\System32\kerberos.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (schannel) - C:\Windows\System32\schannel.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (wdigest) - C:\Windows\System32\wdigest.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (tspkg) - C:\Windows\System32\tspkg.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (livessp) - C:\Windows\System32\livessp.dll (Microsoft Corporation)

O31 - SafeBoot: AlternateShell - cmd.exe

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009/06/10 21:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: lanmangpsvc - File not found

NetSvcs: FastUserSwitchingCompatibility - File not found

NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)

NetSvcs: Nla - File not found

NetSvcs: Ntmssvc - File not found

NetSvcs: NWCWorkstation - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: SRService - File not found

NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software)

NetSvcs: WmdmPmSp - File not found

NetSvcs: oracle_load_balancer_60_-forms6ip9 - File not found

NetSvcs: beatjammusicstreamingvaiomediaplatform-integrated-http - File not found

NetSvcs: mvTermService - File not found

NetSvcs: LogonHours - File not found

NetSvcs: PCAudit - File not found

NetSvcs: helpsvc - File not found

NetSvcs: uploadmgr - File not found

MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Orbit.lnk - C:\Program Files\Orbitdownloader\orbitdm.exe - (Orbitdownloader.com)

MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^RocketDock.lnk - C:\Program Files\RocketDock\RocketDock.exe - ()

MsConfig - StartUpFolder: C:^Users^user^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE - (Microsoft Corporation)

MsConfig - StartUpReg: 00TCrdMain - hkey= - key= - File not found

MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)

MsConfig - StartUpReg: Bing Bar - hkey= - key= - C:\Program Files\MSN Toolbar\Platform\5.0.1423.0\mswinext.exe (Microsoft Corp.)

MsConfig - StartUpReg: Camera Assistant Software - hkey= - key= - C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony)

MsConfig - StartUpReg: DAEMON Tools Lite - hkey= - key= - C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)

MsConfig - StartUpReg: EPSON SX100 Series - hkey= - key= - File not found

MsConfig - StartUpReg: EPSON SX100 Series (Copy 1) - hkey= - key= - File not found

MsConfig - StartUpReg: GrooveMonitor - hkey= - key= - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)

MsConfig - StartUpReg: Microsoft Default Manager - hkey= - key= - C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe (Microsoft Corporation)

MsConfig - StartUpReg: NSU_agent - hkey= - key= - C:\Program Files\Nokia\Nokia Software Updater\nsu3ui_agent.exe ()

MsConfig - StartUpReg: SmoothView - hkey= - key= - File not found

MsConfig - StartUpReg: Windows Mobile Device Center - hkey= - key= - C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)

MsConfig - State: "startup" - 2

SafeBootMin: Base - Driver Group

SafeBootMin: Boot Bus Extender - Driver Group

SafeBootMin: Boot file system - Driver Group

SafeBootMin: File system - Driver Group

SafeBootMin: Filter - Driver Group

SafeBootMin: HelpSvc - Service

SafeBootMin: MsMpSvc - C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)

SafeBootMin: NTDS - File not found

SafeBootMin: PCI Configuration - Driver Group

SafeBootMin: PNP Filter - Driver Group

SafeBootMin: Primary disk - Driver Group

SafeBootMin: sacsvr - Service

SafeBootMin: SCSI Class - Driver Group

SafeBootMin: System Bus Extender - Driver Group

SafeBootMin: vmms - Service

SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: Base - Driver Group

SafeBootNet: Boot Bus Extender - Driver Group

SafeBootNet: Boot file system - Driver Group

SafeBootNet: File system - Driver Group

SafeBootNet: Filter - Driver Group

SafeBootNet: HelpSvc - Service

SafeBootNet: Messenger - Service

SafeBootNet: MsMpSvc - C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)

SafeBootNet: NDIS Wrapper - Driver Group

SafeBootNet: NetBIOSGroup - Driver Group

SafeBootNet: NetDDEGroup - Driver Group

SafeBootNet: Network - Driver Group

SafeBootNet: NetworkProvider - Driver Group

SafeBootNet: NTDS - File not found

SafeBootNet: PCI Configuration - Driver Group

SafeBootNet: PNP Filter - Driver Group

SafeBootNet: PNP_TDI - Driver Group

SafeBootNet: Primary disk - Driver Group

SafeBootNet: rdsessmgr - Service

SafeBootNet: sacsvr - Service

SafeBootNet: SCSI Class - Driver Group

SafeBootNet: Streams Drivers - Driver Group

SafeBootNet: System Bus Extender - Driver Group

SafeBootNet: TDI - Driver Group

SafeBootNet: vmms - Service

SafeBootNet: WudfUsbccidDriver - Driver

SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers

SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive

SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive

SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller

SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc

SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard

SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse

SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net

SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient

SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService

SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans

SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters

SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter

SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System

SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive

SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers

SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy

SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers

SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume

SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices

SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

========== Files/Folders - Created Within 90 Days ==========

[2012/03/10 19:27:58 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe

[2012/03/10 19:24:59 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\2

[2012/03/10 19:22:11 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2012/03/10 19:16:14 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2012/03/10 19:13:36 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\temp

[2012/03/10 18:56:58 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\1

[2012/03/10 18:18:00 | 000,237,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe

[2012/03/10 18:13:00 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client

[2012/03/10 17:55:38 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\Cleening 10.03.12

[2012/03/10 13:19:12 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Defender

[2012/03/09 21:42:47 | 000,388,096 | ---- | C] (Microsoft Corporation) -- C:\csc.sys

[2012/03/09 21:42:47 | 000,187,904 | ---- | C] (Microsoft Corporation) -- C:\netbt.sys

[2012/03/09 21:30:02 | 000,181,064 | ---- | C] (Sysinternals) -- C:\Windows\PSEXESVC.EXE

[2012/03/09 21:20:20 | 000,381,816 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\PsExec.exe

[2012/03/09 21:04:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT

[2012/03/09 21:04:24 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT

[2012/03/09 20:59:39 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\Cleening 09.03.12

[2012/03/09 00:09:47 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\Cleening 08.03.12

[2012/03/08 23:17:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012/03/08 23:17:45 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012/03/07 07:23:45 | 000,000,000 | ---D | C] -- C:\FRST

[2012/03/04 12:52:17 | 000,338,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\afd.svs

[2012/03/04 11:59:31 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2012/03/04 11:59:31 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2012/03/04 11:59:31 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2012/02/29 18:38:40 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\AVG2012

[2012/02/28 23:02:45 | 000,000,000 | ---D | C] -- C:\_OTL

[2012/02/28 19:06:49 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\MigWiz

[2012/02/26 21:54:14 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT

[2012/02/26 21:49:50 | 000,000,000 | ---D | C] -- C:\Qoobox

[2012/02/25 21:02:16 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\DDS

[2012/02/21 00:14:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LopeSoft

[2012/02/21 00:14:09 | 000,000,000 | ---D | C] -- C:\Program Files\LopeSoft

[2012/02/21 00:03:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Magazine Utilities

[2012/02/21 00:03:24 | 000,000,000 | ---D | C] -- C:\Program Files\PC Magazine Utilities

[2012/02/20 23:10:19 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft ShellExView

[2012/02/20 23:10:19 | 000,000,000 | ---D | C] -- C:\Program Files\NirSoft

[2012/02/20 22:58:24 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\Context Menu Edit

[2012/02/18 23:32:40 | 000,000,000 | ---D | C] -- C:\Program Files\WinPcap

[2012/02/15 17:41:43 | 000,000,000 | ---D | C] -- C:\e64a0c4b528f8264dfe36f93064430

[2012/02/15 17:34:58 | 002,340,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys

[2012/02/10 19:49:40 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\Anonimous Surfing&Proxy

[2012/02/10 00:10:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fortop Digital

[2012/02/10 00:10:27 | 000,000,000 | ---D | C] -- C:\Program Files\Fortop Digital

[2012/02/10 00:02:17 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\W7 Shared Folders

[2012/02/04 12:56:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EASEUS Partition Master 9.1.0 Home Edition

[2012/02/04 12:56:41 | 000,000,000 | ---D | C] -- C:\Program Files\EASEUS

[2012/01/30 22:48:17 | 000,000,000 | ---D | C] -- C:\Users\user\Desktop\Stay With Me

[2012/01/10 18:10:26 | 000,000,000 | ---D | C] -- C:\85b25716f0b585b72a7ceadfc15c

[2012/01/10 18:09:19 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\packager.dll

[2012/01/10 18:09:17 | 000,314,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\webio.dll

[2012/01/10 18:09:16 | 000,015,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sspisrv.dll

[2012/01/10 18:09:05 | 001,328,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll

[2012/01/10 18:09:04 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qdvd.dll

[2012/01/06 19:32:58 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Calendar

[2012/01/06 17:42:12 | 000,020,480 | ---- | C] (Green Eclipse) -- C:\Windows\System32\EclipseUpdateSpawn.exe

[2011/12/13 18:07:35 | 000,000,000 | ---D | C] -- C:\f4a2d3ba6d70a6c715882be63d

[2011/12/13 18:07:07 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb

[2011/12/13 18:07:06 | 001,798,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll

[2011/12/13 18:07:05 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll

[2011/12/13 18:07:04 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll

[2011/12/13 18:07:04 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll

[2011/12/13 18:07:00 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl

[2011/12/13 18:05:41 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll

[2011/12/13 18:05:26 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll

[2011/12/13 18:05:24 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\csrsrv.dll

[2011/12/13 18:04:57 | 003,901,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe

[2011/12/13 18:04:56 | 003,957,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe

[1 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\*.tmp files -> C:\ProgramData\Microsoft\Windows\Start Menu\Programs\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2012/03/10 19:27:59 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe

[2012/03/10 19:17:00 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012/03/10 19:16:53 | 000,000,878 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012/03/10 19:16:07 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts

[2012/03/10 19:15:18 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012/03/10 19:15:08 | 1508,712,448 | -HS- | M] () -- C:\hiberfil.sys

[2012/03/10 18:14:34 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif

[2012/03/10 18:13:15 | 000,621,012 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012/03/10 18:13:15 | 000,108,232 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012/03/10 18:03:13 | 000,014,224 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012/03/10 18:03:13 | 000,014,224 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012/03/09 22:50:14 | 000,000,050 | ---- | M] () -- C:\Users\user\Desktop\Evtino.co.uk - Доставка на стоки до България от всички английски online магазини.URL

[2012/03/09 21:41:00 | 000,187,904 | ---- | M] (Microsoft Corporation) -- C:\netbt.sys

[2012/03/09 21:40:45 | 000,388,096 | ---- | M] (Microsoft Corporation) -- C:\csc.sys

[2012/03/09 21:30:02 | 000,181,064 | ---- | M] (Sysinternals) -- C:\Windows\PSEXESVC.EXE

[2012/03/09 21:04:38 | 000,001,074 | ---- | M] () -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk

[2012/03/04 10:43:44 | 000,000,000 | -HS- | M] () -- C:\Windows\System32\dds_trash_log.cmd

[2012/02/28 18:47:19 | 000,000,017 | ---- | M] () -- C:\Users\user\AppData\Local\resmon.resmoncfg

[2012/02/26 21:33:45 | 000,000,082 | ---- | M] () -- C:\Users\user\Desktop\Заразен лаптоп - kaldata.com - Форуми.URL

[2012/02/21 19:47:27 | 000,000,964 | -H-- | M] () -- C:\Windows\EPMBatch.ept

[2012/02/15 18:32:07 | 000,414,888 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012/02/05 19:49:50 | 000,000,068 | ---- | M] () -- C:\Users\user\Desktop\Facebook.URL

[2012/02/04 13:05:21 | 000,001,388 | ---- | M] () -- C:\Users\user\Application Data\Microsoft\Internet Explorer\Quick Launch\EASEUS Partition Master 9.1.0 Home Edition.lnk

[2012/02/03 16:32:56 | 000,002,032 | ---- | M] () -- C:\Users\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk

[2012/01/31 04:59:04 | 000,237,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe

[2012/01/14 03:48:30 | 002,340,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys

[2012/01/06 17:42:12 | 000,020,480 | ---- | M] (Green Eclipse) -- C:\Windows\System32\EclipseUpdateSpawn.exe

[2012/01/04 23:15:19 | 000,000,058 | ---- | M] () -- C:\Users\user\Desktop\Toyota Owners Club UK.URL

========== Files Created - No Company Name ==========

[2012/03/10 18:14:34 | 000,001,945 | ---- | C] () -- C:\Windows\epplauncher.mif

[2012/03/10 18:13:08 | 000,001,897 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk

[2012/03/09 22:50:14 | 000,000,050 | ---- | C] () -- C:\Users\user\Desktop\Evtino.co.uk - Доставка на стоки до България от всички английски online магазини.URL

[2012/03/09 21:04:38 | 000,001,074 | ---- | C] () -- C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk

[2012/03/04 11:59:31 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2012/03/04 11:59:31 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2012/03/04 11:59:31 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2012/03/04 11:59:31 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2012/03/04 11:59:31 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2012/02/28 23:05:55 | 000,000,000 | -HS- | C] () -- C:\Windows\System32\dds_trash_log.cmd

[2012/02/28 18:47:19 | 000,000,017 | ---- | C] () -- C:\Users\user\AppData\Local\resmon.resmoncfg

[2012/02/26 21:33:45 | 000,000,082 | ---- | C] () -- C:\Users\user\Desktop\Заразен лаптоп - kaldata.com - Форуми.URL

[2012/02/21 19:45:29 | 000,000,964 | -H-- | C] () -- C:\Windows\EPMBatch.ept

[2012/02/05 19:49:50 | 000,000,068 | ---- | C] () -- C:\Users\user\Desktop\Facebook.URL

[2012/02/04 13:05:21 | 000,001,388 | ---- | C] () -- C:\Users\user\Application Data\Microsoft\Internet Explorer\Quick Launch\EASEUS Partition Master 9.1.0 Home Edition.lnk

[2012/02/04 12:56:47 | 002,469,760 | ---- | C] () -- C:\Windows\System32\BootMan.exe

[2012/02/04 12:56:47 | 000,086,408 | ---- | C] () -- C:\Windows\System32\setupempdrv03.exe

[2012/02/04 12:56:47 | 000,019,840 | ---- | C] () -- C:\Windows\System32\EuEpmGdi.dll

[2012/02/04 12:56:47 | 000,014,216 | ---- | C] () -- C:\Windows\System32\epmntdrv.sys

[2012/02/04 12:56:47 | 000,008,456 | ---- | C] () -- C:\Windows\System32\EuGdiDrv.sys

[2012/02/03 23:45:57 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk

[2012/01/04 23:15:19 | 000,000,058 | ---- | C] () -- C:\Users\user\Desktop\Toyota Owners Club UK.URL

[2011/11/26 00:18:09 | 000,007,680 | ---- | C] () -- C:\Users\user\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011/09/10 20:15:37 | 000,102,912 | R--- | C] () -- C:\Windows\System32\JPEGCODE.DLL

[2011/02/11 21:23:34 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll

[2010/10/06 17:49:09 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat

[2010/10/04 11:03:38 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin

[2010/10/04 11:00:53 | 000,189,051 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat

[2010/10/04 11:00:53 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll

[2010/10/04 10:47:19 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat

[2010/10/04 10:43:23 | 000,164,352 | ---- | C] () -- C:\Windows\System32\unrar.dll

[2010/10/04 10:43:23 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini

[2010/10/04 10:43:22 | 000,755,027 | ---- | C] () -- C:\Windows\System32\xvidcore.dll

[2010/10/04 10:43:22 | 000,159,839 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll

[2010/10/04 10:43:21 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll

[2010/10/04 10:43:21 | 000,007,680 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll

========== LOP Check ==========

[2012/02/29 18:38:40 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\AVG2012

[2011/08/24 21:02:47 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\calibre

[2011/02/07 21:54:28 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\DAEMON Tools Lite

[2010/10/04 10:43:34 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\GrabPro

[2010/10/16 21:58:19 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\ImgBurn

[2011/02/09 22:29:48 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\IObit

[2011/11/28 00:07:57 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Nokia

[2011/11/28 00:07:57 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Nokia Suite

[2010/10/14 09:51:31 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Notepad++

[2011/10/27 19:06:26 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Orbit

[2011/11/26 20:50:25 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\PC Suite

[2011/02/19 13:52:20 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\ScanMaster-ELM

[2011/10/26 21:28:31 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\TK8 Software

[2010/10/23 15:23:22 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\toshiba

[2011/02/09 22:09:57 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\TuneUp Software

[2011/02/09 20:26:55 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\USBSafelyRemove

[2012/02/20 00:00:59 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\uTorrent

[2010/10/04 11:00:23 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\WinBatch

[2012/03/07 23:18:19 | 000,032,606 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >

[2010/10/04 14:58:20 | 000,000,003 | ---- | M] () -- C:\7Loader.TAG

[2009/06/10 21:42:20 | 000,000,024 | ---- | M] () -- C:\autoexec.bat

[2012/03/10 19:22:09 | 000,021,109 | ---- | M] () -- C:\ComboFix.txt

[2009/06/10 21:42:20 | 000,000,010 | ---- | M] () -- C:\config.sys

[2012/03/09 21:40:45 | 000,388,096 | ---- | M] (Microsoft Corporation) -- C:\csc.sys

[2012/03/10 19:15:08 | 1508,712,448 | -HS- | M] () -- C:\hiberfil.sys

[2011/02/19 13:51:40 | 000,000,000 | RHS- | M] () -- C:\IO.SYS

[2011/02/19 13:51:40 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS

[2012/03/09 21:41:00 | 000,187,904 | ---- | M] (Microsoft Corporation) -- C:\netbt.sys

[2012/03/10 19:15:10 | 2011,619,328 | -HS- | M] () -- C:\pagefile.sys

[2010/04/27 11:04:06 | 000,381,816 | ---- | M] (Sysinternals - www.sysinternals.com) -- C:\PsExec.exe

[2012/02/26 21:41:05 | 000,088,154 | ---- | M] () -- C:\TDSSKiller.2.7.14.0_26.02.2012_21.35.07_log.txt

[2012/02/26 23:17:12 | 000,088,508 | ---- | M] () -- C:\TDSSKiller.2.7.14.0_26.02.2012_23.14.11_log.txt

[2012/03/08 21:47:08 | 000,088,430 | ---- | M] () -- C:\TDSSKiller.2.7.19.0_08.03.2012_21.43.41_log.txt

< %USERPROFILE%\*.* >

[2012/03/10 19:31:30 | 004,980,736 | -HS- | M] () -- C:\Users\user\ntuser.dat

[2012/03/10 19:31:30 | 000,262,144 | -HS- | M] () -- C:\Users\user\ntuser.dat.LOG1

[2010/10/04 10:43:01 | 000,000,000 | -HS- | M] () -- C:\Users\user\ntuser.dat.LOG2

[2011/11/02 22:42:02 | 000,065,536 | -HS- | M] () -- C:\Users\user\ntuser.dat{10bf3db7-057e-11e1-abe7-001e68684795}.TM.blf

[2011/11/02 22:42:02 | 000,524,288 | -HS- | M] () -- C:\Users\user\ntuser.dat{10bf3db7-057e-11e1-abe7-001e68684795}.TMContainer00000000000000000001.regtrans-ms

[2011/11/02 22:42:02 | 000,524,288 | -HS- | M] () -- C:\Users\user\ntuser.dat{10bf3db7-057e-11e1-abe7-001e68684795}.TMContainer00000000000000000002.regtrans-ms

[2010/10/04 11:02:38 | 000,065,536 | -HS- | M] () -- C:\Users\user\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf

[2010/10/04 11:02:38 | 000,524,288 | -HS- | M] () -- C:\Users\user\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms

[2010/10/04 11:02:38 | 000,524,288 | -HS- | M] () -- C:\Users\user\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms

[2010/10/24 00:34:14 | 000,065,536 | -HS- | M] () -- C:\Users\user\ntuser.dat{a5a96c88-df03-11df-aa4d-001e68684795}.TM.blf

[2010/10/24 00:34:14 | 000,524,288 | -HS- | M] () -- C:\Users\user\ntuser.dat{a5a96c88-df03-11df-aa4d-001e68684795}.TMContainer00000000000000000001.regtrans-ms

[2010/10/24 00:34:14 | 000,524,288 | -HS- | M] () -- C:\Users\user\ntuser.dat{a5a96c88-df03-11df-aa4d-001e68684795}.TMContainer00000000000000000002.regtrans-ms

[2012/03/04 15:40:41 | 000,065,536 | -HS- | M] () -- C:\Users\user\ntuser.dat{d96c7400-6609-11e1-9c23-001644d33735}.TM.blf

[2012/03/04 15:40:41 | 000,524,288 | -HS- | M] () -- C:\Users\user\ntuser.dat{d96c7400-6609-11e1-9c23-001644d33735}.TMContainer00000000000000000001.regtrans-ms

[2012/03/04 15:40:41 | 000,524,288 | -HS- | M] () -- C:\Users\user\ntuser.dat{d96c7400-6609-11e1-9c23-001644d33735}.TMContainer00000000000000000002.regtrans-ms

[2010/10/04 10:43:01 | 000,000,020 | -HS- | M] () -- C:\Users\user\ntuser.ini

[2011/08/04 22:10:08 | 000,000,436 | RHS- | M] () -- C:\Users\user\ntuser.pol

< %USERPROFILE%\AppData\Local\*.* >

[2011/11/26 00:18:18 | 000,007,680 | ---- | M] () -- C:\Users\user\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011/11/02 20:20:12 | 000,109,768 | ---- | M] () -- C:\Users\user\AppData\Local\GDIPFONTCACHEV1.DAT

[2012/03/10 18:02:55 | 003,935,879 | -H-- | M] () -- C:\Users\user\AppData\Local\IconCache.db

[2012/02/28 18:47:19 | 000,000,017 | ---- | M] () -- C:\Users\user\AppData\Local\resmon.resmoncfg

< %USERPROFILE%\AppData\Roaming\*.* >

< %ProgramData%\*.* >

< %CommonProgramFiles%\*.* >

< %PROGRAMFILES%\*.* >

[2009/07/14 04:41:57 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %systemroot%\system32\config\systemprofile\AppData\Local\*.* >

< %windir%\ServiceProfiles\LocalService\AppData\Local\Temp\*.* >

< %windir%\ServiceProfiles\NetworkService\AppData\Local\Temp\*.* >

[2010/10/30 16:16:09 | 000,000,000 | ---- | M] () -- C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\FXSSVCDebugLogFile.txt

[2010/10/30 16:16:09 | 000,000,000 | ---- | M] () -- C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\FXSTIFFDebugLogFile.txt

[2012/03/10 19:25:42 | 000,026,716 | ---- | M] () -- C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\MpCmdRun.log

[2012/03/10 18:18:27 | 000,011,796 | ---- | M] () -- C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\MpSigStub.log

[2010/10/30 16:16:12 | 000,000,000 | ---- | M] () -- C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\T30DebugLogFile.txt

< %windir%\temp\*.* >

[2012/03/10 19:25:42 | 000,000,806 | ---- | M] () -- C:\Windows\temp\MpCmdRun.log

[1 C:\Windows\temp\*.tmp files -> C:\Windows\temp\*.tmp -> ]

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /90 >

[2012/03/09 21:41:00 | 000,187,904 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\drivers\netbt.sys

< %systemroot%\system32\drivers\*.sys /lockedfiles >

[2011/02/07 21:09:32 | 000,691,696 | ---- | M] () Unable to obtain MD5 -- C:\Windows\system32\drivers\sptd.sys

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >

[2009/07/14 01:15:18 | 000,033,280 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Windows\system32\Spool\prtprocs\w32x86\EP0NPP01.DLL

[2009/07/14 01:15:35 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\Spool\prtprocs\w32x86\jnwppr.dll

[2006/10/26 18:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\Spool\prtprocs\w32x86\msonpppr.dll

[2009/07/14 01:16:19 | 000,029,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\Spool\prtprocs\w32x86\winprint.dll

< %systemroot%\*. /rp /s >

< %systemroot%\assembly\temp\*.* /S /MD5 >

< %systemroot%\assembly\tmp\*.* /S /MD5 >

< %systemroot%\assembly\GAC_32\*.* /S /MD5 >

[2009/07/14 01:19:59 | 000,004,608 | ---- | M] () MD5=2CBEAFED3233C20DF11B88DF909CD74F -- C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\AuditPolicyGPManagedStubs.Interop.dll

[2009/07/14 01:25:34 | 000,238,080 | ---- | M] () MD5=CA14B4670046CA499087F36070E187D6 -- C:\Windows\assembly\GAC_32\BDATunePIA\6.1.0.0__31bf3856ad364e35\BDATunePIA.dll

[2009/06/10 21:22:50 | 000,069,120 | ---- | M] () MD5=A7C018EA06C5E8F73BB2BBEF072BFBAC -- C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll

[2009/06/10 21:22:57 | 000,072,192 | ---- | M] () MD5=BBE45F61F5A170FC518F283E872D6F20 -- C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll

[2009/07/14 01:20:04 | 000,134,656 | ---- | M] () MD5=BFE7E37D0E47FAD0FCB0C959AC566DE5 -- C:\Windows\assembly\GAC_32\mcstoredb\6.1.0.0__31bf3856ad364e35\mcstoredb.dll

[2009/07/14 01:22:17 | 000,185,856 | ---- | M] () MD5=770DCEF52E70ED5C0D86B0F937CF2D4E -- C:\Windows\assembly\GAC_32\mcupdate\6.1.0.0__31bf3856ad364e35\mcupdate.exe

[2009/07/14 01:20:56 | 000,121,856 | ---- | M] () MD5=15483F90F8D22ECE512F3224F69FD5C8 -- C:\Windows\assembly\GAC_32\Mcx2Dvcs\6.1.0.0__31bf3856ad364e35\Mcx2Dvcs.dll

[2009/07/14 02:12:54 | 000,090,112 | ---- | M] () MD5=7643FE2D5D8DC339868BD4D952E0F385 -- C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\Microsoft.GroupPolicy.AdmTmplEditor.Resources.dll

[2009/07/14 01:21:26 | 000,189,952 | ---- | M] () MD5=1ABB50BC0EC02F4D16C6300CDAD04EDB -- C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\Microsoft.GroupPolicy.AdmTmplEditor.dll

[2009/07/14 01:24:07 | 000,146,432 | ---- | M] () MD5=82FBA2151ACAD6329BF79E845B9C1038 -- C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\Microsoft.GroupPolicy.Interop.dll

[2009/07/14 01:24:14 | 000,507,904 | ---- | M] () MD5=269691AFEE6C44C52CDCA23C24BDBB0C -- C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\Microsoft.Ink.dll

[2009/07/14 01:24:28 | 000,077,824 | ---- | M] () MD5=BB2BB7BFE455562249E922A7AA4493A5 -- C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\Microsoft.Interop.Security.AzRoles.dll

[2011/08/17 04:30:26 | 000,280,576 | ---- | M] () MD5=7FF4C376BF58EBF0E1054B2902E37745 -- C:\Windows\assembly\GAC_32\Microsoft.MediaCenter.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.MediaCenter.Interop.dll

[2009/07/14 01:25:23 | 000,129,536 | ---- | M] () MD5=097A68781F1682677E875CAB06969C2D -- C:\Windows\assembly\GAC_32\Microsoft.MediaCenter.iTV.Media\6.1.0.0__31bf3856ad364e35\Microsoft.MediaCenter.iTV.Media.dll

[2009/07/14 01:22:38 | 000,053,248 | ---- | M] () MD5=965CF066D3FDBA1AF5B53E58F1500529 -- C:\Windows\assembly\GAC_32\Microsoft.MediaCenter.Mheg\6.1.0.0__31bf3856ad364e35\Microsoft.MediaCenter.Mheg.dll

[2009/08/18 05:53:15 | 000,139,264 | ---- | M] () MD5=F46DB1085E90346C2D191F5D233B6E6B -- C:\Windows\assembly\GAC_32\Microsoft.MediaCenter.Playback\6.1.0.0__31bf3856ad364e35\Microsoft.MediaCenter.Playback.dll

[2009/07/14 01:23:17 | 000,307,712 | ---- | M] () MD5=2C66DB2944AE9A10CA1E51B7D083742B -- C:\Windows\assembly\GAC_32\Microsoft.MediaCenter.TV.Tuners.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.MediaCenter.TV.Tuners.Interop.dll

[2010/10/04 15:11:11 | 000,118,112 | ---- | M] () MD5=9249408608D1B5BA410481D763D248B5 -- C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Infopath.Client.Internal.Host.Interop.dll

[2009/07/14 01:23:55 | 000,008,192 | ---- | M] () MD5=79D7E7A3CB56C91FE9030C5EFE2DC13C -- C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll

[2009/06/10 21:14:03 | 000,163,840 | ---- | M] () MD5=4EF239C0475CE7B45993255D5E474AF7 -- C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll

[2010/10/04 15:11:23 | 000,367,400 | ---- | M] () MD5=6CAD87F2BE4A4BC31D3FD5C923741418 -- C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.InteropAdapter.dll

[2009/07/14 01:26:31 | 000,008,192 | ---- | M] () MD5=FA44A672F1C12791984D9ECAB7DC3177 -- C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll

[2009/07/14 01:23:22 | 000,019,968 | ---- | M] () MD5=3A353975A7EC8BB4918E8E93BB7F9143 -- C:\Windows\assembly\GAC_32\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\6.1.0.0__31bf3856ad364e35\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.dll

[2009/06/10 21:14:52 | 000,087,888 | ---- | M] () MD5=2E5F1CF69F92392F8829FC9C9263AE9B -- C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe

[2009/06/10 21:14:53 | 000,001,581 | ---- | M] () MD5=1EA3E30080C0E256C2EF0C621E91C345 -- C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\msbuild.exe.config

[2009/06/10 21:22:47 | 000,066,728 | ---- | M] () MD5=C01B81BB10AD14DBC5C4ECD350638096 -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\big5.nlp

[2009/06/10 21:22:47 | 000,082,172 | ---- | M] () MD5=EE1F60F8774D74BED8B13498F3FE737A -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bopomofo.nlp

[2009/06/10 21:22:58 | 000,116,756 | ---- | M] () MD5=F6DFDA5A31162D848634504565F6D321 -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\ksc.nlp

[2011/07/08 22:35:48 | 004,550,656 | ---- | M] () MD5=3E6F496B59A67515C1B854C3482BD75C -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll

[2009/06/10 21:23:13 | 000,059,342 | ---- | M] () MD5=DA5748A89E22A3932387E65694B25BBB -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normidna.nlp

[2009/06/10 21:23:13 | 000,045,794 | ---- | M] () MD5=3831A5E217D6FA828CCE1011DA26E677 -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfc.nlp

[2009/06/10 21:23:13 | 000,039,284 | ---- | M] () MD5=DBDE664E0BA4BACD0A6A04AE2232B205 -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfd.nlp

[2009/06/10 21:23:13 | 000,066,384 | ---- | M] () MD5=C9B88B759FE81D59CE8EBF5A0A8EB75A -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfkc.nlp

[2009/06/10 21:23:13 | 000,060,294 | ---- | M] () MD5=3CAB6AB66759FCDF73B61EE262C9ACF4 -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfkd.nlp

[2009/06/10 21:23:14 | 000,083,748 | ---- | M] () MD5=54144F43EDF5AA8F504A30E7C1D1A7B5 -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\prc.nlp

[2009/06/10 21:23:14 | 000,083,748 | ---- | M] () MD5=901863C68E6523336CAC602FE9320ABC -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\prcp.nlp

[2009/06/10 21:23:17 | 000,262,148 | ---- | M] () MD5=FB59D247F7143C3B9683A547E808A88B -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp

[2009/06/10 21:23:17 | 000,020,320 | ---- | M] () MD5=FF13BA175F0013D2311827E0D438C60B -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp

[2009/06/10 21:23:23 | 000,028,288 | ---- | M] () MD5=09E420F90A329BDA68477FA4AF43CB28 -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\xjis.nlp

[2009/07/14 01:22:14 | 000,046,080 | ---- | M] () MD5=276A2AEC6AB593A5F01544A25B34BE9C -- C:\Windows\assembly\GAC_32\napcrypt\6.1.0.0__31bf3856ad364e35\NAPCRYPT.DLL

[2009/07/14 01:22:23 | 000,107,008 | ---- | M] () MD5=7102A6961F0A526A790704946902B23A -- C:\Windows\assembly\GAC_32\naphlpr\6.1.0.0__31bf3856ad364e35\NAPHLPR.DLL

[2009/07/13 22:04:07 | 000,000,442 | ---- | M] () MD5=13E4BF7A255D57592EEDBD04A500C09B -- C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\Policy.1.0.Microsoft.Ink.config

[2009/07/14 01:25:25 | 000,005,632 | ---- | M] () MD5=608232474C33C71F863B0866E5165C1C -- C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\Policy.1.0.Microsoft.Ink.dll

[2009/06/10 21:32:22 | 000,000,494 | ---- | M] () MD5=453626B1A59F62F9A141AC62F4E44E75 -- C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\Microsoft.Interop.Security.AzRoles.config

[2009/07/14 01:26:15 | 000,005,632 | ---- | M] () MD5=2641880E8C12BEE37DDC2813908A2A0F -- C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\Policy.1.0.Microsoft.Interop.Security.AzRoles.dll

[2009/06/10 21:32:22 | 000,000,494 | ---- | M] () MD5=453626B1A59F62F9A141AC62F4E44E75 -- C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\Policy.1.2.Microsoft.Interop.Security.AzRoles.config

[2009/07/14 01:23:30 | 000,005,632 | ---- | M] () MD5=D6C077082EAA747911C212A9EB64A813 -- C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\Policy.1.2.Microsoft.Interop.Security.AzRoles.dll

[2009/07/13 22:04:07 | 000,000,442 | ---- | M] () MD5=13E4BF7A255D57592EEDBD04A500C09B -- C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\Policy.1.7.Microsoft.Ink.config

[2009/07/14 01:22:54 | 000,005,632 | ---- | M] () MD5=331021DA8B00A9ADCDD54B5782943204 -- C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\Policy.1.7.Microsoft.Ink.dll

[2009/07/13 22:04:08 | 000,000,442 | ---- | M] () MD5=13E4BF7A255D57592EEDBD04A500C09B -- C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\Policy.6.0.Microsoft.Ink.config

[2009/07/14 01:23:04 | 000,005,632 | ---- | M] () MD5=B3DB67C90DBBB75BFE110A86E951C2EC -- C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\Policy.6.0.Microsoft.Ink.dll

[2010/03/02 23:24:26 | 004,214,784 | ---- | M] () MD5=55B0662BF458D97405940707D3D55551 -- C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.dll

[2009/06/10 21:14:51 | 000,000,161 | ---- | M] () MD5=C0856EC51C8C75B8FDF02C1BBCFE7B93 -- C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe.config

[2009/06/10 21:14:52 | 001,736,536 | ---- | M] () MD5=56099A6F865EA7771CBB88674545DB44 -- C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\wpfgfx_v0300.dll

[2009/06/10 21:23:17 | 000,486,400 | ---- | M] () MD5=12777E85B175899C02C645D839C83506 -- C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll

[2009/06/10 21:23:17 | 002,933,248 | ---- | M] () MD5=CE24654E99CB7FB24903F8A1826FF343 -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll

[2009/06/10 21:23:18 | 000,258,048 | ---- | M] () MD5=C18C30BFFDF790463B4F5B2311652208 -- C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll

[2009/07/13 20:46:36 | 000,113,664 | ---- | M] () MD5=D16E07E806ABA236B604B92693CE35E0 -- C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll

[2009/06/10 21:14:45 | 000,368,640 | ---- | M] () MD5=B1301F1FF435D9995903A853C0477BE4 -- C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\System.Printing.dll

[2009/06/10 21:23:19 | 000,261,632 | ---- | M] () MD5=5F3F1BF5F5B43293953FC915845910C4 -- C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll

[2011/12/26 19:13:18 | 005,251,072 | ---- | M] () MD5=ED7A7B490221396D20AC78BF3418F6AC -- C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll

< %systemroot%\assembly\GAC_64\*.* /S /MD5 >

< %SystemRoot%\assembly\GAC_MSIL\*.* /S /MD5 >

[2009/06/10 21:22:40 | 000,010,752 | ---- | M] () MD5=7E8C840853FB6EBD5CC16D3C10C7C127 -- C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll

[2010/10/04 11:02:17 | 000,024,576 | ---- | M] () MD5=93D5B9634C4744FB115785081ECF9738 -- C:\Windows\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.DLL

[2010/10/04 11:02:18 | 000,020,480 | ---- | M] () MD5=05E8A9B52EC52DD611B748D80F3B212B -- C:\Windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3309.28608__90ba9c70f846762e\AEM.Actions.CCAA.Shared.DLL

[2010/10/04 11:02:18 | 000,016,384 | ---- | M] () MD5=B8D8FB4D41FB3DF6F3A24495F6B5E0E9 -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3309.28647__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.DLL

[2010/10/04 11:02:18 | 000,016,384 | ---- | M] () MD5=34138AC5853DF0E420904C4B0EB58898 -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.3309.28627__90ba9c70f846762e\AEM.Plugin.EEU.Shared.DLL

[2010/10/04 11:02:18 | 000,016,384 | ---- | M] () MD5=CEAA5823BD0ECCB77675DE53CFC59F23 -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3309.28647__90ba9c70f846762e\AEM.Plugin.GD.Shared.DLL

[2010/10/04 11:02:18 | 000,020,480 | ---- | M] () MD5=DAC86F8AA223FA55ADBC94BD2033DF7F -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3309.28617__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.DLL

[2010/10/04 11:02:18 | 000,016,384 | ---- | M] () MD5=A2C0E7F8793569C4CC8CA0D5301F283E -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.REG.Shared\2.0.3309.28645__90ba9c70f846762e\AEM.Plugin.REG.Shared.DLL

[2010/10/04 11:02:18 | 000,016,384 | ---- | M] () MD5=068664A841DDFCF88C9B2E9469113A2F -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.EEU.Shared\2.0.3309.28645__90ba9c70f846762e\AEM.Plugin.Source.EEU.Shared.DLL

[2010/10/04 11:02:18 | 000,016,384 | ---- | M] () MD5=ACB5B330DCDCAE5E13B7D4008BD3DB9F -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.GD.Shared\2.0.3309.28646__90ba9c70f846762e\AEM.Plugin.Source.GD.Shared.DLL

[2010/10/04 11:02:17 | 000,045,056 | ---- | M] () MD5=F7A2820ED2D49F94C92D610FC3D6B811 -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3428.38818__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.DLL

[2010/10/04 11:02:18 | 000,016,384 | ---- | M] () MD5=1EB5C58C9B446A13A8319EF513E8B5E8 -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3309.28629__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.DLL

[2010/10/04 11:02:17 | 000,016,384 | ---- | M] () MD5=8EB085B26E602CB4A1203F4F1F8AC6F4 -- C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3309.28617__90ba9c70f846762e\AEM.Server.Shared.DLL

[2010/10/04 11:02:16 | 000,045,056 | ---- | M] () MD5=3530F2F5A98195017903B17E85B197C5 -- C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.3428.38714__90ba9c70f846762e\AEM.Server.DLL

[2010/10/04 11:02:17 | 000,020,480 | ---- | M] () MD5=40EA27E8B69DD9BD8BA4C2382F1DF484 -- C:\Windows\assembly\GAC_MSIL\AEM.UI.Shared\2.0.3309.28642__90ba9c70f846762e\AEM.UI.Shared.DLL

[2010/10/04 11:02:16 | 000,061,440 | ---- | M] () MD5=3489FC709271AE011F288CD7005CF771 -- C:\Windows\assembly\GAC_MSIL\AEM.UI\2.0.3428.38804__90ba9c70f846762e\AEM.UI.DLL

[2010/10/04 11:02:17 | 000,020,480 | ---- | M] () MD5=0EB0FF2B6755532976080CAB065F202C -- C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.3309.28626__90ba9c70f846762e\APM.Foundation.DLL

[2010/10/04 11:02:16 | 000,061,440 | ---- | M] () MD5=17AC1A1E353596409A265CE09AAA03BD -- C:\Windows\assembly\GAC_MSIL\APM.Server\2.0.3428.38715__90ba9c70f846762e\APM.Server.DLL

[2009/06/10 21:22:47 | 000,507,904 | ---- | M] () MD5=11B30A8447A724C6E9FBF6261AC0DA6E -- C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll

[2010/10/04 11:02:16 | 000,032,768 | ---- | M] () MD5=90BFF4C71BA375A52C8DE406802BDFA5 -- C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.DLL

[2010/10/04 11:02:16 | 000,081,920 | ---- | M] () MD5=8D5A0C8596D051027F4EC13EAF0247DE -- C:\Windows\assembly\GAC_MSIL\ATIDEMOS\2.0.3428.38716__90ba9c70f846762e\ATIDEMOS.DLL

[2010/10/04 11:02:18 | 000,007,168 | ---- | M] () MD5=EE850C95ED088E8835F2425EE551296F -- C:\Windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.DLL

[2010/10/04 11:02:18 | 000,045,056 | ---- | M] () MD5=E9F2A3C84D59CE514A681835E1B8C94F -- C:\Windows\assembly\GAC_MSIL\AxInterop.SHDocVw\1.1.0.0__90ba9c70f846762e\AxInterop.SHDocVw.DLL

[2010/10/04 11:02:17 | 000,014,848 | ---- | M] () MD5=CD632A9274E7E85B9F37F84C91595C27 -- C:\Windows\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.DLL

[2010/10/04 11:02:16 | 000,028,672 | ---- | M] () MD5=BC0A5B0140A6ED71AB48F555C542FE4C -- C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.3428.38804__90ba9c70f846762e\CCC.Implementation.DLL

[2010/10/04 11:02:18 | 000,049,152 | ---- | M] () MD5=4C08FB7ACB28689B586D986D3F5826CF -- C:\Windows\assembly\GAC_MSIL\CCC\2.0.0.0__90ba9c70f846762e\CCC.EXE

[2010/10/04 11:02:16 | 000,262,144 | ---- | M] () MD5=8F4C7A54B8BCD274F3C647BD9B42EEC4 -- C:\Windows\assembly\GAC_MSIL\CLI.AIB.TutorialInfoCentre.Tutorial.Dashboard\1.2.2600.29179__90ba9c70f846762e\CLI.AIB.TutorialInfoCentre.Tutorial.Dashboard.DLL

[2010/10/04 11:02:18 | 000,090,112 | ---- | M] () MD5=986C9638FF06B1FA097D9E1A15394FAA -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.AForce.Graphics.Dashboard\2.0.3428.38818__90ba9c70f846762e\CLI.Aspect.AForce.Graphics.Dashboard.DLL

[2010/10/04 11:02:18 | 000,012,288 | ---- | M] () MD5=75C14AF30FF62145D8C3C6BC90AB99E5 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.AForce.Graphics.Runtime\2.0.3428.38817__90ba9c70f846762e\CLI.Aspect.AForce.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,020,480 | ---- | M] () MD5=BE02C6DEBE5181285E2E407A13D9693E -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.AForce.Graphics.Shared\2.0.3309.28646__90ba9c70f846762e\CLI.Aspect.AForce.Graphics.Shared.DLL

[2010/10/04 11:02:18 | 000,086,016 | ---- | M] () MD5=B7FFFBCD927CE405F19E4D675490F743 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.ALICrossfire.Graphics.Dashboard\2.0.3428.38833__90ba9c70f846762e\CLI.Aspect.ALICrossfire.Graphics.Dashboard.DLL

[2010/10/04 11:02:18 | 000,036,864 | ---- | M] () MD5=2F556FE072086F1FEF8D5DF82AB793D2 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.ALICrossfire.Graphics.Runtime\2.0.3428.38833__90ba9c70f846762e\CLI.Aspect.ALICrossfire.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,024,576 | ---- | M] () MD5=06D7D6B06DA6D47D0D8F9C93D731DE77 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.ALICrossfire.Graphics.Shared\2.0.3309.28642__90ba9c70f846762e\CLI.Aspect.ALICrossfire.Graphics.Shared.DLL

[2010/10/04 11:02:17 | 000,028,672 | ---- | M] () MD5=3F96DEA77D74A25D49B3572CF8E4AF08 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.3309.28627__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.DLL

[2010/10/04 11:02:16 | 000,020,480 | ---- | M] () MD5=1A192F1A2B5ED9452884BC79E7F1CB10 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormatSelection.Graphics.Dashboard.Shared.Private\2.0.3309.28644__90ba9c70f846762e\CLI.Aspect.CustomFormatSelection.Graphics.Dashboard.Shared.Private.DLL

[2010/10/04 11:02:18 | 000,098,304 | ---- | M] () MD5=4A0DCEF4F13AD90F38D87B2030721173 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormatSelection.Graphics.Dashboard\2.0.3428.38753__90ba9c70f846762e\CLI.Aspect.CustomFormatSelection.Graphics.Dashboard.DLL

[2010/10/04 11:02:18 | 000,438,272 | ---- | M] () MD5=E36357FF2801C3A5D62CB6E7D76B506F -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3428.38761__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.DLL

[2010/10/04 11:02:18 | 000,040,960 | ---- | M] () MD5=B4AA20F51A4FE03CCDACE3E1DC1B7DB6 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3428.38761__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,053,248 | ---- | M] () MD5=4EE13D5EA60A071E0E17E9A9483D8CE9 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.3309.28634__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.DLL

[2010/10/04 11:02:19 | 000,675,840 | ---- | M] () MD5=FC77B8EEF9476FB9048D2F9822027AE0 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Dashboard\2.0.3428.38774__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Dashboard.DLL

[2010/10/04 11:02:20 | 000,069,632 | ---- | M] () MD5=017E51F72E6399AF3B1D8F8B0D312999 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3428.38773__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,040,960 | ---- | M] () MD5=84C2BDB0072817C2A44D80A69F9327BB -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.3309.28636__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.DLL

[2010/10/04 11:02:20 | 000,692,224 | ---- | M] () MD5=C9146968DDB981911412482EB6B12F78 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Wizard\2.0.3428.38782__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Wizard.DLL

[2010/10/04 11:02:19 | 000,450,560 | ---- | M] () MD5=30DDA25E3FC59787DA65AF8F500F1220 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.3428.38757__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.DLL

[2010/10/04 11:02:19 | 000,065,536 | ---- | M] () MD5=D2E8224DAA75DA3E626A2FB786DC5881 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3428.38761__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,049,152 | ---- | M] () MD5=87E6CCA5694E6855AD34E7E7B968931B -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.3309.28634__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.DLL

[2010/10/04 11:02:19 | 000,401,408 | ---- | M] () MD5=8C235F3672FD2F6B1F6BAA9F134DFE7F -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Dashboard\2.0.3428.38772__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Dashboard.DLL

[2010/10/04 11:02:19 | 000,032,768 | ---- | M] () MD5=BBD655ED5D73F9B73137FF102BCDB630 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3428.38772__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,028,672 | ---- | M] () MD5=3B5211F0135BEDC6463CB2722D367A51 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.3309.28630__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.DLL

[2010/10/04 11:02:19 | 000,307,200 | ---- | M] () MD5=8208D1578B3603FCC399385DB8310ADC -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Wizard\2.0.3428.38742__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Wizard.DLL

[2010/10/04 11:02:19 | 000,286,720 | ---- | M] () MD5=9BC2FBA4A4C6F4753068EEDDA322207A -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Dashboard.Shared\2.0.3428.38753__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Dashboard.Shared.DLL

[2010/10/04 11:02:20 | 000,036,864 | ---- | M] () MD5=25573FBB663164EE02CB1C87510E14B3 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3428.38760__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,032,768 | ---- | M] () MD5=1FF7F1098DAC0DA6280D6FC9B8D89E6F -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.3309.28624__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.DLL

[2010/10/04 11:02:19 | 000,798,720 | ---- | M] () MD5=9CF852A8B463E8EA747014BB1598DB70 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Dashboard\2.0.3428.38792__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Dashboard.DLL

[2010/10/04 11:02:20 | 000,077,824 | ---- | M] () MD5=66E18928D018960F01B61B58B7022D27 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3428.38791__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,065,536 | ---- | M] () MD5=31C2A9E6D8FEFA62759318A7F85EA646 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.3309.28636__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.DLL

[2010/10/04 11:02:20 | 000,364,544 | ---- | M] () MD5=67AA7A7C174078BFCA5FF845516B3492 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Wizard\2.0.3428.38795__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Wizard.DLL

[2010/10/04 11:02:19 | 000,589,824 | ---- | M] () MD5=E20FC2889D4F087A57F127558012A6F6 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.3428.38738__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.DLL

[2010/10/04 11:02:19 | 000,040,960 | ---- | M] () MD5=AA1792AC6F56A78B872A6A5643E28645 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.3428.38741__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,028,672 | ---- | M] () MD5=B962A41EECF27644D7B6159060A5DB9C -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.3309.28632__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.DLL

[2010/10/04 11:02:19 | 000,712,704 | ---- | M] () MD5=F7A2F416F234580EDED9EAD4A9B15B73 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.3428.38727__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.DLL

[2010/10/04 11:02:20 | 001,728,512 | ---- | M] () MD5=A6F8437B019A841D27099ECB54129238 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.3428.38736__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.DLL

[2010/10/04 11:02:19 | 000,126,976 | ---- | M] () MD5=0CD02F9217EA4FA95054F086F44AB3CD -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.3428.38771__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.DLL

[2010/10/04 11:02:19 | 000,036,864 | ---- | M] () MD5=6D9ED1B0810F4030BCA4C11689C5007D -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.3428.38771__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,024,576 | ---- | M] () MD5=14018ABDB92B40A145E24C441F5C4361 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.3309.28635__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.DLL

[2010/10/04 11:02:20 | 000,323,584 | ---- | M] () MD5=C20F98118E1DCDCEE6BADA8F9010CBD7 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.FramelockGenlock.Graphics.Dashboard\2.0.3428.38834__90ba9c70f846762e\CLI.Aspect.FramelockGenlock.Graphics.Dashboard.DLL

[2010/10/04 11:02:20 | 000,094,208 | ---- | M] () MD5=BFBBD9173ECDC2E4B883690CA66C98AC -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.FramelockGenlock.Graphics.Runtime\2.0.3428.38834__90ba9c70f846762e\CLI.Aspect.FramelockGenlock.Graphics.Runtime.DLL

[2010/10/04 11:02:18 | 000,069,632 | ---- | M] () MD5=ECC3E8DAEF19FEDA26AB23E865940BF7 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.FramelockGenlock.Graphics.Shared\2.0.3309.28633__90ba9c70f846762e\CLI.Aspect.FramelockGenlock.Graphics.Shared.DLL

[2010/10/04 11:02:20 | 000,020,480 | ---- | M] () MD5=5B18A61C33E44E655052F6571B73DAC7 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3428.38726__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,020,480 | ---- | M] () MD5=C60E27CDFE13E60CA4104FD64C6BF489 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.3309.28630__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.DLL

[2010/10/04 11:02:19 | 000,225,280 | ---- | M] () MD5=55303CD79E3CCFDEC77B50574ED34C09 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3428.38737__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.DLL

[2010/10/04 11:02:20 | 000,204,800 | ---- | M] () MD5=246AB3D3F0ADF23C9E14D2568AA27045 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3428.38737__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.DLL

[2010/10/04 11:02:19 | 000,245,760 | ---- | M] () MD5=B9DF4E343D9667B5F12603AC664E073A -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.IntegratedUMAFrameBuffer.Graphics.Dashboard\2.0.3428.38746__90ba9c70f846762e\CLI.Aspect.IntegratedUMAFrameBuffer.Graphics.Dashboard.DLL

[2010/10/04 11:02:19 | 000,020,480 | ---- | M] () MD5=03427D7988E1FBC3B88C584C5E70E184 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.IntegratedUMAFrameBuffer.Graphics.Runtime\2.0.3428.38746__90ba9c70f846762e\CLI.Aspect.IntegratedUMAFrameBuffer.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,020,480 | ---- | M] () MD5=2CF414829A1E26DADD67B00654F08121 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.IntegratedUMAFrameBuffer.Graphics.Shared\2.0.3309.28632__90ba9c70f846762e\CLI.Aspect.IntegratedUMAFrameBuffer.Graphics.Shared.DLL

[2010/10/04 11:02:19 | 000,811,008 | ---- | M] () MD5=411D8D8EDFC156AB2507FE96EBFCA905 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.3428.38762__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.DLL

[2010/10/04 11:02:19 | 000,081,920 | ---- | M] () MD5=542976E76B2E9681BBEE7660E6C4D79A -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.3428.38762__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,053,248 | ---- | M] () MD5=4D2D6C3B8280D48C33745ACC44894702 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.3309.28634__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.DLL

[2010/10/04 11:02:19 | 000,405,504 | ---- | M] () MD5=185FE492F1D4AED5B2825E7C7BE561F9 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.3428.38786__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.DLL

[2010/10/04 11:02:19 | 000,192,512 | ---- | M] () MD5=E22D842A2CFCB060471728DA79356D31 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU.Graphics.Dashboard\2.0.3428.38763__90ba9c70f846762e\CLI.Aspect.MultiVPU.Graphics.Dashboard.DLL

[2010/10/04 11:02:19 | 000,040,960 | ---- | M] () MD5=D35DD2193E4992EAD40FE0C2B54F9A99 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU.Graphics.Runtime\2.0.3428.38763__90ba9c70f846762e\CLI.Aspect.MultiVPU.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,024,576 | ---- | M] () MD5=2E2BDE68C777BDA76B7017C920118352 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU.Graphics.Shared\2.0.3309.28633__90ba9c70f846762e\CLI.Aspect.MultiVPU.Graphics.Shared.DLL

[2010/10/04 11:02:19 | 000,192,512 | ---- | M] () MD5=79A856940C11CE0554059AC9780E8133 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU2.Graphics.Dashboard\2.0.3428.38767__90ba9c70f846762e\CLI.Aspect.MultiVPU2.Graphics.Dashboard.DLL

[2010/10/04 11:02:19 | 000,045,056 | ---- | M] () MD5=B1A933B754082D5B15327DEA17CB3F9C -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU2.Graphics.Runtime\2.0.3428.38767__90ba9c70f846762e\CLI.Aspect.MultiVPU2.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,024,576 | ---- | M] () MD5=9F3EF2B8D080CE58281C3B7346C66D0F -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU2.Graphics.Shared\2.0.3309.28635__90ba9c70f846762e\CLI.Aspect.MultiVPU2.Graphics.Shared.DLL

[2010/10/04 11:02:19 | 000,196,608 | ---- | M] () MD5=7CD27307C75AD71EAF41E1BF60382A89 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU3.Graphics.Dashboard\2.0.3428.38805__90ba9c70f846762e\CLI.Aspect.MultiVPU3.Graphics.Dashboard.DLL

[2010/10/04 11:02:19 | 000,045,056 | ---- | M] () MD5=C995B153975E2C88B55E8961FF7DA137 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU3.Graphics.Runtime\2.0.3428.38805__90ba9c70f846762e\CLI.Aspect.MultiVPU3.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,024,576 | ---- | M] () MD5=41F0D9D52EF4018E43E6C39E0DCC282B -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU3.Graphics.Shared\2.0.3309.28643__90ba9c70f846762e\CLI.Aspect.MultiVPU3.Graphics.Shared.DLL

[2010/10/04 11:02:19 | 000,151,552 | ---- | M] () MD5=B2BA50A9039E4C60614EA5C63B3425FE -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU4.Graphics.Dashboard\2.0.3428.38827__90ba9c70f846762e\CLI.Aspect.MultiVPU4.Graphics.Dashboard.DLL

[2010/10/04 11:02:19 | 000,040,960 | ---- | M] () MD5=4B1DD7085A52B0726D9AEBDAED105F4C -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU4.Graphics.Runtime\2.0.3428.38826__90ba9c70f846762e\CLI.Aspect.MultiVPU4.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,028,672 | ---- | M] () MD5=F55C66645C3DDAE09F022D4BCB25CE7F -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MultiVPU4.Graphics.Shared\2.0.3309.28642__90ba9c70f846762e\CLI.Aspect.MultiVPU4.Graphics.Shared.DLL

[2010/10/04 11:02:19 | 000,479,232 | ---- | M] () MD5=308B83144C76F588892A1F50BDE8470F -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive2.Graphics.Dashboard\2.0.3428.38747__90ba9c70f846762e\CLI.Aspect.OverDrive2.Graphics.Dashboard.DLL

[2010/10/04 11:02:19 | 000,028,672 | ---- | M] () MD5=66D468EFD1273D9DFD0DBDA9A9B5B420 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive2.Graphics.Runtime\2.0.3428.38747__90ba9c70f846762e\CLI.Aspect.OverDrive2.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,024,576 | ---- | M] () MD5=4B961DFEDAC02ADC1B97733C7574CCFB -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive2.Graphics.Shared\2.0.3309.28632__90ba9c70f846762e\CLI.Aspect.OverDrive2.Graphics.Shared.DLL

[2010/10/04 11:02:19 | 001,036,288 | ---- | M] () MD5=35301CAE4F6D888491EC9FA9066FAB76 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive3.Graphics.Dashboard\2.0.3428.38748__90ba9c70f846762e\CLI.Aspect.OverDrive3.Graphics.Dashboard.DLL

[2010/10/04 11:02:19 | 000,069,632 | ---- | M] () MD5=E0DE08FA5A5D9207D4C886194B716D02 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive3.Graphics.Runtime\2.0.3428.38748__90ba9c70f846762e\CLI.Aspect.OverDrive3.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,024,576 | ---- | M] () MD5=73D1DC6EBD77FCC65B4ECA17B787A234 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive3.Graphics.Shared\2.0.3309.28633__90ba9c70f846762e\CLI.Aspect.OverDrive3.Graphics.Shared.DLL

[2010/10/04 11:02:19 | 000,671,744 | ---- | M] () MD5=B92FFB6C8BE66D70B8E1037B6FAD7321 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Dashboard\2.0.3428.38823__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Dashboard.DLL

[2010/10/04 11:02:19 | 000,077,824 | ---- | M] () MD5=C07A47AD9C1125536DD8725C9474E194 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Runtime\2.0.3428.38822__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,061,440 | ---- | M] () MD5=24EC72EDBE5DCF1A848E51B0F59B4A87 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Shared\2.0.3309.28647__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Shared.DLL

[2010/10/04 11:02:19 | 000,172,032 | ---- | M] () MD5=08F328F50B5BFD97FE62639228E5394C -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlay3.Graphics.Dashboard\2.0.3428.38773__90ba9c70f846762e\CLI.Aspect.PowerPlay3.Graphics.Dashboard.DLL

[2010/10/04 11:02:19 | 000,049,152 | ---- | M] () MD5=15678C84009C31A93972D821E59E2BB2 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlay3.Graphics.Runtime\2.0.3428.38773__90ba9c70f846762e\CLI.Aspect.PowerPlay3.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,028,672 | ---- | M] () MD5=F23EA7F044C97EF2CC41234DEA9C4F0A -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlay3.Graphics.Shared\2.0.3309.28635__90ba9c70f846762e\CLI.Aspect.PowerPlay3.Graphics.Shared.DLL

[2010/10/04 11:02:19 | 000,147,456 | ---- | M] () MD5=B7134C6E0B8EEBBC8EFBEA2AA26F8167 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlay4.Graphics.Dashboard\2.0.3428.38814__90ba9c70f846762e\CLI.Aspect.PowerPlay4.Graphics.Dashboard.DLL

[2010/10/04 11:02:19 | 000,049,152 | ---- | M] () MD5=EEE6743698C0ACDB3E14FB90257EFC68 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlay4.Graphics.Runtime\2.0.3428.38814__90ba9c70f846762e\CLI.Aspect.PowerPlay4.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,028,672 | ---- | M] () MD5=9B57FB805204494EDA16E38075A428BC -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlay4.Graphics.Shared\2.0.3309.28644__90ba9c70f846762e\CLI.Aspect.PowerPlay4.Graphics.Shared.DLL

[2010/10/04 11:02:19 | 000,147,456 | ---- | M] () MD5=7B5F3C37DF33B990993DA09DF95F52AB -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard\2.0.3428.38809__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard.DLL

[2010/10/04 11:02:19 | 000,045,056 | ---- | M] () MD5=9CCF307BC19D1ECB5742608F0D5E0B3E -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime\2.0.3428.38809__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,028,672 | ---- | M] () MD5=5DA588C43C060D22E8B6C6C141AFBCCF -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Shared\2.0.3309.28644__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Shared.DLL

[2010/10/04 11:02:19 | 000,172,032 | ---- | M] () MD5=3E4242A6B33C1BE1DA9D31A2AF03D9EF -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerXpress.Graphics.Dashboard\2.0.3428.38821__90ba9c70f846762e\CLI.Aspect.PowerXpress.Graphics.Dashboard.DLL

[2010/10/04 11:02:19 | 000,019,456 | ---- | M] () MD5=36DF36524C46A3A07693E37480A3C2F2 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerXpress.Graphics.Runtime\2.0.3428.38822__90ba9c70f846762e\CLI.Aspect.PowerXpress.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,024,576 | ---- | M] () MD5=31715393B41136AAAC322974E68A1CDF -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerXpress.Graphics.Shared\2.0.3309.28647__90ba9c70f846762e\CLI.Aspect.PowerXpress.Graphics.Shared.DLL

[2010/10/04 11:02:19 | 000,364,544 | ---- | M] () MD5=499AA0E1BC6B087FFA1B09B1055577DC -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.3428.38778__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.DLL

[2010/10/04 11:02:19 | 000,061,440 | ---- | M] () MD5=EE991D34B162AFBD5AADAD3B640801E1 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.3428.38777__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,053,248 | ---- | M] () MD5=4936982F43A4F23856B398B3D9DD1589 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.3309.28636__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.DLL

[2010/10/04 11:02:19 | 000,094,208 | ---- | M] () MD5=649ACBFA0983D62549D2413F53077E01 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3428.38778__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.DLL

[2010/10/04 11:02:19 | 000,286,720 | ---- | M] () MD5=F26647EF4464C114332FE9152B5A98FD -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.SmartGart.Graphics.Dashboard\2.0.3428.38745__90ba9c70f846762e\CLI.Aspect.SmartGart.Graphics.Dashboard.DLL

[2010/10/04 11:02:19 | 000,028,672 | ---- | M] () MD5=E1FD1A86E66FA78D5BAA4984ACE4003C -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.SmartGart.Graphics.Runtime\2.0.3428.38746__90ba9c70f846762e\CLI.Aspect.SmartGart.Graphics.Runtime.DLL

[2010/10/04 11:02:17 | 000,024,576 | ---- | M] () MD5=BEEF83FF416D5744E946A1554EE7118A -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.SmartGart.Graphics.Shared\2.0.3309.28632__90ba9c70f846762e\CLI.Aspect.SmartGart.Graphics.Shared.DLL

[2010/10/04 11:02:18 | 000,040,960 | ---- | M] () MD5=BA8E4DEF946325D96EF2DA87ECFFC594 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.3309.28644__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.DLL

[2010/10/04 11:02:20 | 000,491,520 | ---- | M] () MD5=18EAA8B779502B7D16DD2C73FC400175 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3428.38810__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.DLL

[2010/10/04 11:02:19 | 000,167,936 | ---- | M] () MD5=C8F6AF495B392C0C741AF4D0B6681290 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.VeryLargeDesktop.Graphics.Dashboard\2.0.3428.38772__90ba9c70f846762e\CLI.Aspect.VeryLargeDesktop.Graphics.Dashboard.DLL

[2010/10/04 11:02:19 | 000,032,768 | ---- | M] () MD5=6D24C1EEC57A73E72C133885560EE27D -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.VeryLargeDesktop.Graphics.Runtime\2.0.3428.38771__90ba9c70f846762e\CLI.Aspect.VeryLargeDesktop.Graphics.Runtime.DLL

[2010/10/04 11:02:18 | 000,024,576 | ---- | M] () MD5=7D294D72938584961B2F38108767DEEB -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.VeryLargeDesktop.Graphics.Shared\2.0.3309.28635__90ba9c70f846762e\CLI.Aspect.VeryLargeDesktop.Graphics.Shared.DLL

[2010/10/04 11:02:19 | 000,106,496 | ---- | M] () MD5=4A5E8894A1A162B63E6732EDC8D369E0 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.VPURecover.Graphics.Dashboard\2.0.3428.38736__90ba9c70f846762e\CLI.Aspect.VPURecover.Graphics.Dashboard.DLL

[2010/10/04 11:02:19 | 000,028,672 | ---- | M] () MD5=E8574D555B0EF7BB0877BD059EFF4973 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.VPURecover.Graphics.Runtime\2.0.3428.38736__90ba9c70f846762e\CLI.Aspect.VPURecover.Graphics.Runtime.DLL

[2010/10/04 11:02:18 | 000,020,480 | ---- | M] () MD5=0D80843568D285390D7B53AA2B64284C -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.VPURecover.Graphics.Shared\2.0.3309.28631__90ba9c70f846762e\CLI.Aspect.VPURecover.Graphics.Shared.DLL

[2010/10/04 11:02:19 | 000,139,264 | ---- | M] () MD5=0387B21C6D372D61B5720204856D53CF -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3428.38810__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.DLL

[2010/10/04 11:02:19 | 000,110,592 | ---- | M] () MD5=B0EC8D26763A66FE55C484D6FE6360CD -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.WorkstationConfig2.Graphics.Dashboard\2.0.3428.38827__90ba9c70f846762e\CLI.Aspect.WorkstationConfig2.Graphics.Dashboard.DLL

[2010/10/04 11:02:19 | 000,032,768 | ---- | M] () MD5=6CE588260DB2429550598CA3869CB952 -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.WorkstationConfig2.Graphics.Runtime\2.0.3428.38827__90ba9c70f846762e\CLI.Aspect.WorkstationConfig2.Graphics.Runtime.DLL

[2010/10/04 11:02:18 | 000,020,480 | ---- | M] () MD5=4B0B5E3B103787EB6B043BA7C3ECA2DF -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.WorkstationConfig2.Graphics.Shared\2.0.3309.28635__90ba9c70f846762e\CLI.Aspect.WorkstationConfig2.Graphics.Shared.DLL

[2010/10/04 11:02:18 | 000,016,384 | ---- | M] () MD5=26BEB141BA70FD1427C69A3D8EC27A79 -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.3309.28630__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.DLL

[2010/10/04 11:02:20 | 000,073,728 | ---- | M] () MD5=A0E3227749B054B3E747BE9F76B8AEE9 -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3428.38726__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.DLL

[2010/10/04 11:02:16 | 000,020,480 | ---- | M] () MD5=54387B3763BA5C91A4C6FA8E5916B2DF -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.3309.28637__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.DLL

[2010/10/04 11:02:20 | 000,290,816 | ---- | M] () MD5=4FA0083EB00A1095F18C272058DB2CD1 -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3428.38718__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.DLL

[2010/10/04 11:02:18 | 000,061,440 | ---- | M] () MD5=62B845865FD089CEE940E682A7793253 -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3309.28618__90ba9c70f846762e\CLI.Caste.Graphics.Shared.DLL

[2010/10/04 11:02:18 | 000,016,384 | ---- | M] () MD5=D38601320578FB9235E6A3634AE5FE20 -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.3309.28631__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.DLL

[2010/10/04 11:02:20 | 000,040,960 | ---- | M] () MD5=24820CAD4D9BF1811FB721783408E6EC -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3428.38732__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.DLL

[2010/10/04 11:02:16 | 000,024,576 | ---- | M] () MD5=E261F743274DCADB465BD36BDACBC031 -- C:\Windows\assembly\GAC_MSIL\CLI.Component.AutoRemoval\2.0.3428.38791__90ba9c70f846762e\CLI.Component.Autoremoval.DLL

[2010/10/04 11:02:16 | 000,040,960 | ---- | M] () MD5=1F3D9B7CF4749DE1BBCA442142976A15 -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3309.28621__90ba9c70f846762e\CLI.Component.Client.Shared.Private.DLL

[2010/10/04 11:02:18 | 000,020,480 | ---- | M] () MD5=3EB71BB5571DB026448FB00C80961D5A -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3309.28611__90ba9c70f846762e\CLI.Component.Client.Shared.DLL

[2010/10/04 11:02:16 | 000,065,536 | ---- | M] () MD5=1C75F0F2B37850FAE9DFA6789DB4B16C -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.HotKeyManager.Resources\2.0.3428.38752__90ba9c70f846762e\CLI.Component.Dashboard.HotKeyManager.Resources.DLL

[2010/10/04 11:02:16 | 000,200,704 | ---- | M] () MD5=45CA7FF5B5E98C8F51AE69CA971DDAD0 -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.HotKeyManager\2.0.3428.38752__90ba9c70f846762e\CLI.Component.Dashboard.HotKeyManager.DLL

[2010/10/04 11:02:16 | 000,065,536 | ---- | M] () MD5=9DCCF56B3D1522C229F1DD1FF95EAB80 -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.ProfileManager.Resources\2.0.3428.38752__90ba9c70f846762e\CLI.Component.Dashboard.ProfileManager.Resources.DLL

[2010/10/04 11:02:16 | 000,188,416 | ---- | M] () MD5=2A05B75D5EAA70D4F29C2A256D15C552 -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.ProfileManager\2.0.3428.38752__90ba9c70f846762e\CLI.Component.Dashboard.ProfileManager.DLL

[2010/10/04 11:02:16 | 000,020,480 | ---- | M] () MD5=31F3A43DDF0FE42F88DE86004003E01F -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3309.28624__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.DLL

[2010/10/04 11:02:18 | 000,020,480 | ---- | M] () MD5=2F0A0D437666EFECEF0FCECB44700CA3 -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3309.28617__90ba9c70f846762e\CLI.Component.Dashboard.Shared.DLL

[2010/10/04 11:02:16 | 001,142,784 | ---- | M] () MD5=AD60E0512A79E515FEBF9FAB622247A0 -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3428.38722__90ba9c70f846762e\CLI.Component.Dashboard.DLL

[2010/10/04 11:02:16 | 001,019,904 | ---- | M] () MD5=0B6BA2F20407A3EEF11ECA9CB6A1AA08 -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Eeu\2.0.3428.38787__90ba9c70f846762e\CLI.Component.Eeu.DLL

[2010/10/04 11:02:17 | 000,061,440 | ---- | M] () MD5=AC181AEA10ECFBDA7F5CD1FBE042AEE3 -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Erecord\2.0.3428.38747__90ba9c70f846762e\CLI.Component.Erecord.DLL

[2010/10/04 11:02:17 | 000,020,480 | ---- | M] () MD5=0CD4D94B66952A2FB21985FAC7E6AFE8 -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Help\2.0.3428.38802__90ba9c70f846762e\CLI.Component.Help.DLL

[2010/10/04 11:02:17 | 000,020,480 | ---- | M] () MD5=77E4A0D2807F0C65DCFB35358856C536 -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Icomponent\2.0.3428.38737__90ba9c70f846762e\CLI.Component.Icomponent.DLL

[2010/10/04 11:02:17 | 000,278,528 | ---- | M] () MD5=0CA7BE0736A47CC5E80B4F937B6026A7 -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Launchpad\2.0.3428.38822__90ba9c70f846762e\CLI.Component.Launchpad.DLL

[2010/10/04 11:02:17 | 000,020,480 | ---- | M] () MD5=61DB4380C342CAE319573B0A8BF048D8 -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Load\2.0.3428.38803__90ba9c70f846762e\CLI.Component.Load.DLL

[2010/10/04 11:02:20 | 000,122,880 | ---- | M] () MD5=1F396FC386CFF0DC1470CB89C83707FA -- C:\Windows\assembly\GAC_MSIL\CLI.Component.PowerXpressHybrid\2.0.3428.38831__90ba9c70f846762e\CLI.Component.PowerXpressHybrid.DLL

[2010/10/04 11:02:17 | 000,007,168 | ---- | M] () MD5=AD03B532AFC9D1381279ED7A13CC3B31 -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3428.38714__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.DLL

[2010/10/04 11:02:17 | 000,045,056 | ---- | M] () MD5=805A0D817C61A2778E5859689FC7CBB8 -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3309.28628__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.DLL

[2010/10/04 11:02:18 | 000,016,384 | ---- | M] () MD5=E46C94064B485BB0ADFB8ED53CCFD598 -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3309.28617__90ba9c70f846762e\CLI.Component.Runtime.Shared.DLL

[2010/10/04 11:02:17 | 000,081,920 | ---- | M] () MD5=79FD7246D31A2EFA2D3F4DA4776BECC1 -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3428.38716__90ba9c70f846762e\CLI.Component.Runtime.DLL

[2010/10/04 11:02:17 | 000,057,344 | ---- | M] () MD5=D0599DE03D6D5CCAD441FA0636587290 -- C:\Windows\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3428.38717__90ba9c70f846762e\CLI.Component.SkinFactory.DLL

[2010/10/04 11:02:17 | 000,544,768 | ---- | M] () MD5=63BE5ADE2974C2B6B2D62D82B0A7AF8C -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3428.38799__90ba9c70f846762e\CLI.Component.Systemtray.DLL

[2010/10/04 11:02:17 | 000,024,576 | ---- | M] () MD5=E40BC3251F860437C4D9068CC9284F80 -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3309.28627__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.DLL

[2010/10/04 11:02:18 | 000,020,480 | ---- | M] () MD5=F26996E9C8D91F5825A692DF8E169506 -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3309.28620__90ba9c70f846762e\CLI.Component.Wizard.Shared.DLL

[2010/10/04 11:02:17 | 000,405,504 | ---- | M] () MD5=829E93107C4A1644318F06C90A3DE855 -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3428.38731__90ba9c70f846762e\CLI.Component.Wizard.DLL

[2010/10/04 11:02:17 | 000,040,960 | ---- | M] () MD5=F6F72C70C12AAC66C5B9EFCBEF484188 -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3309.28608__90ba9c70f846762e\CLI.Foundation.Private.DLL

[2010/10/04 11:02:18 | 000,028,672 | ---- | M] () MD5=A4EC9E917285A39F6FE7FA40669AAA03 -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3309.28669__90ba9c70f846762e\CLI.Foundation.XManifest.DLL

[2010/10/04 11:02:18 | 000,073,728 | ---- | M] () MD5=F73739BA177C749156F4BA29B314FC6A -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.3309.28604__90ba9c70f846762e\CLI.Foundation.DLL

[2010/10/04 11:02:17 | 000,020,480 | ---- | M] () MD5=300EE26D89362A5BB4629D2B38AE6B71 -- C:\Windows\assembly\GAC_MSIL\CLI.Implementation\2.0.3428.38713__90ba9c70f846762e\CLI.Implementation.DLL

[2010/10/04 11:02:18 | 000,049,152 | ---- | M] () MD5=347B6CA6E12A7BF304D87B9DFC0B521C -- C:\Windows\assembly\GAC_MSIL\CLI\2.0.0.0__90ba9c70f846762e\CLI.EXE

[2009/06/10 21:14:02 | 000,165,704 | ---- | M] () MD5=48355AC803ECC2DA6904498627E30FF9 -- C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe

[2009/06/10 21:22:50 | 000,013,312 | ---- | M] () MD5=AAD128271C76C6596E69CFA81D765C2C -- C:\Windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll

[2010/10/04 11:02:18 | 000,016,384 | ---- | M] () MD5=110D2A7BBFBA80AAE36B5F229FE800AD -- C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.DLL

[2010/10/04 11:02:18 | 000,045,056 | ---- | M] () MD5=CCE69BC85D019F49691C592DDCC2FA97 -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.DLL

[2010/10/04 11:02:18 | 000,016,384 | ---- | M] () MD5=3DBC47609EB7C5F765AF5298471A25D1 -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0702\2.0.2594.25693__90ba9c70f846762e\DEM.Graphics.I0702.DLL

[2010/10/04 11:02:18 | 000,020,480 | ---- | M] () MD5=0DEAB952A0A36ABCB6270FE45D3CACE1 -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0703\2.0.2651.18802__90ba9c70f846762e\DEM.Graphics.I0703.DLL

[2010/10/04 11:02:18 | 000,016,384 | ---- | M] () MD5=2E7FAB502A8615B1AAB0EAB35AFBCA3B -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.DLL

[2010/10/04 11:02:18 | 000,016,384 | ---- | M] () MD5=814B9D77B93F0F10D1619483E39A6141 -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.3309.28630__90ba9c70f846762e\DEM.Graphics.DLL

[2010/10/04 11:02:18 | 000,020,480 | ---- | M] () MD5=03571509EC8C5CDA4C347E5398AE0E29 -- C:\Windows\assembly\GAC_MSIL\DEM.OS.I0602\2.0.3309.28630__90ba9c70f846762e\DEM.OS.I0602.DLL

[2010/10/04 11:02:18 | 000,016,384 | ---- | M] () MD5=DC3CA97FE07A5E4387D53E3D77B4A7A7 -- C:\Windows\assembly\GAC_MSIL\DEM.OS\2.0.3309.28645__90ba9c70f846762e\DEM.OS.DLL

[2009/06/10 21:22:50 | 000,005,120 | ---- | M] () MD5=BA86FDE9C3B5BD2FF5EA7A99BF648E82 -- C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe

[2009/07/14 01:20:46 | 000,094,208 | ---- | M] () MD5=824A996B16F5C39D5AD74C8D17BB6C09 -- C:\Windows\assembly\GAC_MSIL\ehCIR\6.1.0.0__31bf3856ad364e35\ehCIR.dll

[2009/07/14 01:20:05 | 000,143,360 | ---- | M] () MD5=E89FAC6D31FE33DE0B2D63C95162AAEE -- C:\Windows\assembly\GAC_MSIL\ehexthost\6.1.0.0__31bf3856ad364e35\ehexthost.exe

[2009/07/13 21:04:37 | 000,002,274 | ---- | M] () MD5=C343B566A3B8DA7743C30796BE0A54D7 -- C:\Windows\assembly\GAC_MSIL\ehexthost\6.1.0.0__31bf3856ad364e35\ehexthost.exe.config

[2009/07/14 01:20:19 | 000,015,872 | ---- | M] () MD5=8C0473A82FF7D19D19B8F3E120B3BB3A -- C:\Windows\assembly\GAC_MSIL\ehiActivScp\6.1.0.0__31bf3856ad364e35\ehiActivScp.dll

[2009/07/14 01:22:13 | 000,011,776 | ---- | M] () MD5=49D389CC7E7DC17C507F4B5AD6203AD3 -- C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\6.1.0.0__31bf3856ad364e35\ehiBmlDataCarousel.dll

[2009/07/14 01:20:15 | 000,077,824 | ---- | M] () MD5=598383C42098DF7D0FFD61F459B6CBAF -- C:\Windows\assembly\GAC_MSIL\ehiExtens\6.1.0.0__31bf3856ad364e35\ehiExtens.dll

[2009/07/14 01:20:46 | 000,040,960 | ---- | M] () MD5=0DBF6B6DEBD8C1F3F810C17AF4A18CE5 -- C:\Windows\assembly\GAC_MSIL\ehiiTV\6.1.0.0__31bf3856ad364e35\ehiiTV.dll

[2009/07/14 01:20:29 | 000,172,032 | ---- | M] () MD5=E081672357BC9AE8BE05B2D902BEA7F7 -- C:\Windows\assembly\GAC_MSIL\ehiProxy\6.1.0.0__31bf3856ad364e35\ehiProxy.dll

[2009/07/14 01:20:56 | 000,086,016 | ---- | M] () MD5=2CC68F809DAF4D4FAC0E66B35A4EB9BE -- C:\Windows\assembly\GAC_MSIL\ehiTVMSMusic\6.1.0.0__31bf3856ad364e35\ehiTVMSMusic.dll

[2009/07/14 01:20:37 | 000,006,144 | ---- | M] () MD5=A924F87D32D7D28D58D3CBDB8B103E6F -- C:\Windows\assembly\GAC_MSIL\ehiUPnP\6.1.0.0__31bf3856ad364e35\ehiUPnP.dll

[2009/07/14 01:20:38 | 000,032,768 | ---- | M] () MD5=62F20E48B43B44D9C6E9B4CF08FB120D -- C:\Windows\assembly\GAC_MSIL\ehiUserXp\6.1.0.0__31bf3856ad364e35\ehiUserXp.dll

[2009/07/14 01:20:51 | 000,335,872 | ---- | M] () MD5=DB2189BF0B4D192F70605F50EC30037B -- C:\Windows\assembly\GAC_MSIL\ehiVidCtl\6.1.0.0__31bf3856ad364e35\ehiVidCtl.dll

[2009/07/14 01:21:00 | 000,143,360 | ---- | M] () MD5=391EF4FF1EF376B4408C0DEFE2041DBF -- C:\Windows\assembly\GAC_MSIL\ehiwmp\6.1.0.0__31bf3856ad364e35\ehiwmp.dll

[2009/07/14 01:22:59 | 000,086,016 | ---- | M] () MD5=82A5798BD1A2FE8678A51CC9CE493F7F -- C:\Windows\assembly\GAC_MSIL\ehiWUapi\6.1.0.0__31bf3856ad364e35\ehiWUapi.dll

[2009/07/14 01:21:10 | 000,196,608 | ---- | M] () MD5=64D881E165F9E95F75B2F2B8BCA761A4 -- C:\Windows\assembly\GAC_MSIL\ehRecObj\6.1.0.0__31bf3856ad364e35\ehRecObj.dll

[2009/08/18 05:53:16 | 006,307,840 | ---- | M] () MD5=634251ED100BDCE57C9FC8293CEDEADE -- C:\Windows\assembly\GAC_MSIL\ehshell\6.1.0.0__31bf3856ad364e35\ehshell.dll

[2009/07/14 02:12:24 | 000,008,192 | ---- | M] () MD5=E21C39A811AC4ECBF56DC341031FB9D1 -- C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_en_31bf3856ad364e35\EventViewer.resources.dll

[2009/07/14 01:21:10 | 000,368,640 | ---- | M] () MD5=EF9EFDE8E8570F92D0E1649C9DA84D67 -- C:\Windows\assembly\GAC_MSIL\EventViewer\6.1.0.0__31bf3856ad364e35\EventViewer.dll

[2009/06/10 21:22:54 | 000,008,192 | ---- | M] () MD5=96D9E7E468D537443DE037A7E15CB804 -- C:\Windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll

[2009/06/10 21:22:55 | 000,077,824 | ---- | M] () MD5=AF29AA7F2F613951A9E913B4290B2ECE -- C:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll

[2009/06/10 21:22:55 | 000,006,656 | ---- | M] () MD5=D051642D0ED61E2886FD8917E8B6FAFD -- C:\Windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll

[2010/10/04 11:02:18 | 000,131,072 | ---- | M] () MD5=5D29E862E0FA0E75B48D7AA17B054D58 -- C:\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__90ba9c70f846762e\Interop.SHDocVw.DLL

[2009/07/14 01:23:32 | 000,106,496 | ---- | M] () MD5=967047584598B8EA09A742328872C06D -- C:\Windows\assembly\GAC_MSIL\loadmxf\6.1.0.0__31bf3856ad364e35\loadmxf.exe

[2010/10/04 11:02:17 | 000,020,480 | ---- | M] () MD5=80AFA16C347A60BA6ECABCFB7351585D -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3309.28626__90ba9c70f846762e\LOG.Foundation.Implementation.Private.DLL

[2010/10/04 11:02:17 | 000,061,440 | ---- | M] () MD5=9AF223F4190053CA3F2AF1A59B5652A0 -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3428.38803__90ba9c70f846762e\LOG.Foundation.Implementation.DLL

[2010/10/04 11:02:17 | 000,032,768 | ---- | M] () MD5=DF8EA7C61BAD44D22867A1B9AEE4E3D8 -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3309.28614__90ba9c70f846762e\LOG.Foundation.Private.DLL

[2010/10/04 11:02:18 | 000,032,768 | ---- | M] () MD5=14D1332BD5DEDABD1C85A5D74EB4BADA -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.3309.28601__90ba9c70f846762e\LOG.Foundation.DLL

[2010/10/04 11:02:17 | 000,086,016 | ---- | M] () MD5=D4549E6655505A2F84BF1B53C8A3B7D7 -- C:\Windows\assembly\GAC_MSIL\LOG\2.0.3428.38803__90ba9c70f846762e\LOG.EXE

[2009/07/14 01:20:36 | 000,937,984 | ---- | M] () MD5=5D745232A3481ECCC01B8519C43B934A -- C:\Windows\assembly\GAC_MSIL\mcepg\6.1.0.0__31bf3856ad364e35\mcepg.dll

[2009/07/14 01:19:48 | 000,053,248 | ---- | M] () MD5=F499B89A60548AF6B4E8EE715C6599B0 -- C:\Windows\assembly\GAC_MSIL\MCESidebarCtrl\6.1.0.0__31bf3856ad364e35\MCESidebarCtrl.dll

[2009/07/14 01:19:48 | 000,122,880 | ---- | M] () MD5=07E68EB19422032AC4E3EFD18C8A70AB -- C:\Windows\assembly\GAC_MSIL\mcglidhostobj\6.1.0.0__31bf3856ad364e35\mcglidhostobj.dll

[2009/07/14 01:20:28 | 000,171,520 | ---- | M] () MD5=9FCFFB08DCD8D902320B7406973383C8 -- C:\Windows\assembly\GAC_MSIL\mcplayerinterop\6.1.0.0__31bf3856ad364e35\mcplayerinterop.dll

[2009/07/14 01:20:31 | 000,634,880 | ---- | M] () MD5=3C9F7F166037FC6E377F1DD90BB08B7F -- C:\Windows\assembly\GAC_MSIL\mcstore\6.1.0.0__31bf3856ad364e35\mcstore.dll

[2009/07/14 02:12:58 | 000,012,800 | ---- | M] () MD5=2C50FCE5493C9EF2FCC19C34BBD4A99A -- C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_en_31bf3856ad364e35\Microsoft.ApplicationId.Framework.Resources.dll

[2009/07/14 01:21:08 | 000,126,976 | ---- | M] () MD5=610AB9782F0856AA539C8385493CB75D -- C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework\6.1.0.0__31bf3856ad364e35\Microsoft.ApplicationId.Framework.dll

[2009/07/14 02:12:44 | 000,221,184 | ---- | M] () MD5=DAD90E47F68C2EAD48A0038E8A048384 -- C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_en_31bf3856ad364e35\Microsoft.ApplicationId.RuleWizard.Resources.dll

[2009/07/14 01:20:46 | 000,339,968 | ---- | M] () MD5=2A7C95DDD68FE05B24C1B80B453CFC87 -- C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard\6.1.0.0__31bf3856ad364e35\Microsoft.ApplicationId.RuleWizard.dll

[2009/07/14 02:12:50 | 000,007,168 | ---- | M] () MD5=FCA8AC8ABBCE37458663CCA33E7F71F7 -- C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.resources.dll

[2009/07/14 01:20:28 | 000,057,344 | ---- | M] () MD5=D16F569EB4264641241465BEFA107BD0 -- C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll

[2009/06/10 21:14:36 | 000,106,496 | ---- | M] () MD5=550E75434C424A17A1E06669D8335C26 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Conversion.v3.5.dll

[2009/06/10 21:22:58 | 000,348,160 | ---- | M] () MD5=086DEB745D071635761378922DF47E1B -- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll

[2009/06/10 21:14:39 | 000,733,184 | ---- | M] () MD5=25D8F577F582A1BEA7805BDC8A0C2E91 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll

[2009/06/10 21:23:01 | 000,036,864 | ---- | M] () MD5=1FE734BB0F2CE11682DD3CAB9A052B11 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll

[2009/06/10 21:14:40 | 000,036,864 | ---- | M] () MD5=80F89EC03B39E5A6700C9CA5A5545230 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll

[2009/06/10 21:14:51 | 000,802,816 | ---- | M] () MD5=8ECDC960D282818590855567CE01D19F -- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.v3.5.dll

[2009/06/10 21:23:01 | 000,655,360 | ---- | M] () MD5=353959C60A3B0230360B019634655446 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll

[2009/06/10 21:14:40 | 000,094,208 | ---- | M] () MD5=84CB14C5F65C88192E2E538F8178B8D3 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.v3.5.dll

[2009/06/10 21:23:01 | 000,077,824 | ---- | M] () MD5=38CFD08C9D276912FF9B7BF33A2B109B -- C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll

[2009/07/14 02:13:04 | 000,471,040 | ---- | M] () MD5=CAEE071511C5D89AD05A6471FA080B11 -- C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_en_31bf3856ad364e35\Microsoft.GroupPolicy.Reporting.Resources.dll

[2009/07/14 01:22:38 | 001,851,392 | ---- | M] () MD5=7F8DEFD7332F2A7AC70BCDDAC76CE9CB -- C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting\2.0.0.0__31bf3856ad364e35\Microsoft.GroupPolicy.Reporting.dll

[2009/07/14 02:13:02 | 000,036,864 | ---- | M] () MD5=3576E621125C0ECE94313B85CCE6F8B6 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_en_31bf3856ad364e35\Microsoft.Ink.Resources.dll

[2009/06/10 21:23:03 | 000,749,568 | ---- | M] () MD5=3CF65928E67E362D5B25424EBCC27B12 -- C:\Windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll

[2009/07/14 02:13:00 | 000,016,384 | ---- | M] () MD5=4D9D34F0204D5DF8EF1DBBD704735EEB -- C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_en_31bf3856ad364e35\Microsoft.ManagementConsole.Resources.dll

[2009/07/14 01:21:42 | 000,188,416 | ---- | M] () MD5=F8B72BFD1D8C36E1A2C98E25C9CF2504 -- C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole\3.0.0.0__31bf3856ad364e35\Microsoft.ManagementConsole.dll

[2009/07/14 01:22:44 | 001,159,168 | ---- | M] () MD5=2D994989944FA2E9D2AD7450953523A9 -- C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Bml\6.1.0.0__31bf3856ad364e35\Microsoft.MediaCenter.Bml.dll

[2009/07/14 01:22:09 | 000,024,576 | ---- | M] () MD5=97D4AC2BAD43C5D5C8C42EDB71B2E532 -- C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTv.Hosting\6.1.0.0__31bf3856ad364e35\Microsoft.MediaCenter.iTv.Hosting.dll

[2009/07/14 01:24:00 | 000,086,016 | ---- | M] () MD5=7E2128A4D8A406E9F642F3D75275B821 -- C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.iTV\6.1.0.0__31bf3856ad364e35\Microsoft.MediaCenter.iTV.dll

[2009/07/14 01:22:27 | 000,045,056 | ---- | M] () MD5=DAF143DA013B2170133505955AB4BFEA -- C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.ITVVM\6.1.0.0__31bf3856ad364e35\Microsoft.MediaCenter.ITVVM.dll

[2009/07/14 01:23:45 | 001,572,864 | ---- | M] () MD5=C03B0775AA4F7F942CB76747E75D4D6A -- C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Shell\6.1.0.0__31bf3856ad364e35\Microsoft.MediaCenter.Shell.dll

[2009/07/14 01:24:35 | 000,241,664 | ---- | M] () MD5=4C41F635D97689C592953BC7D5848014 -- C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\6.1.0.0__31bf3856ad364e35\Microsoft.MediaCenter.Sports.dll

[2009/07/14 01:26:28 | 002,596,864 | ---- | M] () MD5=823AC63E53A47642612217EE832BE28C -- C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\6.1.0.0__31bf3856ad364e35\Microsoft.MediaCenter.UI.dll

[2009/07/14 01:22:00 | 000,385,024 | ---- | M] () MD5=94B94145E81E4861B2E8EFF8A5F0DC55 -- C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter\6.1.0.0__31bf3856ad364e35\Microsoft.MediaCenter.dll

[2010/10/04 15:11:11 | 000,609,104 | ---- | M] () MD5=1D58BB83FAA5D070A8525C9C6398E7A2 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Client.Internal.Host\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Infopath.Client.Internal.Host.dll

[2010/10/04 15:11:11 | 000,043,840 | ---- | M] () MD5=0B8A9BB294B8CF79C99DD3486317285C -- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.FormControl\12.0.0.0__71e9bce111e9429c\microsoft.office.infopath.formcontrol.dll

[2010/10/04 15:11:12 | 000,039,728 | ---- | M] () MD5=A4DAC1328EB3271B7F18B56572BC6433 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\12.0.0.0__71e9bce111e9429c\Microsoft.Office.InfoPath.Vsta.dll

[2010/10/04 15:11:12 | 000,060,200 | ---- | M] () MD5=F8B8E043A7CF09E811A9914BA4A6FE34 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Infopath.dll

[2009/07/14 02:13:04 | 000,010,752 | ---- | M] () MD5=65B27C38DBD68EFEC636665FDBF4D1FF -- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.Commands.Diagnostics.resources.dll

[2009/07/14 01:24:23 | 000,102,400 | ---- | M] () MD5=08E87E8ABF7B41B28663DCE817CE0AB6 -- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Diagnostics.dll

[2009/07/14 02:13:06 | 000,036,864 | ---- | M] () MD5=10C9C4380C4B403B95D757C4517AFD5B -- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.Resources.dll

[2009/07/14 01:23:34 | 000,290,816 | ---- | M] () MD5=B716C82D47B5C6C2631D1EBE7FA099BC -- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll

[2009/07/14 02:13:02 | 000,049,152 | ---- | M] () MD5=B49C73024458FDB80FF14970A84F334B -- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.Resources.dll

[2009/07/14 01:23:51 | 000,667,648 | ---- | M] () MD5=2BF0E6D33F78907C55B55867470566C6 -- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll

[2009/07/14 02:13:06 | 000,040,960 | ---- | M] () MD5=FA7B959A0F8357D4262C1F6C1262878C -- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.Resources.dll

[2009/07/14 01:23:47 | 000,200,704 | ---- | M] () MD5=61408B3CF77B787A753B6F4F4A6840B1 -- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll

[2009/07/14 02:13:04 | 000,069,632 | ---- | M] () MD5=DF60F16CB3FA971EBD1CB6B1FA346AF6 -- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.Editor.Resources.dll

[2009/07/14 01:21:10 | 000,991,232 | ---- | M] () MD5=218DA71F06ED50FDD5DF749A27D1A998 -- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Editor.dll

[2009/07/14 02:13:06 | 000,040,960 | ---- | M] () MD5=41888D6ED40E49C4DAED8E412BB18B90 -- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.Gpowershell.resources.dll

[2009/07/14 01:22:04 | 000,651,264 | ---- | M] () MD5=E66B1EEE2AB24DE9F3D5189A1FC8D4BF -- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.GPowerShell.dll

[2009/07/14 02:13:06 | 000,016,896 | ---- | M] () MD5=E848EEBF463086883E026AAD11C24F1A -- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.GraphicalHost.Resources.dll

[2009/07/14 01:20:38 | 000,278,528 | ---- | M] () MD5=3EAB4DBDC290EDC4D53FE77F1FDB9E59 -- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.GraphicalHost.dll

[2009/07/14 02:11:48 | 000,009,216 | ---- | M] () MD5=462D0B841E939094840CFA61C990410F -- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.PowerShell.Security.Resources.dll

[2009/07/14 01:20:25 | 000,077,824 | ---- | M] () MD5=FC76265F8F526F65AE38A61CD24DFF75 -- C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security\1.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll

[2009/07/14 02:02:52 | 000,082,011 | ---- | M] () MD5=AF07B8B898E6D6E01EC6ECAD383C5CD0 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_en_31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll-Help.xml

[2009/07/14 02:13:04 | 000,005,632 | ---- | M] () MD5=B6B1A93999D480F0892C96D11E4CAEF8 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_en_31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources.dll

[2009/06/10 21:31:47 | 000,000,652 | ---- | M] () MD5=2B16AAD4E01313F505F21AF056730BFE -- C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\AppLocker.psd1

[2009/07/14 01:23:53 | 000,040,960 | ---- | M] () MD5=6AF8A638441BE7A62571166717B1CE0D -- C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll

[2009/07/14 02:13:06 | 000,006,656 | ---- | M] () MD5=410B5C44C9C972B8E38E52458550B0F5 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_en_31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources.dll

[2009/07/14 01:24:08 | 000,045,056 | ---- | M] () MD5=3A6C04FD597605557BD35FA3C5D4B9E8 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll

[2009/07/14 02:13:06 | 000,006,656 | ---- | M] () MD5=7201CD781551B27CE752BEB15D21BB93 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_en_31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources.dll

[2009/07/14 01:24:16 | 000,061,440 | ---- | M] () MD5=E78A62A1A783212133C6B0618D9B72BF -- C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll

[2009/07/14 01:24:27 | 000,012,800 | ---- | M] () MD5=F2051076DF423BF3F29E47D4FFAB13D4 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll

[2009/07/14 02:13:06 | 000,159,744 | ---- | M] () MD5=7A800C3D1330FC8331D3176EAD8026EB -- C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_en_31bf3856ad364e35\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources.dll

[2009/07/14 01:26:50 | 000,675,840 | ---- | M] () MD5=59C6BC50F78BAC3DA986087E6BD65024 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.dll

[2009/07/14 02:13:06 | 000,073,728 | ---- | M] () MD5=67F68317A9F346A32039F9651C7EAC46 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm.Resources\6.1.0.0_en_31bf3856ad364e35\microsoft.tpm.resources.dll

[2009/07/14 01:24:19 | 000,192,512 | ---- | M] () MD5=466761E68D1AAED81DFD5E43B168D2F0 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Tpm\6.1.0.0__31bf3856ad364e35\Microsoft.Tpm.dll

[2009/06/10 21:14:03 | 000,397,312 | ---- | M] () MD5=130FF58B6245F78097E7619EFB61CDD2 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.dll

[2009/06/10 21:23:03 | 000,110,592 | ---- | M] () MD5=A070FD9509392CEB84A3ED8F8A42A504 -- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll

[2009/06/10 21:23:03 | 000,372,736 | ---- | M] () MD5=BC22758E32EDEEBD6088272DE0873EFC -- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll

[2009/06/10 21:23:04 | 000,028,672 | ---- | M] () MD5=A5B5F03020C0A01276801CF2C807FF8C -- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll

[2009/06/10 21:23:03 | 000,610,304 | ---- | M] () MD5=5467E7C4E87E9400F125DCCBD920C8AE -- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll

[2009/06/10 21:14:40 | 000,041,984 | ---- | M] () MD5=DD26812B72AF01116F7A1DDD4FA21E49 -- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC.STLCLR\1.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.STLCLR.dll

[2009/06/10 21:23:04 | 000,005,632 | ---- | M] () MD5=BBAEF0C6E310A25D3BCCAA2ADC538F82 -- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll

[2010/10/04 15:11:20 | 000,211,736 | ---- | M] () MD5=2D273C8B22DA28704B4968E5197A793F -- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Adapter.dll

[2010/10/04 15:11:20 | 000,105,248 | ---- | M] () MD5=F05A0DC8BC23982813A4AD61EAA89E7D -- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInManager\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.AddInManager.dll

[2010/10/04 15:11:20 | 000,330,520 | ---- | M] () MD5=7FBD0EDFBE1A28CD9FC392735699E749 -- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Blueprints\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Blueprints.dll

[2010/10/04 15:11:20 | 000,039,712 | ---- | M] () MD5=52FC5D2D66561348D3ECF4BB5F55145D -- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel.dll

[2010/10/04 15:11:20 | 000,039,704 | ---- | M] () MD5=3DAE657D730C6B4E50107831F7B334E8 -- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Contract.dll

[2010/10/04 15:11:20 | 000,072,472 | ---- | M] () MD5=69A552F5D231C02F43F1E18ABC69B131 -- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.DesignTime\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.DesignTime.dll

[2009/06/10 21:23:04 | 000,012,800 | ---- | M] () MD5=71C2F1A0F8FFD6D017F039AC023DE81C -- C:\Windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll

[2009/06/10 21:23:04 | 000,032,768 | ---- | M] () MD5=45F2E4914DDCDA6F468D99FAA91911F2 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll

[2009/07/14 02:13:08 | 000,004,096 | ---- | M] () MD5=04D3E891B3256A1EBD36FA7B6F984920 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.resources.dll

[2009/07/14 01:25:15 | 000,009,728 | ---- | M] () MD5=96F718F03F4D8782D7EB11954AC0E914 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll

[2009/07/14 02:13:08 | 000,004,096 | ---- | M] () MD5=ADD629AFA64864C8519B2485F6F61554 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.resources.dll

[2009/07/14 01:26:39 | 000,010,752 | ---- | M] () MD5=78EF40CE03E23CB6702391D919F95436 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.dll

[2009/07/14 02:13:08 | 000,004,096 | ---- | M] () MD5=84AA3A80B726C6DCCDAA38A879862D6D -- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.resources.dll

[2009/07/14 01:25:40 | 000,009,216 | ---- | M] () MD5=EE5B0505F2E8E8305748DD270A7AD929 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.dll

[2009/07/14 02:13:08 | 000,004,096 | ---- | M] () MD5=BEBFDDCB2DB36E9302A4358878C8CFD4 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.resources.dll

[2009/07/14 01:25:32 | 000,008,192 | ---- | M] () MD5=7FBCA94271448B41DB000C98C9615312 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.dll

[2009/07/14 02:13:08 | 000,004,096 | ---- | M] () MD5=71BBE49889FA8C5256288D4D7A725384 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDHost.resources.dll

[2009/07/14 01:25:35 | 000,024,576 | ---- | M] () MD5=915BBFA6BBF105C0C51398A3398D19CB -- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDHost.dll

[2009/07/14 02:13:08 | 000,006,656 | ---- | M] () MD5=FC66A5034B5B6A7C09FCE86C47BBF4ED -- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_en_31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.resources.dll

[2009/07/14 01:26:37 | 000,049,152 | ---- | M] () MD5=4BB0FF1D72803CC075D92CE2FBDCA2B3 -- C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll

[2009/07/14 02:12:10 | 000,013,824 | ---- | M] () MD5=CF0707E9D2A9BFA3D0B3AD60A1E8CF43 -- C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.WSMan.Management.resources.dll

[2009/07/14 01:22:05 | 000,286,720 | ---- | M] () MD5=88345A32E0B3E630CC9669C40A8A03C8 -- C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Management.dll

[2009/07/14 01:22:00 | 000,007,168 | ---- | M] () MD5=D5F86545FAF811ED2CCF3C6117B0EC44 -- C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Runtime.dll

[2009/06/10 21:23:04 | 000,007,168 | ---- | M] () MD5=E5640EF09DA87B03E78F18F850CFF728 -- C:\Windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll

[2009/07/14 02:13:12 | 001,552,384 | ---- | M] () MD5=5D85FA66189E6832466C8DEE97CA8C3F -- C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_en_31bf3856ad364e35\MIGUIControls.resources.dll

[2009/07/14 01:27:21 | 003,416,064 | ---- | M] () MD5=10ADEEDB227D4A60E7C848AD902EF6CD -- C:\Windows\assembly\GAC_MSIL\MiguiControls\1.0.0.0__31bf3856ad364e35\MIGUIControls.dll

[2009/07/14 02:13:08 | 000,036,864 | ---- | M] () MD5=93FB96E937A3A76FEC6F2077A21B417F -- C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_en_31bf3856ad364e35\MMCEx.Resources.dll

[2009/07/14 01:26:50 | 000,421,888 | ---- | M] () MD5=A9D4275CE5EA165C267AE05A6821CB54 -- C:\Windows\assembly\GAC_MSIL\MMCEx\3.0.0.0__31bf3856ad364e35\MMCEx.dll

[2009/07/14 02:13:08 | 000,004,096 | ---- | M] () MD5=BFFF1A410441F834F27B4F29E45256B1 -- C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_en_31bf3856ad364e35\MMCFxCommon.Resources.dll

[2009/07/14 01:26:07 | 000,110,592 | ---- | M] () MD5=E72BF459A519312B4FF7F3FA8A85BA13 -- C:\Windows\assembly\GAC_MSIL\MMCFxCommon\3.0.0.0__31bf3856ad364e35\MMCFxCommon.dll

[2010/10/04 11:02:18 | 000,016,384 | ---- | M] () MD5=2995D06505645FE3E58CF270A6653DC8 -- C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.3309.28626__90ba9c70f846762e\MOM.Foundation.DLL

[2010/10/04 11:02:17 | 000,106,496 | ---- | M] () MD5=D478C699AD74D3762DEA4C7DA1DB9706 -- C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.3428.38805__90ba9c70f846762e\MOM.Implementation.DLL

[2010/10/04 11:02:18 | 000,049,152 | ---- | M] () MD5=6B87742F27B087AF7FD4ADC2DB685DE0 -- C:\Windows\assembly\GAC_MSIL\MOM\2.0.0.0__90ba9c70f846762e\MOM.EXE

[2009/07/14 02:12:36 | 000,049,152 | ---- | M] () MD5=EB25746D99F39D4864DD2B488448D981 -- C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_en_31bf3856ad364e35\napinit.Resources.dll

[2009/07/14 01:22:44 | 000,073,728 | ---- | M] () MD5=0E2E919A5255D305CF1B3AE9B9D452F1 -- C:\Windows\assembly\GAC_MSIL\napinit\6.1.0.0__31bf3856ad364e35\NAPINIT.DLL

[2009/07/14 02:12:16 | 000,233,472 | ---- | M] () MD5=804C49310D2EA3B1A2E3809CE3C93B47 -- C:\Windows\assembly\GAC_MSIL\napsnap.resources\6.1.0.0_en_31bf3856ad364e35\napsnap.resources.dll

[2009/07/14 01:25:01 | 000,454,656 | ---- | M] () MD5=FC35785CC6FD225A4E504A23DE13D085 -- C:\Windows\assembly\GAC_MSIL\napsnap\6.1.0.0__31bf3856ad364e35\NAPSNAP.DLL

[2009/07/14 01:24:31 | 001,073,152 | ---- | M] () MD5=05A99415582B90E16D6B68B61FA16B72 -- C:\Windows\assembly\GAC_MSIL\Narrator\6.1.0.0__31bf3856ad364e35\Narrator.exe

[2010/10/04 11:02:18 | 000,028,672 | ---- | M] () MD5=9D5F0100CEF5AB1DB7111E0004E61003 -- C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3309.28603__90ba9c70f846762e\NEWAEM.Foundation.DLL

[2010/10/04 11:02:17 | 000,019,968 | ---- | M] () MD5=AC4EC2E8E3C965E9E86CACA9D418E3C8 -- C:\Windows\assembly\GAC_MSIL\PCKGHLP.Foundation.Implementation\2.0.3428.38818__90ba9c70f846762e\PCKGHLP.Foundation.Implementation.DLL

[2010/10/04 11:02:17 | 000,016,384 | ---- | M] () MD5=8E526406A367B74342A8A6F799E3A52F -- C:\Windows\assembly\GAC_MSIL\PCKGHLP.Foundation.Private\2.0.3309.28643__90ba9c70f846762e\PCKGHLP.Foundation.Private.DLL

[2010/10/04 10:37:58 | 000,000,815 | ---- | M] () MD5=0A33273323603FCBD8DDD74758163161 -- C:\Windows\assembly\GAC_MSIL\Policy.6.0.ehRecObj\6.1.0.0__31bf3856ad364e35\Policy.6.0.ehRecObj.config

[2010/10/04 10:37:58 | 000,005,632 | ---- | M] () MD5=841736FAB112AC493646E4399E684D38 -- C:\Windows\assembly\GAC_MSIL\Policy.6.0.ehRecObj\6.1.0.0__31bf3856ad364e35\Policy.6.0.ehRecObj.dll

[2010/10/04 10:37:58 | 000,000,831 | ---- | M] () MD5=A9C1035129544B3867E06A8F02874FE4 -- C:\Windows\assembly\GAC_MSIL\Policy.6.0.Microsoft.MediaCenter.UI\6.1.0.0__31bf3856ad364e35\Policy.6.0.Microsoft.MediaCenter.UI.config

[2010/10/04 10:37:58 | 000,005,632 | ---- | M] () MD5=1A49D09BD80C023A771214DA826FF6B6 -- C:\Windows\assembly\GAC_MSIL\Policy.6.0.Microsoft.MediaCenter.UI\6.1.0.0__31bf3856ad364e35\Policy.6.0.Microsoft.MediaCenter.UI.dll

[2010/10/04 10:37:58 | 000,000,828 | ---- | M] () MD5=52B88C0916FAFF34E0174CD718980AC4 -- C:\Windows\assembly\GAC_MSIL\Policy.6.0.Microsoft.MediaCenter\6.1.0.0__31bf3856ad364e35\Policy.6.0.Microsoft.MediaCenter.config

[2010/10/04 10:37:58 | 000,005,632 | ---- | M] () MD5=0C8F794B0C057EB421569A4E5B8E98C5 -- C:\Windows\assembly\GAC_MSIL\Policy.6.0.Microsoft.MediaCenter\6.1.0.0__31bf3856ad364e35\Policy.6.0.Microsoft.MediaCenter.dll

[2009/06/10 21:14:43 | 000,598,016 | ---- | M] () MD5=FCD1F37F2AD03BE5C7EC04A25763437E -- C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks\3.0.0.0__31bf3856ad364e35\PresentationBuildTasks.dll

[2009/06/10 21:14:50 | 000,032,768 | ---- | M] () MD5=24F02A6A94DC8AE6F2ACDA7950CBEEB3 -- C:\Windows\assembly\GAC_MSIL\PresentationCFFRasterizer\3.0.0.0__31bf3856ad364e35\PresentationCFFRasterizer.dll

[2009/06/10 21:14:51 | 000,042,856 | ---- | M] () MD5=E56F39F6B7FDA0AC77A79B0FD3DE1A2F -- C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe

[2009/06/10 21:14:43 | 000,196,608 | ---- | M] () MD5=C9DF30B6F5D99C8147C528528B9CC498 -- C:\Windows\assembly\GAC_MSIL\PresentationFramework.Aero\3.0.0.0__31bf3856ad364e35\PresentationFramework.Aero.dll

[2009/06/10 21:14:44 | 000,139,264 | ---- | M] () MD5=98F2493B40E00061B4A4369E63790293 -- C:\Windows\assembly\GAC_MSIL\PresentationFramework.Classic\3.0.0.0__31bf3856ad364e35\PresentationFramework.Classic.dll

[2009/06/10 21:14:44 | 000,397,312 | ---- | M] () MD5=DAFC1E9D6BFC6C4CA5C5EA9765E95095 -- C:\Windows\assembly\GAC_MSIL\PresentationFramework.Luna\3.0.0.0__31bf3856ad364e35\PresentationFramework.Luna.dll

[2009/06/10 21:14:44 | 000,163,840 | ---- | M] () MD5=13E8EC241CA1402C923DF3A1DA9CAF70 -- C:\Windows\assembly\GAC_MSIL\PresentationFramework.Royale\3.0.0.0__31bf3856ad364e35\PresentationFramework.Royale.dll

[2010/03/02 23:24:26 | 005,279,744 | ---- | M] () MD5=12524C6A4C871CA58626F0672BF02E03 -- C:\Windows\assembly\GAC_MSIL\PresentationFramework\3.0.0.0__31bf3856ad364e35\PresentationFramework.dll

[2009/06/10 21:14:52 | 000,864,256 | ---- | M] () MD5=0F8242348EBA698FF93193A6BDC55362 -- C:\Windows\assembly\GAC_MSIL\PresentationUI\3.0.0.0__31bf3856ad364e35\PresentationUI.dll

[2009/06/10 21:14:45 | 000,532,480 | ---- | M] () MD5=A243A30B8D9BB09CDB1F1C7B21A8F58E -- C:\Windows\assembly\GAC_MSIL\ReachFramework\3.0.0.0__31bf3856ad364e35\ReachFramework.dll

[2010/10/04 11:02:17 | 000,503,808 | ---- | M] () MD5=25F947BABBCA5AF1F48338AAD3A90B25 -- C:\Windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Implementation\2.0.3428.38835__90ba9c70f846762e\ResourceManagement.Foundation.Implementation.DLL

[2010/10/04 11:02:17 | 000,020,480 | ---- | M] () MD5=986F472CDCD90453BBB0643A235ACE09 -- C:\Windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Private\2.0.3309.28612__90ba9c70f846762e\ResourceManagement.Foundation.Private.DLL

[2009/07/14 02:12:22 | 000,011,776 | ---- | M] () MD5=5C9AF8FF40A8EE3758294468FD1BF8F3 -- C:\Windows\assembly\GAC_MSIL\SecurityAuditPoliciesSnapIn.resources\6.1.0.0_en_31bf3856ad364e35\SecurityAuditPoliciesSnapIn.resources.dll

[2009/07/14 01:24:36 | 000,167,936 | ---- | M] () MD5=363BCCF6EE29A19D554AB5F495A171DC -- C:\Windows\assembly\GAC_MSIL\SecurityAuditPoliciesSnapIn\6.1.0.0__31bf3856ad364e35\SecurityAuditPoliciesSnapIn.dll

[2009/06/10 21:15:18 | 000,005,632 | ---- | M] () MD5=AA7004ABA8C37DDCA200E16F1570EF62 -- C:\Windows\assembly\GAC_MSIL\Sentinel.v3.5Client\3.5.0.0__b03f5f7f11d50a3a\Sentinel.v3.5Client.dll

[2009/06/10 21:14:05 | 000,110,592 | ---- | M] () MD5=369E1253698898EFBC3D6F9CD051A257 -- C:\Windows\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0__b77a5c561934e089\SMdiagnostics.dll

[2009/06/10 21:14:05 | 000,128,848 | ---- | M] () MD5=FE2AA5A684B0DD9B1FAE57B7817C198B -- C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe

[2009/07/14 01:25:09 | 000,086,016 | ---- | M] () MD5=46107610B0BDFA104BDF859664DB1654 -- C:\Windows\assembly\GAC_MSIL\SonicMCEBurnEngine\6.1.0.0__31bf3856ad364e35\SonicMCEBurnEngine.dll

[2009/07/14 02:12:38 | 000,200,704 | ---- | M] () MD5=0C47C980ABB9D70CAFE330076925B2E2 -- C:\Windows\assembly\GAC_MSIL\SrpUxSnapIn.resources\6.1.0.0_en_31bf3856ad364e35\SrpUxSnapIn.resources.dll

[2009/07/14 01:26:43 | 001,048,576 | ---- | M] () MD5=ACCBEC0D0C34DE1F856443BF65B1B63B -- C:\Windows\assembly\GAC_MSIL\SrpUxSnapIn\6.1.0.0__31bf3856ad364e35\SrpUxSnapIn.dll

[2009/06/10 21:23:17 | 000,110,592 | ---- | M] () MD5=3C8AF820562CC8E3A1CF82650518F66C -- C:\Windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll

[2009/06/10 21:14:41 | 000,045,056 | ---- | M] () MD5=B37D4A9C2C86CF3FA3991564B2E6468D -- C:\Windows\assembly\GAC_MSIL\System.AddIn.Contract\2.0.0.0__b03f5f7f11d50a3a\System.AddIn.Contract.dll

[2010/10/04 15:11:20 | 000,039,624 | ---- | M] () MD5=80F57E4804E4BA1B203F8427C0475470 -- C:\Windows\assembly\GAC_MSIL\System.AddIn\2.0.0.0__b03f5f7f11d50a3a\System.AddIn.dll

[2009/06/10 21:14:41 | 000,163,840 | ---- | M] () MD5=3168D49193CF62E3570259DA4E2C5146 -- C:\Windows\assembly\GAC_MSIL\System.AddIn\3.5.0.0__b77a5c561934e089\System.AddIn.dll

[2009/06/10 21:14:41 | 000,057,344 | ---- | M] () MD5=94596104E64ACD0185609A6D92AC9F0F -- C:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll

[2009/06/10 21:23:17 | 000,081,920 | ---- | M] () MD5=0DC6C0B3B2F72275BEAA9BBCEF887599 -- C:\Windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll

[2009/06/10 21:23:17 | 000,425,984 | ---- | M] () MD5=A48DD7B748B59F919E59151778C32A43 -- C:\Windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll

[2009/06/10 21:14:41 | 000,667,648 | ---- | M] () MD5=E515CF797DC351ED69BEF2437A7F4D87 -- C:\Windows\assembly\GAC_MSIL\System.Core\3.5.0.0__b77a5c561934e089\System.Core.dll

[2009/06/10 21:14:41 | 000,053,248 | ---- | M] () MD5=A6CA0FE6E3CE343FCDF75AF1E60BC20A -- C:\Windows\assembly\GAC_MSIL\System.Data.DataSetExtensions\3.5.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll

[2009/06/10 21:14:41 | 000,229,376 | ---- | M] () MD5=BFC4D06A7933BE331739B10C86B9824E -- C:\Windows\assembly\GAC_MSIL\System.Data.Entity.Design\3.5.0.0__b77a5c561934e089\System.Data.Entity.Design.dll

[2009/06/10 21:14:41 | 002,879,488 | ---- | M] () MD5=7FC42304994C20C1891FFF352B24CFC9 -- C:\Windows\assembly\GAC_MSIL\System.Data.Entity\3.5.0.0__b77a5c561934e089\System.Data.Entity.dll

[2009/06/10 21:14:42 | 000,684,032 | ---- | M] () MD5=02C4B2256CC4C96963F758B806957401 -- C:\Windows\assembly\GAC_MSIL\System.Data.Linq\3.5.0.0__b77a5c561934e089\System.Data.Linq.dll

[2009/06/10 21:14:42 | 000,294,912 | ---- | M] () MD5=97D188D493FF91087D6EAD51909FA9C2 -- C:\Windows\assembly\GAC_MSIL\System.Data.Services.Client\3.5.0.0__b77a5c561934e089\System.Data.Services.Client.dll

[2009/06/10 21:14:43 | 000,114,688 | ---- | M] () MD5=13CE6E1B97C942CF8C3F1DDDC2A7CD6E -- C:\Windows\assembly\GAC_MSIL\System.Data.Services.Design\3.5.0.0__b77a5c561934e089\System.Data.Services.Design.dll

[2009/06/10 21:14:43 | 000,442,368 | ---- | M] () MD5=99FA5DF098453E10F2FF1704E53F1B3F -- C:\Windows\assembly\GAC_MSIL\System.Data.Services\3.5.0.0__b77a5c561934e089\System.Data.Services.dll

[2009/06/10 21:23:17 | 000,745,472 | ---- | M] () MD5=304E3F399C0FFF60C4B72D04B46929BC -- C:\Windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll

[2009/06/10 21:23:17 | 000,970,752 | ---- | M] () MD5=03865F1ACE9381CB3108BC0CF9AF13A9 -- C:\Windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll

[2009/06/10 21:23:18 | 004,927,488 | ---- | M] () MD5=0606524F3842C143F1081FD093855770 -- C:\Windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll

[2009/06/10 21:14:43 | 000,290,816 | ---- | M] () MD5=50A720849C74464E2282F478B094A605 -- C:\Windows\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\3.5.0.0__b77a5c561934e089\System.DirectoryServices.AccountManagement.dll

[2009/06/10 21:23:18 | 000,188,416 | ---- | M] () MD5=EE1DCDAA3EA8F53DA56116875CD01653 -- C:\Windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll

[2009/06/10 21:23:18 | 000,401,408 | ---- | M] () MD5=217FD2DD18AF542143406F654A172999 -- C:\Windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll

[2009/06/10 21:23:18 | 000,081,920 | ---- | M] () MD5=D195A195E3D16A867FD4382D786313B8 -- C:\Windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll

[2009/06/10 21:23:18 | 000,626,688 | ---- | M] () MD5=87A4490F2FB127D40DA7A56D4720C772 -- C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll

[2009/06/10 21:13:53 | 000,126,976 | ---- | M] () MD5=E931A04277012931BA25D1F04A515788 -- C:\Windows\assembly\GAC_MSIL\System.IdentityModel.Selectors\3.0.0.0__b77a5c561934e089\System.IdentityModel.Selectors.dll

[2009/06/10 21:13:53 | 000,438,272 | ---- | M] () MD5=D3DAA393C106A868580E5CBA4358D13D -- C:\Windows\assembly\GAC_MSIL\System.IdentityModel\3.0.0.0__b77a5c561934e089\System.IdentityModel.dll

[2009/06/10 21:13:54 | 000,131,072 | ---- | M] () MD5=AC45DB17E166ECEBD320D4FA2820C1B6 -- C:\Windows\assembly\GAC_MSIL\System.IO.Log\3.0.0.0__b03f5f7f11d50a3a\System.IO.Log.dll

[2009/07/14 02:12:52 | 000,253,952 | ---- | M] () MD5=1EDD1805695D0359F26427AE951F8C49 -- C:\Windows\assembly\GAC_MSIL\System.Management.Automation.Resources\1.0.0.0_en_31bf3856ad364e35\System.Management.Automation.Resources.dll

[2009/07/14 01:27:19 | 003,010,560 | ---- | M] () MD5=A86CE73D49B58BDF2D5DD1AE1F99131D -- C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll

[2009/06/10 21:14:43 | 000,143,360 | ---- | M] () MD5=616A76EBF4E2BAF781FD79FFAFD8D91F -- C:\Windows\assembly\GAC_MSIL\System.Management.Instrumentation\3.5.0.0__b77a5c561934e089\System.Management.Instrumentation.dll

[2009/06/10 21:23:18 | 000,372,736 | ---- | M] () MD5=5FB63CD5A4A3DF7978008A224631712C -- C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll

[2009/06/10 21:23:18 | 000,258,048 | ---- | M] () MD5=26BF0487D0316C4B752BCE342D3719CF -- C:\Windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll

[2009/06/10 21:14:43 | 000,237,568 | ---- | M] () MD5=3DCEE3E54CF61AF54192BA17C0BD5F68 -- C:\Windows\assembly\GAC_MSIL\System.Net\3.5.0.0__b03f5f7f11d50a3a\System.Net.dll

[2009/06/10 21:23:19 | 000,303,104 | ---- | M] () MD5=D1AAD0BC231DB38BF1DC941D037A1881 -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll

[2009/06/10 21:23:19 | 000,131,072 | ---- | M] () MD5=C9781DA4EE6A5BBAE271CC0AC4B25D7C -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll

[2009/06/10 21:13:54 | 000,970,752 | ---- | M] () MD5=E84934B015EFA04C7AE4490FCE717E80 -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization\3.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll

[2010/03/03 23:27:51 | 000,258,048 | ---- | M] () MD5=F96F62C128238F9C9CD0F0F073938F31 -- C:\Windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll

[2009/06/10 21:14:06 | 000,073,728 | ---- | M] () MD5=AE27E37C39C3F6F4512A7FD0429E0DD4 -- C:\Windows\assembly\GAC_MSIL\System.ServiceModel.Install\3.0.0.0__b77a5c561934e089\System.ServiceModel.Install.dll

[2009/06/10 21:14:07 | 000,032,768 | ---- | M] () MD5=488B1BB57FF630B8A55AC4746892C62A -- C:\Windows\assembly\GAC_MSIL\System.ServiceModel.WasHosting\3.0.0.0__b77a5c561934e089\System.ServiceModel.WasHosting.dll

[2009/06/10 21:14:02 | 000,569,344 | ---- | M] () MD5=942E87FCCDD49EA19FE88568418EEEC2 -- C:\Windows\assembly\GAC_MSIL\System.ServiceModel.Web\3.5.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll

[2009/06/10 21:13:55 | 005,963,776 | ---- | M] () MD5=EEB8E36572EF516AD3A83C4A822480A1 -- C:\Windows\assembly\GAC_MSIL\System.ServiceModel\3.0.0.0__b77a5c561934e089\System.ServiceModel.dll

[2009/06/10 21:23:19 | 000,114,688 | ---- | M] () MD5=3D727C622207B1EE2A3F5EF1D0A06103 -- C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll

[2009/06/10 21:14:45 | 000,688,128 | ---- | M] () MD5=31588B867657A7DF046AC1908550D73C -- C:\Windows\assembly\GAC_MSIL\System.Speech\3.0.0.0__31bf3856ad364e35\System.Speech.dll

[2009/06/10 21:14:43 | 000,077,824 | ---- | M] () MD5=ED80E41E33CA025AF3E9E37C94EF67D0 -- C:\Windows\assembly\GAC_MSIL\System.Web.Abstractions\3.5.0.0__31bf3856ad364e35\System.Web.Abstractions.dll

[2009/06/10 21:14:44 | 000,032,768 | ---- | M] () MD5=0DA799A261DED34749433028A4FB7933 -- C:\Windows\assembly\GAC_MSIL\System.Web.DynamicData.Design\3.5.0.0__31bf3856ad364e35\System.Web.DynamicData.Design.dll

[2009/06/10 21:14:44 | 000,229,376 | ---- | M] () MD5=9C34FC484CF5B173952D30E6E80BD101 -- C:\Windows\assembly\GAC_MSIL\System.Web.DynamicData\3.5.0.0__31bf3856ad364e35\System.Web.DynamicData.dll

[2009/06/10 21:14:44 | 000,131,072 | ---- | M] () MD5=28EADDDC076CD923521939C69B04049A -- C:\Windows\assembly\GAC_MSIL\System.Web.Entity.Design\3.5.0.0__b77a5c561934e089\System.Web.Entity.Design.dll

[2009/06/10 21:14:44 | 000,139,264 | ---- | M] () MD5=A8F666FBE7B85071ACE625EE97D40C71 -- C:\Windows\assembly\GAC_MSIL\System.Web.Entity\3.5.0.0__b77a5c561934e089\System.Web.Entity.dll

[2009/06/10 21:14:44 | 000,335,872 | ---- | M] () MD5=6466B1D33C081E16897A760E32D0A70A -- C:\Windows\assembly\GAC_MSIL\System.Web.Extensions.Design\3.5.0.0__31bf3856ad364e35\System.Web.Extensions.Design.dll

[2011/12/26 19:13:18 | 001,277,952 | ---- | M] () MD5=3DCEF2887FC9E56009576D7953DEAC10 -- C:\Windows\assembly\GAC_MSIL\System.Web.Extensions\3.5.0.0__31bf3856ad364e35\System.Web.Extensions.dll

[2009/06/10 21:23:20 | 000,835,584 | ---- | M] () MD5=354D0B6C4788FA64D4E20C03BD3087B5 -- C:\Windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll

[2009/06/10 21:23:20 | 000,077,824 | ---- | M] () MD5=1CDB3B55F1330F85A674B0B5927399F4 -- C:\Windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll

[2009/06/10 21:14:45 | 000,061,440 | ---- | M] () MD5=E055C3327514D7C13A09066BEA9D2272 -- C:\Windows\assembly\GAC_MSIL\System.Web.Routing\3.5.0.0__31bf3856ad364e35\System.Web.Routing.dll

[2009/06/10 21:23:20 | 000,839,680 | ---- | M] () MD5=8C003C74490965809C31872AD37AB3D0 -- C:\Windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll

[2011/03/29 22:31:57 | 005,025,792 | ---- | M] () MD5=42152D485417AEF6A6DE591D03E5060C -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll

[2009/06/10 21:15:18 | 000,012,288 | ---- | M] () MD5=1CCEE8037C8EF9A08DD0ADB7E3E38D78 -- C:\Windows\assembly\GAC_MSIL\System.Windows.Presentation\3.5.0.0__b77a5c561934e089\System.Windows.Presentation.dll

[2009/06/10 21:15:04 | 001,142,784 | ---- | M] () MD5=E83FFA8C63A9FC3C780AE0534E7E418D -- C:\Windows\assembly\GAC_MSIL\System.Workflow.Activities\3.0.0.0__31bf3856ad364e35\System.Workflow.Activities.dll

[2009/06/10 21:15:04 | 001,630,208 | ---- | M] () MD5=F27C84A85FB5B7417CC8137214C5DFDF -- C:\Windows\assembly\GAC_MSIL\System.Workflow.ComponentModel\3.0.0.0__31bf3856ad364e35\System.Workflow.ComponentModel.dll

[2009/06/10 21:15:06 | 000,540,672 | ---- | M] () MD5=92B6701C135AE30B417434930A86428E -- C:\Windows\assembly\GAC_MSIL\System.Workflow.Runtime\3.0.0.0__31bf3856ad364e35\System.Workflow.Runtime.dll

[2009/06/10 21:14:02 | 000,507,904 | ---- | M] () MD5=78E116F57E03D87E4AEAC40983E89CB2 -- C:\Windows\assembly\GAC_MSIL\System.WorkflowServices\3.5.0.0__31bf3856ad364e35\System.WorkflowServices.dll

[2009/06/10 21:14:45 | 000,139,264 | ---- | M] () MD5=B6C23BF05E37A09411FC53846C1DC367 -- C:\Windows\assembly\GAC_MSIL\System.Xml.Linq\3.5.0.0__b77a5c561934e089\System.Xml.Linq.dll

[2009/06/10 21:23:20 | 002,048,000 | ---- | M] () MD5=F22D328C441D7CA7CA37B418B56FE044 -- C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll

[2011/10/31 23:17:23 | 003,182,592 | ---- | M] () MD5=3FE4FADC22BDFEE94CDF027D53479888 -- C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll

[2009/07/14 02:12:46 | 000,007,168 | ---- | M] () MD5=ABBF43F681EF160CAAB7C41BC289DA06 -- C:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_en_31bf3856ad364e35\TaskScheduler.resources.dll

[2009/07/14 01:20:39 | 000,167,936 | ---- | M] () MD5=23DA50771A645276CA5DB01B855040C3 -- C:\Windows\assembly\GAC_MSIL\TaskScheduler\6.1.0.0__31bf3856ad364e35\TaskScheduler.dll

[2009/06/10 21:14:45 | 000,172,032 | ---- | M] () MD5=3F47DB8D603A84FBF1154901AAC177CD -- C:\Windows\assembly\GAC_MSIL\UIAutomationClient\3.0.0.0__31bf3856ad364e35\UIAutomationClient.dll

[2009/06/10 21:14:46 | 000,380,928 | ---- | M] () MD5=32D7B8CC805D2DA70D01DA89982DCE1D -- C:\Windows\assembly\GAC_MSIL\UIAutomationClientsideProviders\3.0.0.0__31bf3856ad364e35\UIAutomationClientsideProviders.dll

[2009/06/10 21:14:46 | 000,040,960 | ---- | M] () MD5=0D2A84FF4383B4F41EDA8B4DE2D45D6C -- C:\Windows\assembly\GAC_MSIL\UIAutomationProvider\3.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll

[2009/06/10 21:14:46 | 000,098,304 | ---- | M] () MD5=62DF8C1D169752DF885E44D21309F7E6 -- C:\Windows\assembly\GAC_MSIL\UIAutomationTypes\3.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll

[2010/03/02 23:24:26 | 001,249,280 | ---- | M] () MD5=3049F8DEA68EAFB3A8B91463C6675574 -- C:\Windows\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\WindowsBase.dll

[2009/06/10 21:14:47 | 000,094,208 | ---- | M] () MD5=D9673C241B14E5526A81B3ABAD3FD3BA -- C:\Windows\assembly\GAC_MSIL\WindowsFormsIntegration\3.0.0.0__31bf3856ad364e35\WindowsFormsIntegration.dll

[2009/06/10 21:14:07 | 000,149,328 | ---- | M] () MD5=ED901B53CCA792700D688003FA1F09F7 -- C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe

< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems /s >

"Debug" =

"" = mnmsrvc

"Kmode" = \SystemRoot\System32\win32k.sys

"Optional" = Posix [binary data]

"Posix" = %SystemRoot%\system32\psxss.exe

"Required" = DebugWindows [binary data]

"Windows" = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\CSRSS]

"CsrSrvSharedSectionBase" = 2137980928

< MD5 for: AFD.SYS >

[2011/04/25 02:18:03 | 000,338,944 | ---- | M] (Microsoft Corporation) MD5=9EBBBA55060F786F0FCAA3893BFA2806 -- C:\Windows\System32\drivers\afd.sys

[2011/04/25 02:18:03 | 000,338,944 | ---- | M] (Microsoft Corporation) MD5=9EBBBA55060F786F0FCAA3893BFA2806 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17603_none_d9f97e05bca8003a\afd.sys

[2011/04/25 02:27:23 | 000,338,944 | ---- | M] (Microsoft Corporation) MD5=C114AB7A1550D42EA1700FFD4179CF5A -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.20951_none_d864ad9ad8c98d1f\afd.sys

[2011/04/25 03:24:09 | 000,338,944 | ---- | M] (Microsoft Corporation) MD5=C427F91A748CD342A2B3F9278D9FD6A5 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.21712_none_da774a9ad5cea29e\afd.sys

[2009/07/13 23:12:38 | 000,338,944 | ---- | M] (Microsoft Corporation) MD5=DDC040FDB01EF1712A6B13E52AFB104C -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16385_none_d7be98b5bfc0b4c1\afd.sys

< MD5 for: ATAPI.SYS >

[2009/07/14 01:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\ERDNT\cache\atapi.sys

[2009/07/14 01:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys

[2009/07/14 01:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys

[2009/07/14 01:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys

< MD5 for: CSC.SYS >

[2009/07/13 23:15:13 | 000,387,584 | ---- | M] (Microsoft Corporation) MD5=27C9490BDD0AE48911AB8CF1932591ED -- C:\Windows\System32\drivers\csc.sys

[2012/03/09 21:40:45 | 000,388,096 | ---- | M] (Microsoft Corporation) MD5=3C2177A897B4CA2788C6FB0C3FD81D4B -- C:\csc.sys

[2012/03/09 21:40:45 | 000,388,096 | ---- | M] (Microsoft Corporation) MD5=3C2177A897B4CA2788C6FB0C3FD81D4B -- C:\Documents and Settings\user\Desktop\Cleening 09.03.12\csc.sys

[2012/03/09 21:40:45 | 000,388,096 | ---- | M] (Microsoft Corporation) MD5=3C2177A897B4CA2788C6FB0C3FD81D4B -- C:\Users\user\Desktop\Cleening 09.03.12\csc.sys

< MD5 for: DISK.SYS >

[2009/07/14 01:20:27 | 000,057,424 | ---- | M] (Microsoft Corporation) MD5=565003F326F99802E68CA78F2A68E9FF -- C:\Windows\System32\drivers\disk.sys

[2009/07/14 01:20:27 | 000,057,424 | ---- | M] (Microsoft Corporation) MD5=565003F326F99802E68CA78F2A68E9FF -- C:\Windows\System32\DriverStore\FileRepository\disk.inf_x86_neutral_b431b61a11f8df6c\disk.sys

[2009/07/14 01:20:27 | 000,057,424 | ---- | M] (Microsoft Corporation) MD5=565003F326F99802E68CA78F2A68E9FF -- C:\Windows\winsxs\x86_disk.inf_31bf3856ad364e35_6.1.7600.16385_none_f99cd807d58018cb\disk.sys

< MD5 for: EXPLORER.EXE >

[2009/07/14 01:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe

[2009/10/31 05:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\ERDNT\cache\explorer.exe

[2009/10/31 05:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\explorer.exe

[2009/10/31 05:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe

[2009/08/03 05:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe

[2009/08/03 05:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe

[2009/10/31 06:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe

< MD5 for: I8042PRT.SYS >

[2009/07/13 23:11:24 | 000,080,896 | ---- | M] (Microsoft Corporation) MD5=F151F0BDC47F4A28B1B20A0818EA36D6 -- C:\Windows\System32\drivers\i8042prt.sys

[2009/07/13 23:11:24 | 000,080,896 | ---- | M] (Microsoft Corporation) MD5=F151F0BDC47F4A28B1B20A0818EA36D6 -- C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_x86_neutral_0c4a1880f2aa5a72\i8042prt.sys

[2009/07/13 23:11:24 | 000,080,896 | ---- | M] (Microsoft Corporation) MD5=F151F0BDC47F4A28B1B20A0818EA36D6 -- C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_x86_neutral_7a9084e0177406eb\i8042prt.sys

[2009/07/13 23:11:24 | 000,080,896 | ---- | M] (Microsoft Corporation) MD5=F151F0BDC47F4A28B1B20A0818EA36D6 -- C:\Windows\winsxs\x86_keyboard.inf_31bf3856ad364e35_6.1.7600.16385_none_9724c3fc3a4c81ef\i8042prt.sys

[2009/07/13 23:11:24 | 000,080,896 | ---- | M] (Microsoft Corporation) MD5=F151F0BDC47F4A28B1B20A0818EA36D6 -- C:\Windows\winsxs\x86_msmouse.inf_31bf3856ad364e35_6.1.7600.16385_none_4e0a61a033aec8c3\i8042prt.sys

< MD5 for: LSASS.EXE >

[2011/11/17 07:09:25 | 000,022,528 | ---- | M] (Microsoft Corporation) MD5=05F38CB7CAB3CE8E9A1812D517DA93EF -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.1.7600.21092_none_a69c8e86d7476262\lsass.exe

[2011/11/17 05:29:50 | 000,022,528 | ---- | M] (Microsoft Corporation) MD5=81951F51E318AECC2D68559E47485CC4 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.1.7601.17725_none_a84828d7bb1480d7\lsass.exe

[2011/11/17 05:36:26 | 000,022,528 | ---- | M] (Microsoft Corporation) MD5=C2243FF9E9AAD0C30E8B1A0914DA15B6 -- C:\Windows\ERDNT\cache\lsass.exe

[2011/11/17 05:36:26 | 000,022,528 | ---- | M] (Microsoft Corporation) MD5=C2243FF9E9AAD0C30E8B1A0914DA15B6 -- C:\Windows\System32\lsass.exe

[2011/11/17 05:36:26 | 000,022,528 | ---- | M] (Microsoft Corporation) MD5=C2243FF9E9AAD0C30E8B1A0914DA15B6 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.1.7600.16915_none_a66c9bbdbde5f8fa\lsass.exe

[2009/07/14 01:14:23 | 000,022,528 | ---- | M] (Microsoft Corporation) MD5=F42309C4191C506B71DB5D1126D26318 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.1.7600.16385_none_a620e0e5be1ecda7\lsass.exe

[2011/11/17 05:24:04 | 000,022,528 | ---- | M] (Microsoft Corporation) MD5=FBCB2DFA40862DAA7B1534C9538208A5 -- C:\Windows\winsxs\x86_microsoft-windows-lsa_31bf3856ad364e35_6.1.7601.21861_none_a8a284cad4562b09\lsass.exe

< MD5 for: NETBT.SYS >

[2012/03/09 21:41:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=280122DDCF04B378EDD1AD54D71C1E54 -- C:\Documents and Settings\user\Desktop\Cleening 09.03.12\netbt.sys

[2012/03/09 21:41:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=280122DDCF04B378EDD1AD54D71C1E54 -- C:\netbt.sys

[2012/03/09 21:41:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=280122DDCF04B378EDD1AD54D71C1E54 -- C:\Users\user\Desktop\Cleening 09.03.12\netbt.sys

[2012/03/09 21:41:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=280122DDCF04B378EDD1AD54D71C1E54 -- C:\Windows\System32\drivers\netbt.sys

< MD5 for: SERIAL.SYS >

[2009/07/13 23:45:33 | 000,083,456 | ---- | M] (Microsoft Corporation) MD5=5FB7FCEA0490D821F26F39CC5EA3D1E2 -- C:\Windows\System32\drivers\serial.sys

[2009/07/13 23:45:33 | 000,083,456 | ---- | M] (Microsoft Corporation) MD5=5FB7FCEA0490D821F26F39CC5EA3D1E2 -- C:\Windows\System32\DriverStore\FileRepository\msports.inf_x86_neutral_c1a802e06677f73f\serial.sys

[2009/07/13 23:45:33 | 000,083,456 | ---- | M] (Microsoft Corporation) MD5=5FB7FCEA0490D821F26F39CC5EA3D1E2 -- C:\Windows\winsxs\x86_msports.inf_31bf3856ad364e35_6.1.7600.16385_none_f86e06d519b1d9a4\serial.sys

< MD5 for: SVCHOST.EXE >

[2009/07/14 01:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\ERDNT\cache\svchost.exe

[2009/07/14 01:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\System32\svchost.exe

[2009/07/14 01:14:41 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 -- C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe

[2012/01/13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe

< MD5 for: TCPIP.SYS >

[2011/04/25 04:56:06 | 001,286,016 | ---- | M] (Microsoft Corporation) MD5=0158D5E9982E9D6A90DFC802F618E130 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.16802_none_b347f075c77b9c9d\tcpip.sys

[2011/06/21 05:34:23 | 001,290,624 | ---- | M] (Microsoft Corporation) MD5=04E4A7D53A7ACE02E8C55B17A498F631 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.17638_none_b513df73c4b4f466\tcpip.sys

[2011/09/29 16:02:44 | 001,301,872 | ---- | M] (Microsoft Corporation) MD5=22F7E7CBCA308DEE3428B097D4F8A61C -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.21060_none_b38e8546e0cbe4a1\tcpip.sys

[2011/04/25 04:31:30 | 001,290,624 | ---- | M] (Microsoft Corporation) MD5=24326784DF8F3D5F5BBB9F878CE33C14 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.17603_none_b52f4dc5c4a121e0\tcpip.sys

[2009/07/14 01:19:10 | 001,285,712 | ---- | M] (Microsoft Corporation) MD5=2CC3D75488ABD3EC628BBB9A4FC84EFC -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.16385_none_b2f46875c7b9d667\tcpip.sys

[2011/09/29 16:17:18 | 001,303,920 | ---- | M] (Microsoft Corporation) MD5=3C1C41E317710F74CEC1E7F0D5325993 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.21828_none_b5a84e10ddca7566\tcpip.sys

[2011/09/29 15:43:37 | 001,285,488 | ---- | M] (Microsoft Corporation) MD5=56C198AC82EFA622DD93E9E43575F79C -- C:\Windows\ERDNT\cache\tcpip.sys

[2011/09/29 15:43:37 | 001,285,488 | ---- | M] (Microsoft Corporation) MD5=56C198AC82EFA622DD93E9E43575F79C -- C:\Windows\System32\drivers\tcpip.sys

[2011/09/29 15:43:37 | 001,285,488 | ---- | M] (Microsoft Corporation) MD5=56C198AC82EFA622DD93E9E43575F79C -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.16889_none_b2f8731bc7b62d86\tcpip.sys

[2011/09/29 16:03:04 | 001,290,608 | ---- | M] (Microsoft Corporation) MD5=65D10B191C59C5501A1263FC33F6894B -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.17697_none_b4d1ffa1c4e682b5\tcpip.sys

[2011/04/25 06:31:09 | 001,301,376 | ---- | M] (Microsoft Corporation) MD5=6D4728CFF2724FF3A4654971D61D0F1C -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.21712_none_b5ad1a5addc7c444\tcpip.sys

[2011/04/25 04:44:18 | 001,298,816 | ---- | M] (Microsoft Corporation) MD5=8861B9A06BA99C6E1D62D0C86DFAB86C -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.20951_none_b39a7d5ae0c2aec5\tcpip.sys

[2011/06/21 05:30:45 | 001,301,376 | ---- | M] (Microsoft Corporation) MD5=93C444D118B184452132357C322124CD -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.20992_none_b3703df4e0e237e0\tcpip.sys

[2010/06/14 06:06:58 | 001,288,576 | ---- | M] (Microsoft Corporation) MD5=A39EA325C081AD27461F630C8E3E56E0 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.20733_none_b3b219fae0b0af43\tcpip.sys

[2010/06/14 06:12:30 | 001,286,016 | ---- | M] (Microsoft Corporation) MD5=BB7F39C31C4A4417FD318E7CD184E225 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.16610_none_b33b1c29c7858b92\tcpip.sys

[2011/06/21 05:39:53 | 001,286,016 | ---- | M] (Microsoft Corporation) MD5=C2DAAEB48F3A47C410B041A0D2382EE1 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.16839_none_b32e82b7c78da1d1\tcpip.sys

[2011/06/21 06:54:00 | 001,303,424 | ---- | M] (Microsoft Corporation) MD5=DEC4940487050AE13C60C86F40E07E75 -- C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.21754_none_b583db3edde666b6\tcpip.sys

< MD5 for: USERINIT.EXE >

[2009/07/14 01:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\ERDNT\cache\userinit.exe

[2009/07/14 01:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe

[2009/07/14 01:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe

< MD5 for: VOLSNAP.SYS >

[2009/07/14 01:19:10 | 000,245,328 | ---- | M] (Microsoft Corporation) MD5=58DF9D2481A56EDDE167E51B334D44FD -- C:\Windows\System32\drivers\volsnap.sys

[2009/07/14 01:19:10 | 000,245,328 | ---- | M] (Microsoft Corporation) MD5=58DF9D2481A56EDDE167E51B334D44FD -- C:\Windows\System32\DriverStore\FileRepository\volume.inf_x86_neutral_29364d30156a24ca\volsnap.sys

[2009/07/14 01:19:10 | 000,245,328 | ---- | M] (Microsoft Corporation) MD5=58DF9D2481A56EDDE167E51B334D44FD -- C:\Windows\winsxs\x86_volume.inf_31bf3856ad364e35_6.1.7600.16385_none_158d0da45d68903e\volsnap.sys

< MD5 for: WININIT.EXE >

[2009/07/14 01:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\ERDNT\cache\wininit.exe

[2009/07/14 01:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe

[2009/07/14 01:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe

< MD5 for: WINLOGON.EXE >

[2009/10/28 06:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\ERDNT\cache\winlogon.exe

[2009/10/28 06:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe

[2009/10/28 06:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe

[2009/10/28 05:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe

[2012/01/13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe

[2009/07/14 01:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe

========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data] -> C:\Windows\system32\config\systemprofile\AppData\Local -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data] -> C:\Windows\system32\config\systemprofile\AppData\Local -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data] -> C:\Windows\system32\config\systemprofile\AppData\Local -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data] -> C:\Windows\system32\config\systemprofile\AppData\Local -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data] -> C:\Windows\system32\config\systemprofile\AppData\Local -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\History] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data] -> C:\Windows\system32\config\systemprofile\AppData\Local -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\History] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Application Data] -> C:\Windows\system32\config\systemprofile\AppData\Local -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\History] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data\Temporary Internet Files] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Application Data] -> C:\Windows\system32\config\systemprofile\AppData\Local -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\History] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data\Temporary Internet Files] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Application Data] -> C:\Windows\system32\config\systemprofile\AppData\Local -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\History] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data\Temporary Internet Files] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Application Data] -> C:\Windows\system32\config\systemprofile\AppData\Local -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\History] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History -> Junction

[C:\Windows\System32\config\systemprofile\AppData\Local\Temporary Internet Files] -> C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files -> Junction

[C:\Windows\System32\config\systemprofile\Application Data] -> C:\Windows\system32\config\systemprofile\AppData\Roaming -> Junction

[C:\Windows\System32\config\systemprofile\Documents\My Music] -> C:\Windows\system32\config\systemprofile\Music -> Junction

[C:\Windows\System32\config\systemprofile\Documents\My Pictures] -> C:\Windows\system32\config\systemprofile\Pictures -> Junction

[C:\Windows\System32\config\systemprofile\Documents\My Videos] -> C:\Windows\system32\config\systemprofile\Videos -> Junction

[C:\Windows\System32\config\systemprofile\Local Settings] -> C:\Windows\system32\config\systemprofile\AppData\Local -> Junction

[C:\Windows\System32\config\systemprofile\My Documents] -> C:\Windows\system32\config\systemprofile\Documents -> Junction

[C:\Windows\System32\config\systemprofile\NetHood] -> C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Network Shortcuts -> Junction

[C:\Windows\System32\config\systemprofile\PrintHood] -> C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Printer Shortcuts -> Junction

[C:\Windows\System32\config\systemprofile\Recent] -> C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Recent -> Junction

[C:\Windows\System32\config\systemprofile\SendTo] -> C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo -> Junction

[C:\Windows\System32\config\systemprofile\Start Menu] -> C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu -> Junction

[C:\Windows\System32\config\systemprofile\Templates] -> C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Templates -> Junction

========== Alternate Data Streams ==========

@Alternate Data Stream - 156 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >

3.От Junction:

Junction v1.06 - Windows junction creator and reparse point viewer

Sysinternals - www.sysinternals.com

No reparse points found.

4.От ESET-сканира 3ч15мин, намери 27..., повечето в D:.Там имам exeфайлове на програми и някои имат кейгенове, пачове и сигурно са заминали, ще трябва да ги възстановявам от другаде...Когато AVG ги карантинира, аз ги връщам...

ESETSmartInstaller@High as downloader log:

Can not open internetESETSmartInstaller@High as downloader log:

Can not open internetCan not open internetESETSmartInstaller@High as downloader log:

Can not open internet# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=77cf0a545b472d4cb669b174cdfee22c

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2012-03-10 11:19:43

# local_time=2012-03-10 11:19:43 (+0000, GMT Standard Time)

# country="United Kingdom"

# lang=1033

# osver=6.1.7600 NT

# compatibility_mode=1029 16777214 0 1 873337 873337 0 0

# compatibility_mode=5893 16776574 66 85 121905 83869177 0 0

# compatibility_mode=8192 67108863 100 0 3858 3858 0 0

# scanned=203679

# found=27

# cleaned=27

# scan_time=11596

C:\Documents and Settings\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\eBay.lnk Win32/Adware.ADON application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Start Menu\eBay.lnk Win32/Adware.ADON application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\user\Desktop\Context Menu Edit\File menu Tools\SoftonicDownloader_for_filemenu-tools.exe a variant of Win32/SoftonicDownloader.C application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Qoobox\Quarantine\C\Users\user\AppData\Local\1780797c\U\[email protected] Win32/Sirefef.DV trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Qoobox\Quarantine\C\Users\user\AppData\Local\1780797c\U\[email protected] Win32/Agent.TEO trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Qoobox\Quarantine\C\Windows\system32\Drivers\csc.sys.vir a variant of Win32/Sirefef.DA trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Qoobox\Quarantine\C\Windows\system32\Drivers\csc.sys.vir_ a variant of Win32/Sirefef.DA trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

D:\My Exe Files\A&Video Converters\Free RIP\freeripmp3-setup.exe Win32/Toolbar.Zugo application (deleted - quarantined) 00000000000000000000000000000000 C

D:\My Exe Files\Act.Sinc & W.Mobile Device Centre\Windows Mobile Device Centre\SoftonicDownloader_for_windows-mobile-device-center.exe a variant of Win32/SoftonicDownloader.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

D:\My Exe Files\Cars\Diagnostic Programs\ELM Compatible\ScanMaster 2.1\ScanMaster.ELM.v2.1.104.771\KeyGen\Kg.exe probably a variant of Win32/Spy.Agent.EKAKGWH trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

D:\My Exe Files\PC-Wind-Test- Maintenance\Advanced System Care\asc-setup.exe a variant of Win32/Toolbar.Widgi application (deleted - quarantined) 00000000000000000000000000000000 C

D:\My Exe Files\PC-Wind-Test- Maintenance\Unlocker\Unlocker\Unlocker1%5B1%5D.9.0.exe Win32/Adware.ADON application (deleted - quarantined) 00000000000000000000000000000000 C

D:\My Exe Files\PC-Wind-Test- Maintenance\Unlocker\Unlocker setup\unlocker1.8.7.exe Win32/Adware.ADON application (deleted - quarantined) 00000000000000000000000000000000 C

D:\My Exe Files\PDF Programs\Adobe.Acrobat.v9.Pro.Extended\Adobe.Acrobat.v9.PRO.Extended.iso probably a variant of Win32/Agent.DQPHVKD trojan (deleted - quarantined) 00000000000000000000000000000000 C

D:\My Exe Files\Validation key(XP)and (7)\Win 7\WActivators&Remove WAT\WA2\ac-wmvvv.rar a variant of MSIL/TrojanDropper.Agent.AX trojan (deleted - quarantined) 00000000000000000000000000000000 C

D:\My Exe Files\Validation key(XP)and (7)\Win 7\WActivators&Remove WAT\WA3\w7lxe.exe a variant of Win32/HackKMS.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

D:\My Exe Files\Validation key(XP)and (7)\Win XP\Crack Validation\CDRoller_7.70.99.1\Patch\CDRoller.v7.70.99.1-RES-patch.exe a variant of Win32/HackTool.Patcher.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

D:\My Exe Files\Validation key(XP)and (7)\Win XP\Key valid check & change(XP)\keyfinder.exe Win32/PSWTool.RAS.A application (deleted - quarantined) 00000000000000000000000000000000 C

D:\My Exe Files\Validation key(XP)and (7)\Win XP\Make Your Copy of Windows Genuine\Make Your Copy of Windows 100% Genuine\keyfinder.exe Win32/PSWTool.RAS.A application (deleted - quarantined) 00000000000000000000000000000000 C

D:\My Exe Files\Virtual Flash Drive v.3.30\Keygen\keygen.exe a variant of Win32/Keygen.CX application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

D:\TOSHIBA-EQUIUM\Backup Set 2011-05-07 115612\Backup Files 2011-05-07 115612\Backup files 1.zip Win32/Adware.ADON application (deleted - quarantined) 00000000000000000000000000000000 C

D:\TOSHIBA-EQUIUM\Backup Set 2011-09-04 211452\Backup Files 2011-09-04 211452\Backup files 1.zip Win32/Adware.ADON application (deleted - quarantined) 00000000000000000000000000000000 C

D:\TOSHIBA-EQUIUM\Backup Set 2011-10-23 190002\Backup Files 2011-10-23 190002\Backup files 1.zip Win32/Adware.ADON application (deleted - quarantined) 00000000000000000000000000000000 C

D:\TOSHIBA-EQUIUM\Backup Set 2011-10-23 190002\Backup Files 2011-10-30 190001\Backup files 1.zip multiple threats (deleted - quarantined) 00000000000000000000000000000000 C

D:\TOSHIBA-EQUIUM\Backup Set 2011-11-02 202906\Backup Files 2011-11-02 202906\Backup files 1.zip multiple threats (deleted - quarantined) 00000000000000000000000000000000 C

D:\TOSHIBA-EQUIUM\Backup Set 2011-12-18 190001\Backup Files 2011-12-18 190001\Backup files 1.zip multiple threats (deleted - quarantined) 00000000000000000000000000000000 C

D:\TOSHIBA-EQUIUM\Backup Set 2012-02-19 190002\Backup Files 2012-02-19 190002\Backup files 1.zip multiple threats (deleted - quarantined) 00000000000000000000000000000000 C

5. От Hitman:прикачен

D/U лоуда си остана.Имам 2 въпроса:

-Да инсталирам ли пак AVG?

-Може ли и AVG и MS Security Esentials да са включени едновременно?

Накрая прикачения:

log.xml

11 март 201214 г.

Не може наведнъж да се пусне, ще разделя посовете.

Няма проблеми...

FSS лога вече ми харесва...

От ComboFix:

Тук имаме още малко работа:

Отворете notepad и с copy/paste въведете следната информация:

ADS::
C:ProgramDataTEMP
Folder::
c:usersuserAppDataRoamingAVG2012
File::
c:windowssystem32dds_trash_log.cmd
Fcopy::
c:windowswinsxsx86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3user32.dll | c:windowsSystem32user32.dll
Driver::
avf8q72s
lanmangpsvc
oracle_load_balancer_60_-forms6ip9
beatjammusicstreamingvaiomediaplatform-integrated-http
mvTermService
NetSvc::
avf8q72s
lanmangpsvc
oracle_load_balancer_60_-forms6ip9
beatjammusicstreamingvaiomediaplatform-integrated-http
mvTermService
RegLock::
[HKEY_USERS.DefaultSoftwareMicrosoftInternet ExplorerApproved Extensions]
[HKEY_USERS.DefaultSoftwareMicrosoftInternet ExplorerApprovedExtensionsMigration]
[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0000AllUserSettings]
[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0001AllUserSettings]
[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0002AllUserSettings]
[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlPCWSecurity]
Registry::
[HKEY_USERS.DefaultSoftwareMicrosoftInternet ExplorerApproved Extensions]
"{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}"=-

Запазете файла с име CFScript и го провлачете и пуснете в Combofix (както е показано на картинката отдолу).
По време на сканиране от страна на ComboFix не стартирайте никакви други приложения, не натискайте клавиши от клавиатурата и не местете мишката !
Публикувайте лог файла, който ще се създаде след рестарта на компютъра в следващия си пост.

От OTL- получи се само txt, няма Extras-не може да се прикачи-480KB-много голям (до колко може да се прикачва?) За това го поствам тук:

Няма проблеми, че сте го копирали тук. Даже е по-добре така (и по-нагледно).

Включих някои редове от лог файла в скрипта си за Combofix, така че се получи малко 2 в 1.

От Junction:

Изглежда наред.

От ESET-сканира 3ч15мин, намери 27..., повечето в D:.Там имам exeфайлове на програми и някои имат кейгенове, пачове и сигурно са заминали, ще трябва да ги възстановявам от другаде...Когато AVG ги карантинира, аз ги връщам...

Аз затова бях писал да не натискате бутона за премахване на намерените неща в инструкциите си, докато не прегледам лог файла. Както и да е. И без това е препоръчително да стоите настрана от кракове, пачове и кейгенератори при наличието на толкова много безплатни алтернативи. Използването на подобен софтуер е причината да имате тема в този раздел в момента !

От Hitman:прикачен

Лог файла е чист. Един подозрителен обект (фалшива тревога) + няколко изтрити бисквитки.

D/U лоуда си остана.

Пробвайте следното...Отворете Start => в полето за търсене въведете CMD => стартирайте конзолата => въведете командата Ipconfig /all.

Запазете някъде настройките си за всеки случай.

След това изтеглете и разархивирайте на десктопа прикачения файл. => internet.zip

Стартирайте файла internet.bat и след като се рестартира компютъра проверете пак какво е положението.

Имам 2 въпроса:

-Да инсталирам ли пак AVG?

-Може ли и AVG и MS Security Esentials да са включени едновременно?

Ако харесвате повече AVG, трябва да деинсталирате MSE.

Две антивирусни не е препоръчително да работят едновременно:

*получават се конфликти (при опит за обезвреждане на един и същи обект)

*забавяне на системата (излишно пилеене на системни ресурси)

*фалшиви тревоги и други неприятни проблеми с Windows

Поздрави !

11 март 201214 г.

Автор

Аз затова бях писал да не натискате бутона за премахване на намерените неща в инструкциите си, докато не прегледам лог файла. Както и да е. И без това е препоръчително да стоите настрана от кракове, пачове и кейгенератори при наличието на толкова много безплатни алтернативи. Използването на подобен софтуер е причината да имате тема в този раздел в момента !

Аз не си спомням дали съм натиснал някакъв бутон или го затворих...

Моите кракове и киигенове са от години там и не е имало проблеми. Проблемите са когато ги търсиш из нета, което не ми се случва често, но със сигурност така е станала заразата...

Две антивирусни не е препоръчително да работят едновременно:

Може ли да използвам AVG активна, а другата без да я деинсталирам, да махна тикчето на Real Time Protection?

ComboFix 12-03-11.01 - user 11/03/2012 22:26:18.6.2 - x86

Microsoft® Windows 7 Eternity™ 2009 6.1.7600.0.1251.359.1033.18.1918.1136 [GMT 0:00]

Running from: c:usersuserDesktopComboFix.exe

Command switches used :: c:usersuserDesktopCFScript.txt

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FILE ::

"c:windowssystem32dds_trash_log.cmd"

ADS - TEMP: deleted 156 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

c:usersuserAppDataRoamingAVG2012

c:usersuserAppDataRoamingAVG2012cfgalluserawacs.cfg

c:usersuserAppDataRoamingAVG2012cfgallusergui.cfg

c:windowssystem32dds_trash_log.cmd

--------------- FCopy ---------------

c:windowswinsxsx86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3user32.dll --> c:windowsSystem32user32.dll

((((((((((((((((((((((((( Files Created from 2012-02-11 to 2012-03-11 )))))))))))))))))))))))))))))))

2012-03-11 22:34 . 2012-03-11 22:34 -------- d-----w- c:usersuserAppDataLocaltemp

2012-03-11 22:34 . 2012-03-11 22:34 -------- d-----w- c:usersDefaultAppDataLocaltemp

2012-03-10 23:52 . 2012-03-01 13:34 6552120 ----a-w- c:programdataMicrosoftMicrosoft AntimalwareDefinition Updates{4ECBA43A-A12E-445D-9BFA-9363CB4955AC}mpengine.dll

2012-03-10 23:36 . 2012-03-10 23:38 -------- d-----w- c:programdataHitmanPro

2012-03-10 20:02 . 2012-03-10 20:02 -------- d-----w- c:program filesESET

2012-03-10 19:56 . 2010-09-07 15:39 150392 ----a-w- c:windowsjunction.exe

2012-03-10 18:18 . 2012-02-09 13:17 713784 ----a-w- c:programdataMicrosoftMicrosoft AntimalwareDefinition UpdatesNISBackupgapaengine.dll

2012-03-10 18:18 . 2012-02-09 13:17 713784 ----a-w- c:programdataMicrosoftMicrosoft AntimalwareDefinition Updates{CB955983-B570-4869-9BC0-D4149D1D38D3}gapaengine.dll

2012-03-10 18:18 . 2012-01-31 04:59 237072 ------w- c:windowssystem32MpSigStub.exe

2012-03-10 18:13 . 2012-03-10 18:13 -------- d-----w- c:program filesMicrosoft Security Client

2012-03-10 13:19 . 2012-03-09 11:14 -------- d-----w- c:program filesWindows Defender

2012-03-09 22:38 . 2012-03-09 21:41 187904 ----a-w- c:windowssystem32driversnetbt.sys

2012-03-09 21:42 . 2012-03-09 21:41 187904 ----a-w- C:netbt.sys

2012-03-09 21:42 . 2012-03-09 21:40 388096 ----a-w- C:csc.sys

2012-03-09 21:30 . 2012-03-09 21:30 181064 ----a-w- c:windowsPSEXESVC.EXE

2012-03-09 21:20 . 2010-04-27 11:04 381816 ----a-w- C:PsExec.exe

2012-03-09 21:04 . 2012-03-09 21:04 -------- d-----w- c:program filesERUNT

2012-03-08 23:17 . 2011-12-10 15:24 20464 ----a-w- c:windowssystem32driversmbam.sys

2012-03-07 07:23 . 2012-03-08 05:26 -------- d-----w- C:FRST

2012-02-28 23:02 . 2012-02-28 23:02 -------- d-----w- C:_OTL

2012-02-28 19:06 . 2012-02-28 19:06 -------- dc----w- c:usersuserAppDataLocalMigWiz

2012-02-27 21:40 . 2009-07-13 23:15 387584 ----a-w- c:windowssystem32driverscsc.sys

2012-02-21 00:14 . 2012-02-21 00:14 -------- d-----w- c:program filesLopeSoft

2012-02-21 00:03 . 2012-02-21 00:03 -------- d-----w- c:program filesPC Magazine Utilities

2012-02-20 23:10 . 2012-02-20 23:10 -------- d-----w- c:program filesNirSoft

2012-02-18 23:32 . 2012-02-18 23:32 -------- d-----w- c:program filesWinPcap

2012-02-15 17:41 . 2012-02-15 17:52 -------- d-----w- C:e64a0c4b528f8264dfe36f93064430

2012-02-15 17:35 . 2011-12-16 07:59 690688 ----a-w- c:windowssystem32msvcrt.dll

2012-02-15 17:34 . 2012-01-14 03:48 2340864 ----a-w- c:windowssystem32win32k.sys

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2012-01-06 17:42 . 2012-01-06 17:42 20480 ----a-w- c:windowssystem32EclipseUpdateSpawn.exe

2012-02-18 10:58 . 2011-07-28 21:49 134104 ----a-w- c:program filesmozilla firefoxcomponentsbrowsercomps.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionexplorershelliconoverlayidentifiersWin7SharedFolderIcon]

@="{15AB4D5B-4FDB-4F84-B5E2-245E47F2F632}"

[HKEY_CLASSES_ROOTCLSID{15AB4D5B-4FDB-4F84-B5E2-245E47F2F632}]

2010-02-27 20:25 180224 ----a-w- c:program filesFortop DigitalWin7 Shared Folder IconSharedFolderIcon.dll

[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]

"Sidebar"="c:program filesWindows Sidebarsidebar.exe" [2009-07-14 1173504]

"Welcome Center"="c:windowssystem32OobeFldr.dll" [2009-09-11 859648]

"DU Meter"="c:program filesDU MeterDUMeter.exe" [2007-10-15 2582288]

"Skype"="c:program filesSkypePhoneSkype.exe" [2010-09-02 13351304]

"Sticky Pad"="c:program filesStickyPadStickyPad.exe" [2012-01-05 520249]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]

"StartCCC"="c:program filesATI TechnologiesATI.ACECore-StaticCLIStart.exe" [2009-05-21 61440]

"cAudioFilterAgent"="c:program filesConexantcAudioFilterAgentcAudioFilterAgent.exe" [2009-07-20 484920]

"SynTPEnh"="c:program filesSynapticsSynTPSynTPEnh.exe" [2009-06-12 1533224]

"TPwrMain"="c:program filesTOSHIBAPower SaverTPwrMain.EXE" [2009-08-21 476512]

"HSON"="c:program filesTOSHIBATBSHSON.exe" [2009-03-09 55160]

"Malwarebytes' Anti-Malware"="c:program filesMalwarebytes' Anti-Malwarembamgui.exe" [2012-01-13 460872]

"MSC"="c:program filesMicrosoft Security Clientmsseces.exe" [2011-06-15 997920]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRun]

"Welcome Center"="c:windowssystem32OobeFldr.dll" [2009-09-11 859648]

"Sidebar"="c:program filesWindows Sidebarsidebar.exe" [2009-07-14 1173504]

[HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersionRunOnce]

"FlashPlayerUpdate"="c:windowssystem32MacromedFlashFlashUtil10b.exe" [2009-02-03 240544]

c:usersuserAppDataRoamingMicrosoftWindowsStart MenuProgramsStartup

ERUNT AutoBackup.lnk - c:program filesERUNTAUTOBACK.EXE [2005-10-20 38912]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 0 (0x0)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]

"NoResolveTrack"= 1 (0x1)

"NoSMBalloonTip"= 1 (0x1)

[HKEY_USERS.defaultsoftwaremicrosoftwindowscurrentversionpoliciesexplorer]

"NoResolveTrack"= 1 (0x1)

"NoSMBalloonTip"= 1 (0x1)

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversiondrivers32]

"aux1"=wdmaud.drv

[HKEY_LOCAL_MACHINEsystemcurrentcontrolsetcontrollsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimalMsMpSvc]

@="Service"

[HKLM~startupfolderC:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Orbit.lnk]

path=c:programdataMicrosoftWindowsStart MenuProgramsStartupOrbit.lnk

backup=c:windowspssOrbit.lnk.CommonStartup

backupExtension=.CommonStartup

[HKLM~startupfolderC:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^RocketDock.lnk]

path=c:programdataMicrosoftWindowsStart MenuProgramsStartupRocketDock.lnk

backup=c:windowspssRocketDock.lnk.CommonStartup

backupExtension=.CommonStartup

[HKLM~startupfolderC:^Users^user^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]

path=c:usersuserAppDataRoamingMicrosoftWindowsStart MenuProgramsStartupOneNote 2007 Screen Clipper and Launcher.lnk

backup=c:windowspssOneNote 2007 Screen Clipper and Launcher.lnk.Startup

backupExtension=.Startup

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupreg00TCrdMain]

2009-08-05 13:04 738616 ----a-w- c:program filesToshibaFlashCardsTCrdMain.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe ARM]

2012-01-02 10:07 843712 ----a-r- c:program filesCommon FilesAdobeARM1.0AdobeARM.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregAdobe Reader Speed Launcher]

2012-01-03 22:51 37296 ----a-w- c:program filesAdobeReader 9.0Readerreader_sl.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregBing Bar]

2010-03-24 16:26 243544 ----a-w- c:program filesMSN ToolbarPlatform5.0.1423.0mswinext.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregCamera Assistant Software]

2009-04-10 16:09 417792 ----a-w- c:program filesCamera Assistant Software for Toshibatraybar.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregDAEMON Tools Lite]

2010-04-01 09:16 357696 ----a-w- c:program filesDAEMON Tools LiteDTLite.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregEPSON SX100 Series]

2009-07-29 08:12 188928 ----a-w- c:windowsSystem32spooldriversw32x863E_FATIEDE.EXE

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregEPSON SX100 Series (Copy 1)]

2009-07-29 08:12 188928 ----a-w- c:windowsSystem32spooldriversw32x863E_FATIEDE.EXE

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregGrooveMonitor]

2006-10-26 23:47 31016 ----a-w- c:program filesMicrosoft OfficeOffice12GrooveMonitor.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregMicrosoft Default Manager]

2009-11-11 17:43 288088 ----a-w- c:program filesMicrosoftSearch Enhancement PackDefault ManagerDefMgr.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregNSU_agent]

2011-10-19 14:53 190768 ----a-w- c:program filesNokiaNokia Software Updaternsu3ui_agent.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregSmoothView]

2009-08-13 11:31 521528 ----a-w- c:program filesToshibaSmoothViewSmoothView.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftshared toolsmsconfigstartupregWindows Mobile Device Center]

2007-05-31 09:21 648072 ----a-w- c:windowsWindowsMobilewmdc.exe

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionrun-]

"Adobe Reader Speed Launcher"="c:program filesAdobeReader 9.0ReaderReader_sl.exe"

"Adobe ARM"="c:program filesCommon FilesAdobeARM1.0AdobeARM.exe"

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:windowsMicrosoft.NETFrameworkv4.0.30319mscorsvw.exe [2010-03-18 130384]

R2 gupdate;Google Update Service (gupdate);c:program filesGoogleUpdateGoogleUpdate.exe [2010-10-06 136176]

R3 epmntdrv;epmntdrv;c:windowssystem32epmntdrv.sys [2011-07-29 14216]

R3 EuGdiDrv;EuGdiDrv;c:windowssystem32EuGdiDrv.sys [2011-07-29 8456]

R3 gupdatem;Google Update Service (gupdatem);c:program filesGoogleUpdateGoogleUpdate.exe [2010-10-06 136176]

R3 MpNWMon;Microsoft Malware Protection Network Driver;c:windowssystem32DRIVERSMpNWMon.sys [2011-04-18 43392]

R3 NisDrv;Microsoft Network Inspection System;c:windowssystem32DRIVERSNisDrvWFP.sys [2011-04-27 65024]

R3 NisSrv;Microsoft Network Inspection;c:program filesMicrosoft Security ClientAntimalwareNisSrv.exe [2011-04-27 208944]

R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:windowssystem32driversnmwcdnsu.sys [2011-08-17 137472]

R3 nmwcdnsuc;Nokia USB Flashing Generic;c:windowssystem32driversnmwcdnsuc.sys [2011-08-17 8576]

R3 WatAdminSvc;WatAdminSvc;c:windowssystem32WatWatAdminSvc.exe [2011-11-02 1343400]

S0 sptd;sptd;c:windowsSystem32Driverssptd.sys [2011-02-07 691696]

S1 vwififlt;Virtual WiFi Filter Driver;c:windowssystem32DRIVERSvwififlt.sys [2009-07-13 48128]

S2 DUMeterSvc;DU Meter Service;c:program filesDU MeterDUMeterSvc.exe [2007-10-15 1382672]

S2 MBAMService;MBAMService;c:program filesMalwarebytes' Anti-Malwarembamservice.exe [2012-01-13 652360]

S2 npf;NetGroup Packet Filter Driver;c:windowssystem32driversnpf.sys [2011-02-11 35088]

S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:program filesTuneUp Utilities 2010TuneUpUtilitiesService32.exe [2010-02-25 1047880]

S2 USBSafelyRemoveService;USB Safely Remove Assistant;c:program filesUSB Safely RemoveUSBSRService.exe [2009-11-26 261456]

S3 CnxtHdmiAudService;Conexant UAA HDMI Function Driver for High Definition Audio Service;c:windowssystem32driversCHDMI32.sys [2009-06-23 487936]

S3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2011-12-10 20464]

S3 O2MDRDR;O2MDRDR;c:windowssystem32DRIVERSo2media.sys [2008-03-04 48600]

S3 QIOMem;Generic IO & Memory Access;c:windowssystem32DRIVERSQIOMem.sys [2007-04-09 8192]

S3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:windowssystem32DRIVERSRTL8187B.sys [2010-03-31 379904]

S3 SrvHsfHDA;SrvHsfHDA;c:windowssystem32DRIVERSVSTAZL3.SYS [2009-07-13 207360]

S3 SrvHsfV92;SrvHsfV92;c:windowssystem32DRIVERSVSTDPV3.SYS [2009-07-13 980992]

S3 SrvHsfWinac;SrvHsfWinac;c:windowssystem32DRIVERSVSTCNXT3.SYS [2009-07-13 661504]

S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:program filesTuneUp Utilities 2010TuneUpUtilitiesDriver32.sys [2010-02-25 10064]

S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:windowssystem32DRIVERSyk62x86.sys [2009-07-13 311296]

[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionsvchost]

WindowsMobile REG_MULTI_SZ wcescomm rapimgr

LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvchost - NetSvcs

UxTuneUp

Contents of the 'Scheduled Tasks' folder

2012-03-11 c:windowsTasksGoogleUpdateTaskMachineCore.job

- c:program filesGoogleUpdateGoogleUpdate.exe [2010-10-06 17:47]

2012-03-11 c:windowsTasksGoogleUpdateTaskMachineUA.job

- c:program filesGoogleUpdateGoogleUpdate.exe [2010-10-06 17:47]

------- Supplementary Scan -------

uStart Page = hxxp://www.google.co.uk/

IE: &Download by Orbit - c:program filesOrbitdownloaderorbitmxt.dll/201

IE: &Grab video by Orbit - c:program filesOrbitdownloaderorbitmxt.dll/204

IE: Do&wnload selected by Orbit - c:program filesOrbitdownloaderorbitmxt.dll/203

IE: Down&load all by Orbit - c:program filesOrbitdownloaderorbitmxt.dll/202

IE: E&xport to Microsoft Excel - c:progra~1MICROS~2Office12EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.1.254

FF - ProfilePath - c:usersuserAppDataRoamingMozillaFirefoxProfiles2zame245.default

FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=DCF3DF&PC=DCF3&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - www.google.co.uk

FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=DCF3DF&PC=DCF3&q=

FF - prefs.js: network.proxy.http - 84.22.23.6

FF - prefs.js: network.proxy.http_port - 8080

FF - prefs.js: network.proxy.type - 0

[HKEY_LOCAL_MACHINESYSTEMControlSet001servicesDUMeterSvc]

"ImagePath"="c:program filesDU MeterDUMeterSvc.exe /startedbyscm:E1F6D4BE-40E33354-DUMeterService"

Completion time: 2012-03-11 22:37:23

ComboFix-quarantined-files.txt 2012-03-11 22:37

ComboFix2.txt 2012-03-10 19:22

Pre-Run: 10,243,039,232 bytes free

Post-Run: 10,200,596,480 bytes free

- - End Of File - - 80181CB6EEBA3BD7A8353F3876FED83B

След процедурите съобщението "Failed to connect to a Windows service" при стартиране си остана, DU лоуда също остана.

Премахнах информацията за Ipconfig /all защото съдържа чувствителна информация.

11 март 201214 г.

Аз не си спомням дали съм натиснал някакъв бутон или го затворих...
Моите кракове и киигенове са от години там и не е имало проблеми. Проблемите са когато ги търсиш из нета, което не ми се случва често, но със сигурност така е станала заразата...

Можете да отворите Eset Online Scanner => Quarantine => и да върнете това което сметнете, че е безопасно и ви трябва (но лично аз не препоръчвам тези действия).

Може ли да използвам AVG активна, а другата без да я деинсталирам, да махна тикчето на Real Time Protection?

Не е препоръчително. По-добре я деинсталирайте и си карайте само с AVG.

След процедурите съобщението "Failed to connect to a Windows service" при стартиране си остана, DU лоуда също остана.

За грешката пробеайте следното:

Start => напишете CMD => кликнете с десен бутон върху CMD.exe => Run as administrator => в конзолата въведете командата sfc /scannow

И натиснете Enter => Изчакайте проверката да завърши и рестартирайте. Пишете дали има промяна.

Колкото до download-a => програмата показва ли коя програма или през кой порт става трафика ?

Ако ли не, вижте дали currports или tcpview ще помогнат за установяването на причината.

Ако сте по-запознати, може да опитате и с Wireshark

12 март 201214 г.

Автор

Можете да отворите Eset Online Scanner => Quarantine => и да върнете това което сметнете, че е безопасно и ви трябва (но лично аз не препоръчвам тези действия).

Трябва да го инсталирам наново ли и там да търся Quarantine?

За грешката пробеайте следното:
Start => напишете CMD => кликнете с десен бутон върху CMD.exe => Run as administrator => в конзолата въведете командата sfc /scannow
И натиснете Enter => Изчакайте проверката да завърши и рестартирайте. Пишете дали има промяна.

Няма промяна.Ще прикача скрииншотове за IPconfig преди и след и за CMD.exe, защото там се споменава corrupted file. CBS лога ще постна, защото е мн. голям и не може а се прикачи.

Колкото до download-a => програмата показва ли коя програма или през кой порт става трафика ?

Ще прикача скрииншотове за TCP Connections и TCP и UDP Ports,защото не мога да ги копирам от DU метъра.

Прикачването нещо не става, не знам колко е допустимия размер на единичен файл и колко на един пост...

CBS лога e okolo 13MB, как да го покажа?

Редактирано 13 март 201214 г. от B-boy[StyLe] (преглед на промените)

12 март 201214 г.

Автор

Ето картинки:

http://www.picvalley.net/v.php?p=u/2886/95661570312578741611331591105VLEuKRYAfcrDvJB6WUXa.JPG

http://www.picvalley.net/v.php?p=u/2246/208599811518804634661331591082TSIeRbHJ1I6UX3DE2mAl.JPG

http://www.picvalley...TK2elfM539n.JPG

Редактирано 12 март 201214 г. от Kibik (преглед на промените)

13 март 201214 г.

Здравейте,

Извинявам се за забавянето, но имам много работа тези дни и чак утре след 16.00 ще мога сериозно да се заема с проблемите.

Моля не давайте информация за Ipconfig. Съдържа се информация с вашия IP адрес и тя трябва да е само за вашите очи!

Колкото до проблемите, ще питам експертите в чужбина какво може да се направи за грешките.

Засега само, отворете Start => напишете долу в полето за търсене => Services.msc => Вижте дали услугата Group Policy Client е стартирана и е сложена на automatic режим.

Колкото до трафика => не сте показали дали с Currports или TCPView или Wireshark се вижда кое приложение прави този трафик. Можете да питате и доставчика ви какво отчитат и те като действия. Аз ще се посъветвам с колегите и за този проблем. От DU се вижда само трафика, но не и кое го причинява.

Системата би трябвало да е чиста вече, но да направим една проверка с това: => emsisoft free emergency kit

Изтеглете инструмента и го разархивирайте в папка на десктопа.

Стартирайте файла start.exe => натиснете Emergency Kit Scanner

Натиснете Update now => след това натиснете Back to Security Status

Натиснете Scan Now => Custom Scan => Scan

Сложете отметка пред Heuristic scan for unknown malware => натиснете Next и изчакайте.

След края на проверката натиснете View Report => ще се отвори папката с лог файловете.

Отворете съдържанието на последния по дата лог файл и копирайте съдържанието му в следващия си пост.

Също така изтеглете този инструмент - Windows Repair All in one

Инсталирайте приложението и го стартирайте.

От стъпка 2 => стартирайте Check Disk

От стъпка 3 => стартирайте пак SFC

от Стъпка 4 натиснете на Advanced Mode

оттук вече сложете всички отметки;

Сложете отметка пред restart system when finished и натиснете Start.

Пишете после как е положението.

13 март 201214 г.

Автор

1.Group Policy Client е на Automatic, но не е стартирана и не може да се стартира, защото опциите и Start навсякъде не са активни (сиво)...

2.Emsisoft сканира почти 4 часа.От дяла C: с висок риск е само ADCDA2..., което е програмата Autodata.Във D: отново всичките с висок риска са киигенове, които са от години там и не е имало проблем стях, освем, че някои антивирусни не ги харесват...

Emsisoft Emergency Kit - Version 1.0

Last update: 13/03/2012 19:00:57

Scan settings:

Scan type: Custom Scan

Objects: Memory, Traces, Cookies, C:\, D:\

Scan archives: On

Heuristics: On

ADS Scan: On

Scan start: 13/03/2012 19:03:59

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\cookies.sqlite:1299524927258000 detected: Trace.TrackingCookie.count!A2

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\cookies.sqlite:1311889640537213 detected: Trace.TrackingCookie.www.3dstats.com!A2

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\cookies.sqlite:1311889640546615 detected: Trace.TrackingCookie.reuters.com!A2

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\cookies.sqlite:1311889640546617 detected: Trace.TrackingCookie.reuters.com!A2

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\cookies.sqlite:1311889640546619 detected: Trace.TrackingCookie.reuters.com!A2

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\cookies.sqlite:1311889640546622 detected: Trace.TrackingCookie.reuters.com!A2

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\cookies.sqlite:1311889640553547 detected: Trace.TrackingCookie.com!A2

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\cookies.sqlite:1311889640556858 detected: Trace.TrackingCookie.count!A2

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\cookies.sqlite:1311889640559140 detected: Trace.TrackingCookie.cnt.tyxo.bg!A2

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\cookies.sqlite:1311889640564779 detected: Trace.TrackingCookie.about.com!A2

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\cookies.sqlite:1311889640564786 detected: Trace.TrackingCookie.about.com!A2

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\cookies.sqlite:1311889640582166 detected: Trace.TrackingCookie.webtrends!A2

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\cookies.sqlite:1311889640602607 detected: Trace.TrackingCookie.audit.median.hu!A2

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\cookies.sqlite:1311889640605806 detected: Trace.TrackingCookie.www.buy!A2

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\cookies.sqlite:1311889640610939 detected: Trace.TrackingCookie.ctix8.cheaptickets.com!A2

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\cookies.sqlite:1311889640618257 detected: Trace.TrackingCookie.about.com!A2

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\cookies.sqlite:1311889640618265 detected: Trace.TrackingCookie.aol.com!A2

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\cookies.sqlite:1311889640621619 detected: Trace.TrackingCookie.myspace.com!A2

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\cookies.sqlite:1311889640638081 detected: Trace.TrackingCookie.server.iad.livepers!A2

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\cookies.sqlite:1311889640660369 detected: Trace.TrackingCookie.statse.webtrendslive!A2

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2zame245.default\cookies.sqlite:1311889640661190 detected: Trace.TrackingCookie.m.webtrends.com!A2

C:\ADCDA2\SCAPIInterface.DLL detected: possible-Threat.Patch.ADCDA2!IK

D:\My Exe Files\PC-Wind-Test- Maintenance\Windows Doctor Pro v2.0\Patch\WD20_CRK.exe detected: Trojan.Win32.Agent!IK

D:\My Exe Files\Radio Decoder\decoder\decod.exe detected: Trojan.Win32.Agent!IK

D:\My Exe Files\Validation key(XP)and (7)\Win 7\WActivators&Remove WAT\RemoveWAT.2.2.5.Hazar.carter67\RemoveWAT.exe detected: HackTool.Win32.Wpakill!IK

D:\My Exe Files\Validation key(XP)and (7)\Win 7\WActivators&Remove WAT\WA1\Windows 7 Loader\Windows 7 Loader.exe detected: Riskware.Hacktool.Win7Loader!IK

D:\My Exe Files\Validation key(XP)and (7)\Win XP\Crack_WinXP-SP2-SP3\Crypt.dll detected: Riskware.Hacktool.Antiwpa!IK

D:\My Exe Files\Vivid\Vivid(Install,crack)\windows-1251''Vi81.rar/Crack\CRP32DLL.dll detected: Trojan.Win32.Genome!IK

D:\My GPS Navigation\TomTom\TT5\TomTom5(part)\(1)Keygen tomtom maps\kg_new.exe detected: Riskware.Keygen.TomTom!IK

D:\My GPS Navigation\TomTom\TT5\TomTom5(part)\(2)TTNKeygen\Key.exe detected: Riskware.Keygen.TomTom!IK

D:\My GPS Navigation\TomTom\TT5\TomTom5(part)\(3)TTNKeygen\Key.exe detected: Riskware.Keygen.TomTom!IK

D:\My GPS Navigation\TomTom\TT5\TomTom5(part)\TT(milstan)\Keygen za TT Maps\TTNKeygen\Key.exe detected: Riskware.Keygen.TomTom!IK

D:\My GPS Navigation\TomTom\TT5\TomTom5(part)\TT(milstan)\Keygen za TT Maps\TTNKeygen.rar/TTNKeygen\Key.exe detected: Riskware.Keygen.TomTom!IK

D:\My GPS Navigation\TomTom\TT7.450+TT830 Maps+Activators\TT830. Maps\EasyActivator5.rar/Easy Activator.exe detected: Trojan-PWS.Win32.Staem!IK

D:\My GPS Navigation\TomTom\TT7.910+TT840 Maps+ Activator\Activators&Keygens\Easy Activator v0.57.016\Easy Activator.exe detected: Riskware.Keygen.TomTom!IK

D:\My GPS Navigation\TomTom\TT7.910+TT840 Maps+ Activator\Activators&Keygens\Easyusetools_for Keygen_Mapcheck_Metacheck_ttsystempatcher\Progs\keygen6.exe detected: Riskware.Keygen.TomTom!IK

D:\My GPS Navigation\TomTom\TT7.910+TT840 Maps+ Activator\Activators&Keygens\Easyusetools_for Keygen_Mapcheck_Metacheck_ttsystempatcher\Progs\tt7_keygen.exe detected: Riskware.Keygen.TomTom!IK

D:\My GPS Navigation\TomTom\TT7.910+TT840 Maps+ Activator\Activators&Keygens\Easyusetools_for Keygen_Mapcheck_Metacheck_ttsystempatcher\Progs\tt7_metacheck.exe detected: Riskware.Keygen.TomTom!IK

D:\My GPS Navigation\TomTom\TT7.910+TT840 Maps+ Activator\Activators&Keygens\Easyusetools_for Keygen_Mapcheck_Metacheck_ttsystempatcher\Progs\tt8_mapcheck.exe detected: Riskware.Keygen.TomTom!IK

D:\My GPS Navigation\TomTom\TT7.910+TT840 Maps+ Activator\Activators&Keygens\Easyusetools_for Keygen_Mapcheck_Metacheck_ttsystempatcher\Progs\tt8_mapcheck2.exe detected: Riskware.Keygen.TomTom!IK

D:\My GPS Navigation\TomTom\TT7.910+TT840 Maps+ Activator\Activators&Keygens\Easyusetools_for Keygen_Mapcheck_Metacheck_ttsystempatcher\ttsystem_Patcher\Patcher.exe detected: Riskware.Patch.TomTom!IK

D:\My GPS Navigation\TomTom\TT7.910+TT840 Maps+ Activator\Activators&Keygens\TomTom Keygen 2009\MSINET.OCX detected: Backdoor.Win32.VB!IK

Scanned

Files: 440345

Traces: 405875

Cookies: 3139

Processes: 58

Found

Files: 21

Traces: 0

Cookies: 23

Processes: 0

Registry keys: 0

Scan end: 13/03/2012 22:55:14

Scan time: 3:51:15

13 март 201214 г.

Което потвърждава, че системата е чиста...

Все пак пробвайте и стъпките от другата програма.

Колкото за трафика - пак казвам вижте дали не можете да изкопчите повече информация от DU Meter, currports, TCPView или Wireshark (или даже интернет доставчика).

Може би инсталирането на една защитна стена би било добра идея на този етап.

За втората грешка, ако и втората програма не помогне, ще го мъдрим, но е много вероятно да се наложи да си направите нов потребителски ауант и да копирате данните от повредения в него...

http://windows.micro...ed-user-profile

14 март 201214 г.

Автор

След Windows repair съобщението за Windows service... при стартиране остана(както казах, не може да се стартира Group policy client). DU изглежда се оправи(ще видя дали е трайно), но ми докара друг проблем- съобщение, че уиндоуса не е Genuine и разбира се десктопа стана черен...

14 март 201214 г.

Радвам се, че трафика най-после е сепнал.

Колкото до съобщението Genuine - тук не мога да дам препоръка (заради правилата на форума).

Ако е платен - обадете се на центъра за поддръжка на MS, ако не е знаете каква е процедурата.

Колкото до грешката, да видим какво е положението със зависимите услуги:

Моля, стартирайте SystemLook, която вече би трябвало да имате изтеглена на вашия компютър.

Копирайте съдържанието на следния код в текстовото поле на програмата

:reg
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservicesMup /s
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservicesDcomLaunch /s
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservicesRpcEptMapper /s
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservicesgpsvc /s

Кликнете на бутона Look, за да започне сканирането.
Когато сканирането завърши ще Ви се отвори Notepad с резултата от сканирането. Моля, публикувайте лог файла в следващия си коментар.

14 март 201214 г.

Автор

Когато сканирането завърши ще Ви се отвори Notepad с резултата от сканирането. Моля, публикувайте лог файла в следващия си коментар.

SystemLook 30.07.11 by jpshortstuff

Log created at 23:14 on 14/03/2012 by user

Administrator - Elevation successful

========== reg ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Mup]

"DisplayName"="@%systemroot%\system32\drivers\mup.sys,-101"

"Group"="Network"

"ImagePath"="System32\Drivers\mup.sys"

"Description"="@%systemroot%\system32\drivers\mup.sys,-102"

"ErrorControl"= 0x0000000001 (1)

"Start"= 0x0000000000 (0)

"Type"= 0x0000000002 (2)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Mup\Parameters]

(No values found)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Mup\Enum]

"0"="Root\LEGACY_MUP\0000"

"Count"= 0x0000000001 (1)

"NextInstance"= 0x0000000001 (1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DcomLaunch]

"DisplayName"="@oleres.dll,-5012"

"Group"="COM Infrastructure"

"ImagePath"="%SystemRoot%\system32\svchost.exe -k DcomLaunch"

"Description"="@oleres.dll,-5013"

"ObjectName"="LocalSystem"

"ErrorControl"= 0x0000000001 (1)

"Start"= 0x0000000002 (2)

"Type"= 0x0000000020 (32)

"FailureActions"=00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 02 00 00 00 60 ea 00 00 (REG_BINARY)

"RequiredPrivileges"="SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeDebugPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege SeTcbPrivilege SeBackupPrivilege SeRestorePrivilege"

"ServiceSidType"= 0x0000000001 (1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DcomLaunch\Parameters]

"ServiceDll"="%SystemRoot%\system32\rpcss.dll"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DcomLaunch\Security]

"Security"=01 00 14 80 90 00 00 00 9c 00 00 00 14 00 00 00 30 00 00 00 02 00 1c 00 01 00 00 00 02 80 14 00 ff 00 0f 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 85 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 14 00 ff 00 0e 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 fd 00 0e 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 18 00 85 00 00 00 01 02 00 00 00 00 00 05 20 00 00 00 21 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 (REG_BINARY)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RpcEptMapper]

"DisplayName"="@%windir%\system32\RpcEpMap.dll,-1001"

"Group"="COM Infrastructure"

"ImagePath"="%SystemRoot%\system32\svchost.exe -k RPCSS"

"Description"="@%windir%\system32\RpcEpMap.dll,-1002"

"ObjectName"="NT AUTHORITY\NetworkService"

"ErrorControl"= 0x0000000001 (1)

"Start"= 0x0000000002 (2)

"Type"= 0x0000000020 (32)

"ServiceSidType"= 0x0000000001 (1)

"RequiredPrivileges"="SeChangeNotifyPrivilege SeImpersonatePrivilege SeCreateGlobalPrivilege"

"FailureActions"=80 51 01 00 00 00 00 00 00 00 00 00 03 00 00 00 14 00 00 00 01 00 00 00 c0 d4 01 00 01 00 00 00 e0 93 04 00 00 00 00 00 00 00 00 00 (REG_BINARY)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RpcEptMapper\Parameters]

"ServiceDll"="C:\Windows\System32\RpcEpMap.dll"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RpcEptMapper\Security]

"Security"=01 00 14 80 90 00 00 00 9c 00 00 00 14 00 00 00 30 00 00 00 02 00 1c 00 01 00 00 00 02 80 14 00 ff 00 0f 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 85 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 14 00 ff 00 0e 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 fd 00 0e 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 18 00 95 00 00 00 01 02 00 00 00 00 00 05 20 00 00 00 21 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 (REG_BINARY)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\gpsvc]

"PreshutdownTimeout"= 0x00000dbba0 (900000)

"DisplayName"="@gpapi.dll,-112"

"Group"="ProfSvc_Group"

"ImagePath"="%systemroot%\system32\svchost.exe -k netsvcs"

"Description"="@gpapi.dll,-113"

"ObjectName"="LocalSystem"

"ErrorControl"= 0x0000000001 (1)

"Start"= 0x0000000002 (2)

"Type"= 0x0000000020 (32)

"DependOnService"="RPCSS Mup"

"RequiredPrivileges"="SeImpersonatePrivilege SeTcbPrivilege SeTakeOwnershipPrivilege SeIncreaseQuotaPrivilege SeAssignPrimaryTokenPrivilege SeSecurityPrivilege SeChangeNotifyPrivilege SeCreatePermanentPrivilege SeShutdownPrivilege SeLoadDriverPrivilege SeRestorePrivilege SeBackupPrivilege"

"FailureActions"=80 51 01 00 00 00 00 00 00 00 00 00 03 00 00 00 14 00 00 00 01 00 00 00 c0 d4 01 00 01 00 00 00 e0 93 04 00 00 00 00 00 00 00 00 00 (REG_BINARY)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\gpsvc\Parameters]

"ServiceDll"="%SystemRoot%\System32\gpsvc.dll"

"ServiceMain"="GroupPolicyClientServiceMain"

"ServiceDllUnloadOnStop"= 0x0000000001 (1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\gpsvc\Security]

"Security"=01 00 14 80 8c 00 00 00 98 00 00 00 14 00 00 00 30 00 00 00 02 00 1c 00 01 00 00 00 02 c0 14 00 02 00 0d 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 5c 00 04 00 00 00 00 00 14 00 ff 01 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 8d 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8d 01 02 00 01 01 00 00 00 00 00 05 04 00 00 00 00 00 14 00 8d 01 02 00 01 01 00 00 00 00 00 05 06 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 (REG_BINARY)

-= EOF =-

Освен съобщението за уиндоус сървиза при стартиране, забелязах и че не ми работи домашната мрежа- казва, че компютъра (който и да е) не е достъпен и Server service is not started.

Видях, че имам Restore points на 10.03, когато деинсталирах AVG, на 14.03 когато използвах Windows Repair и след това още две от Windows Update, но не знам дали ще работят...

Редактирано 14 март 201214 г. от Kibik (преглед на промените)

15 март 201214 г.

Да, но темата ви е от доста по-отдавна от 10.03. Ако имате Restore Point от февруари ок, но на този етап незнам дали е удачно да я използвате. АКо го направире, дори да се оправи проблема с Genuine Windows, могат да се върнат проблемите с неоправдания трафик. Пробвайте да направите нов акаунт и вижте дали в него има описаните проблеми с Group Policy Service, Server Service и т.н. За Genuine знаете какво трябва да направите, ако сте пират... Ако и с нов акаунт има тези проблеми, може би е добре да се направи един Windows Repair Install, който да поправи пораженията без да губите настройките си. Няма нужда от формат, защото системата е вече чиста. Аз ще помисля още малко дали може да се направи нещо по въпроса.

15 март 201214 г.

Автор

Направих 2 нови акаунта, от единия опитах да копирам файловете от стария в другия. И това не става- излиза съобщение: Folder access denied. You require permision from Toshiba-Equium\user to make changes to this folder (Application Data) Toshiba-Equium е лаптопа, а има и такава папка в D:. В нея има няколко файла Backup Set от различни дати. user е стария акаунт.

16 март 201214 г.

И двата нови ли ги направи с администраторски права ? Ако да, пробва ли с това ? http://www.wintuts.com/Change-permissions-take-ownership

Архивирана тема

Темата е твърде стара и е архивирана. Не можете да добавяте нови отговори в нея, но винаги можете да публикувате нова тема, в която да продължи дискусията. Регистрирайте се или влезте във вашия профил за да публикувате нова тема.

Няма регистрирани потребители разглеждащи тази страница.

Подкрепи съществуването на форума - направи дарение
32%

Дарени 315 € от нужните 1 000 €
- +21

Получавайте известие, когато има важна промяна или новина свързана с форума.

Абонирайте се

Добре дошли!

Заразен лаптоп

Featured Replies

Архивирана тема

Разглеждащи това в момента 0

Дарение

Бюлетин

Профил

Навигация

Търсене

Конфигуриране на push известия в браузъра

Chrome (Android)

Chrome (Desktop)

Safari (iOS 16.4+)

Safari (macOS)

Edge (Android)

Edge (Desktop)

Firefox (Android)

Firefox (Desktop)