API tools faq
paste
Advertisement
jcraig4550

OTL.txt

jcraig4550
Mar 17th, 2014
59
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 157.74 KB | None | 0 0
raw download clone embed print report
  1. OTL logfile created on: 3/17/2014 3:08:30 PM - Run 1
  2. OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\mmurphy\Desktop
  3. Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
  4. Internet Explorer (Version = 8.0.6001.18702)
  5. Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
  6.  
  7. 1.94 Gb Total Physical Memory | 1.33 Gb Available Physical Memory | 68.83% Memory free
  8. 2.44 Gb Paging File | 2.05 Gb Available in Paging File | 83.93% Paging File free
  9. Paging file location(s): C:\pagefile.sys 672 1344 [binary data]
  10.  
  11. %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
  12. Drive C: | 37.26 Gb Total Space | 13.80 Gb Free Space | 37.03% Space Free | Partition Type: NTFS
  13. Drive D: | 497.72 Mb Total Space | 11.75 Mb Free Space | 2.36% Space Free | Partition Type: FAT
  14. Drive U: | 68.23 Gb Total Space | 1.91 Gb Free Space | 2.79% Space Free | Partition Type: NTFS
  15.  
  16. Computer Name: JCRAIG | User Name: mmurphy | Logged in as Administrator.
  17. Boot Mode: Normal | Scan Mode: All users
  18. Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 90 Days
  19.  
  20. [color=#E56717]========== Processes (SafeList) ==========[/color]
  21.  
  22. PRC - [2014/03/17 15:01:34 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\mmurphy\Desktop\OTL.exe
  23. PRC - [2014/02/18 11:26:50 | 000,275,568 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
  24. PRC - [2011/12/15 11:40:54 | 001,446,248 | ---- | M] (Garmin) -- C:\Program Files\Garmin\Lifetime Updater\GarminLifetime.exe
  25. PRC - [2010/12/09 06:45:58 | 000,074,752 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\Winamp\winampa.exe
  26. PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
  27. PRC - [2004/07/21 16:28:02 | 000,413,807 | ---- | M] (American Power Conversion Corporation) -- C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
  28. PRC - [2004/07/21 16:26:36 | 000,176,241 | ---- | M] (American Power Conversion Corporation) -- C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
  29. PRC - [2003/05/15 02:19:50 | 000,217,193 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
  30.  
  31.  
  32. [color=#E56717]========== Modules (No Company Name) ==========[/color]
  33.  
  34. MOD - [2014/02/18 11:26:50 | 003,578,992 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
  35. MOD - [2014/02/12 04:39:23 | 000,393,216 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\05be173cbacba4b7604a67a267acdfe4\System.Xml.Linq.ni.dll
  36. MOD - [2014/02/12 04:38:21 | 001,801,728 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xaml\d116eda30a35c490e59221b0ebac6fcd\System.Xaml.ni.dll
  37. MOD - [2014/02/12 04:28:04 | 000,309,760 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\bd52c6f899032f62270379681f559c41\PresentationFramework.Classic.ni.dll
  38. MOD - [2014/02/12 04:27:34 | 018,003,456 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\9aafa1869d136f77bc483f25d0795229\PresentationFramework.ni.dll
  39. MOD - [2014/02/12 04:26:44 | 000,751,616 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Security\e0579383d49e212d5bf5a87c3dad50e7\System.Security.ni.dll
  40. MOD - [2014/02/12 04:26:34 | 005,628,928 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\850fa7110c7423c324762c1ad3130219\System.Xml.ni.dll
  41. MOD - [2014/02/12 04:26:17 | 007,053,824 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\a4b5a1a06d2d7f77258943c8c228a5e0\System.Core.ni.dll
  42. MOD - [2014/02/12 04:25:56 | 013,199,360 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\2781e84862746a34f026d0ee179eed2b\System.Windows.Forms.ni.dll
  43. MOD - [2014/02/12 04:25:29 | 001,667,584 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\243ff1822abc8282cb8fee37538170b4\System.Drawing.ni.dll
  44. MOD - [2014/02/12 04:25:23 | 011,451,904 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationCore\b307821c69c09ed0a2ee47122fdcdd4d\PresentationCore.ni.dll
  45. MOD - [2014/02/12 04:24:48 | 003,858,944 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\WindowsBase\49605239a73cd565e3a08048a31b442e\WindowsBase.ni.dll
  46. MOD - [2014/02/12 04:24:32 | 009,099,776 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\4c906eb82e6f56aea01b2a7291fab7ea\System.ni.dll
  47. MOD - [2014/02/12 04:24:07 | 014,416,896 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\4e62d1d9b7dd2c2d14915abb73c22d50\mscorlib.ni.dll
  48. MOD - [2011/03/27 16:11:04 | 000,094,208 | ---- | M] () -- C:\Program Files\FileZilla FTP Client\fzshellext.dll
  49.  
  50.  
  51. [color=#E56717]========== Services (SafeList) ==========[/color]
  52.  
  53. SRV - [2014/03/12 11:11:43 | 000,257,928 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
  54. SRV - [2014/02/18 11:26:50 | 000,118,896 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
  55. SRV - [2010/04/12 08:34:20 | 000,183,808 | ---- | M] (InfoTronics, Inc.) [Auto | Stopped] -- C:\Program Files\InfoTronics\Attendance Enterprise\AESERVICE.EXE -- (AeService)
  56. SRV - [2004/07/21 16:26:36 | 000,176,241 | ---- | M] (American Power Conversion Corporation) [Auto | Running] -- C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe -- (APC UPS Service)
  57.  
  58.  
  59. [color=#E56717]========== Driver Services (SafeList) ==========[/color]
  60.  
  61. DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
  62. DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
  63. DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
  64. DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
  65. DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
  66. DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
  67. DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
  68. DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
  69. DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
  70. DRV - File not found [Kernel | System | Stopped] -- U:\John\Downloads\EmsisoftEmergencyKit(1)\Run\a2ddax86.sys -- (A2DDA)
  71. DRV - [2014/03/14 17:35:56 | 000,052,312 | ---- | M] (Malwarebytes Corporation) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\mbamchameleon.sys -- (mbamchameleon)
  72. DRV - [2009/12/15 15:29:42 | 000,034,248 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mferkdk.sys -- (MfeRKDK)
  73. DRV - [2009/12/15 15:29:34 | 000,214,664 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk)
  74. DRV - [2009/12/15 15:29:30 | 000,035,272 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mfebopk.sys -- (MfeBOPK)
  75. DRV - [2009/12/15 15:29:26 | 000,079,816 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mfeavfk.sys -- (MfeAVFK)
  76. DRV - [2009/12/15 14:29:52 | 000,055,304 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\mfetdik.sys -- (mfetdik)
  77. DRV - [2005/10/18 17:15:42 | 004,034,048 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService)
  78. DRV - [2005/08/31 01:42:36 | 001,333,760 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
  79. DRV - [2005/08/24 16:56:28 | 000,074,752 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp)
  80. DRV - [2004/08/03 18:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139)
  81.  
  82.  
  83. [color=#E56717]========== Standard Registry (All) ==========[/color]
  84.  
  85.  
  86. [color=#E56717]========== Internet Explorer ==========[/color]
  87.  
  88. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  89. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  90. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
  91. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
  92. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
  93. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  94. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
  95. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  96. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
  97. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
  98. IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
  99. IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
  100.  
  101.  
  102. IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
  103. IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  104.  
  105. IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
  106. IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  107.  
  108.  
  109.  
  110. IE - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
  111. IE - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
  112. IE - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
  113. IE - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)
  114. IE - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
  115. IE - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
  116. IE - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  117.  
  118. [color=#E56717]========== FireFox ==========[/color]
  119.  
  120. FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:27.0.1
  121. FF - user.js - File not found
  122.  
  123. FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
  124. FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
  125. FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
  126. FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
  127.  
  128. FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2012/02/20 17:01:03 | 000,000,000 | ---D | M]
  129. FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2012/10/13 03:00:45 | 000,000,000 | ---D | M]
  130. FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components
  131. FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2014/02/18 11:26:38 | 000,000,000 | ---D | M]
  132.  
  133. [2014/03/13 07:50:18 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\mmurphy\Application Data\Mozilla\Extensions
  134. [2014/02/18 11:26:35 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
  135. [2014/02/18 11:26:50 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
  136. [2012/02/20 17:01:00 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
  137. [2007/03/22 20:23:30 | 000,017,248 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL
  138. [2012/12/18 15:08:32 | 000,209,112 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\mozilla firefox\plugins\nppdf32.dll
  139. [2010/12/09 06:47:06 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll
  140.  
  141. O1 HOSTS File: ([2001/08/23 08:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
  142. O1 - Hosts: 127.0.0.1 localhost
  143. O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
  144. O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
  145. O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
  146. O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
  147. O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
  148. O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
  149. O3 - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
  150. O3 - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\..\Toolbar\ShellBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
  151. O3 - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
  152. O3 - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
  153. O3 - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
  154. O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
  155. O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
  156. O4 - HKLM..\Run: [Garmin Lifetime Updater] C:\Program Files\Garmin\Lifetime Updater\GarminLifetime.exe (Garmin)
  157. O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.)
  158. O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
  159. O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
  160. O4 - HKU\S-1-5-21-2000478354-1979792683-725345543-1006..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)
  161. O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe (Adobe Systems Inc.)
  162. O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\APC UPS Status.lnk = C:\Program Files\APC\APC PowerChute Personal Edition\Display.exe (American Power Conversion Corporation)
  163. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
  164. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
  165. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
  166. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
  167. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LegalNoticeText =
  168. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LegalNoticeCaption =
  169. O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
  170. O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
  171. O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
  172. O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
  173. O7 - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
  174. O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
  175. O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
  176. O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation)
  177. O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
  178. O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
  179. O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
  180. O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation)
  181. O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
  182. O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
  183. O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
  184. O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
  185. O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
  186. O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
  187. O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
  188. O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
  189. O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
  190. O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
  191. O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
  192. O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
  193. O15 - HKLM\..Trusted Domains: //about.htm/ ([]myui in Trusted sites)
  194. O15 - HKLM\..Trusted Domains: //Exclude.htm/ ([]myui in Trusted sites)
  195. O15 - HKLM\..Trusted Domains: //LanguageSelection.htm/ ([]myui in Trusted sites)
  196. O15 - HKLM\..Trusted Domains: //Message.htm/ ([]myui in Trusted sites)
  197. O15 - HKLM\..Trusted Domains: //MyAgttryCmd.htm/ ([]myui in Trusted sites)
  198. O15 - HKLM\..Trusted Domains: //MyAgttryNag.htm/ ([]myui in Trusted sites)
  199. O15 - HKLM\..Trusted Domains: //MyNotification.htm/ ([]myui in Trusted sites)
  200. O15 - HKLM\..Trusted Domains: //NOCLessUpdate.htm/ ([]myui in Trusted sites)
  201. O15 - HKLM\..Trusted Domains: //quarantine.htm/ ([]myui in Trusted sites)
  202. O15 - HKLM\..Trusted Domains: //ScanNow.htm/ ([]myui in Trusted sites)
  203. O15 - HKLM\..Trusted Domains: //strings.vbs/ ([]myui in Trusted sites)
  204. O15 - HKLM\..Trusted Domains: //Template.htm/ ([]myui in Trusted sites)
  205. O15 - HKLM\..Trusted Domains: //Update.htm/ ([]myui in Trusted sites)
  206. O15 - HKLM\..Trusted Domains: //VirFound.htm/ ([]myui in Trusted sites)
  207. O15 - HKLM\..Trusted Domains: mcafee.com ([*] http in Trusted sites)
  208. O15 - HKLM\..Trusted Domains: mcafee.com ([*] https in Trusted sites)
  209. O15 - HKLM\..Trusted Domains: mcafeeasap.com ([betavscan] http in Trusted sites)
  210. O15 - HKLM\..Trusted Domains: mcafeeasap.com ([betavscan] https in Trusted sites)
  211. O15 - HKLM\..Trusted Domains: mcafeeasap.com ([vs] http in Trusted sites)
  212. O15 - HKLM\..Trusted Domains: mcafeeasap.com ([vs] https in Trusted sites)
  213. O15 - HKLM\..Trusted Domains: mcafeeasap.com ([www] http in Trusted sites)
  214. O15 - HKLM\..Trusted Domains: mcafeeasap.com ([www] https in Trusted sites)
  215. O16 - DPF: {037790A6-1576-11D6-903D-00105AABADD3} https://www.ussco.com/bluezone/controls/sglw2hcm.ocx (Seagull Web-to-Host Control Module v4)
  216. O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1358279557099 (WUWebControl Class)
  217. O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1358279603631 (MUWebControl Class)
  218. O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
  219. O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
  220. O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
  221. O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4F812C9A-4072-430C-87AD-28B103F95B28}: NameServer = 209.244.0.3,209.244.0.4
  222. O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
  223. O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
  224. O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)
  225. O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
  226. O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
  227. O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
  228. O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
  229. O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
  230. O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
  231. O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
  232. O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
  233. O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
  234. O18 - Protocol\Handler\ipp - No CLSID value found
  235. O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
  236. O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)
  237. O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
  238. O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
  239. O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
  240. O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation)
  241. O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
  242. O18 - Protocol\Handler\msdaipp - No CLSID value found
  243. O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
  244. O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
  245. O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)
  246. O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
  247. O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
  248. O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
  249. O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
  250. O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)
  251. O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
  252. O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation)
  253. O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
  254. O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
  255. O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
  256. O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
  257. O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
  258. O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
  259. O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
  260. O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
  261. O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
  262. O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
  263. O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
  264. O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation)
  265. O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
  266. O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)
  267. O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
  268. O20 - Winlogon\Notify\crypt32chain: DllName - (crypt32.dll) - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)
  269. O20 - Winlogon\Notify\cryptnet: DllName - (cryptnet.dll) - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)
  270. O20 - Winlogon\Notify\cscdll: DllName - (cscdll.dll) - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)
  271. O20 - Winlogon\Notify\dimsntfy: DllName - (%SystemRoot%\System32\dimsntfy.dll) - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation)
  272. O20 - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
  273. O20 - Winlogon\Notify\Schedule: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
  274. O20 - Winlogon\Notify\sclgntfy: DllName - (sclgntfy.dll) - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)
  275. O20 - Winlogon\Notify\SensLogn: DllName - (WlNotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
  276. O20 - Winlogon\Notify\termsrv: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
  277. O20 - Winlogon\Notify\WgaLogon: DllName - (WgaLogon.dll) - C:\WINDOWS\System32\WgaLogon.dll (Microsoft Corporation)
  278. O20 - Winlogon\Notify\wlballoon: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
  279. O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
  280. O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
  281. O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation)
  282. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)
  283. O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll (Microsoft Corporation)
  284. O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
  285. O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
  286. O24 - Desktop Components:0 (My Current Home Page) - About:Home
  287. O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
  288. O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)
  289. O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
  290. O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation)
  291. O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)
  292. O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
  293. O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)
  294. O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
  295. O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
  296. O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)
  297. O31 - SafeBoot: AlternateShell - cmd.exe
  298. O32 - HKLM CDRom: AutoRun - 1
  299. O32 - AutoRun File - [2006/01/20 17:59:13 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
  300. O34 - HKLM BootExecute: (autocheck autochk *)
  301. O35 - HKLM\..comfile [open] -- "%1" %*
  302. O35 - HKLM\..exefile [open] -- "%1" %*
  303. O37 - HKLM\...com [@ = comfile] -- "%1" %*
  304. O37 - HKLM\...exe [@ = exefile] -- "%1" %*
  305. O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
  306. O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
  307.  
  308. NetSvcs: 6to4 - File not found
  309. NetSvcs: Ias - File not found
  310. NetSvcs: Iprip - File not found
  311. NetSvcs: Irmon - File not found
  312. NetSvcs: NWCWorkstation - File not found
  313. NetSvcs: Nwsapagent - File not found
  314. NetSvcs: WmdmPmSp - File not found
  315.  
  316.  
  317. SafeBootMin: Base - Driver Group
  318. SafeBootMin: Boot Bus Extender - Driver Group
  319. SafeBootMin: Boot file system - Driver Group
  320. SafeBootMin: File system - Driver Group
  321. SafeBootMin: Filter - Driver Group
  322. SafeBootMin: PCI Configuration - Driver Group
  323. SafeBootMin: PNP Filter - Driver Group
  324. SafeBootMin: Primary disk - Driver Group
  325. SafeBootMin: SCSI Class - Driver Group
  326. SafeBootMin: sermouse.sys - Driver
  327. SafeBootMin: System Bus Extender - Driver Group
  328. SafeBootMin: vds - Service
  329. SafeBootMin: vga.sys - Driver
  330. SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
  331. SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
  332. SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
  333. SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
  334. SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
  335. SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
  336. SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
  337. SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
  338. SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
  339. SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
  340. SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
  341. SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
  342. SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
  343. SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
  344.  
  345. SafeBootNet: Base - Driver Group
  346. SafeBootNet: Boot Bus Extender - Driver Group
  347. SafeBootNet: Boot file system - Driver Group
  348. SafeBootNet: File system - Driver Group
  349. SafeBootNet: Filter - Driver Group
  350. SafeBootNet: NDIS Wrapper - Driver Group
  351. SafeBootNet: NetBIOSGroup - Driver Group
  352. SafeBootNet: NetDDEGroup - Driver Group
  353. SafeBootNet: Network - Driver Group
  354. SafeBootNet: NetworkProvider - Driver Group
  355. SafeBootNet: PCI Configuration - Driver Group
  356. SafeBootNet: PNP Filter - Driver Group
  357. SafeBootNet: PNP_TDI - Driver Group
  358. SafeBootNet: Primary disk - Driver Group
  359. SafeBootNet: SCSI Class - Driver Group
  360. SafeBootNet: sermouse.sys - Driver
  361. SafeBootNet: Streams Drivers - Driver Group
  362. SafeBootNet: System Bus Extender - Driver Group
  363. SafeBootNet: TDI - Driver Group
  364. SafeBootNet: vga.sys - Driver
  365. SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
  366. SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
  367. SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
  368. SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
  369. SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
  370. SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
  371. SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
  372. SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
  373. SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
  374. SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
  375. SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
  376. SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
  377. SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
  378. SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
  379. SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
  380. SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
  381. SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
  382.  
  383. ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
  384. ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
  385. ActiveX: {1325db73-d9f1-48f8-8895-6d814ec58889} - Security Update for Windows XP (KB913433)
  386. ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
  387. ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
  388. ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
  389. ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
  390. ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
  391. ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
  392. ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
  393. ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
  394. ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
  395. ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
  396. ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
  397. ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
  398. ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
  399. ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
  400. ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
  401. ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
  402. ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
  403. ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
  404. ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
  405. ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
  406. ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
  407. ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
  408. ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
  409. ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
  410. ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
  411. ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
  412. ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - DOTNETFRAMEWORKS
  413. ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
  414. ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
  415. ActiveX: {C3C986D6-06B1-43BF-90DD-BE30756C00DE} - RevokedRootsUpdate
  416. ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
  417. ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
  418. ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
  419. ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash
  420. ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
  421. ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
  422. ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
  423. ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
  424. ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
  425. ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
  426. ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
  427. ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
  428.  
  429. Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
  430. Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
  431. Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
  432. Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
  433. Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
  434. Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
  435. Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
  436. Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
  437. Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
  438.  
  439. [color=#E56717]========== Files/Folders - Created Within 90 Days ==========[/color]
  440.  
  441. [2014/03/17 15:06:14 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\mmurphy\Desktop\OTL.exe
  442. [2014/03/17 08:15:17 | 000,000,000 | -H-D | C] -- C:\WINDOWS\PIF
  443. [2014/03/14 17:36:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)
  444. [2014/03/14 17:27:09 | 000,052,312 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamchameleon.sys
  445. [2014/03/14 17:27:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mmurphy\Desktop\mbar
  446. [2014/03/14 17:26:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mmurphy\mbar
  447. [2014/03/14 15:03:43 | 000,000,000 | ---D | C] -- C:\FRST
  448. [2014/03/14 15:02:34 | 001,145,856 | ---- | C] (Farbar) -- C:\Documents and Settings\mmurphy\FRST.exe
  449. [2014/03/14 14:07:18 | 000,000,000 | R--D | C] -- C:\Documents and Settings\mmurphy\My Documents\My Videos
  450. [2014/03/14 14:07:18 | 000,000,000 | R--D | C] -- C:\Documents and Settings\mmurphy\Start Menu\Programs\Administrative Tools
  451. [2014/03/14 12:19:12 | 000,688,992 | R--- | C] (Swearware) -- C:\Documents and Settings\mmurphy\dds.com
  452. [2014/03/14 12:01:06 | 000,107,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
  453. [2014/03/13 10:48:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mmurphy\Application Data\Runscanner.net
  454. [2014/03/13 07:53:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mmurphy\Application Data\Malwarebytes
  455. [2014/03/13 07:51:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mmurphy\My Documents\Downloads
  456. [2014/03/13 07:50:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mmurphy\Local Settings\Application Data\Mozilla
  457. [2014/03/13 07:50:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mmurphy\Application Data\Mozilla
  458. [2014/03/12 11:11:40 | 005,777,288 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerInstaller.exe
  459. [2014/02/18 11:26:35 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
  460. [2014/02/12 04:21:54 | 000,000,000 | -HSD | C] -- C:\Config.Msi
  461. [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
  462. [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
  463.  
  464. [color=#E56717]========== Files - Modified Within 90 Days ==========[/color]
  465.  
  466. [2014/03/17 15:11:05 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
  467. [2014/03/17 15:11:02 | 000,002,523 | ---- | M] () -- C:\WINDOWS\pw5.ini
  468. [2014/03/17 15:05:39 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
  469. [2014/03/17 15:01:34 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\mmurphy\Desktop\OTL.exe
  470. [2014/03/17 05:04:04 | 000,002,521 | ---- | M] () -- C:\Documents and Settings\mmurphy\Desktop\Microsoft Office Outlook 2003.lnk
  471. [2014/03/14 17:36:18 | 000,107,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
  472. [2014/03/14 17:35:56 | 000,052,312 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamchameleon.sys
  473. [2014/03/14 17:34:16 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
  474. [2014/03/14 17:34:13 | 2078,855,168 | -HS- | M] () -- C:\hiberfil.sys
  475. [2014/03/14 14:59:48 | 001,145,856 | ---- | M] (Farbar) -- C:\Documents and Settings\mmurphy\FRST.exe
  476. [2014/03/14 12:19:13 | 000,688,992 | R--- | M] (Swearware) -- C:\Documents and Settings\mmurphy\dds.com
  477. [2014/03/14 03:19:23 | 000,243,128 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
  478. [2014/03/14 03:02:35 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
  479. [2014/03/13 10:21:16 | 000,496,578 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
  480. [2014/03/13 10:21:16 | 000,085,040 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
  481. [2014/03/13 07:57:24 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
  482. [2014/03/12 11:11:43 | 000,692,616 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
  483. [2014/03/12 11:11:43 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
  484. [2014/03/12 11:11:40 | 005,777,288 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerInstaller.exe
  485. [2014/02/24 16:24:24 | 000,174,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\ie4uinit.exe
  486. [2014/02/24 16:24:24 | 000,174,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ie4uinit.exe
  487. [2014/02/24 07:46:36 | 000,920,064 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wininet.dll
  488. [2014/02/24 07:46:31 | 000,759,296 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\vgx.dll
  489. [2014/02/24 07:46:25 | 001,216,000 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\urlmon.dll
  490. [2014/02/24 07:46:19 | 000,105,984 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\url.dll
  491. [2014/02/24 07:46:19 | 000,105,984 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\url.dll
  492. [2014/02/24 07:46:18 | 000,206,848 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\occache.dll
  493. [2014/02/24 07:46:16 | 000,611,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\mstime.dll
  494. [2014/02/24 07:46:16 | 000,611,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mstime.dll
  495. [2014/02/24 07:46:11 | 006,022,144 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
  496. [2014/02/24 07:46:11 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtmled.dll
  497. [2014/02/24 07:45:58 | 000,630,272 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msfeeds.dll
  498. [2014/02/24 07:45:58 | 000,630,272 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeeds.dll
  499. [2014/02/24 07:45:58 | 000,055,296 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msfeedsbs.dll
  500. [2014/02/24 07:45:58 | 000,055,296 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeedsbs.dll
  501. [2014/02/24 07:45:58 | 000,043,520 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\licmgr10.dll
  502. [2014/02/24 07:45:58 | 000,043,520 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\licmgr10.dll
  503. [2014/02/24 07:45:57 | 002,006,016 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iertutil.dll
  504. [2014/02/24 07:45:57 | 001,469,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\inetcpl.cpl
  505. [2014/02/24 07:45:57 | 001,469,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\inetcpl.cpl
  506. [2014/02/24 07:45:57 | 000,522,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jsdbgui.dll
  507. [2014/02/24 07:45:57 | 000,025,600 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\jsproxy.dll
  508. [2014/02/24 07:45:57 | 000,025,600 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jsproxy.dll
  509. [2014/02/24 07:45:56 | 000,184,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\iepeers.dll
  510. [2014/02/24 07:45:56 | 000,184,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iepeers.dll
  511. [2014/02/24 07:45:55 | 011,113,472 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieframe.dll
  512. [2014/02/24 07:45:43 | 000,743,424 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedvtool.dll
  513. [2014/02/24 07:45:43 | 000,387,584 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\iedkcs32.dll
  514. [2014/02/24 07:45:43 | 000,387,584 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedkcs32.dll
  515. [2014/02/24 07:45:42 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\corpol.dll
  516. [2014/02/24 07:45:42 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\corpol.dll
  517. [2014/02/24 06:54:21 | 000,385,024 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\html.iec
  518. [2014/02/06 22:01:37 | 001,879,040 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\win32k.sys
  519. [2014/02/06 22:01:37 | 001,879,040 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\win32k.sys
  520. [2014/02/05 04:55:04 | 000,562,688 | ---- | M] () -- C:\WINDOWS\System32\dllcache\qedit.dll
  521. [2014/01/03 23:13:05 | 000,420,864 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\vbscript.dll
  522. [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
  523. [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
  524.  
  525. [color=#E56717]========== Files Created - No Company Name ==========[/color]
  526.  
  527. [2014/03/13 10:42:18 | 2078,855,168 | -HS- | C] () -- C:\hiberfil.sys
  528. [2014/03/13 07:57:24 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
  529. [2013/01/16 04:23:36 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
  530. [2012/08/29 17:36:17 | 083,023,306 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\0tbpw.pad
  531. [2012/01/13 20:12:34 | 001,573,344 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-2000478354-1979792683-725345543-1004-0.dat
  532. [2012/01/13 20:12:30 | 001,082,281 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-2000478354-1979792683-725345543-1006-0.dat
  533. [2012/01/13 20:12:26 | 000,260,782 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
  534.  
  535. [color=#E56717]========== ZeroAccess Check ==========[/color]
  536.  
  537. [2012/10/11 09:51:43 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
  538.  
  539. [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  540.  
  541. [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
  542.  
  543. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  544. "" = %SystemRoot%\system32\shdocvw.dll -- [2012/10/31 07:33:26 | 001,510,400 | ---- | M] (Microsoft Corporation)
  545. "ThreadingModel" = Apartment
  546.  
  547. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
  548. "" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 08:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
  549. "ThreadingModel" = Free
  550.  
  551. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
  552. "" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008/04/13 20:12:08 | 000,273,920 | ---- | M] (Microsoft Corporation)
  553. "ThreadingModel" = Both
  554.  
  555. [color=#E56717]========== LOP Check ==========[/color]
  556.  
  557. [2010/11/23 17:14:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Attendance Enterprise Backups
  558. [2013/07/08 11:21:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FedEx Customer Tools
  559. [2012/01/04 15:43:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Garmin
  560. [2012/10/11 10:37:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GEOTAB
  561. [2013/05/13 09:01:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Craig\Application Data\Desktop Apps
  562. [2013/06/19 08:49:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Craig\Application Data\Dropbox
  563. [2014/02/19 15:00:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Craig\Application Data\FileZilla
  564. [2014/03/13 15:28:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess
  565. [2012/01/04 16:13:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Craig\Application Data\Garmin
  566. [2012/10/11 10:37:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Craig\Application Data\GEOTAB
  567. [2013/01/04 10:33:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Craig\Application Data\Notepad++
  568. [2012/03/07 17:09:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Craig\Application Data\OpenOffice.org
  569. [2014/03/13 10:49:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Craig\Application Data\Runscanner.net
  570. [2012/04/25 07:36:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Craig\Application Data\Seagull Software
  571. [2012/01/04 23:23:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\Garmin
  572. [2014/03/13 10:48:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\Runscanner.net
  573.  
  574. [color=#E56717]========== Purity Check ==========[/color]
  575.  
  576.  
  577.  
  578. [color=#E56717]========== Custom Scans ==========[/color]
  579.  
  580. [color=#A23BEC]< %SYSTEMDRIVE%\*.* >[/color]
  581. [2006/01/20 17:59:13 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
  582. [2006/01/20 17:51:25 | 000,000,211 | -HS- | M] () -- C:\boot.ini
  583. [2006/01/20 17:59:13 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
  584. [2006/01/20 18:20:34 | 000,000,183 | ---- | M] () -- C:\GFX.log
  585. [2014/03/14 17:34:13 | 2078,855,168 | -HS- | M] () -- C:\hiberfil.sys
  586. [2006/01/20 18:16:59 | 000,000,090 | ---- | M] () -- C:\INF.log
  587. [2006/01/20 17:59:13 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
  588. [2006/01/20 18:27:20 | 000,000,224 | ---- | M] () -- C:\LAN.log
  589. [2006/01/20 17:59:13 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
  590. [2004/08/03 22:38:34 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
  591. [2013/01/15 17:28:43 | 000,250,048 | RHS- | M] () -- C:\ntldr
  592. [2014/03/14 17:34:12 | 704,643,072 | -HS- | M] () -- C:\pagefile.sys
  593. [2006/01/20 18:24:16 | 000,000,206 | ---- | M] () -- C:\Realtek.log
  594. [2006/01/20 18:24:12 | 000,000,391 | ---- | M] () -- C:\RtlSetup.log
  595.  
  596. [color=#A23BEC]< %SYSTEMDRIVE%\*. >[/color]
  597. [2012/10/11 09:54:28 | 000,000,000 | ---D | M] -- C:\5d8b9505ae343a4029daeac31d39
  598. [2013/01/15 15:37:39 | 000,000,000 | ---D | M] -- C:\a Download
  599. [2013/01/16 08:44:38 | 000,000,000 | ---D | M] -- C:\a7110dbd450582aa7803cdd700359cc0
  600. [2014/02/12 04:46:58 | 000,000,000 | -HSD | M] -- C:\Config.Msi
  601. [2012/10/10 09:15:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings
  602. [2013/02/26 17:34:51 | 000,000,000 | ---D | M] -- C:\Documents%20and%20Settings
  603. [2014/03/14 17:24:06 | 000,000,000 | ---D | M] -- C:\FRST
  604. [2012/11/06 15:41:52 | 000,000,000 | RH-D | M] -- C:\MSOCache
  605. [2006/01/21 20:57:59 | 000,000,000 | ---D | M] -- C:\Office2k
  606. [2014/02/18 16:50:09 | 000,000,000 | R--D | M] -- C:\Program Files
  607. [2010/05/24 02:15:36 | 000,000,000 | -HSD | M] -- C:\RECYCLER
  608. [2006/12/15 17:44:50 | 000,000,000 | ---D | M] -- C:\RouteTracking
  609. [2006/01/20 18:05:37 | 000,000,000 | -HSD | M] -- C:\System Volume Information
  610. [2006/01/20 18:29:40 | 000,000,000 | ---D | M] -- C:\TempEI4
  611. [2014/03/17 08:15:17 | 000,000,000 | ---D | M] -- C:\WINDOWS
  612.  
  613. [color=#A23BEC]< %USERPROFILE%\*.* >[/color]
  614. [2014/03/14 15:04:54 | 000,018,335 | ---- | M] () -- C:\Documents and Settings\mmurphy\Addition.txt
  615. [2014/03/14 14:08:03 | 000,019,163 | ---- | M] () -- C:\Documents and Settings\mmurphy\attach.txt
  616. [2014/03/14 12:19:13 | 000,688,992 | R--- | M] (Swearware) -- C:\Documents and Settings\mmurphy\dds.com
  617. [2014/03/14 14:07:57 | 000,008,284 | ---- | M] () -- C:\Documents and Settings\mmurphy\dds.txt
  618. [2014/03/14 17:24:06 | 000,001,482 | ---- | M] () -- C:\Documents and Settings\mmurphy\Fixlog.txt
  619. [2014/03/14 14:59:48 | 001,145,856 | ---- | M] (Farbar) -- C:\Documents and Settings\mmurphy\FRST.exe
  620. [2014/03/14 15:04:54 | 000,028,688 | ---- | M] () -- C:\Documents and Settings\mmurphy\FRST.txt
  621. [2014/03/17 05:10:31 | 008,388,608 | -H-- | M] () -- C:\Documents and Settings\mmurphy\NTUSER.DAT
  622. [2014/03/17 15:11:10 | 000,001,024 | -H-- | M] () -- C:\Documents and Settings\mmurphy\NTUSER.DAT.LOG
  623. [2014/03/17 05:10:31 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\mmurphy\ntuser.ini
  624.  
  625. [color=#A23BEC]< %USERPROFILE%\*. >[/color]
  626. [2014/03/13 10:48:43 | 000,000,000 | RH-D | M] -- C:\Documents and Settings\mmurphy\Application Data
  627. [2014/03/17 05:10:21 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\mmurphy\Cookies
  628. [2014/03/17 15:06:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Desktop
  629. [2013/01/17 07:59:34 | 000,000,000 | R--D | M] -- C:\Documents and Settings\mmurphy\Favorites
  630. [2013/01/17 07:59:32 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\mmurphy\IETldCache
  631. [2014/03/13 10:28:36 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\mmurphy\Local Settings
  632. [2014/03/14 17:26:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\mbar
  633. [2014/03/14 14:07:18 | 000,000,000 | R--D | M] -- C:\Documents and Settings\mmurphy\My Documents
  634. [2011/04/27 07:39:56 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\mmurphy\NetHood
  635. [2006/01/21 01:46:41 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\mmurphy\PrintHood
  636. [2013/01/18 03:14:19 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\mmurphy\PrivacIE
  637. [2014/03/14 18:23:23 | 000,000,000 | RH-D | M] -- C:\Documents and Settings\mmurphy\Recent
  638. [2006/01/20 18:11:36 | 000,000,000 | RH-D | M] -- C:\Documents and Settings\mmurphy\SendTo
  639. [2011/02/11 07:45:41 | 000,000,000 | R--D | M] -- C:\Documents and Settings\mmurphy\Start Menu
  640. [2006/01/20 17:54:36 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\mmurphy\Templates
  641. [2006/01/20 18:15:28 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\mmurphy\UserData
  642.  
  643. [color=#A23BEC]< %USERPROFILE%\*.exe /s >[/color]
  644. [2014/03/14 14:59:48 | 001,145,856 | ---- | M] (Farbar) -- C:\Documents and Settings\mmurphy\FRST.exe
  645. [2011/03/18 04:47:19 | 002,871,968 | ---- | M] (Adobe Systems, Inc.) -- C:\Documents and Settings\mmurphy\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
  646. [2014/03/13 10:48:43 | 000,157,184 | ---- | M] () -- C:\Documents and Settings\mmurphy\Application Data\Runscanner.net\VirusTotalUpload.exe
  647. [2014/03/17 15:01:34 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\mmurphy\Desktop\OTL.exe
  648. [2014/01/07 20:29:35 | 001,180,472 | ---- | M] (Malwarebytes Corporation) -- C:\Documents and Settings\mmurphy\Desktop\mbar\mbar.exe
  649. [2014/01/07 20:30:17 | 000,821,560 | ---- | M] (Malwarebytes Corporation) -- C:\Documents and Settings\mmurphy\Desktop\mbar\Plugins\fixdamage.exe
  650. [2011/07/12 22:01:04 | 002,374,968 | ---- | M] (iMesh Inc. ) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\iMesh_setup.exe
  651. [2013/04/06 10:00:56 | 012,871,152 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp1.exe
  652. [2013/03/22 00:01:16 | 012,873,968 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp11F.exe
  653. [2013/11/04 23:07:00 | 012,142,192 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp127.exe
  654. [2013/12/20 02:01:20 | 012,159,416 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp161.exe
  655. [2013/09/19 05:01:15 | 012,332,168 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp16B.exe
  656. [2013/06/20 23:01:19 | 012,871,152 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp173.exe
  657. [2013/04/21 10:01:37 | 012,871,152 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp19.exe
  658. [2013/10/20 12:01:13 | 012,142,192 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp1D1.exe
  659. [2012/08/20 22:12:27 | 012,397,960 | ---- | M] (Garmin International) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp2013.exe
  660. [2013/08/05 02:01:14 | 012,330,800 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp268.exe
  661. [2014/02/03 22:33:52 | 012,160,392 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp2B1.exe
  662. [2013/09/04 04:01:15 | 012,332,168 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp2BB.exe
  663. [2013/10/05 11:40:35 | 012,142,192 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp2E6.exe
  664. [2013/07/06 00:01:25 | 012,871,152 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp3.exe
  665. [2013/05/06 20:24:01 | 012,871,152 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp40.exe
  666. [2014/03/05 23:09:42 | 030,543,216 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp4A2.exe
  667. [2013/07/21 01:01:14 | 012,330,072 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp5.exe
  668. [2014/01/19 11:01:18 | 012,160,392 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp53.exe
  669. [2014/01/04 10:03:20 | 012,160,392 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp88.exe
  670. [2013/11/20 00:01:14 | 012,159,080 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp8F.exe
  671. [2013/12/05 01:01:13 | 012,159,080 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp92.exe
  672. [2013/06/05 22:41:57 | 012,871,152 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp9C.exe
  673. [2013/05/21 21:01:28 | 012,871,152 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmpB0.exe
  674. [2014/02/18 22:45:29 | 029,410,392 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmpCD.exe
  675. [308 C:\Documents and Settings\mmurphy\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\mmurphy\Local Settings\Temp\*.tmp -> ]
  676. [2010/05/09 09:06:38 | 002,559,890 | ---- | M] (Adobe Systems, Inc.) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tour_695490\start_001.exe
  677. [2014/03/14 17:26:30 | 012,589,848 | ---- | M] (Malwarebytes Corp.) -- C:\Documents and Settings\mmurphy\mbar\mbar-1.07.0.1009.exe
  678. [2014/03/13 07:52:12 | 010,285,040 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\mmurphy\My Documents\Downloads\mbam-setup-1.75.0.1300.exe
  679. [2014/03/13 10:48:31 | 002,248,504 | ---- | M] (Runscanner.net) -- C:\Documents and Settings\mmurphy\My Documents\Downloads\runscanner.exe
  680.  
  681. [color=#A23BEC]< %USERPROFILE%\My Documents\*.* >[/color]
  682. [2012/10/02 22:14:46 | 002,565,715 | ---- | M] () -- C:\Documents and Settings\mmurphy\My Documents\2011-08-25_21-51-56_908.JPG
  683. [2013/03/18 07:04:56 | 000,017,408 | ---- | M] () -- C:\Documents and Settings\mmurphy\My Documents\Bl2013 Sunday Golf Group.xls
  684. [2013/01/17 07:59:33 | 000,000,078 | -HS- | M] () -- C:\Documents and Settings\mmurphy\My Documents\desktop.ini
  685.  
  686. [color=#A23BEC]< %USERPROFILE%\My Documents\*. >[/color]
  687. [2014/03/14 17:26:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\My Documents\Downloads
  688. [2010/05/25 22:56:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\My Documents\My eBooks
  689. [2013/01/17 07:59:33 | 000,000,000 | R--D | M] -- C:\Documents and Settings\mmurphy\My Documents\My Music
  690. [2014/03/14 14:07:18 | 000,000,000 | R--D | M] -- C:\Documents and Settings\mmurphy\My Documents\My Videos
  691.  
  692. [color=#A23BEC]< %USERPROFILE%\Application Data\*.* >[/color]
  693. [2013/11/03 10:25:37 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\mmurphy\Application Data\desktop.ini
  694.  
  695. [color=#A23BEC]< %USERPROFILE%\Application Data\*. >[/color]
  696. [2011/03/14 01:19:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\Adobe
  697. [2012/01/04 23:23:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\Garmin
  698. [2006/01/20 18:11:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\Identities
  699. [2007/05/21 06:42:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\Macromedia
  700. [2014/03/13 07:53:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\Malwarebytes
  701. [2010/03/25 01:41:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\McAfee
  702. [2011/03/14 01:19:38 | 000,000,000 | --SD | M] -- C:\Documents and Settings\mmurphy\Application Data\Microsoft
  703. [2006/01/21 22:02:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\Microsoft Web Folders
  704. [2014/03/13 07:50:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\Mozilla
  705. [2014/03/13 10:48:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\Runscanner.net
  706. [2012/02/22 01:18:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\Sun
  707. [2011/04/18 02:16:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\Winamp
  708.  
  709. [color=#A23BEC]< %USERPROFILE%\Local Settings\*.* >[/color]
  710. [2014/03/17 15:05:37 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\mmurphy\Local Settings\desktop.ini
  711.  
  712. [color=#A23BEC]< %USERPROFILE%\Local Settings\*. >[/color]
  713. [2014/03/13 07:50:15 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\mmurphy\Local Settings\Application Data
  714. [2013/07/08 21:58:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Local Settings\Apps
  715. [2013/01/15 20:24:36 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\mmurphy\Local Settings\History
  716. [2014/03/17 15:11:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Local Settings\Temp
  717. [2013/01/15 20:23:58 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\mmurphy\Local Settings\Temporary Internet Files
  718.  
  719. [color=#A23BEC]< %USERPROFILE%\Local Settings\Application Data\*.* >[/color]
  720. [2013/04/04 05:03:35 | 000,054,608 | ---- | M] () -- C:\Documents and Settings\mmurphy\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
  721. [2012/11/05 04:34:42 | 004,842,274 | -H-- | M] () -- C:\Documents and Settings\mmurphy\Local Settings\Application Data\IconCache.db
  722.  
  723. [color=#A23BEC]< %USERPROFILE%\Local Settings\Application Data\*. >[/color]
  724. [2011/03/14 01:19:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Local Settings\Application Data\Adobe
  725. [2008/06/24 02:24:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Local Settings\Application Data\Identities
  726. [2014/03/13 08:59:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Local Settings\Application Data\Microsoft
  727. [2014/03/13 07:50:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Local Settings\Application Data\Mozilla
  728. [2011/07/12 22:01:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Local Settings\Application Data\PackageAware
  729. [2011/03/14 01:19:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Local Settings\Application Data\Temp
  730.  
  731. [color=#A23BEC]< %USERPROFILE%\Local Settings\Temp\*.tlb >[/color]
  732.  
  733. [color=#A23BEC]< %USERPROFILE%\Local Settings\Application Data\Google\Chrome\User Data\Default\*.* >[/color]
  734.  
  735. [color=#A23BEC]< %AllUsersProfile%\*. >[/color]
  736. [2014/03/14 17:36:19 | 000,000,000 | RH-D | M] -- C:\Documents and Settings\All Users\Application Data
  737. [2014/03/13 07:57:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Desktop
  738. [2006/01/21 09:19:53 | 000,000,000 | R--D | M] -- C:\Documents and Settings\All Users\Documents
  739. [2007/05/09 14:53:15 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\All Users\DRM
  740. [2006/01/21 01:46:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Favorites
  741. [2013/01/15 17:33:43 | 000,000,000 | R--D | M] -- C:\Documents and Settings\All Users\Start Menu
  742. [2012/02/20 17:07:45 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Templates
  743.  
  744. [color=#A23BEC]< %AllUsersProfile%\*.exe /s >[/color]
  745. [2012/12/18 16:34:04 | 000,364,816 | ---- | M] (Adobe Systems Incorporated) -- C:\Documents and Settings\All Users\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}\setup.exe
  746. [2012/08/30 07:45:28 | 010,652,120 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
  747.  
  748. [color=#A23BEC]< %AllUsersProfile%\DRM\*.tmp >[/color]
  749.  
  750. [color=#A23BEC]< %AllUsersProfile%\Microsoft\Windows\DRM\*.tmp >[/color]
  751.  
  752. [color=#A23BEC]< %AllUsersProfile%\Application Data\Microsoft\Windows\DRM\*.tmp >[/color]
  753.  
  754. [color=#A23BEC]< %AllUsersProfile%\Application Data\*.* >[/color]
  755. [2012/08/30 07:33:48 | 083,023,306 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\0tbpw.pad
  756. [2006/01/21 01:46:41 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini
  757.  
  758. [color=#A23BEC]< %AllUsersProfile%\Application Data\*. >[/color]
  759. [2013/03/19 15:20:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Adobe
  760. [2010/11/23 17:14:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Attendance Enterprise Backups
  761. [2013/07/08 11:21:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FedEx Customer Tools
  762. [2012/01/04 15:43:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Garmin
  763. [2012/10/11 10:37:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GEOTAB
  764. [2011/12/01 09:43:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
  765. [2014/03/14 18:20:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)
  766. [2010/03/25 01:39:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\McAfee
  767. [2012/11/06 16:11:46 | 000,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Application Data\Microsoft
  768. [2012/05/03 15:16:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Mozilla
  769. [2012/02/20 17:03:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sun
  770. [2013/01/11 09:42:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Symantec
  771. [2006/01/20 18:34:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
  772.  
  773. [color=#A23BEC]< C:\Documents and Settings\Default User\*.exe /s >[/color]
  774. [2011/03/10 11:34:41 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Documents and Settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
  775. [2006/01/20 17:56:28 | 000,000,065 | RH-- | C] () -- C:\WINDOWS\Tasks\desktop.ini
  776. [2006/01/20 18:05:27 | 000,000,006 | -H-- | C] () -- C:\WINDOWS\Tasks\SA.DAT
  777. [2013/03/19 15:19:21 | 000,000,830 | ---- | C] () -- C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
  778.  
  779. [color=#A23BEC]< C:\Documents and Settings\Default User\Application Data\*.* >[/color]
  780. [2006/01/21 01:46:41 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\Default User\Application Data\desktop.ini
  781.  
  782. [color=#A23BEC]< C:\Documents and Settings\Default User\Application Data\*. >[/color]
  783. [2006/01/21 09:20:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\Adobe
  784. [2006/01/20 18:11:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\Identities
  785. [2011/03/10 11:34:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\Macromedia
  786. [2006/05/23 10:26:50 | 000,000,000 | --SD | M] -- C:\Documents and Settings\Default User\Application Data\Microsoft
  787. [2006/01/21 22:02:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\Microsoft Web Folders
  788.  
  789. [color=#A23BEC]< C:\Documents and Settings\Default User\Local Settings\*.* >[/color]
  790.  
  791. [color=#A23BEC]< C:\Documents and Settings\Default User\Local Settings\*. >[/color]
  792. [2012/10/12 03:03:36 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Default User\Local Settings\History
  793. [2012/10/12 03:03:36 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files
  794.  
  795. [color=#A23BEC]< C:\Documents and Settings\Default User\Local Settings\Application Data\*.* >[/color]
  796.  
  797. [color=#A23BEC]< C:\Documents and Settings\Default User\Local Settings\Application Data\*. >[/color]
  798.  
  799. [color=#A23BEC]< C:\Documents and Settings\Default User\Local Settings\Temp\*.tlb >[/color]
  800.  
  801. [color=#A23BEC]< C:\Documents and Settings\LocalService\*.exe /s >[/color]
  802.  
  803. [color=#A23BEC]< C:\Documents and Settings\LocalService\*.* >[/color]
  804. [2014/03/14 17:33:33 | 000,262,144 | -H-- | M] () -- C:\Documents and Settings\LocalService\NTUSER.DAT
  805. [2014/03/14 17:36:12 | 000,001,024 | -H-- | M] () -- C:\Documents and Settings\LocalService\ntuser.dat.LOG
  806. [2006/01/20 18:05:26 | 000,000,020 | -HS- | M] () -- C:\Documents and Settings\LocalService\ntuser.ini
  807.  
  808. [color=#A23BEC]< C:\Documents and Settings\LocalService\Application Data\*.* >[/color]
  809.  
  810. [color=#A23BEC]< C:\Documents and Settings\LocalService\Application Data\*. >[/color]
  811. [2007/05/09 17:53:57 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
  812.  
  813. [color=#A23BEC]< C:\Documents and Settings\LocalService\Local Settings\*.* >[/color]
  814. [2014/03/14 17:34:18 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\LocalService\Local Settings\desktop.ini
  815.  
  816. [color=#A23BEC]< C:\Documents and Settings\LocalService\Local Settings\*. >[/color]
  817. [2012/10/12 03:10:01 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data
  818. [2006/01/21 01:46:41 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\LocalService\Local Settings\History
  819. [2006/01/20 18:05:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Temp
  820. [2006/01/21 01:46:41 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files
  821.  
  822. [color=#A23BEC]< C:\Documents and Settings\LocalService\Local Settings\Application Data\*.* >[/color]
  823. [2014/03/14 17:33:14 | 001,573,344 | ---- | M] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-2000478354-1979792683-725345543-1004-0.dat
  824. [2014/03/14 17:33:14 | 001,082,281 | ---- | M] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-2000478354-1979792683-725345543-1006-0.dat
  825. [2014/03/14 17:33:13 | 000,260,782 | ---- | M] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
  826.  
  827. [color=#A23BEC]< C:\Documents and Settings\LocalService\Local Settings\Application Data\*. >[/color]
  828. [2013/01/15 18:00:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
  829.  
  830. [color=#A23BEC]< C:\Documents and Settings\LocalService\Local Settings\temp\*.tlb >[/color]
  831.  
  832. [color=#A23BEC]< C:\Documents and Settings\NetworkService\*.exe /s >[/color]
  833.  
  834. [color=#A23BEC]< C:\Documents and Settings\NetworkService\*.* >[/color]
  835. [2014/03/14 17:33:33 | 000,262,144 | -H-- | M] () -- C:\Documents and Settings\NetworkService\NTUSER.DAT
  836. [2014/03/14 17:36:13 | 000,001,024 | -H-- | M] () -- C:\Documents and Settings\NetworkService\ntuser.dat.LOG
  837. [2006/01/20 18:03:23 | 000,000,020 | -HS- | M] () -- C:\Documents and Settings\NetworkService\ntuser.ini
  838.  
  839. [color=#A23BEC]< C:\Documents and Settings\NetworkService\Application Data\*.* >[/color]
  840.  
  841. [color=#A23BEC]< C:\Documents and Settings\NetworkService\Application Data\*. >[/color]
  842. [2006/01/20 17:59:03 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
  843.  
  844. [color=#A23BEC]< C:\Documents and Settings\NetworkService\Local Settings\*.* >[/color]
  845. [2014/03/14 17:34:17 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\NetworkService\Local Settings\desktop.ini
  846.  
  847. [color=#A23BEC]< C:\Documents and Settings\NetworkService\Local Settings\*. >[/color]
  848. [2006/01/20 18:03:22 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data
  849. [2006/01/21 01:46:41 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\NetworkService\Local Settings\History
  850. [2006/01/20 18:03:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Temp
  851. [2006/01/21 01:46:41 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files
  852.  
  853. [color=#A23BEC]< C:\Documents and Settings\NetworkService\Local Settings\Application Data\*.* >[/color]
  854.  
  855. [color=#A23BEC]< C:\Documents and Settings\NetworkService\Local Settings\Application Data\*. >[/color]
  856. [2006/01/20 18:03:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
  857.  
  858. [color=#A23BEC]< C:\Documents and Settings\NetworkService\Local Settings\temp\*.tlb >[/color]
  859.  
  860. [color=#A23BEC]< C:\Documents and Settings\Guest Access\*.exe /s >[/color]
  861.  
  862. [color=#A23BEC]< C:\Documents and Settings\Guest Access\*.* >[/color]
  863.  
  864. [color=#A23BEC]< C:\Documents and Settings\Guest Access\Application Data\*.* >[/color]
  865.  
  866. [color=#A23BEC]< C:\Documents and Settings\Guest Access\Application Data\*. >[/color]
  867.  
  868. [color=#A23BEC]< C:\Documents and Settings\Guest Access\Local Settings\*.* >[/color]
  869.  
  870. [color=#A23BEC]< C:\Documents and Settings\Guest Access\Local Settings\*. >[/color]
  871.  
  872. [color=#A23BEC]< C:\Documents and Settings\Guest Access\Local Settings\Application Data\*.* >[/color]
  873.  
  874. [color=#A23BEC]< C:\Documents and Settings\Guest Access\Local Settings\Application Data\*. >[/color]
  875.  
  876. [color=#A23BEC]< C:\Documents and Settings\Guest Access\Local Settings\temp\*.tlb >[/color]
  877.  
  878. [color=#A23BEC]< %CommonProgramFiles%\*.exe >[/color]
  879.  
  880. [color=#A23BEC]< %CommonProgramFiles%\ComObjects\*.* >[/color]
  881.  
  882. [color=#A23BEC]< %PROGRAMFILES%\*.* >[/color]
  883.  
  884. [color=#A23BEC]< %PROGRAMFILES%\*. >[/color]
  885. [2013/01/09 11:17:33 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
  886. [2006/05/25 09:20:25 | 000,000,000 | ---D | M] -- C:\Program Files\APC
  887. [2012/11/06 16:18:48 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
  888. [2006/01/20 17:55:08 | 000,000,000 | ---D | M] -- C:\Program Files\ComPlus Applications
  889. [2013/02/25 16:03:51 | 000,000,000 | ---D | M] -- C:\Program Files\Dropbox
  890. [2011/04/25 14:23:28 | 000,000,000 | ---D | M] -- C:\Program Files\FileZilla FTP Client
  891. [2011/05/19 17:16:12 | 000,000,000 | ---D | M] -- C:\Program Files\Fotosizer
  892. [2012/01/04 15:40:07 | 000,000,000 | ---D | M] -- C:\Program Files\Garmin
  893. [2013/05/13 09:05:39 | 000,000,000 | ---D | M] -- C:\Program Files\GIMP 2
  894. [2007/10/31 09:44:09 | 000,000,000 | ---D | M] -- C:\Program Files\InfoRad Wireless
  895. [2010/11/23 17:17:44 | 000,000,000 | ---D | M] -- C:\Program Files\InfoTronics
  896. [2006/05/25 09:20:19 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
  897. [2014/03/14 03:19:21 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
  898. [2011/04/25 14:16:24 | 000,000,000 | ---D | M] -- C:\Program Files\iq
  899. [2012/02/20 17:00:35 | 000,000,000 | ---D | M] -- C:\Program Files\Java
  900. [2014/03/13 10:18:36 | 000,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
  901. [2012/10/11 06:30:36 | 000,000,000 | ---D | M] -- C:\Program Files\McAfee
  902. [2013/01/15 17:36:58 | 000,000,000 | ---D | M] -- C:\Program Files\Messenger
  903. [2012/11/06 16:19:28 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft ActiveSync
  904. [2006/01/21 22:02:49 | 000,000,000 | ---D | M] -- C:\Program Files\microsoft frontpage
  905. [2012/11/06 16:18:51 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office
  906. [2012/11/06 16:11:46 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft.NET
  907. [2013/05/13 09:01:06 | 000,000,000 | ---D | M] -- C:\Program Files\Mioplanet
  908. [2013/01/16 08:18:12 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
  909. [2014/02/18 11:26:51 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
  910. [2014/02/18 16:50:09 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Maintenance Service
  911. [2012/10/11 09:54:59 | 000,000,000 | ---D | M] -- C:\Program Files\MSBuild
  912. [2011/02/28 12:46:45 | 000,000,000 | ---D | M] -- C:\Program Files\MSECache
  913. [2006/01/20 17:54:02 | 000,000,000 | ---D | M] -- C:\Program Files\MSN
  914. [2006/01/20 17:54:45 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Gaming Zone
  915. [2006/01/20 18:16:14 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 4.0
  916. [2012/10/11 09:49:56 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 6.0
  917. [2013/01/15 17:30:47 | 000,000,000 | ---D | M] -- C:\Program Files\NetMeeting
  918. [2013/01/04 10:32:02 | 000,000,000 | ---D | M] -- C:\Program Files\Notepad++
  919. [2006/01/20 17:57:19 | 000,000,000 | ---D | M] -- C:\Program Files\Online Services
  920. [2012/02/20 17:04:54 | 000,000,000 | ---D | M] -- C:\Program Files\OpenOffice.org 3
  921. [2013/01/16 08:05:14 | 000,000,000 | ---D | M] -- C:\Program Files\Outlook Express
  922. [2006/01/20 18:22:37 | 000,000,000 | ---D | M] -- C:\Program Files\Realtek
  923. [2012/10/11 09:54:45 | 000,000,000 | ---D | M] -- C:\Program Files\Reference Assemblies
  924. [2011/11/08 14:43:22 | 000,000,000 | ---D | M] -- C:\Program Files\RoughDraft
  925. [2013/01/11 09:42:35 | 000,000,000 | ---D | M] -- C:\Program Files\Symantec
  926. [2006/01/20 18:11:39 | 000,000,000 | -H-D | M] -- C:\Program Files\Uninstall Information
  927. [2011/01/12 14:44:43 | 000,000,000 | ---D | M] -- C:\Program Files\Winamp
  928. [2011/01/12 14:43:35 | 000,000,000 | ---D | M] -- C:\Program Files\Winamp Detect
  929. [2007/05/09 14:53:52 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Connect 2
  930. [2013/01/15 17:30:44 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Player
  931. [2013/01/15 17:30:44 | 000,000,000 | ---D | M] -- C:\Program Files\Windows NT
  932. [2006/01/20 17:57:23 | 000,000,000 | -H-D | M] -- C:\Program Files\WindowsUpdate
  933. [2006/01/20 17:59:33 | 000,000,000 | ---D | M] -- C:\Program Files\xerox
  934.  
  935. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\*.* >[/color]
  936. [2006/01/20 18:44:38 | 000,262,144 | ---- | M] () -- C:\WINDOWS\system32\config\systemprofile\ntuser.dat
  937. [2007/04/04 11:37:07 | 000,001,024 | -H-- | M] () -- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
  938.  
  939. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\*. >[/color]
  940. [2006/01/21 01:46:41 | 000,000,000 | RH-D | M] -- C:\WINDOWS\system32\config\systemprofile\Application Data
  941. [2006/01/20 18:05:22 | 000,000,000 | --SD | M] -- C:\WINDOWS\system32\config\systemprofile\Cookies
  942. [2006/01/21 01:46:41 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\config\systemprofile\Desktop
  943. [2006/01/21 01:46:41 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\config\systemprofile\Favorites
  944. [2006/01/21 01:46:41 | 000,000,000 | RH-D | M] -- C:\WINDOWS\system32\config\systemprofile\Local Settings
  945. [2006/01/21 01:46:41 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\config\systemprofile\My Documents
  946. [2006/01/21 01:46:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\system32\config\systemprofile\NetHood
  947. [2006/01/21 01:46:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\system32\config\systemprofile\PrintHood
  948. [2006/01/21 01:46:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\system32\config\systemprofile\Recent
  949. [2006/01/20 17:57:39 | 000,000,000 | RH-D | M] -- C:\WINDOWS\system32\config\systemprofile\SendTo
  950. [2006/01/21 01:46:41 | 000,000,000 | R--D | M] -- C:\WINDOWS\system32\config\systemprofile\Start Menu
  951. [2006/01/20 17:54:36 | 000,000,000 | -H-D | M] -- C:\WINDOWS\system32\config\systemprofile\Templates
  952.  
  953. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\*.exe /s >[/color]
  954.  
  955. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\Application Data\*.* >[/color]
  956. [2006/01/21 01:46:41 | 000,000,062 | -HS- | M] () -- C:\WINDOWS\system32\config\systemprofile\Application Data\desktop.ini
  957.  
  958. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\Application Data\*. >[/color]
  959. [2006/01/21 01:46:20 | 000,000,000 | --SD | M] -- C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft
  960.  
  961. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\Local Settings\*.* >[/color]
  962. [2006/01/21 01:46:41 | 000,000,062 | -HS- | M] () -- C:\WINDOWS\system32\config\systemprofile\Local Settings\desktop.ini
  963.  
  964. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\Local Settings\*. >[/color]
  965. [2006/01/21 01:46:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data
  966. [2006/01/20 18:05:22 | 000,000,000 | --SD | M] -- C:\WINDOWS\system32\config\systemprofile\Local Settings\History
  967. [2014/02/12 04:29:17 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp
  968. [2006/01/20 18:05:22 | 000,000,000 | --SD | M] -- C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files
  969.  
  970. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\Local Settings\Application Data\*.* >[/color]
  971.  
  972. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\Local Settings\Application Data\*. >[/color]
  973. [2013/01/16 04:01:55 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft
  974.  
  975. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\Local Settings\Temp\*.tlb >[/color]
  976.  
  977. [color=#A23BEC]< %windir%\temp\*.exe /s >[/color]
  978.  
  979. [color=#A23BEC]< %windir%\temp\*.* >[/color]
  980. [2012/10/12 03:03:39 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00000.log
  981. [2012/10/12 03:08:46 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00001.log
  982. [2012/10/12 03:17:51 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00002.log
  983. [2012/10/13 03:05:34 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00003.log
  984. [2013/01/16 08:09:03 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00004.log
  985. [2013/01/16 08:17:01 | 000,005,930 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00005.log
  986. [2013/01/16 08:34:07 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00006.log
  987. [2013/01/16 08:39:08 | 000,005,930 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00007.log
  988. [2013/01/17 04:03:35 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00008.log
  989. [2013/01/17 04:17:38 | 000,005,930 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00009.log
  990. [2013/01/17 04:36:09 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00010.log
  991. [2013/01/17 04:40:08 | 000,005,930 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00011.log
  992. [2013/01/17 05:03:22 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00012.log
  993. [2013/02/13 04:03:23 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00013.log
  994. [2013/05/15 03:12:11 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00014.log
  995. [2013/07/11 03:04:38 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00015.log
  996. [2013/07/11 03:25:17 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00016.log
  997. [2013/08/16 03:03:49 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00017.log
  998. [2013/10/10 03:08:02 | 000,005,930 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00018.log
  999. [2013/10/10 03:20:54 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00019.log
  1000. [2014/02/12 04:03:57 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00020.log
  1001. [2014/02/12 04:14:39 | 000,005,930 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00021.log
  1002. [2014/02/12 04:20:00 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00022.log
  1003. [2014/02/12 04:29:14 | 000,211,321 | ---- | M] () -- C:\WINDOWS\temp\dd_clwireg.txt
  1004. [2013/01/17 04:18:24 | 000,547,348 | ---- | M] () -- C:\WINDOWS\temp\dd_vcredistMSI7455.txt
  1005. [2013/01/17 04:18:24 | 000,013,598 | ---- | M] () -- C:\WINDOWS\temp\dd_vcredistUI7455.txt
  1006. [2013/01/16 08:16:34 | 000,004,500 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_CA_smci_20130116_121633_500.txt
  1007. [2013/01/16 08:38:41 | 000,004,500 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_CA_smci_20130116_123840_734.txt
  1008. [2013/01/17 04:17:02 | 000,003,448 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_CA_smci_20130117_081702_078.txt
  1009. [2013/01/17 04:39:26 | 000,004,500 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_CA_smci_20130117_083926_187.txt
  1010. [2013/10/10 03:07:29 | 000,004,500 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_CA_smci_20131010_070728_937.txt
  1011. [2014/02/12 04:14:11 | 000,003,448 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_CA_smci_20140212_081411_929.txt
  1012. [2012/10/12 03:09:57 | 000,004,198 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_retCA2663.txt
  1013. [2012/10/12 03:11:57 | 000,004,198 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_retCA3D13.txt
  1014. [2013/07/11 03:01:03 | 000,004,196 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_retCA596F.txt
  1015. [2013/01/17 04:26:20 | 000,004,196 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_retCA5C9A.txt
  1016. [2012/10/13 03:06:54 | 000,004,198 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_retCA6019.txt
  1017. [2013/01/17 04:32:50 | 000,004,196 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_retCA61C9.txt
  1018. [2013/01/16 08:29:09 | 000,004,196 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_retCA7322.txt
  1019. [2009/09/11 18:21:23 | 000,000,966 | ---- | M] () -- C:\WINDOWS\temp\myAgent.log
  1020. [2013/06/13 03:19:57 | 000,016,384 | ---- | M] () -- C:\WINDOWS\temp\Perflib_Perfdata_10c.dat
  1021. [2012/08/30 07:08:54 | 000,016,384 | ---- | M] () -- C:\WINDOWS\temp\Perflib_Perfdata_14c.dat
  1022. [2013/01/15 18:00:07 | 000,016,384 | ---- | M] () -- C:\WINDOWS\temp\Perflib_Perfdata_664.dat
  1023. [2013/12/12 04:21:24 | 000,016,384 | ---- | M] () -- C:\WINDOWS\temp\Perflib_Perfdata_6b4.dat
  1024. [2012/10/15 02:52:58 | 000,016,384 | ---- | M] () -- C:\WINDOWS\temp\Perflib_Perfdata_6f8.dat
  1025. [2013/01/10 11:33:22 | 000,016,384 | ---- | M] () -- C:\WINDOWS\temp\Perflib_Perfdata_6fc.dat
  1026. [2013/01/17 07:31:57 | 000,016,384 | ---- | M] () -- C:\WINDOWS\temp\Perflib_Perfdata_770.dat
  1027. [2014/03/14 17:34:34 | 000,016,384 | ---- | M] () -- C:\WINDOWS\temp\Perflib_Perfdata_788.dat
  1028. [2013/11/14 10:56:28 | 000,016,384 | ---- | M] () -- C:\WINDOWS\temp\Perflib_Perfdata_b4.dat
  1029. [2013/01/16 08:23:28 | 000,016,384 | ---- | M] () -- C:\WINDOWS\temp\Perflib_Perfdata_ea8.dat
  1030. [2014/03/17 15:05:37 | 000,000,511 | ---- | M] () -- C:\WINDOWS\temp\WGAErrLog.txt
  1031. [2013/01/15 16:25:42 | 000,000,409 | ---- | M] () -- C:\WINDOWS\temp\WGANotify.settings
  1032. [1 C:\WINDOWS\temp\*.tmp files -> C:\WINDOWS\temp\*.tmp -> ]
  1033.  
  1034. [color=#A23BEC]< %windir%\temp\*. >[/color]
  1035. [2007/07/17 22:28:12 | 000,000,000 | --SD | M] -- C:\WINDOWS\temp\Cookies
  1036. [2007/07/17 22:28:12 | 000,000,000 | --SD | M] -- C:\WINDOWS\temp\History
  1037. [2013/01/16 08:37:59 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2487367_10.0.30319
  1038. [2013/01/16 08:22:37 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2604121_10.0.30319
  1039. [2013/01/16 08:10:29 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2656351_10.0.30319
  1040. [2013/01/17 04:18:36 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2729449_10.0.30319
  1041. [2013/01/17 04:36:44 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2736428_10.0.30319
  1042. [2013/01/17 04:28:29 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2737019_10.0.30319
  1043. [2013/01/17 04:05:53 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2742595_10.0.30319
  1044. [2013/02/13 04:03:43 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2789642_10.0.30319
  1045. [2013/05/15 03:02:31 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2804576_10.0.30319
  1046. [2013/07/11 03:15:57 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2832407_10.0.30319
  1047. [2013/07/11 03:27:26 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2835393_10.0.30319
  1048. [2013/08/16 03:06:50 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2840628v2_10.0.30319
  1049. [2013/07/11 03:05:16 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2840628_10.0.30319
  1050. [2013/10/10 03:00:35 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2858302v2_10.0.30319
  1051. [2013/10/10 03:12:48 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2861188_10.0.30319
  1052. [2014/02/12 04:20:18 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2898855v2_10.0.30319
  1053. [2014/02/12 04:07:31 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2901110v2_10.0.30319
  1054. [2007/07/17 22:28:12 | 000,000,000 | --SD | M] -- C:\WINDOWS\temp\Temporary Internet Files
  1055. [2011/11/12 16:29:24 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\UPD32.tmp
  1056.  
  1057. [color=#A23BEC]< %windir%\*. >[/color]
  1058. [2013/05/15 03:01:28 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$hf_mig$
  1059. [2013/01/15 17:26:59 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtServicePackUninstall$
  1060. [2013/01/17 04:24:26 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2115168$
  1061. [2013/01/15 17:36:35 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2229593$
  1062. [2011/12/02 04:15:06 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2229593_0$
  1063. [2013/01/17 04:24:47 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2296011$
  1064. [2013/01/17 04:27:58 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2345886$
  1065. [2013/01/16 08:36:32 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2347290$
  1066. [2013/01/16 08:05:04 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2360937$
  1067. [2013/01/17 04:05:36 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2378111_WM9$
  1068. [2013/01/17 04:36:33 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2387149$
  1069. [2013/01/16 08:05:47 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2393802$
  1070. [2013/01/16 08:21:07 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2419632$
  1071. [2013/01/16 08:05:13 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2423089$
  1072. [2013/01/16 08:41:16 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2440591$
  1073. [2013/01/17 04:05:19 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2443105$
  1074. [2013/01/17 04:55:43 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2467659$
  1075. [2013/01/16 08:36:53 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2476490$
  1076. [2013/01/16 08:05:58 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2478960$
  1077. [2013/01/17 04:31:48 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2478971$
  1078. [2013/01/17 04:32:17 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2479943$
  1079. [2013/01/16 08:41:44 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2481109$
  1080. [2013/01/16 08:36:21 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2483185$
  1081. [2013/01/16 08:41:35 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2485663$
  1082. [2013/01/16 08:19:54 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2506212$
  1083. [2013/01/16 08:37:24 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2507938$
  1084. [2013/01/16 08:20:57 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2508429$
  1085. [2013/01/16 08:10:19 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2509553$
  1086. [2013/01/16 08:37:13 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2510581$
  1087. [2013/01/16 08:30:10 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2535512$
  1088. [2013/01/17 04:25:52 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2536276-v2$
  1089. [2013/01/16 08:06:05 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2544521$
  1090. [2013/01/17 04:28:07 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2544893-v2$
  1091. [2013/01/17 04:31:58 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2564958$
  1092. [2013/01/16 08:05:33 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2566454$
  1093. [2013/01/16 08:29:22 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2570947$
  1094. [2014/03/13 15:30:12 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2584146$
  1095. [2013/01/17 04:25:21 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2585542$
  1096. [2013/01/16 08:31:02 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2592799$
  1097. [2013/01/16 08:41:24 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2598479$
  1098. [2013/01/16 08:21:45 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2603381$
  1099. [2013/01/16 08:17:57 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2618451$
  1100. [2013/01/16 08:19:09 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2619339$
  1101. [2013/01/16 08:05:39 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2620712$
  1102. [2013/01/16 08:35:52 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2624667$
  1103. [2013/01/17 04:24:56 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2631813$
  1104. [2013/01/17 04:25:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2646524$
  1105. [2013/01/16 08:20:49 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2653956$
  1106. [2013/01/17 04:05:04 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2655992$
  1107. [2013/01/17 04:32:05 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2659262$
  1108. [2013/01/16 08:17:50 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2661254-v2$
  1109. [2013/01/16 08:05:26 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2661637$
  1110. [2013/01/16 08:10:07 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2676562$
  1111. [2013/01/16 08:40:45 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2686509$
  1112. [2013/01/17 04:24:36 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2691442$
  1113. [2013/01/16 08:19:29 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2698365$
  1114. [2013/01/16 08:18:59 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2705219-v2$
  1115. [2013/01/17 04:36:24 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2712808$
  1116. [2013/01/16 08:31:12 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2719985$
  1117. [2013/01/16 08:18:04 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2723135-v2$
  1118. [2013/01/16 08:43:39 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2724197$
  1119. [2013/01/16 08:18:38 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2727528$
  1120. [2013/01/16 08:41:08 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2736233$
  1121. [2013/01/16 08:20:42 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2749655$
  1122. [2013/01/16 08:30:51 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2753842-v2$
  1123. [2013/01/16 08:21:18 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2757638$
  1124. [2013/01/17 04:28:18 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2758857$
  1125. [2013/01/16 08:30:30 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2761465$
  1126. [2013/01/16 08:30:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2770660$
  1127. [2013/02/13 04:12:29 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2778344$
  1128. [2013/01/17 04:25:31 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2779030$
  1129. [2013/01/17 04:18:08 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2779562$
  1130. [2013/02/13 04:10:38 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2780091$
  1131. [2013/01/16 08:40:57 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2799329$
  1132. [2013/02/13 04:11:15 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2799494$
  1133. [2013/02/13 04:10:55 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2802968$
  1134. [2013/03/22 03:01:34 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2807986$
  1135. [2013/04/10 03:02:29 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2808735$
  1136. [2013/04/10 03:01:19 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2813170$
  1137. [2013/04/10 03:01:32 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2813345$
  1138. [2013/05/15 03:01:30 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2820197$
  1139. [2013/04/10 03:02:21 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2820917$
  1140. [2013/05/15 03:01:20 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2829361$
  1141. [2013/07/11 03:26:59 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2834886$
  1142. [2013/08/29 03:00:23 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$
  1143. [2013/07/11 03:27:09 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2834904_WM11$
  1144. [2013/06/13 03:02:35 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2839229$
  1145. [2013/07/11 03:25:44 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2845187$
  1146. [2013/10/10 03:16:50 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2847311$
  1147. [2013/08/16 03:05:26 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2849470$
  1148. [2013/07/11 03:26:10 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2850851$
  1149. [2013/08/16 03:06:32 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2850869$
  1150. [2013/08/16 03:06:22 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2859537$
  1151. [2013/11/14 04:03:49 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2862152$
  1152. [2013/10/10 03:10:09 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2862330$
  1153. [2013/10/10 03:16:31 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2862335$
  1154. [2013/08/16 03:06:13 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2863058$
  1155. [2013/09/11 03:04:20 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2864063$
  1156. [2013/10/10 03:12:26 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2868038$
  1157. [2013/11/14 04:05:02 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2868626$
  1158. [2013/09/11 03:04:29 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2876217$
  1159. [2013/09/11 03:04:38 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2876315$
  1160. [2013/11/14 04:02:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2876331$
  1161. [2013/10/10 03:10:18 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2883150$
  1162. [2013/12/12 04:02:25 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2892075$
  1163. [2013/12/12 04:02:43 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2893294$
  1164. [2013/12/12 04:02:35 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2893984$
  1165. [2013/12/12 04:03:02 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2898715$
  1166. [2013/11/14 04:04:49 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2900986$
  1167. [2013/12/12 04:02:52 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2904266$
  1168. [2014/01/16 04:02:20 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2914368$
  1169. [2014/02/12 04:30:30 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2916036$
  1170. [2014/03/14 03:02:26 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2929961$
  1171. [2014/03/14 03:02:06 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2930275$
  1172. [2007/11/15 11:29:36 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB921503$
  1173. [2013/01/15 17:36:44 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB923561$
  1174. [2011/12/02 04:01:55 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB923561_0$
  1175. [2012/10/12 03:11:11 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB925720$
  1176. [2007/11/15 11:30:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB933360$
  1177. [2007/11/15 11:31:20 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB933729$
  1178. [2007/11/15 11:31:12 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB936021$
  1179. [2007/11/15 11:30:08 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB936782_WMP11$
  1180. [2007/11/15 11:30:32 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB938127$
  1181. [2007/11/15 11:29:23 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB938828$
  1182. [2007/11/15 11:29:44 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB938829$
  1183. [2007/11/15 11:31:43 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB939653$
  1184. [2007/11/15 11:31:00 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB939683$
  1185. [2007/11/15 11:31:29 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB941202$
  1186. [2011/12/02 04:10:09 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB941569$
  1187. [2007/11/15 11:32:00 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB943460$
  1188. [2011/12/02 04:02:09 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB944338-v2$
  1189. [2013/01/15 17:36:56 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB946648$
  1190. [2011/12/02 04:18:54 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB946648_0$
  1191. [2013/01/15 17:37:15 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB950762$
  1192. [2011/12/02 04:09:02 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB950762_0$
  1193. [2013/01/15 17:37:23 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB950974$
  1194. [2011/12/02 04:14:54 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB950974_0$
  1195. [2013/01/15 17:37:30 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB951376-v2$
  1196. [2011/12/02 04:19:27 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB951376-v2_0$
  1197. [2013/01/15 17:37:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB951748$
  1198. [2011/12/02 04:07:02 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB951748_0$
  1199. [2013/01/17 04:05:28 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB951978$
  1200. [2013/01/15 17:37:50 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB952004$
  1201. [2011/12/02 04:11:01 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB952004_0$
  1202. [2011/12/02 04:11:56 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB952069_WM9$
  1203. [2013/01/15 17:37:59 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB952287$
  1204. [2011/12/02 04:08:18 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB952287_0$
  1205. [2013/01/15 17:38:08 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB952954$
  1206. [2011/12/02 04:19:17 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB952954_0$
  1207. [2011/12/02 04:02:17 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB954154_WM11$
  1208. [2011/12/02 04:17:17 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB954155_WM9$
  1209. [2013/01/15 17:38:16 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB955069$
  1210. [2011/12/02 04:03:45 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB955069_0$
  1211. [2013/01/15 17:38:35 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB955759$
  1212. [2011/12/02 04:16:18 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB955759_0$
  1213. [2013/01/15 17:38:44 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB956572$
  1214. [2011/12/02 04:12:52 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB956572_0$
  1215. [2013/01/16 08:37:03 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB956744$
  1216. [2013/01/15 17:38:59 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB956802$
  1217. [2011/12/02 04:03:35 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB956802_0$
  1218. [2013/01/15 17:39:09 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB956803$
  1219. [2011/12/02 04:18:38 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB956803_0$
  1220. [2013/01/15 17:39:17 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB956844$
  1221. [2011/12/02 04:12:30 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB956844_0$
  1222. [2011/12/02 04:05:31 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB958470$
  1223. [2013/01/15 17:39:25 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB958644$
  1224. [2011/12/02 04:03:57 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB958644_0$
  1225. [2011/12/02 04:17:25 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB958869$
  1226. [2013/01/15 17:39:34 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB959426$
  1227. [2011/12/02 04:19:05 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB959426_0$
  1228. [2013/01/15 17:39:48 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB960225$
  1229. [2011/12/02 04:13:56 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB960225_0$
  1230. [2013/01/15 17:39:57 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB960803$
  1231. [2011/12/02 04:05:17 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB960803_0$
  1232. [2013/01/15 17:40:08 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB960859$
  1233. [2011/12/02 04:18:27 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB960859_0$
  1234. [2013/01/15 17:40:19 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB961118$
  1235. [2012/10/12 03:12:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB961118_0$
  1236. [2013/01/15 17:40:46 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB961501$
  1237. [2011/12/02 04:12:19 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB961501_0$
  1238. [2013/01/15 17:40:56 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB967715$
  1239. [2011/12/02 04:07:50 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB967715_0$
  1240. [2013/01/15 17:41:07 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB968389$
  1241. [2011/12/02 04:01:22 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB968389_0$
  1242. [2013/01/15 17:41:17 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB969059$
  1243. [2011/12/02 04:15:17 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB969059_0$
  1244. [2013/01/15 17:41:26 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB970238$
  1245. [2011/12/02 04:06:25 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB970238_0$
  1246. [2013/01/15 17:41:34 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB970430$
  1247. [2011/12/02 20:16:52 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB970430_0$
  1248. [2013/01/16 08:20:08 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB971029$
  1249. [2011/12/02 04:04:13 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB971032$
  1250. [2013/01/15 17:41:43 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB971468$
  1251. [2011/12/02 04:18:10 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB971468_0$
  1252. [2013/01/15 17:41:52 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB971657$
  1253. [2011/12/02 04:14:22 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB971657_0$
  1254. [2013/01/15 17:42:03 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB971737$
  1255. [2011/12/02 20:16:31 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB971737_0$
  1256. [2011/12/02 04:06:50 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB971961$
  1257. [2013/01/15 17:42:17 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB972270$
  1258. [2011/12/02 04:13:46 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB972270_0$
  1259. [2013/01/15 17:42:30 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB973507$
  1260. [2011/12/02 04:10:21 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB973507_0$
  1261. [2011/12/02 04:11:15 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB973540_WM9L$
  1262. [2013/01/15 17:42:43 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB973687$
  1263. [2011/12/02 04:09:13 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB973687_0$
  1264. [2013/01/15 17:38:25 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB973687_1$
  1265. [2013/01/15 17:42:54 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB973815$
  1266. [2011/12/02 04:05:06 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB973815_0$
  1267. [2013/01/15 17:43:08 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB973869$
  1268. [2011/12/02 04:11:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB973869_0$
  1269. [2011/12/02 04:08:06 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB973904$
  1270. [2013/01/15 17:43:23 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB974112$
  1271. [2011/12/02 04:13:35 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB974112_0$
  1272. [2013/01/15 17:43:36 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB974318$
  1273. [2011/12/02 04:15:29 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB974318_0$
  1274. [2013/01/15 17:43:49 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB974392$
  1275. [2011/12/02 04:07:37 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB974392_0$
  1276. [2013/01/15 17:44:02 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB974571$
  1277. [2011/12/02 04:10:48 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB974571_0$
  1278. [2013/01/15 17:44:13 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975025$
  1279. [2011/12/02 04:11:30 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975025_0$
  1280. [2013/01/15 17:44:25 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975467$
  1281. [2011/12/02 04:01:44 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975467_0$
  1282. [2013/01/17 04:18:27 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975558_WM8$
  1283. [2013/01/15 17:44:35 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975560$
  1284. [2011/12/02 04:10:36 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975560_0$
  1285. [2013/01/15 17:44:44 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975561$
  1286. [2011/12/02 04:12:07 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975561_0$
  1287. [2013/01/15 17:44:52 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975562$
  1288. [2011/12/02 04:04:54 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975562_0$
  1289. [2013/01/15 17:45:00 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975713$
  1290. [2011/12/02 04:14:32 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975713_0$
  1291. [2011/12/02 04:09:24 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB977816$
  1292. [2013/01/15 17:45:11 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB977914$
  1293. [2011/12/02 04:07:25 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB977914_0$
  1294. [2013/01/15 17:45:20 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB978037$
  1295. [2011/12/02 04:14:44 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB978037_0$
  1296. [2013/01/15 17:45:28 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB978338$
  1297. [2011/12/02 04:14:07 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB978338_0$
  1298. [2013/01/15 17:45:36 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB978542$
  1299. [2011/12/02 04:06:37 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB978542_0$
  1300. [2013/01/15 17:45:45 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB978601$
  1301. [2011/12/02 04:08:44 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB978601_0$
  1302. [2011/12/02 04:06:06 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB978695_WM9$
  1303. [2013/01/15 17:45:53 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB978706$
  1304. [2011/12/02 04:05:46 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB978706_0$
  1305. [2013/01/15 17:46:02 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB979309$
  1306. [2011/12/02 04:06:15 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB979309_0$
  1307. [2013/01/15 17:46:10 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB979482$
  1308. [2011/12/02 04:05:58 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB979482_0$
  1309. [2013/01/15 17:46:17 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB979559$
  1310. [2011/12/02 04:08:29 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB979559_0$
  1311. [2013/01/15 17:46:26 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB979683$
  1312. [2011/12/02 04:17:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB979683_0$
  1313. [2013/01/16 08:34:22 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB979687$
  1314. [2011/12/02 04:17:10 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB980195$
  1315. [2013/01/15 17:46:39 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB980218$
  1316. [2011/12/02 04:19:38 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB980218_0$
  1317. [2013/01/15 17:46:46 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB980232$
  1318. [2011/12/02 04:16:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB980232_0$
  1319. [2013/01/16 08:22:20 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB981322$
  1320. [2012/08/30 08:51:08 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB981350$
  1321. [2011/12/02 04:08:51 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB981793$
  1322. [2013/01/16 08:18:11 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB981997$
  1323. [2013/01/16 08:40:37 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB982132$
  1324. [2013/01/15 17:46:56 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB982381$
  1325. [2011/12/02 04:03:01 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB982381_0$
  1326. [2013/01/16 08:09:56 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB982665$
  1327. [2012/01/04 15:18:35 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallWIC$
  1328. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\addins
  1329. [2013/01/15 17:58:42 | 000,000,000 | ---D | M] -- C:\WINDOWS\AppPatch
  1330. [2014/02/12 04:54:19 | 000,000,000 | R-SD | M] -- C:\WINDOWS\assembly
  1331. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\Config
  1332. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\Connection Wizard
  1333. [2006/01/20 18:17:58 | 000,000,000 | -HSD | M] -- C:\WINDOWS\CSC
  1334. [2006/01/20 17:54:41 | 000,000,000 | ---D | M] -- C:\WINDOWS\Cursors
  1335. [2011/12/01 13:30:27 | 000,000,000 | ---D | M] -- C:\WINDOWS\Debug
  1336. [2013/01/15 15:53:26 | 000,000,000 | --SD | M] -- C:\WINDOWS\Downloaded Program Files
  1337. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\Driver Cache
  1338. [2013/01/15 17:24:19 | 000,000,000 | ---D | M] -- C:\WINDOWS\ehome
  1339. [2013/01/16 04:02:34 | 000,000,000 | R-SD | M] -- C:\WINDOWS\Fonts
  1340. [2013/01/17 05:20:12 | 000,000,000 | ---D | M] -- C:\WINDOWS\Help
  1341. [2013/01/17 04:54:12 | 000,000,000 | -H-D | M] -- C:\WINDOWS\ie8
  1342. [2013/01/17 04:55:17 | 000,000,000 | ---D | M] -- C:\WINDOWS\ie8updates
  1343. [2013/01/15 17:33:01 | 000,000,000 | ---D | M] -- C:\WINDOWS\ime
  1344. [2014/03/17 15:05:26 | 000,000,000 | -H-D | M] -- C:\WINDOWS\inf
  1345. [2014/02/12 04:30:08 | 000,000,000 | -HSD | M] -- C:\WINDOWS\Installer
  1346. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\java
  1347. [2013/01/15 17:32:50 | 000,000,000 | ---D | M] -- C:\WINDOWS\l2schemas
  1348. [2011/01/12 14:43:54 | 000,000,000 | ---D | M] -- C:\WINDOWS\Logs
  1349. [2013/01/17 04:54:22 | 000,000,000 | ---D | M] -- C:\WINDOWS\Media
  1350. [2014/02/12 04:54:19 | 000,000,000 | ---D | M] -- C:\WINDOWS\Microsoft.NET
  1351. [2013/01/15 17:30:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\msagent
  1352. [2006/01/21 22:02:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\msapps
  1353. [2013/01/15 17:30:50 | 000,000,000 | ---D | M] -- C:\WINDOWS\mui
  1354. [2013/01/15 17:33:01 | 000,000,000 | ---D | M] -- C:\WINDOWS\network diagnostic
  1355. [2006/01/20 17:57:36 | 000,000,000 | R--D | M] -- C:\WINDOWS\Offline Web Pages
  1356. [2006/01/20 18:26:53 | 000,000,000 | ---D | M] -- C:\WINDOWS\OPTIONS
  1357. [2009/04/27 01:31:24 | 000,000,000 | ---D | M] -- C:\WINDOWS\pchealth
  1358. [2013/01/15 17:32:50 | 000,000,000 | ---D | M] -- C:\WINDOWS\PeerNet
  1359. [2014/03/17 08:15:17 | 000,000,000 | -H-D | M] -- C:\WINDOWS\PIF
  1360. [2014/03/17 15:07:00 | 000,000,000 | ---D | M] -- C:\WINDOWS\Prefetch
  1361. [2012/08/30 08:51:08 | 000,000,000 | ---D | M] -- C:\WINDOWS\Provisioning
  1362. [2008/12/22 17:35:37 | 000,000,000 | ---D | M] -- C:\WINDOWS\pss
  1363. [2006/01/20 17:58:47 | 000,000,000 | ---D | M] -- C:\WINDOWS\Registration
  1364. [2006/01/20 17:59:32 | 000,000,000 | ---D | M] -- C:\WINDOWS\repair
  1365. [2013/05/13 08:53:55 | 000,000,000 | ---D | M] -- C:\WINDOWS\Resources
  1366. [2013/01/15 17:58:03 | 000,000,000 | ---D | M] -- C:\WINDOWS\security
  1367. [2013/01/15 17:30:58 | 000,000,000 | ---D | M] -- C:\WINDOWS\ServicePackFiles
  1368. [2012/11/06 16:19:36 | 000,000,000 | ---D | M] -- C:\WINDOWS\SHELLNEW
  1369. [2013/01/15 15:52:44 | 000,000,000 | ---D | M] -- C:\WINDOWS\SoftwareDistribution
  1370. [2013/01/15 17:30:48 | 000,000,000 | ---D | M] -- C:\WINDOWS\srchasst
  1371. [2012/04/25 07:35:27 | 000,000,000 | ---D | M] -- C:\WINDOWS\Sun
  1372. [2013/01/15 17:30:19 | 000,000,000 | ---D | M] -- C:\WINDOWS\system
  1373. [2014/03/16 13:43:36 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32
  1374. [2014/03/14 17:23:58 | 000,000,000 | --SD | M] -- C:\WINDOWS\Tasks
  1375. [2014/03/14 17:34:34 | 000,000,000 | ---D | M] -- C:\WINDOWS\Temp
  1376. [2014/03/13 10:18:12 | 000,000,000 | ---D | M] -- C:\WINDOWS\twain_32
  1377. [2013/01/17 04:54:32 | 000,000,000 | ---D | M] -- C:\WINDOWS\WBEM
  1378. [2006/01/20 17:57:39 | 000,000,000 | R--D | M] -- C:\WINDOWS\Web
  1379. [2014/02/12 04:22:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\WinSxS
  1380.  
  1381. [color=#A23BEC]< %windir%\AppPatch\*.exe >[/color]
  1382.  
  1383. [color=#A23BEC]< %windir%\ShellNew\*.exe >[/color]
  1384.  
  1385. [color=#A23BEC]< %windir%\installer\*. >[/color]
  1386. [2011/03/10 11:41:20 | 000,000,000 | -HSD | M] -- C:\WINDOWS\installer\$PatchCache$
  1387. [2013/01/15 17:32:50 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\tsclientmsitrans
  1388. [2012/01/04 15:40:20 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{028BB5A9-6385-4CF6-A6FF-D512D5015DBA}
  1389. [2006/01/20 18:11:48 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}
  1390. [2006/11/27 12:36:17 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
  1391. [2012/02/20 17:08:00 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{3E171899-0175-47CC-84C4-562ACDD4C021}
  1392. [2012/10/12 03:13:29 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{56EA8BC0-3751-4B93-BC9D-6651CC36E5AA}
  1393. [2006/01/20 18:16:15 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{716E0306-8318-4364-8B8F-0CC4E9376BAC}
  1394. [2011/12/02 04:02:36 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
  1395. [2014/01/16 04:03:41 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{90110409-6000-11D3-8CFE-0150048383C9}
  1396. [2014/01/16 04:03:52 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{90120000-0020-0409-0000-0000000FF1CE}
  1397. [2013/09/14 03:00:26 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{95120000-0038-0409-0000-0000000FF1CE}
  1398. [2011/03/22 16:36:37 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{AC76BA86-1033-0000-7760-000000000001}
  1399. [2013/01/09 11:18:29 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{AC76BA86-7AD7-1033-7B44-AB0000000001}
  1400. [2007/11/15 11:30:25 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{C04E32E0-0416-434D-AFB9-6969D703A9EF}
  1401. [2010/11/23 17:16:25 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{CD392969-DEFB-4AB2-BA5D-2DAF65DCD432}
  1402. [2011/12/02 04:02:29 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
  1403.  
  1404. [color=#A23BEC]< %windir%\system32\*. >[/color]
  1405. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\1025
  1406. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\1028
  1407. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\1031
  1408. [2006/01/21 01:40:28 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\1033
  1409. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\1037
  1410. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\1041
  1411. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\1042
  1412. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\1054
  1413. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\2052
  1414. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\3076
  1415. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\3com_dmi
  1416. [2011/03/16 16:41:58 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\appmgmt
  1417. [2013/01/15 17:32:50 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\bits
  1418. [2013/01/15 17:46:59 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\CatRoot
  1419. [2014/03/17 08:15:19 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\CatRoot2
  1420. [2013/01/15 17:30:46 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\Com
  1421. [2013/01/17 04:54:38 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\config
  1422. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\dhcp
  1423. [2011/01/12 14:44:21 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\DirectX
  1424. [2014/03/14 03:03:19 | 000,000,000 | RHSD | M] -- C:\WINDOWS\system32\dllcache
  1425. [2014/03/14 17:27:09 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\drivers
  1426. [2013/01/15 17:32:50 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\en
  1427. [2013/01/17 04:54:32 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\en-US
  1428. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\export
  1429. [2006/01/20 17:58:34 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\ias
  1430. [2006/01/21 01:41:03 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\icsxml
  1431. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\IME
  1432. [2013/01/15 17:33:01 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\inetsrv
  1433. [2014/03/17 15:05:47 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\Lang
  1434. [2007/05/09 14:52:13 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\LogFiles
  1435. [2006/01/20 17:56:22 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\Macromed
  1436. [2006/05/22 10:42:18 | 000,000,000 | --SD | M] -- C:\WINDOWS\system32\Microsoft
  1437. [2006/01/20 17:55:00 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\MsDtc
  1438. [2012/01/04 15:27:16 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\mui
  1439. [2013/01/15 17:30:50 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\npp
  1440. [2013/01/15 17:30:21 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\oobe
  1441. [2006/01/20 18:32:29 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\PreInstall
  1442. [2006/01/21 01:41:08 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\ras
  1443. [2010/06/22 02:25:15 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\ReinstallBackups
  1444. [2013/01/15 17:30:50 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\Restore
  1445. [2006/01/20 18:24:12 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\RTCOM
  1446. [2013/01/15 17:32:50 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\scripting
  1447. [2013/01/15 17:58:42 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\Setup
  1448. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\ShellExt
  1449. [2006/01/20 18:30:48 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\SoftwareDistribution
  1450. [2012/10/11 09:54:14 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\spool
  1451. [2013/01/15 17:32:51 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\usmt
  1452. [2013/09/11 08:47:37 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\wbem
  1453. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\wins
  1454. [2006/01/20 17:59:33 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\xircom
  1455. [2013/07/11 03:00:52 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\XPSViewer
  1456.  
  1457. [color=#A23BEC]< %Temp%\smtmp\1\*.* >[/color]
  1458.  
  1459. [color=#A23BEC]< %Temp%\smtmp\2\*.* >[/color]
  1460.  
  1461. [color=#A23BEC]< %Temp%\smtmp\3\*.* >[/color]
  1462.  
  1463. [color=#A23BEC]< %Temp%\smtmp\4\*.* >[/color]
  1464.  
  1465. [color=#A23BEC]< %systemroot%\system32\*.dll /lockedfiles >[/color]
  1466. [1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
  1467.  
  1468. [color=#A23BEC]< %systemroot%\Tasks\*.job /lockedfiles >[/color]
  1469.  
  1470. [color=#A23BEC]< %systemroot%\system32\drivers\*.sys /90 >[/color]
  1471. [2014/03/14 17:35:56 | 000,052,312 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\system32\drivers\mbamchameleon.sys
  1472. [2014/03/14 17:36:18 | 000,107,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
  1473.  
  1474. [color=#A23BEC]< %systemroot%\system32\drivers\*.sys /lockedfiles >[/color]
  1475.  
  1476. [color=#A23BEC]< %SYSTEMDRIVE%\*. /rp /s >[/color]
  1477.  
  1478. [color=#A23BEC]< %systemroot%\assembly\tmp\*.* /S /MD5 >[/color]
  1479.  
  1480. [color=#A23BEC]< %systemroot%\assembly\temp\*.* /S /MD5 >[/color]
  1481.  
  1482. [color=#A23BEC]< %systemroot%\assembly\GAC\*.ini >[/color]
  1483.  
  1484. [color=#A23BEC]< %systemroot%\assembly\GAC_32\*.ini >[/color]
  1485.  
  1486. [color=#A23BEC]< %SystemRoot%\assembly\GAC_MSIL\*.ini >[/color]
  1487.  
  1488. [color=#A23BEC]< wsSystemRoot|l,n,u,@;True;False;True;$,{ /fn >[/color]
  1489.  
  1490. [color=#A23BEC]< %systemdrive%\$Recycle.Bin|@;true;true;true /fp >[/color]
  1491.  
  1492. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24} /s >[/color]
  1493. "" = PSFactoryBuffer
  1494. [HKEY_CLASSES_ROOT\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32]
  1495. "" = C:\WINDOWS\system32\wbem\wbemsvc.dll -- [2008/04/13 20:12:08 | 000,043,520 | ---- | M] (Microsoft Corporation)
  1496. "ThreadingModel" = Both
  1497.  
  1498. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s >[/color]
  1499. "" = Microsoft WBEM New Event Subsystem
  1500. [HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32]
  1501. "" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008/04/13 20:12:08 | 000,273,920 | ---- | M] (Microsoft Corporation)
  1502. "ThreadingModel" = Both
  1503.  
  1504. [color=#A23BEC]< HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s >[/color]
  1505.  
  1506. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s >[/color]
  1507. "" = Microsoft WBEM New Event Subsystem
  1508. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32]
  1509. "" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008/04/13 20:12:08 | 000,273,920 | ---- | M] (Microsoft Corporation)
  1510. "ThreadingModel" = Both
  1511.  
  1512. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s >[/color]
  1513. "" = MruPidlList
  1514. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  1515. "" = %SystemRoot%\system32\shdocvw.dll -- [2012/10/31 07:33:26 | 001,510,400 | ---- | M] (Microsoft Corporation)
  1516. "ThreadingModel" = Apartment
  1517.  
  1518. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} /s >[/color]
  1519. "" = Start Menu Pin
  1520. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}\InProcServer32]
  1521. "" = %SystemRoot%\system32\SHELL32.dll -- [2012/06/08 10:26:20 | 008,462,848 | ---- | M] (Microsoft Corporation)
  1522. "ThreadingModel" = Apartment
  1523.  
  1524. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24} /s >[/color]
  1525. "" = PSFactoryBuffer
  1526. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32]
  1527. "" = C:\WINDOWS\system32\wbem\wbemsvc.dll -- [2008/04/13 20:12:08 | 000,043,520 | ---- | M] (Microsoft Corporation)
  1528. "ThreadingModel" = Both
  1529.  
  1530. [color=#A23BEC]< HKEY_CLASSES_ROOT\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /s >[/color]
  1531. "" = Microsoft WBEM _WbemFetchRefresherMgr Proxy Helper
  1532. [HKEY_CLASSES_ROOT\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32]
  1533. "" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 08:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
  1534. "ThreadingModel" = Free
  1535.  
  1536. [color=#A23BEC]< HKEY_CLASSES_ROOT\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9} /s >[/color]
  1537. "" = ShellFolder for CD Burning
  1538. [HKEY_CLASSES_ROOT\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
  1539. "" = %SystemRoot%\system32\SHELL32.dll -- [2012/06/08 10:26:20 | 008,462,848 | ---- | M] (Microsoft Corporation)
  1540. "ThreadingModel" = Apartment
  1541. [HKEY_CLASSES_ROOT\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\MergedFolder]
  1542. "Attributes" = 0x0
  1543. "AttributeMask" = 0xffffffff
  1544. "Location" = @shell32.dll,-12589 -- [2012/06/08 10:26:20 | 008,462,848 | ---- | M] (Microsoft Corporation)
  1545. "ConflictOverlayIcon" = %SystemRoot%\system32\SHELL32.dll,-232 -- [2012/06/08 10:26:20 | 008,462,848 | ---- | M] (Microsoft Corporation)
  1546.  
  1547. [color=#A23BEC]< HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9} /s >[/color]
  1548.  
  1549. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /s >[/color]
  1550. "" = Microsoft WBEM _WbemFetchRefresherMgr Proxy Helper
  1551. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32]
  1552. "" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 08:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
  1553. "ThreadingModel" = Free
  1554.  
  1555. [color=#A23BEC]< HKEY_CURRENT_USER\Software\Microsoft\Command Processor /s >[/color]
  1556. "CompletionChar" = 9
  1557. "DefaultColor" = 0
  1558. "EnableExtensions" = 1
  1559.  
  1560. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor /s >[/color]
  1561. "AutoRun" =
  1562. "CompletionChar" = 64
  1563. "DefaultColor" = 0
  1564. "EnableExtensions" = 1
  1565. "PathCompletionChar" = 64
  1566.  
  1567. [color=#A23BEC]< HKCU\Software\Classes\CLSID\{ECD4FC4D-521C-11D0-B792-00A0C90312E1}\InprocServer32 /s >[/color]
  1568.  
  1569. [color=#A23BEC]< HKLM\Software\Classes\CLSID\{E6BB64BE-0618-4353-9193-0AFE606D6F0C}\InprocServer32 /s >[/color]
  1570.  
  1571. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\scsimap /s >[/color]
  1572.  
  1573. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{118BEDCC-A901-4203-B4F2-ADCB957D1887} /s >[/color]
  1574.  
  1575. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{312BED3C-A901-4203-B4F2-ADCB957D1887} /s >[/color]
  1576.  
  1577. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{F12BE2CC-A901-4203-B4F2-ADCB957D1887} /s >[/color]
  1578.  
  1579. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{312BFDCE-A901-4203-B4F2-ADCB957D1887} /s >[/color]
  1580.  
  1581. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{212B3DCC-A901-4203-B4F2-ADCB957D1887} /s >[/color]
  1582.  
  1583. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{A12BEDCC-A901-4203-B4F2-ADCB957D1887} /s >[/color]
  1584.  
  1585. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D188F} /s >[/color]
  1586.  
  1587. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D188B} /s >[/color]
  1588.  
  1589. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{3543619C-D563-43f7-95EA-4DA7E1CC396A} /s >[/color]
  1590.  
  1591. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3543619C-D563-43f7-95EA-4DA7E1CC396A} /s >[/color]
  1592.  
  1593. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{3543619C-D563-43f7-95EA-4DA7E1CC396A} /s >[/color]
  1594.  
  1595. [color=#A23BEC]< HKEY_CLASSES_ROOT\Directory\shellex\CopyHookHandlers /s >[/color]
  1596. [HKEY_CLASSES_ROOT\Directory\shellex\CopyHookHandlers\CDF]
  1597. "" = {67EA19A0-CCEF-11d0-8024-00C04FD75D13}
  1598. [HKEY_CLASSES_ROOT\Directory\shellex\CopyHookHandlers\FileSystem]
  1599. "" = {217FC9C0-3AEA-1069-A2DB-08002B30309D}
  1600. [HKEY_CLASSES_ROOT\Directory\shellex\CopyHookHandlers\FileZilla3CopyHook]
  1601. "" = {DB70412E-EEC9-479C-BBA9-BE36BFDDA41B}
  1602. [HKEY_CLASSES_ROOT\Directory\shellex\CopyHookHandlers\MyDocuments]
  1603. "" = {ECF03A33-103D-11d2-854D-006008059367}
  1604. [HKEY_CLASSES_ROOT\Directory\shellex\CopyHookHandlers\Sharing]
  1605. "" = {40dd6e20-7c17-11ce-a804-00aa003ca9f6}
  1606.  
  1607. [color=#A23BEC]< HKEY_CLASSES_ROOT\Directory\Shellex\CopyHookHandlers\MSCopy /s >[/color]
  1608.  
  1609. [color=#A23BEC]< HKEY_CURRENT_USER\Software\Classes\Directory\shellex\CopyHookHandlers /s >[/color]
  1610.  
  1611. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers /s >[/color]
  1612. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\CDF]
  1613. "" = {67EA19A0-CCEF-11d0-8024-00C04FD75D13}
  1614. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\FileSystem]
  1615. "" = {217FC9C0-3AEA-1069-A2DB-08002B30309D}
  1616. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\FileZilla3CopyHook]
  1617. "" = {DB70412E-EEC9-479C-BBA9-BE36BFDDA41B}
  1618. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\MyDocuments]
  1619. "" = {ECF03A33-103D-11d2-854D-006008059367}
  1620. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\Sharing]
  1621. "" = {40dd6e20-7c17-11ce-a804-00aa003ca9f6}
  1622.  
  1623. [color=#A23BEC]< HKEY_CURRENT_USER\Software\MSOLoad /s >[/color]
  1624.  
  1625. [color=#A23BEC]< type C:\WINDOWS\system.ini >> test.txt /c >[/color]
  1626. ; for 16-bit app support
  1627. [drivers]
  1628. wave=mmdrv.dll
  1629. timer=timer.drv
  1630. [mci]
  1631. [driver32]
  1632. [386enh]
  1633. woafont=dosapp.FON
  1634. EGA80WOA.FON=EGA80WOA.FON
  1635. EGA40WOA.FON=EGA40WOA.FON
  1636. CGA80WOA.FON=CGA80WOA.FON
  1637. CGA40WOA.FON=CGA40WOA.FON
  1638.  
  1639. [color=#A23BEC]< type c:\diskreport.txt /c >[/color]
  1640. Microsoft DiskPart version 5.1.3565
  1641. Copyright (C) 1999-2003 Microsoft Corporation.
  1642. On computer: JCRAIG
  1643. Volume ### Ltr Label Fs Type Size Status Info
  1644. ---------- --- ----------- ----- ---------- ------- --------- --------
  1645. Volume 0 C NTFS Partition 37 GB Healthy System
  1646. Volume 1 D WORK_WELL FAT Removeable 498 MB
  1647.  
  1648. [color=#A23BEC]< MD5 for: AFD.SYS >[/color]
  1649. [2011/08/17 09:49:54 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=1E44BC1E83D8FD2305F8D452DB109CF9 -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\afd.sys
  1650. [2011/08/17 09:49:54 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=1E44BC1E83D8FD2305F8D452DB109CF9 -- C:\WINDOWS\system32\dllcache\afd.sys
  1651. [2011/08/17 09:49:54 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=1E44BC1E83D8FD2305F8D452DB109CF9 -- C:\WINDOWS\system32\drivers\afd.sys
  1652. [2008/04/13 15:19:23 | 000,138,112 | ---- | M] (Microsoft Corporation) MD5=322D0E36693D6E24A2398BEE62A268CD -- C:\WINDOWS\$NtUninstallKB951748$\afd.sys
  1653. [2008/04/13 15:19:23 | 000,138,112 | ---- | M] (Microsoft Corporation) MD5=322D0E36693D6E24A2398BEE62A268CD -- C:\WINDOWS\ServicePackFiles\i386\afd.sys
  1654. [2008/10/16 11:07:58 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=38D7B715504DA4741DF35E3594FE2099 -- C:\WINDOWS\$hf_mig$\KB2509553\SP3QFE\afd.sys
  1655. [2008/08/14 06:34:26 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=4D43E74F2A1239D53929B82600F1971C -- C:\WINDOWS\$hf_mig$\KB956803\SP3QFE\afd.sys
  1656. [2008/08/14 05:51:43 | 000,138,368 | ---- | M] (Microsoft Corporation) MD5=55E6E1C51B6D30E54335750955453702 -- C:\WINDOWS\$NtServicePackUninstall$\afd.sys
  1657. [2004/08/03 23:14:16 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=5AC495F4CB807B2B98AD2AD591E6D92E -- C:\WINDOWS\$NtUninstallKB951748_0$\afd.sys
  1658. [2008/08/14 05:48:52 | 000,138,368 | ---- | M] (Microsoft Corporation) MD5=6A0397376853E604DE8E1E7A87FC08AC -- C:\WINDOWS\$hf_mig$\KB956803\SP2QFE\afd.sys
  1659. [2008/10/16 10:43:01 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=7618D5218F2A614672EC61A80D854A37 -- C:\WINDOWS\$NtUninstallKB2592799$\afd.sys
  1660. [2008/08/14 06:04:36 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=7E775010EF291DA96AD17CA4B17137D7 -- C:\WINDOWS\$hf_mig$\KB956803\SP3GDR\afd.sys
  1661. [2008/08/14 06:04:36 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=7E775010EF291DA96AD17CA4B17137D7 -- C:\WINDOWS\$NtUninstallKB2509553$\afd.sys
  1662. [2008/06/20 06:44:38 | 000,138,368 | ---- | M] (Microsoft Corporation) MD5=944CA435BFCFC82CC1ED9E3A7D731AA9 -- C:\WINDOWS\$NtUninstallKB956803_0$\afd.sys
  1663. [2008/06/20 07:48:03 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=D6EE6014241D034E63C49A50CB2B442A -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\afd.sys
  1664. [2008/06/20 06:44:08 | 000,138,368 | ---- | M] (Microsoft Corporation) MD5=D99DDFFB33DEACDCF20717CB520379F6 -- C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\afd.sys
  1665. [2008/06/20 07:40:08 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=E3049B90FE06F3F740B7CFDA44995E2C -- C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\afd.sys
  1666. [2008/06/20 07:40:08 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=E3049B90FE06F3F740B7CFDA44995E2C -- C:\WINDOWS\$NtUninstallKB956803$\afd.sys
  1667. [2011/08/17 09:41:46 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=F6B7B1ECD7B41736BDB6FF4B092BCB79 -- C:\WINDOWS\$hf_mig$\KB2592799\SP3QFE\afd.sys
  1668.  
  1669. [color=#A23BEC]< MD5 for: ATAPI.SYS >[/color]
  1670. [2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
  1671. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
  1672. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
  1673. [2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\atapi.sys
  1674. [2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
  1675. [2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
  1676. [2004/08/03 23:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
  1677. [2004/08/03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\i386\atapi.sys
  1678.  
  1679. [color=#A23BEC]< MD5 for: DISK.SYS >[/color]
  1680. [2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:disk.sys
  1681. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:disk.sys
  1682. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:disk.sys
  1683. [2004/08/03 22:59:56 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=00CA44E4534865F8A3B64F7C0984BFF0 -- C:\WINDOWS\$NtServicePackUninstall$\disk.sys
  1684. [2008/04/13 14:40:47 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\disk.sys
  1685. [2008/04/13 14:40:47 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\ServicePackFiles\i386\disk.sys
  1686. [2008/04/13 14:40:47 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\system32\drivers\disk.sys
  1687.  
  1688. [color=#A23BEC]< MD5 for: EVENTLOG.DLL >[/color]
  1689. [2008/04/13 20:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
  1690. [2008/04/13 20:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll
  1691. [2004/08/04 00:56:44 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
  1692.  
  1693. [color=#A23BEC]< MD5 for: EXPLORER.EXE >[/color]
  1694. [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe
  1695. [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
  1696. [2007/06/13 07:26:03 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
  1697. [2007/06/13 06:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
  1698. [2004/08/04 00:56:50 | 001,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
  1699.  
  1700. [color=#A23BEC]< MD5 for: FASTFAT.SYS >[/color]
  1701. [2004/08/03 23:14:18 | 000,143,360 | ---- | M] (Microsoft Corporation) MD5=3117F595E9615E04F05A54FC15A03B20 -- C:\WINDOWS\$NtServicePackUninstall$\fastfat.sys
  1702. [2008/04/13 15:14:29 | 000,143,744 | ---- | M] (Microsoft Corporation) MD5=38D332A6D56AF32635675F132548343E -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\Fastfat.sys
  1703. [2008/04/13 15:14:29 | 000,143,744 | ---- | M] (Microsoft Corporation) MD5=38D332A6D56AF32635675F132548343E -- C:\WINDOWS\ServicePackFiles\i386\fastfat.sys
  1704. [2008/04/13 15:14:29 | 000,143,744 | ---- | M] (Microsoft Corporation) MD5=38D332A6D56AF32635675F132548343E -- C:\WINDOWS\system32\drivers\fastfat.sys
  1705.  
  1706. [color=#A23BEC]< MD5 for: I8042PRT.SYS >[/color]
  1707. [2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:i8042prt.sys
  1708. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:i8042prt.sys
  1709. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:i8042prt.sys
  1710. [2008/04/13 15:18:00 | 000,052,480 | ---- | M] (Microsoft Corporation) MD5=4A0B06AA8943C1E332520F7440C0AA30 -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\i8042prt.sys
  1711. [2008/04/13 15:18:00 | 000,052,480 | ---- | M] (Microsoft Corporation) MD5=4A0B06AA8943C1E332520F7440C0AA30 -- C:\WINDOWS\ServicePackFiles\i386\i8042prt.sys
  1712. [2008/04/13 15:18:00 | 000,052,480 | ---- | M] (Microsoft Corporation) MD5=4A0B06AA8943C1E332520F7440C0AA30 -- C:\WINDOWS\system32\drivers\i8042prt.sys
  1713. [2004/08/03 23:14:38 | 000,052,736 | ---- | M] (Microsoft Corporation) MD5=5502B58EEF7486EE6F93F3F164DCB808 -- C:\WINDOWS\$NtServicePackUninstall$\i8042prt.sys
  1714.  
  1715. [color=#A23BEC]< MD5 for: IMAPI.SYS >[/color]
  1716. [2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:imapi.sys
  1717. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:imapi.sys
  1718. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:imapi.sys
  1719. [2008/04/13 14:40:58 | 000,042,112 | ---- | M] (Microsoft Corporation) MD5=083A052659F5310DD8B6A6CB05EDCF8E -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\imapi.sys
  1720. [2008/04/13 14:40:58 | 000,042,112 | ---- | M] (Microsoft Corporation) MD5=083A052659F5310DD8B6A6CB05EDCF8E -- C:\WINDOWS\ServicePackFiles\i386\imapi.sys
  1721. [2008/04/13 14:40:58 | 000,042,112 | ---- | M] (Microsoft Corporation) MD5=083A052659F5310DD8B6A6CB05EDCF8E -- C:\WINDOWS\system32\drivers\imapi.sys
  1722. [2004/08/03 23:00:16 | 000,041,856 | ---- | M] (Microsoft Corporation) MD5=F8AA320C6A0409C0380E5D8A99D76EC6 -- C:\WINDOWS\$NtServicePackUninstall$\imapi.sys
  1723.  
  1724. [color=#A23BEC]< MD5 for: IPSEC.SYS >[/color]
  1725. [2008/04/13 15:19:42 | 000,075,264 | ---- | M] (Microsoft Corporation) MD5=23C74D75E36E7158768DD63D92789A91 -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\ipsec.sys
  1726. [2008/04/13 15:19:42 | 000,075,264 | ---- | M] (Microsoft Corporation) MD5=23C74D75E36E7158768DD63D92789A91 -- C:\WINDOWS\ServicePackFiles\i386\ipsec.sys
  1727. [2008/04/13 15:19:42 | 000,075,264 | ---- | M] (Microsoft Corporation) MD5=23C74D75E36E7158768DD63D92789A91 -- C:\WINDOWS\system32\drivers\ipsec.sys
  1728. [2004/08/03 23:14:30 | 000,074,752 | ---- | M] (Microsoft Corporation) MD5=64537AA5C003A6AFEEE1DF819062D0D1 -- C:\WINDOWS\$NtServicePackUninstall$\ipsec.sys
  1729.  
  1730. [color=#A23BEC]< MD5 for: KBDCLASS.SYS >[/color]
  1731. [2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:kbdclass.sys
  1732. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:kbdclass.sys
  1733. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:kbdclass.sys
  1734. [2008/04/13 14:39:47 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=463C1EC80CD17420A542B7F36A36F128 -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\kbdclass.sys
  1735. [2008/04/13 14:39:47 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=463C1EC80CD17420A542B7F36A36F128 -- C:\WINDOWS\ServicePackFiles\i386\kbdclass.sys
  1736. [2008/04/13 14:39:47 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=463C1EC80CD17420A542B7F36A36F128 -- C:\WINDOWS\system32\drivers\kbdclass.sys
  1737. [2004/08/03 22:58:34 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=EBDEE8A2EE5393890A1ACEE971C4C246 -- C:\WINDOWS\$NtServicePackUninstall$\kbdclass.sys
  1738.  
  1739. [color=#A23BEC]< MD5 for: LSASS.EXE >[/color]
  1740. [2004/08/04 00:56:52 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=84885F9B82F4D55C6146EBF6065D75D2 -- C:\WINDOWS\$NtServicePackUninstall$\lsass.exe
  1741. [2008/04/13 20:12:24 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=BF2466B3E18E970D8A976FB95FC1CA85 -- C:\WINDOWS\ServicePackFiles\i386\lsass.exe
  1742. [2008/04/13 20:12:24 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=BF2466B3E18E970D8A976FB95FC1CA85 -- C:\WINDOWS\system32\lsass.exe
  1743.  
  1744. [color=#A23BEC]< MD5 for: MOUCLASS.SYS >[/color]
  1745. [2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:mouclass.sys
  1746. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:mouclass.sys
  1747. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:mouclass.sys
  1748. [2004/08/04 01:05:44 | 000,023,040 | ---- | M] (Microsoft Corporation) MD5=34E1F0031153E491910E12551400192C -- C:\WINDOWS\$NtServicePackUninstall$\mouclass.sys
  1749. [2008/04/13 14:39:47 | 000,023,040 | ---- | M] (Microsoft Corporation) MD5=35C9E97194C8CFB8430125F8DBC34D04 -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\mouclass.sys
  1750. [2008/04/13 14:39:47 | 000,023,040 | ---- | M] (Microsoft Corporation) MD5=35C9E97194C8CFB8430125F8DBC34D04 -- C:\WINDOWS\ServicePackFiles\i386\mouclass.sys
  1751. [2008/04/13 14:39:47 | 000,023,040 | ---- | M] (Microsoft Corporation) MD5=35C9E97194C8CFB8430125F8DBC34D04 -- C:\WINDOWS\system32\drivers\mouclass.sys
  1752.  
  1753. [color=#A23BEC]< MD5 for: NETBT.SYS >[/color]
  1754. [2004/08/03 23:14:38 | 000,162,816 | ---- | M] (Microsoft Corporation) MD5=0C80E410CD2F47134407EE7DD19CC86B -- C:\WINDOWS\$NtServicePackUninstall$\netbt.sys
  1755. [2008/04/13 15:21:00 | 000,162,816 | ---- | M] (Microsoft Corporation) MD5=74B2B2F5BEA5E9A3DC021D685551BD3D -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\netbt.sys
  1756. [2008/04/13 15:21:00 | 000,162,816 | ---- | M] (Microsoft Corporation) MD5=74B2B2F5BEA5E9A3DC021D685551BD3D -- C:\WINDOWS\ServicePackFiles\i386\netbt.sys
  1757. [2008/04/13 15:21:00 | 000,162,816 | ---- | M] (Microsoft Corporation) MD5=74B2B2F5BEA5E9A3DC021D685551BD3D -- C:\WINDOWS\system32\drivers\netbt.sys
  1758.  
  1759. [color=#A23BEC]< MD5 for: NETLOGON.DLL >[/color]
  1760. [2008/04/13 20:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
  1761. [2008/04/13 20:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
  1762. [2009/02/06 14:46:09 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
  1763. [2009/02/06 14:46:09 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll
  1764. [2004/08/04 00:56:46 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
  1765.  
  1766. [color=#A23BEC]< MD5 for: REDBOOK.SYS >[/color]
  1767. [2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:redbook.sys
  1768. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:redbook.sys
  1769. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:redbook.sys
  1770. [2004/08/03 18:59:38 | 000,057,472 | ---- | M] (Microsoft Corporation) MD5=B31B4588E4086D8D84ADBF9845C2402B -- C:\WINDOWS\$NtServicePackUninstall$\redbook.sys
  1771. [2008/04/13 14:40:27 | 000,057,600 | ---- | M] (Microsoft Corporation) MD5=F828DD7E1419B6653894A8F97A0094C5 -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\redbook.sys
  1772. [2008/04/13 14:40:27 | 000,057,600 | ---- | M] (Microsoft Corporation) MD5=F828DD7E1419B6653894A8F97A0094C5 -- C:\WINDOWS\ServicePackFiles\i386\redbook.sys
  1773. [2008/04/13 14:40:27 | 000,057,600 | ---- | M] (Microsoft Corporation) MD5=F828DD7E1419B6653894A8F97A0094C5 -- C:\WINDOWS\system32\drivers\redbook.sys
  1774.  
  1775. [color=#A23BEC]< MD5 for: SCECLI.DLL >[/color]
  1776. [2004/08/04 00:56:46 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
  1777. [2008/04/13 20:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
  1778. [2008/04/13 20:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll
  1779.  
  1780. [color=#A23BEC]< MD5 for: SERIAL.SYS >[/color]
  1781. [2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:serial.sys
  1782. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:serial.sys
  1783. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:serial.sys
  1784. [2008/04/13 15:15:45 | 000,064,512 | ---- | M] (Microsoft Corporation) MD5=CCA207A8896D4C6A0C9CE29A4AE411A7 -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\serial.sys
  1785. [2008/04/13 15:15:45 | 000,064,512 | ---- | M] (Microsoft Corporation) MD5=CCA207A8896D4C6A0C9CE29A4AE411A7 -- C:\WINDOWS\ServicePackFiles\i386\serial.sys
  1786. [2008/04/13 15:15:45 | 000,064,512 | ---- | M] (Microsoft Corporation) MD5=CCA207A8896D4C6A0C9CE29A4AE411A7 -- C:\WINDOWS\system32\drivers\serial.sys
  1787. [2004/08/03 23:15:54 | 000,064,896 | ---- | M] (Microsoft Corporation) MD5=CD9404D115A00D249F70A371B46D5A26 -- C:\WINDOWS\$NtServicePackUninstall$\serial.sys
  1788.  
  1789. [color=#A23BEC]< MD5 for: SERVICES.EXE >[/color]
  1790. [2009/02/06 07:06:24 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=020CEAAEDC8EB655B6506B8C70D53BB6 -- C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe
  1791. [2008/04/13 20:12:34 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 -- C:\WINDOWS\$NtUninstallKB956572$\services.exe
  1792. [2008/04/13 20:12:34 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 -- C:\WINDOWS\ServicePackFiles\i386\services.exe
  1793. [2009/02/06 13:14:03 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=37561F8D4160D62DA86D24AE41FAE8DE -- C:\WINDOWS\$NtServicePackUninstall$\services.exe
  1794. [2009/02/06 06:22:21 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=4712531AB7A01B7EE059853CA17D39BD -- C:\WINDOWS\$hf_mig$\KB956572\SP2QFE\services.exe
  1795. [2009/02/06 07:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\$hf_mig$\KB956572\SP3GDR\services.exe
  1796. [2009/02/06 07:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\system32\dllcache\services.exe
  1797. [2009/02/06 07:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\system32\services.exe
  1798. [2004/08/04 00:56:56 | 000,108,032 | ---- | M] (Microsoft Corporation) MD5=C6CE6EEC82F187615D1002BB3BB50ED4 -- C:\WINDOWS\$NtUninstallKB956572_0$\services.exe
  1799.  
  1800. [color=#A23BEC]< MD5 for: SMSS.EXE >[/color]
  1801. [2008/04/13 20:12:36 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=5F816C1F539266D2D4C78694239DA0B5 -- C:\WINDOWS\ServicePackFiles\i386\smss.exe
  1802. [2008/04/13 20:12:36 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=5F816C1F539266D2D4C78694239DA0B5 -- C:\WINDOWS\system32\smss.exe
  1803. [2004/08/04 00:56:58 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=BD7FB0957C716F1A60333AEE04DE2178 -- C:\WINDOWS\$NtServicePackUninstall$\smss.exe
  1804.  
  1805. [color=#A23BEC]< MD5 for: SVCHOST.EXE >[/color]
  1806. [2008/04/13 20:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\ServicePackFiles\i386\svchost.exe
  1807. [2008/04/13 20:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\system32\svchost.exe
  1808. [2004/08/04 00:56:58 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 -- C:\WINDOWS\$NtServicePackUninstall$\svchost.exe
  1809. [2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
  1810.  
  1811. [color=#A23BEC]< MD5 for: TCPIP.SYS >[/color]
  1812. [2006/04/20 07:51:50 | 000,359,808 | ---- | M] (Microsoft Corporation) MD5=1DBF125862891817F374F407626967F4 -- C:\WINDOWS\$NtUninstallKB951748_0$\tcpip.sys
  1813. [2008/06/20 06:45:13 | 000,360,320 | ---- | M] (Microsoft Corporation) MD5=2A5554FC5B1E04E131230E3CE035C3F9 -- C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
  1814. [2006/01/13 13:07:08 | 000,360,448 | ---- | M] (Microsoft Corporation) MD5=5562CC0A47B2AEF06D3417B733F3C195 -- C:\WINDOWS\$hf_mig$\KB913446\SP2QFE\tcpip.sys
  1815. [2005/05/25 15:07:12 | 000,359,936 | ---- | M] (Microsoft Corporation) MD5=63FDFEA54EB53DE2D863EE454937CE1E -- C:\WINDOWS\$hf_mig$\KB893066\SP2QFE\tcpip.sys
  1816. [2008/06/20 06:44:42 | 000,360,960 | ---- | M] (Microsoft Corporation) MD5=744E57C99232201AE98C49168B918F48 -- C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys
  1817. [2008/04/13 15:20:16 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys
  1818. [2008/04/13 15:20:16 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
  1819. [2008/06/20 07:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\tcpip.sys
  1820. [2008/06/20 07:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys
  1821. [2008/06/20 07:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\dllcache\tcpip.sys
  1822. [2008/06/20 07:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\drivers\tcpip.sys
  1823. [2008/06/20 07:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\$hf_mig$\KB2509553\SP3QFE\tcpip.sys
  1824. [2008/06/20 07:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
  1825. [2006/04/20 08:18:35 | 000,360,576 | ---- | M] (Microsoft Corporation) MD5=B2220C618B42A2212A59D91EBD6FC4B4 -- C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
  1826.  
  1827. [color=#A23BEC]< MD5 for: USERINIT.EXE >[/color]
  1828. [2004/08/04 00:56:58 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
  1829. [2008/04/13 20:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
  1830. [2008/04/13 20:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe
  1831.  
  1832. [color=#A23BEC]< MD5 for: VOLSNAP.SYS >[/color]
  1833. [2008/04/13 14:41:01 | 000,052,352 | ---- | M] (Microsoft Corporation) MD5=4C8FCB5CC53AAB716D810740FE59D025 -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\VolSnap.sys
  1834. [2008/04/13 14:41:01 | 000,052,352 | ---- | M] (Microsoft Corporation) MD5=4C8FCB5CC53AAB716D810740FE59D025 -- C:\WINDOWS\ServicePackFiles\i386\volsnap.sys
  1835. [2008/04/13 14:41:01 | 000,052,352 | ---- | M] (Microsoft Corporation) MD5=4C8FCB5CC53AAB716D810740FE59D025 -- C:\WINDOWS\system32\drivers\volsnap.sys
  1836. [2004/08/03 23:00:18 | 000,052,352 | ---- | M] (Microsoft Corporation) MD5=EE4660083DEBA849FF6C485D944B379B -- C:\WINDOWS\$NtServicePackUninstall$\volsnap.sys
  1837.  
  1838. [color=#A23BEC]< MD5 for: WINLOGON.EXE >[/color]
  1839. [2004/08/04 00:56:58 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
  1840. [2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
  1841. [2008/04/13 20:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
  1842. [2008/04/13 20:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe
  1843.  
  1844. [color=#E56717]========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========[/color]
  1845. [C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a] -> C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790 -> Junction
  1846. [C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a] -> C:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e -> Junction
  1847. [C:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a] -> C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492 -> Junction
  1848. [C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35] -> C:\WINDOWS\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5 -> Junction
  1849.  
  1850. < End of report >
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!