jcraig4550

OTL.txt

Mar 17th, 2014
15
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. OTL logfile created on: 3/17/2014 3:08:30 PM - Run 1
  2. OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\mmurphy\Desktop
  3. Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
  4. Internet Explorer (Version = 8.0.6001.18702)
  5. Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
  6.  
  7. 1.94 Gb Total Physical Memory | 1.33 Gb Available Physical Memory | 68.83% Memory free
  8. 2.44 Gb Paging File | 2.05 Gb Available in Paging File | 83.93% Paging File free
  9. Paging file location(s): C:\pagefile.sys 672 1344 [binary data]
  10.  
  11. %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
  12. Drive C: | 37.26 Gb Total Space | 13.80 Gb Free Space | 37.03% Space Free | Partition Type: NTFS
  13. Drive D: | 497.72 Mb Total Space | 11.75 Mb Free Space | 2.36% Space Free | Partition Type: FAT
  14. Drive U: | 68.23 Gb Total Space | 1.91 Gb Free Space | 2.79% Space Free | Partition Type: NTFS
  15.  
  16. Computer Name: JCRAIG | User Name: mmurphy | Logged in as Administrator.
  17. Boot Mode: Normal | Scan Mode: All users
  18. Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 90 Days
  19.  
  20. [color=#E56717]========== Processes (SafeList) ==========[/color]
  21.  
  22. PRC - [2014/03/17 15:01:34 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\mmurphy\Desktop\OTL.exe
  23. PRC - [2014/02/18 11:26:50 | 000,275,568 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
  24. PRC - [2011/12/15 11:40:54 | 001,446,248 | ---- | M] (Garmin) -- C:\Program Files\Garmin\Lifetime Updater\GarminLifetime.exe
  25. PRC - [2010/12/09 06:45:58 | 000,074,752 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\Winamp\winampa.exe
  26. PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
  27. PRC - [2004/07/21 16:28:02 | 000,413,807 | ---- | M] (American Power Conversion Corporation) -- C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
  28. PRC - [2004/07/21 16:26:36 | 000,176,241 | ---- | M] (American Power Conversion Corporation) -- C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
  29. PRC - [2003/05/15 02:19:50 | 000,217,193 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
  30.  
  31.  
  32. [color=#E56717]========== Modules (No Company Name) ==========[/color]
  33.  
  34. MOD - [2014/02/18 11:26:50 | 003,578,992 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
  35. MOD - [2014/02/12 04:39:23 | 000,393,216 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\05be173cbacba4b7604a67a267acdfe4\System.Xml.Linq.ni.dll
  36. MOD - [2014/02/12 04:38:21 | 001,801,728 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xaml\d116eda30a35c490e59221b0ebac6fcd\System.Xaml.ni.dll
  37. MOD - [2014/02/12 04:28:04 | 000,309,760 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\bd52c6f899032f62270379681f559c41\PresentationFramework.Classic.ni.dll
  38. MOD - [2014/02/12 04:27:34 | 018,003,456 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\9aafa1869d136f77bc483f25d0795229\PresentationFramework.ni.dll
  39. MOD - [2014/02/12 04:26:44 | 000,751,616 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Security\e0579383d49e212d5bf5a87c3dad50e7\System.Security.ni.dll
  40. MOD - [2014/02/12 04:26:34 | 005,628,928 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\850fa7110c7423c324762c1ad3130219\System.Xml.ni.dll
  41. MOD - [2014/02/12 04:26:17 | 007,053,824 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\a4b5a1a06d2d7f77258943c8c228a5e0\System.Core.ni.dll
  42. MOD - [2014/02/12 04:25:56 | 013,199,360 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\2781e84862746a34f026d0ee179eed2b\System.Windows.Forms.ni.dll
  43. MOD - [2014/02/12 04:25:29 | 001,667,584 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\243ff1822abc8282cb8fee37538170b4\System.Drawing.ni.dll
  44. MOD - [2014/02/12 04:25:23 | 011,451,904 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationCore\b307821c69c09ed0a2ee47122fdcdd4d\PresentationCore.ni.dll
  45. MOD - [2014/02/12 04:24:48 | 003,858,944 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\WindowsBase\49605239a73cd565e3a08048a31b442e\WindowsBase.ni.dll
  46. MOD - [2014/02/12 04:24:32 | 009,099,776 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\4c906eb82e6f56aea01b2a7291fab7ea\System.ni.dll
  47. MOD - [2014/02/12 04:24:07 | 014,416,896 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\4e62d1d9b7dd2c2d14915abb73c22d50\mscorlib.ni.dll
  48. MOD - [2011/03/27 16:11:04 | 000,094,208 | ---- | M] () -- C:\Program Files\FileZilla FTP Client\fzshellext.dll
  49.  
  50.  
  51. [color=#E56717]========== Services (SafeList) ==========[/color]
  52.  
  53. SRV - [2014/03/12 11:11:43 | 000,257,928 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
  54. SRV - [2014/02/18 11:26:50 | 000,118,896 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
  55. SRV - [2010/04/12 08:34:20 | 000,183,808 | ---- | M] (InfoTronics, Inc.) [Auto | Stopped] -- C:\Program Files\InfoTronics\Attendance Enterprise\AESERVICE.EXE -- (AeService)
  56. SRV - [2004/07/21 16:26:36 | 000,176,241 | ---- | M] (American Power Conversion Corporation) [Auto | Running] -- C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe -- (APC UPS Service)
  57.  
  58.  
  59. [color=#E56717]========== Driver Services (SafeList) ==========[/color]
  60.  
  61. DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
  62. DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
  63. DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
  64. DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
  65. DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
  66. DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
  67. DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
  68. DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
  69. DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
  70. DRV - File not found [Kernel | System | Stopped] -- U:\John\Downloads\EmsisoftEmergencyKit(1)\Run\a2ddax86.sys -- (A2DDA)
  71. DRV - [2014/03/14 17:35:56 | 000,052,312 | ---- | M] (Malwarebytes Corporation) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\mbamchameleon.sys -- (mbamchameleon)
  72. DRV - [2009/12/15 15:29:42 | 000,034,248 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mferkdk.sys -- (MfeRKDK)
  73. DRV - [2009/12/15 15:29:34 | 000,214,664 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk)
  74. DRV - [2009/12/15 15:29:30 | 000,035,272 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mfebopk.sys -- (MfeBOPK)
  75. DRV - [2009/12/15 15:29:26 | 000,079,816 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mfeavfk.sys -- (MfeAVFK)
  76. DRV - [2009/12/15 14:29:52 | 000,055,304 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\mfetdik.sys -- (mfetdik)
  77. DRV - [2005/10/18 17:15:42 | 004,034,048 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService)
  78. DRV - [2005/08/31 01:42:36 | 001,333,760 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
  79. DRV - [2005/08/24 16:56:28 | 000,074,752 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp)
  80. DRV - [2004/08/03 18:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139)
  81.  
  82.  
  83. [color=#E56717]========== Standard Registry (All) ==========[/color]
  84.  
  85.  
  86. [color=#E56717]========== Internet Explorer ==========[/color]
  87.  
  88. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  89. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  90. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
  91. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
  92. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
  93. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  94. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
  95. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  96. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
  97. IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
  98. IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
  99. IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
  100.  
  101.  
  102. IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
  103. IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  104.  
  105. IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
  106. IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  107.  
  108.  
  109.  
  110. IE - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
  111. IE - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
  112. IE - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
  113. IE - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)
  114. IE - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
  115. IE - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
  116. IE - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
  117.  
  118. [color=#E56717]========== FireFox ==========[/color]
  119.  
  120. FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:27.0.1
  121. FF - user.js - File not found
  122.  
  123. FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
  124. FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
  125. FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
  126. FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
  127.  
  128. FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2012/02/20 17:01:03 | 000,000,000 | ---D | M]
  129. FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2012/10/13 03:00:45 | 000,000,000 | ---D | M]
  130. FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components
  131. FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2014/02/18 11:26:38 | 000,000,000 | ---D | M]
  132.  
  133. [2014/03/13 07:50:18 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\mmurphy\Application Data\Mozilla\Extensions
  134. [2014/02/18 11:26:35 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
  135. [2014/02/18 11:26:50 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
  136. [2012/02/20 17:01:00 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
  137. [2007/03/22 20:23:30 | 000,017,248 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL
  138. [2012/12/18 15:08:32 | 000,209,112 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\mozilla firefox\plugins\nppdf32.dll
  139. [2010/12/09 06:47:06 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll
  140.  
  141. O1 HOSTS File: ([2001/08/23 08:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
  142. O1 - Hosts: 127.0.0.1 localhost
  143. O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
  144. O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
  145. O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
  146. O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
  147. O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
  148. O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
  149. O3 - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
  150. O3 - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\..\Toolbar\ShellBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
  151. O3 - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
  152. O3 - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
  153. O3 - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
  154. O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
  155. O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
  156. O4 - HKLM..\Run: [Garmin Lifetime Updater] C:\Program Files\Garmin\Lifetime Updater\GarminLifetime.exe (Garmin)
  157. O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.)
  158. O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
  159. O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
  160. O4 - HKU\S-1-5-21-2000478354-1979792683-725345543-1006..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)
  161. O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe (Adobe Systems Inc.)
  162. O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\APC UPS Status.lnk = C:\Program Files\APC\APC PowerChute Personal Edition\Display.exe (American Power Conversion Corporation)
  163. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
  164. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
  165. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
  166. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
  167. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LegalNoticeText =
  168. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LegalNoticeCaption =
  169. O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
  170. O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
  171. O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
  172. O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
  173. O7 - HKU\S-1-5-21-2000478354-1979792683-725345543-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
  174. O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
  175. O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
  176. O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation)
  177. O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
  178. O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
  179. O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
  180. O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation)
  181. O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
  182. O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
  183. O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
  184. O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
  185. O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
  186. O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
  187. O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
  188. O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
  189. O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
  190. O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
  191. O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
  192. O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
  193. O15 - HKLM\..Trusted Domains: //about.htm/ ([]myui in Trusted sites)
  194. O15 - HKLM\..Trusted Domains: //Exclude.htm/ ([]myui in Trusted sites)
  195. O15 - HKLM\..Trusted Domains: //LanguageSelection.htm/ ([]myui in Trusted sites)
  196. O15 - HKLM\..Trusted Domains: //Message.htm/ ([]myui in Trusted sites)
  197. O15 - HKLM\..Trusted Domains: //MyAgttryCmd.htm/ ([]myui in Trusted sites)
  198. O15 - HKLM\..Trusted Domains: //MyAgttryNag.htm/ ([]myui in Trusted sites)
  199. O15 - HKLM\..Trusted Domains: //MyNotification.htm/ ([]myui in Trusted sites)
  200. O15 - HKLM\..Trusted Domains: //NOCLessUpdate.htm/ ([]myui in Trusted sites)
  201. O15 - HKLM\..Trusted Domains: //quarantine.htm/ ([]myui in Trusted sites)
  202. O15 - HKLM\..Trusted Domains: //ScanNow.htm/ ([]myui in Trusted sites)
  203. O15 - HKLM\..Trusted Domains: //strings.vbs/ ([]myui in Trusted sites)
  204. O15 - HKLM\..Trusted Domains: //Template.htm/ ([]myui in Trusted sites)
  205. O15 - HKLM\..Trusted Domains: //Update.htm/ ([]myui in Trusted sites)
  206. O15 - HKLM\..Trusted Domains: //VirFound.htm/ ([]myui in Trusted sites)
  207. O15 - HKLM\..Trusted Domains: mcafee.com ([*] http in Trusted sites)
  208. O15 - HKLM\..Trusted Domains: mcafee.com ([*] https in Trusted sites)
  209. O15 - HKLM\..Trusted Domains: mcafeeasap.com ([betavscan] http in Trusted sites)
  210. O15 - HKLM\..Trusted Domains: mcafeeasap.com ([betavscan] https in Trusted sites)
  211. O15 - HKLM\..Trusted Domains: mcafeeasap.com ([vs] http in Trusted sites)
  212. O15 - HKLM\..Trusted Domains: mcafeeasap.com ([vs] https in Trusted sites)
  213. O15 - HKLM\..Trusted Domains: mcafeeasap.com ([www] http in Trusted sites)
  214. O15 - HKLM\..Trusted Domains: mcafeeasap.com ([www] https in Trusted sites)
  215. O16 - DPF: {037790A6-1576-11D6-903D-00105AABADD3} https://www.ussco.com/bluezone/controls/sglw2hcm.ocx (Seagull Web-to-Host Control Module v4)
  216. O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1358279557099 (WUWebControl Class)
  217. O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1358279603631 (MUWebControl Class)
  218. O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
  219. O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
  220. O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
  221. O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4F812C9A-4072-430C-87AD-28B103F95B28}: NameServer = 209.244.0.3,209.244.0.4
  222. O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
  223. O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
  224. O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)
  225. O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
  226. O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
  227. O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
  228. O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
  229. O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
  230. O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
  231. O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
  232. O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
  233. O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
  234. O18 - Protocol\Handler\ipp - No CLSID value found
  235. O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
  236. O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)
  237. O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
  238. O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
  239. O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
  240. O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation)
  241. O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
  242. O18 - Protocol\Handler\msdaipp - No CLSID value found
  243. O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
  244. O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
  245. O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)
  246. O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
  247. O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
  248. O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
  249. O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
  250. O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)
  251. O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
  252. O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation)
  253. O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
  254. O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
  255. O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
  256. O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
  257. O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
  258. O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
  259. O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
  260. O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
  261. O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
  262. O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
  263. O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
  264. O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation)
  265. O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
  266. O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)
  267. O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
  268. O20 - Winlogon\Notify\crypt32chain: DllName - (crypt32.dll) - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)
  269. O20 - Winlogon\Notify\cryptnet: DllName - (cryptnet.dll) - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)
  270. O20 - Winlogon\Notify\cscdll: DllName - (cscdll.dll) - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)
  271. O20 - Winlogon\Notify\dimsntfy: DllName - (%SystemRoot%\System32\dimsntfy.dll) - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation)
  272. O20 - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
  273. O20 - Winlogon\Notify\Schedule: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
  274. O20 - Winlogon\Notify\sclgntfy: DllName - (sclgntfy.dll) - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)
  275. O20 - Winlogon\Notify\SensLogn: DllName - (WlNotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
  276. O20 - Winlogon\Notify\termsrv: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
  277. O20 - Winlogon\Notify\WgaLogon: DllName - (WgaLogon.dll) - C:\WINDOWS\System32\WgaLogon.dll (Microsoft Corporation)
  278. O20 - Winlogon\Notify\wlballoon: DllName - (wlnotify.dll) - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
  279. O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
  280. O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
  281. O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation)
  282. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)
  283. O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll (Microsoft Corporation)
  284. O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
  285. O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
  286. O24 - Desktop Components:0 (My Current Home Page) - About:Home
  287. O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
  288. O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)
  289. O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
  290. O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation)
  291. O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)
  292. O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
  293. O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)
  294. O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
  295. O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
  296. O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)
  297. O31 - SafeBoot: AlternateShell - cmd.exe
  298. O32 - HKLM CDRom: AutoRun - 1
  299. O32 - AutoRun File - [2006/01/20 17:59:13 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
  300. O34 - HKLM BootExecute: (autocheck autochk *)
  301. O35 - HKLM\..comfile [open] -- "%1" %*
  302. O35 - HKLM\..exefile [open] -- "%1" %*
  303. O37 - HKLM\...com [@ = comfile] -- "%1" %*
  304. O37 - HKLM\...exe [@ = exefile] -- "%1" %*
  305. O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
  306. O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
  307.  
  308. NetSvcs: 6to4 - File not found
  309. NetSvcs: Ias - File not found
  310. NetSvcs: Iprip - File not found
  311. NetSvcs: Irmon - File not found
  312. NetSvcs: NWCWorkstation - File not found
  313. NetSvcs: Nwsapagent - File not found
  314. NetSvcs: WmdmPmSp - File not found
  315.  
  316.  
  317. SafeBootMin: Base - Driver Group
  318. SafeBootMin: Boot Bus Extender - Driver Group
  319. SafeBootMin: Boot file system - Driver Group
  320. SafeBootMin: File system - Driver Group
  321. SafeBootMin: Filter - Driver Group
  322. SafeBootMin: PCI Configuration - Driver Group
  323. SafeBootMin: PNP Filter - Driver Group
  324. SafeBootMin: Primary disk - Driver Group
  325. SafeBootMin: SCSI Class - Driver Group
  326. SafeBootMin: sermouse.sys - Driver
  327. SafeBootMin: System Bus Extender - Driver Group
  328. SafeBootMin: vds - Service
  329. SafeBootMin: vga.sys - Driver
  330. SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
  331. SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
  332. SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
  333. SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
  334. SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
  335. SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
  336. SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
  337. SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
  338. SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
  339. SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
  340. SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
  341. SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
  342. SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
  343. SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
  344.  
  345. SafeBootNet: Base - Driver Group
  346. SafeBootNet: Boot Bus Extender - Driver Group
  347. SafeBootNet: Boot file system - Driver Group
  348. SafeBootNet: File system - Driver Group
  349. SafeBootNet: Filter - Driver Group
  350. SafeBootNet: NDIS Wrapper - Driver Group
  351. SafeBootNet: NetBIOSGroup - Driver Group
  352. SafeBootNet: NetDDEGroup - Driver Group
  353. SafeBootNet: Network - Driver Group
  354. SafeBootNet: NetworkProvider - Driver Group
  355. SafeBootNet: PCI Configuration - Driver Group
  356. SafeBootNet: PNP Filter - Driver Group
  357. SafeBootNet: PNP_TDI - Driver Group
  358. SafeBootNet: Primary disk - Driver Group
  359. SafeBootNet: SCSI Class - Driver Group
  360. SafeBootNet: sermouse.sys - Driver
  361. SafeBootNet: Streams Drivers - Driver Group
  362. SafeBootNet: System Bus Extender - Driver Group
  363. SafeBootNet: TDI - Driver Group
  364. SafeBootNet: vga.sys - Driver
  365. SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
  366. SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
  367. SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
  368. SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
  369. SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
  370. SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
  371. SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
  372. SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
  373. SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
  374. SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
  375. SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
  376. SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
  377. SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
  378. SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
  379. SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
  380. SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
  381. SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
  382.  
  383. ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
  384. ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
  385. ActiveX: {1325db73-d9f1-48f8-8895-6d814ec58889} - Security Update for Windows XP (KB913433)
  386. ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
  387. ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
  388. ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
  389. ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
  390. ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
  391. ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
  392. ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
  393. ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
  394. ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
  395. ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
  396. ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
  397. ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
  398. ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
  399. ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
  400. ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
  401. ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
  402. ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
  403. ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
  404. ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
  405. ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
  406. ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
  407. ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
  408. ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
  409. ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
  410. ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
  411. ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
  412. ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - DOTNETFRAMEWORKS
  413. ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
  414. ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
  415. ActiveX: {C3C986D6-06B1-43BF-90DD-BE30756C00DE} - RevokedRootsUpdate
  416. ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
  417. ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
  418. ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
  419. ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash
  420. ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
  421. ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
  422. ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
  423. ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
  424. ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
  425. ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
  426. ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
  427. ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
  428.  
  429. Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
  430. Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
  431. Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
  432. Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
  433. Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
  434. Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
  435. Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
  436. Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
  437. Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
  438.  
  439. [color=#E56717]========== Files/Folders - Created Within 90 Days ==========[/color]
  440.  
  441. [2014/03/17 15:06:14 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\mmurphy\Desktop\OTL.exe
  442. [2014/03/17 08:15:17 | 000,000,000 | -H-D | C] -- C:\WINDOWS\PIF
  443. [2014/03/14 17:36:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)
  444. [2014/03/14 17:27:09 | 000,052,312 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamchameleon.sys
  445. [2014/03/14 17:27:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mmurphy\Desktop\mbar
  446. [2014/03/14 17:26:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mmurphy\mbar
  447. [2014/03/14 15:03:43 | 000,000,000 | ---D | C] -- C:\FRST
  448. [2014/03/14 15:02:34 | 001,145,856 | ---- | C] (Farbar) -- C:\Documents and Settings\mmurphy\FRST.exe
  449. [2014/03/14 14:07:18 | 000,000,000 | R--D | C] -- C:\Documents and Settings\mmurphy\My Documents\My Videos
  450. [2014/03/14 14:07:18 | 000,000,000 | R--D | C] -- C:\Documents and Settings\mmurphy\Start Menu\Programs\Administrative Tools
  451. [2014/03/14 12:19:12 | 000,688,992 | R--- | C] (Swearware) -- C:\Documents and Settings\mmurphy\dds.com
  452. [2014/03/14 12:01:06 | 000,107,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
  453. [2014/03/13 10:48:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mmurphy\Application Data\Runscanner.net
  454. [2014/03/13 07:53:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mmurphy\Application Data\Malwarebytes
  455. [2014/03/13 07:51:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mmurphy\My Documents\Downloads
  456. [2014/03/13 07:50:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mmurphy\Local Settings\Application Data\Mozilla
  457. [2014/03/13 07:50:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mmurphy\Application Data\Mozilla
  458. [2014/03/12 11:11:40 | 005,777,288 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerInstaller.exe
  459. [2014/02/18 11:26:35 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
  460. [2014/02/12 04:21:54 | 000,000,000 | -HSD | C] -- C:\Config.Msi
  461. [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
  462. [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
  463.  
  464. [color=#E56717]========== Files - Modified Within 90 Days ==========[/color]
  465.  
  466. [2014/03/17 15:11:05 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
  467. [2014/03/17 15:11:02 | 000,002,523 | ---- | M] () -- C:\WINDOWS\pw5.ini
  468. [2014/03/17 15:05:39 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
  469. [2014/03/17 15:01:34 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\mmurphy\Desktop\OTL.exe
  470. [2014/03/17 05:04:04 | 000,002,521 | ---- | M] () -- C:\Documents and Settings\mmurphy\Desktop\Microsoft Office Outlook 2003.lnk
  471. [2014/03/14 17:36:18 | 000,107,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
  472. [2014/03/14 17:35:56 | 000,052,312 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamchameleon.sys
  473. [2014/03/14 17:34:16 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
  474. [2014/03/14 17:34:13 | 2078,855,168 | -HS- | M] () -- C:\hiberfil.sys
  475. [2014/03/14 14:59:48 | 001,145,856 | ---- | M] (Farbar) -- C:\Documents and Settings\mmurphy\FRST.exe
  476. [2014/03/14 12:19:13 | 000,688,992 | R--- | M] (Swearware) -- C:\Documents and Settings\mmurphy\dds.com
  477. [2014/03/14 03:19:23 | 000,243,128 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
  478. [2014/03/14 03:02:35 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
  479. [2014/03/13 10:21:16 | 000,496,578 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
  480. [2014/03/13 10:21:16 | 000,085,040 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
  481. [2014/03/13 07:57:24 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
  482. [2014/03/12 11:11:43 | 000,692,616 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
  483. [2014/03/12 11:11:43 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
  484. [2014/03/12 11:11:40 | 005,777,288 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerInstaller.exe
  485. [2014/02/24 16:24:24 | 000,174,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\ie4uinit.exe
  486. [2014/02/24 16:24:24 | 000,174,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ie4uinit.exe
  487. [2014/02/24 07:46:36 | 000,920,064 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wininet.dll
  488. [2014/02/24 07:46:31 | 000,759,296 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\vgx.dll
  489. [2014/02/24 07:46:25 | 001,216,000 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\urlmon.dll
  490. [2014/02/24 07:46:19 | 000,105,984 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\url.dll
  491. [2014/02/24 07:46:19 | 000,105,984 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\url.dll
  492. [2014/02/24 07:46:18 | 000,206,848 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\occache.dll
  493. [2014/02/24 07:46:16 | 000,611,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\mstime.dll
  494. [2014/02/24 07:46:16 | 000,611,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mstime.dll
  495. [2014/02/24 07:46:11 | 006,022,144 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
  496. [2014/02/24 07:46:11 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtmled.dll
  497. [2014/02/24 07:45:58 | 000,630,272 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msfeeds.dll
  498. [2014/02/24 07:45:58 | 000,630,272 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeeds.dll
  499. [2014/02/24 07:45:58 | 000,055,296 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msfeedsbs.dll
  500. [2014/02/24 07:45:58 | 000,055,296 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeedsbs.dll
  501. [2014/02/24 07:45:58 | 000,043,520 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\licmgr10.dll
  502. [2014/02/24 07:45:58 | 000,043,520 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\licmgr10.dll
  503. [2014/02/24 07:45:57 | 002,006,016 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iertutil.dll
  504. [2014/02/24 07:45:57 | 001,469,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\inetcpl.cpl
  505. [2014/02/24 07:45:57 | 001,469,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\inetcpl.cpl
  506. [2014/02/24 07:45:57 | 000,522,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jsdbgui.dll
  507. [2014/02/24 07:45:57 | 000,025,600 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\jsproxy.dll
  508. [2014/02/24 07:45:57 | 000,025,600 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jsproxy.dll
  509. [2014/02/24 07:45:56 | 000,184,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\iepeers.dll
  510. [2014/02/24 07:45:56 | 000,184,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iepeers.dll
  511. [2014/02/24 07:45:55 | 011,113,472 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieframe.dll
  512. [2014/02/24 07:45:43 | 000,743,424 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedvtool.dll
  513. [2014/02/24 07:45:43 | 000,387,584 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\iedkcs32.dll
  514. [2014/02/24 07:45:43 | 000,387,584 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedkcs32.dll
  515. [2014/02/24 07:45:42 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\corpol.dll
  516. [2014/02/24 07:45:42 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\corpol.dll
  517. [2014/02/24 06:54:21 | 000,385,024 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\html.iec
  518. [2014/02/06 22:01:37 | 001,879,040 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\win32k.sys
  519. [2014/02/06 22:01:37 | 001,879,040 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\win32k.sys
  520. [2014/02/05 04:55:04 | 000,562,688 | ---- | M] () -- C:\WINDOWS\System32\dllcache\qedit.dll
  521. [2014/01/03 23:13:05 | 000,420,864 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\vbscript.dll
  522. [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
  523. [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
  524.  
  525. [color=#E56717]========== Files Created - No Company Name ==========[/color]
  526.  
  527. [2014/03/13 10:42:18 | 2078,855,168 | -HS- | C] () -- C:\hiberfil.sys
  528. [2014/03/13 07:57:24 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
  529. [2013/01/16 04:23:36 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
  530. [2012/08/29 17:36:17 | 083,023,306 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\0tbpw.pad
  531. [2012/01/13 20:12:34 | 001,573,344 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-2000478354-1979792683-725345543-1004-0.dat
  532. [2012/01/13 20:12:30 | 001,082,281 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-2000478354-1979792683-725345543-1006-0.dat
  533. [2012/01/13 20:12:26 | 000,260,782 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
  534.  
  535. [color=#E56717]========== ZeroAccess Check ==========[/color]
  536.  
  537. [2012/10/11 09:51:43 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
  538.  
  539. [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  540.  
  541. [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
  542.  
  543. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  544. "" = %SystemRoot%\system32\shdocvw.dll -- [2012/10/31 07:33:26 | 001,510,400 | ---- | M] (Microsoft Corporation)
  545. "ThreadingModel" = Apartment
  546.  
  547. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
  548. "" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 08:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
  549. "ThreadingModel" = Free
  550.  
  551. [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
  552. "" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008/04/13 20:12:08 | 000,273,920 | ---- | M] (Microsoft Corporation)
  553. "ThreadingModel" = Both
  554.  
  555. [color=#E56717]========== LOP Check ==========[/color]
  556.  
  557. [2010/11/23 17:14:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Attendance Enterprise Backups
  558. [2013/07/08 11:21:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FedEx Customer Tools
  559. [2012/01/04 15:43:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Garmin
  560. [2012/10/11 10:37:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GEOTAB
  561. [2013/05/13 09:01:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Craig\Application Data\Desktop Apps
  562. [2013/06/19 08:49:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Craig\Application Data\Dropbox
  563. [2014/02/19 15:00:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Craig\Application Data\FileZilla
  564. [2014/03/13 15:28:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess
  565. [2012/01/04 16:13:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Craig\Application Data\Garmin
  566. [2012/10/11 10:37:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Craig\Application Data\GEOTAB
  567. [2013/01/04 10:33:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Craig\Application Data\Notepad++
  568. [2012/03/07 17:09:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Craig\Application Data\OpenOffice.org
  569. [2014/03/13 10:49:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Craig\Application Data\Runscanner.net
  570. [2012/04/25 07:36:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\John Craig\Application Data\Seagull Software
  571. [2012/01/04 23:23:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\Garmin
  572. [2014/03/13 10:48:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\Runscanner.net
  573.  
  574. [color=#E56717]========== Purity Check ==========[/color]
  575.  
  576.  
  577.  
  578. [color=#E56717]========== Custom Scans ==========[/color]
  579.  
  580. [color=#A23BEC]< %SYSTEMDRIVE%\*.* >[/color]
  581. [2006/01/20 17:59:13 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
  582. [2006/01/20 17:51:25 | 000,000,211 | -HS- | M] () -- C:\boot.ini
  583. [2006/01/20 17:59:13 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
  584. [2006/01/20 18:20:34 | 000,000,183 | ---- | M] () -- C:\GFX.log
  585. [2014/03/14 17:34:13 | 2078,855,168 | -HS- | M] () -- C:\hiberfil.sys
  586. [2006/01/20 18:16:59 | 000,000,090 | ---- | M] () -- C:\INF.log
  587. [2006/01/20 17:59:13 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
  588. [2006/01/20 18:27:20 | 000,000,224 | ---- | M] () -- C:\LAN.log
  589. [2006/01/20 17:59:13 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
  590. [2004/08/03 22:38:34 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
  591. [2013/01/15 17:28:43 | 000,250,048 | RHS- | M] () -- C:\ntldr
  592. [2014/03/14 17:34:12 | 704,643,072 | -HS- | M] () -- C:\pagefile.sys
  593. [2006/01/20 18:24:16 | 000,000,206 | ---- | M] () -- C:\Realtek.log
  594. [2006/01/20 18:24:12 | 000,000,391 | ---- | M] () -- C:\RtlSetup.log
  595.  
  596. [color=#A23BEC]< %SYSTEMDRIVE%\*. >[/color]
  597. [2012/10/11 09:54:28 | 000,000,000 | ---D | M] -- C:\5d8b9505ae343a4029daeac31d39
  598. [2013/01/15 15:37:39 | 000,000,000 | ---D | M] -- C:\a Download
  599. [2013/01/16 08:44:38 | 000,000,000 | ---D | M] -- C:\a7110dbd450582aa7803cdd700359cc0
  600. [2014/02/12 04:46:58 | 000,000,000 | -HSD | M] -- C:\Config.Msi
  601. [2012/10/10 09:15:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings
  602. [2013/02/26 17:34:51 | 000,000,000 | ---D | M] -- C:\Documents%20and%20Settings
  603. [2014/03/14 17:24:06 | 000,000,000 | ---D | M] -- C:\FRST
  604. [2012/11/06 15:41:52 | 000,000,000 | RH-D | M] -- C:\MSOCache
  605. [2006/01/21 20:57:59 | 000,000,000 | ---D | M] -- C:\Office2k
  606. [2014/02/18 16:50:09 | 000,000,000 | R--D | M] -- C:\Program Files
  607. [2010/05/24 02:15:36 | 000,000,000 | -HSD | M] -- C:\RECYCLER
  608. [2006/12/15 17:44:50 | 000,000,000 | ---D | M] -- C:\RouteTracking
  609. [2006/01/20 18:05:37 | 000,000,000 | -HSD | M] -- C:\System Volume Information
  610. [2006/01/20 18:29:40 | 000,000,000 | ---D | M] -- C:\TempEI4
  611. [2014/03/17 08:15:17 | 000,000,000 | ---D | M] -- C:\WINDOWS
  612.  
  613. [color=#A23BEC]< %USERPROFILE%\*.* >[/color]
  614. [2014/03/14 15:04:54 | 000,018,335 | ---- | M] () -- C:\Documents and Settings\mmurphy\Addition.txt
  615. [2014/03/14 14:08:03 | 000,019,163 | ---- | M] () -- C:\Documents and Settings\mmurphy\attach.txt
  616. [2014/03/14 12:19:13 | 000,688,992 | R--- | M] (Swearware) -- C:\Documents and Settings\mmurphy\dds.com
  617. [2014/03/14 14:07:57 | 000,008,284 | ---- | M] () -- C:\Documents and Settings\mmurphy\dds.txt
  618. [2014/03/14 17:24:06 | 000,001,482 | ---- | M] () -- C:\Documents and Settings\mmurphy\Fixlog.txt
  619. [2014/03/14 14:59:48 | 001,145,856 | ---- | M] (Farbar) -- C:\Documents and Settings\mmurphy\FRST.exe
  620. [2014/03/14 15:04:54 | 000,028,688 | ---- | M] () -- C:\Documents and Settings\mmurphy\FRST.txt
  621. [2014/03/17 05:10:31 | 008,388,608 | -H-- | M] () -- C:\Documents and Settings\mmurphy\NTUSER.DAT
  622. [2014/03/17 15:11:10 | 000,001,024 | -H-- | M] () -- C:\Documents and Settings\mmurphy\NTUSER.DAT.LOG
  623. [2014/03/17 05:10:31 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\mmurphy\ntuser.ini
  624.  
  625. [color=#A23BEC]< %USERPROFILE%\*. >[/color]
  626. [2014/03/13 10:48:43 | 000,000,000 | RH-D | M] -- C:\Documents and Settings\mmurphy\Application Data
  627. [2014/03/17 05:10:21 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\mmurphy\Cookies
  628. [2014/03/17 15:06:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Desktop
  629. [2013/01/17 07:59:34 | 000,000,000 | R--D | M] -- C:\Documents and Settings\mmurphy\Favorites
  630. [2013/01/17 07:59:32 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\mmurphy\IETldCache
  631. [2014/03/13 10:28:36 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\mmurphy\Local Settings
  632. [2014/03/14 17:26:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\mbar
  633. [2014/03/14 14:07:18 | 000,000,000 | R--D | M] -- C:\Documents and Settings\mmurphy\My Documents
  634. [2011/04/27 07:39:56 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\mmurphy\NetHood
  635. [2006/01/21 01:46:41 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\mmurphy\PrintHood
  636. [2013/01/18 03:14:19 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\mmurphy\PrivacIE
  637. [2014/03/14 18:23:23 | 000,000,000 | RH-D | M] -- C:\Documents and Settings\mmurphy\Recent
  638. [2006/01/20 18:11:36 | 000,000,000 | RH-D | M] -- C:\Documents and Settings\mmurphy\SendTo
  639. [2011/02/11 07:45:41 | 000,000,000 | R--D | M] -- C:\Documents and Settings\mmurphy\Start Menu
  640. [2006/01/20 17:54:36 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\mmurphy\Templates
  641. [2006/01/20 18:15:28 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\mmurphy\UserData
  642.  
  643. [color=#A23BEC]< %USERPROFILE%\*.exe /s >[/color]
  644. [2014/03/14 14:59:48 | 001,145,856 | ---- | M] (Farbar) -- C:\Documents and Settings\mmurphy\FRST.exe
  645. [2011/03/18 04:47:19 | 002,871,968 | ---- | M] (Adobe Systems, Inc.) -- C:\Documents and Settings\mmurphy\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
  646. [2014/03/13 10:48:43 | 000,157,184 | ---- | M] () -- C:\Documents and Settings\mmurphy\Application Data\Runscanner.net\VirusTotalUpload.exe
  647. [2014/03/17 15:01:34 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\mmurphy\Desktop\OTL.exe
  648. [2014/01/07 20:29:35 | 001,180,472 | ---- | M] (Malwarebytes Corporation) -- C:\Documents and Settings\mmurphy\Desktop\mbar\mbar.exe
  649. [2014/01/07 20:30:17 | 000,821,560 | ---- | M] (Malwarebytes Corporation) -- C:\Documents and Settings\mmurphy\Desktop\mbar\Plugins\fixdamage.exe
  650. [2011/07/12 22:01:04 | 002,374,968 | ---- | M] (iMesh Inc. ) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\iMesh_setup.exe
  651. [2013/04/06 10:00:56 | 012,871,152 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp1.exe
  652. [2013/03/22 00:01:16 | 012,873,968 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp11F.exe
  653. [2013/11/04 23:07:00 | 012,142,192 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp127.exe
  654. [2013/12/20 02:01:20 | 012,159,416 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp161.exe
  655. [2013/09/19 05:01:15 | 012,332,168 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp16B.exe
  656. [2013/06/20 23:01:19 | 012,871,152 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp173.exe
  657. [2013/04/21 10:01:37 | 012,871,152 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp19.exe
  658. [2013/10/20 12:01:13 | 012,142,192 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp1D1.exe
  659. [2012/08/20 22:12:27 | 012,397,960 | ---- | M] (Garmin International) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp2013.exe
  660. [2013/08/05 02:01:14 | 012,330,800 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp268.exe
  661. [2014/02/03 22:33:52 | 012,160,392 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp2B1.exe
  662. [2013/09/04 04:01:15 | 012,332,168 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp2BB.exe
  663. [2013/10/05 11:40:35 | 012,142,192 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp2E6.exe
  664. [2013/07/06 00:01:25 | 012,871,152 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp3.exe
  665. [2013/05/06 20:24:01 | 012,871,152 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp40.exe
  666. [2014/03/05 23:09:42 | 030,543,216 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp4A2.exe
  667. [2013/07/21 01:01:14 | 012,330,072 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp5.exe
  668. [2014/01/19 11:01:18 | 012,160,392 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp53.exe
  669. [2014/01/04 10:03:20 | 012,160,392 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp88.exe
  670. [2013/11/20 00:01:14 | 012,159,080 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp8F.exe
  671. [2013/12/05 01:01:13 | 012,159,080 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp92.exe
  672. [2013/06/05 22:41:57 | 012,871,152 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmp9C.exe
  673. [2013/05/21 21:01:28 | 012,871,152 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmpB0.exe
  674. [2014/02/18 22:45:29 | 029,410,392 | ---- | M] (Garmin Ltd or its subsidiaries) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tmpCD.exe
  675. [308 C:\Documents and Settings\mmurphy\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\mmurphy\Local Settings\Temp\*.tmp -> ]
  676. [2010/05/09 09:06:38 | 002,559,890 | ---- | M] (Adobe Systems, Inc.) -- C:\Documents and Settings\mmurphy\Local Settings\Temp\tour_695490\start_001.exe
  677. [2014/03/14 17:26:30 | 012,589,848 | ---- | M] (Malwarebytes Corp.) -- C:\Documents and Settings\mmurphy\mbar\mbar-1.07.0.1009.exe
  678. [2014/03/13 07:52:12 | 010,285,040 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\mmurphy\My Documents\Downloads\mbam-setup-1.75.0.1300.exe
  679. [2014/03/13 10:48:31 | 002,248,504 | ---- | M] (Runscanner.net) -- C:\Documents and Settings\mmurphy\My Documents\Downloads\runscanner.exe
  680.  
  681. [color=#A23BEC]< %USERPROFILE%\My Documents\*.* >[/color]
  682. [2012/10/02 22:14:46 | 002,565,715 | ---- | M] () -- C:\Documents and Settings\mmurphy\My Documents\2011-08-25_21-51-56_908.JPG
  683. [2013/03/18 07:04:56 | 000,017,408 | ---- | M] () -- C:\Documents and Settings\mmurphy\My Documents\Bl2013 Sunday Golf Group.xls
  684. [2013/01/17 07:59:33 | 000,000,078 | -HS- | M] () -- C:\Documents and Settings\mmurphy\My Documents\desktop.ini
  685.  
  686. [color=#A23BEC]< %USERPROFILE%\My Documents\*. >[/color]
  687. [2014/03/14 17:26:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\My Documents\Downloads
  688. [2010/05/25 22:56:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\My Documents\My eBooks
  689. [2013/01/17 07:59:33 | 000,000,000 | R--D | M] -- C:\Documents and Settings\mmurphy\My Documents\My Music
  690. [2014/03/14 14:07:18 | 000,000,000 | R--D | M] -- C:\Documents and Settings\mmurphy\My Documents\My Videos
  691.  
  692. [color=#A23BEC]< %USERPROFILE%\Application Data\*.* >[/color]
  693. [2013/11/03 10:25:37 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\mmurphy\Application Data\desktop.ini
  694.  
  695. [color=#A23BEC]< %USERPROFILE%\Application Data\*. >[/color]
  696. [2011/03/14 01:19:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\Adobe
  697. [2012/01/04 23:23:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\Garmin
  698. [2006/01/20 18:11:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\Identities
  699. [2007/05/21 06:42:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\Macromedia
  700. [2014/03/13 07:53:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\Malwarebytes
  701. [2010/03/25 01:41:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\McAfee
  702. [2011/03/14 01:19:38 | 000,000,000 | --SD | M] -- C:\Documents and Settings\mmurphy\Application Data\Microsoft
  703. [2006/01/21 22:02:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\Microsoft Web Folders
  704. [2014/03/13 07:50:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\Mozilla
  705. [2014/03/13 10:48:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\Runscanner.net
  706. [2012/02/22 01:18:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\Sun
  707. [2011/04/18 02:16:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Application Data\Winamp
  708.  
  709. [color=#A23BEC]< %USERPROFILE%\Local Settings\*.* >[/color]
  710. [2014/03/17 15:05:37 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\mmurphy\Local Settings\desktop.ini
  711.  
  712. [color=#A23BEC]< %USERPROFILE%\Local Settings\*. >[/color]
  713. [2014/03/13 07:50:15 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\mmurphy\Local Settings\Application Data
  714. [2013/07/08 21:58:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Local Settings\Apps
  715. [2013/01/15 20:24:36 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\mmurphy\Local Settings\History
  716. [2014/03/17 15:11:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Local Settings\Temp
  717. [2013/01/15 20:23:58 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\mmurphy\Local Settings\Temporary Internet Files
  718.  
  719. [color=#A23BEC]< %USERPROFILE%\Local Settings\Application Data\*.* >[/color]
  720. [2013/04/04 05:03:35 | 000,054,608 | ---- | M] () -- C:\Documents and Settings\mmurphy\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
  721. [2012/11/05 04:34:42 | 004,842,274 | -H-- | M] () -- C:\Documents and Settings\mmurphy\Local Settings\Application Data\IconCache.db
  722.  
  723. [color=#A23BEC]< %USERPROFILE%\Local Settings\Application Data\*. >[/color]
  724. [2011/03/14 01:19:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Local Settings\Application Data\Adobe
  725. [2008/06/24 02:24:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Local Settings\Application Data\Identities
  726. [2014/03/13 08:59:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Local Settings\Application Data\Microsoft
  727. [2014/03/13 07:50:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Local Settings\Application Data\Mozilla
  728. [2011/07/12 22:01:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Local Settings\Application Data\PackageAware
  729. [2011/03/14 01:19:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmurphy\Local Settings\Application Data\Temp
  730.  
  731. [color=#A23BEC]< %USERPROFILE%\Local Settings\Temp\*.tlb >[/color]
  732.  
  733. [color=#A23BEC]< %USERPROFILE%\Local Settings\Application Data\Google\Chrome\User Data\Default\*.* >[/color]
  734.  
  735. [color=#A23BEC]< %AllUsersProfile%\*. >[/color]
  736. [2014/03/14 17:36:19 | 000,000,000 | RH-D | M] -- C:\Documents and Settings\All Users\Application Data
  737. [2014/03/13 07:57:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Desktop
  738. [2006/01/21 09:19:53 | 000,000,000 | R--D | M] -- C:\Documents and Settings\All Users\Documents
  739. [2007/05/09 14:53:15 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\All Users\DRM
  740. [2006/01/21 01:46:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Favorites
  741. [2013/01/15 17:33:43 | 000,000,000 | R--D | M] -- C:\Documents and Settings\All Users\Start Menu
  742. [2012/02/20 17:07:45 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Templates
  743.  
  744. [color=#A23BEC]< %AllUsersProfile%\*.exe /s >[/color]
  745. [2012/12/18 16:34:04 | 000,364,816 | ---- | M] (Adobe Systems Incorporated) -- C:\Documents and Settings\All Users\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AB0000000001}\setup.exe
  746. [2012/08/30 07:45:28 | 010,652,120 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
  747.  
  748. [color=#A23BEC]< %AllUsersProfile%\DRM\*.tmp >[/color]
  749.  
  750. [color=#A23BEC]< %AllUsersProfile%\Microsoft\Windows\DRM\*.tmp >[/color]
  751.  
  752. [color=#A23BEC]< %AllUsersProfile%\Application Data\Microsoft\Windows\DRM\*.tmp >[/color]
  753.  
  754. [color=#A23BEC]< %AllUsersProfile%\Application Data\*.* >[/color]
  755. [2012/08/30 07:33:48 | 083,023,306 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\0tbpw.pad
  756. [2006/01/21 01:46:41 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini
  757.  
  758. [color=#A23BEC]< %AllUsersProfile%\Application Data\*. >[/color]
  759. [2013/03/19 15:20:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Adobe
  760. [2010/11/23 17:14:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Attendance Enterprise Backups
  761. [2013/07/08 11:21:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FedEx Customer Tools
  762. [2012/01/04 15:43:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Garmin
  763. [2012/10/11 10:37:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GEOTAB
  764. [2011/12/01 09:43:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
  765. [2014/03/14 18:20:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)
  766. [2010/03/25 01:39:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\McAfee
  767. [2012/11/06 16:11:46 | 000,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Application Data\Microsoft
  768. [2012/05/03 15:16:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Mozilla
  769. [2012/02/20 17:03:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sun
  770. [2013/01/11 09:42:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Symantec
  771. [2006/01/20 18:34:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
  772.  
  773. [color=#A23BEC]< C:\Documents and Settings\Default User\*.exe /s >[/color]
  774. [2011/03/10 11:34:41 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Documents and Settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
  775. [2006/01/20 17:56:28 | 000,000,065 | RH-- | C] () -- C:\WINDOWS\Tasks\desktop.ini
  776. [2006/01/20 18:05:27 | 000,000,006 | -H-- | C] () -- C:\WINDOWS\Tasks\SA.DAT
  777. [2013/03/19 15:19:21 | 000,000,830 | ---- | C] () -- C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
  778.  
  779. [color=#A23BEC]< C:\Documents and Settings\Default User\Application Data\*.* >[/color]
  780. [2006/01/21 01:46:41 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\Default User\Application Data\desktop.ini
  781.  
  782. [color=#A23BEC]< C:\Documents and Settings\Default User\Application Data\*. >[/color]
  783. [2006/01/21 09:20:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\Adobe
  784. [2006/01/20 18:11:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\Identities
  785. [2011/03/10 11:34:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\Macromedia
  786. [2006/05/23 10:26:50 | 000,000,000 | --SD | M] -- C:\Documents and Settings\Default User\Application Data\Microsoft
  787. [2006/01/21 22:02:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\Microsoft Web Folders
  788.  
  789. [color=#A23BEC]< C:\Documents and Settings\Default User\Local Settings\*.* >[/color]
  790.  
  791. [color=#A23BEC]< C:\Documents and Settings\Default User\Local Settings\*. >[/color]
  792. [2012/10/12 03:03:36 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Default User\Local Settings\History
  793. [2012/10/12 03:03:36 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files
  794.  
  795. [color=#A23BEC]< C:\Documents and Settings\Default User\Local Settings\Application Data\*.* >[/color]
  796.  
  797. [color=#A23BEC]< C:\Documents and Settings\Default User\Local Settings\Application Data\*. >[/color]
  798.  
  799. [color=#A23BEC]< C:\Documents and Settings\Default User\Local Settings\Temp\*.tlb >[/color]
  800.  
  801. [color=#A23BEC]< C:\Documents and Settings\LocalService\*.exe /s >[/color]
  802.  
  803. [color=#A23BEC]< C:\Documents and Settings\LocalService\*.* >[/color]
  804. [2014/03/14 17:33:33 | 000,262,144 | -H-- | M] () -- C:\Documents and Settings\LocalService\NTUSER.DAT
  805. [2014/03/14 17:36:12 | 000,001,024 | -H-- | M] () -- C:\Documents and Settings\LocalService\ntuser.dat.LOG
  806. [2006/01/20 18:05:26 | 000,000,020 | -HS- | M] () -- C:\Documents and Settings\LocalService\ntuser.ini
  807.  
  808. [color=#A23BEC]< C:\Documents and Settings\LocalService\Application Data\*.* >[/color]
  809.  
  810. [color=#A23BEC]< C:\Documents and Settings\LocalService\Application Data\*. >[/color]
  811. [2007/05/09 17:53:57 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
  812.  
  813. [color=#A23BEC]< C:\Documents and Settings\LocalService\Local Settings\*.* >[/color]
  814. [2014/03/14 17:34:18 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\LocalService\Local Settings\desktop.ini
  815.  
  816. [color=#A23BEC]< C:\Documents and Settings\LocalService\Local Settings\*. >[/color]
  817. [2012/10/12 03:10:01 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data
  818. [2006/01/21 01:46:41 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\LocalService\Local Settings\History
  819. [2006/01/20 18:05:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Temp
  820. [2006/01/21 01:46:41 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files
  821.  
  822. [color=#A23BEC]< C:\Documents and Settings\LocalService\Local Settings\Application Data\*.* >[/color]
  823. [2014/03/14 17:33:14 | 001,573,344 | ---- | M] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-2000478354-1979792683-725345543-1004-0.dat
  824. [2014/03/14 17:33:14 | 001,082,281 | ---- | M] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-2000478354-1979792683-725345543-1006-0.dat
  825. [2014/03/14 17:33:13 | 000,260,782 | ---- | M] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
  826.  
  827. [color=#A23BEC]< C:\Documents and Settings\LocalService\Local Settings\Application Data\*. >[/color]
  828. [2013/01/15 18:00:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
  829.  
  830. [color=#A23BEC]< C:\Documents and Settings\LocalService\Local Settings\temp\*.tlb >[/color]
  831.  
  832. [color=#A23BEC]< C:\Documents and Settings\NetworkService\*.exe /s >[/color]
  833.  
  834. [color=#A23BEC]< C:\Documents and Settings\NetworkService\*.* >[/color]
  835. [2014/03/14 17:33:33 | 000,262,144 | -H-- | M] () -- C:\Documents and Settings\NetworkService\NTUSER.DAT
  836. [2014/03/14 17:36:13 | 000,001,024 | -H-- | M] () -- C:\Documents and Settings\NetworkService\ntuser.dat.LOG
  837. [2006/01/20 18:03:23 | 000,000,020 | -HS- | M] () -- C:\Documents and Settings\NetworkService\ntuser.ini
  838.  
  839. [color=#A23BEC]< C:\Documents and Settings\NetworkService\Application Data\*.* >[/color]
  840.  
  841. [color=#A23BEC]< C:\Documents and Settings\NetworkService\Application Data\*. >[/color]
  842. [2006/01/20 17:59:03 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
  843.  
  844. [color=#A23BEC]< C:\Documents and Settings\NetworkService\Local Settings\*.* >[/color]
  845. [2014/03/14 17:34:17 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\NetworkService\Local Settings\desktop.ini
  846.  
  847. [color=#A23BEC]< C:\Documents and Settings\NetworkService\Local Settings\*. >[/color]
  848. [2006/01/20 18:03:22 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data
  849. [2006/01/21 01:46:41 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\NetworkService\Local Settings\History
  850. [2006/01/20 18:03:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Temp
  851. [2006/01/21 01:46:41 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files
  852.  
  853. [color=#A23BEC]< C:\Documents and Settings\NetworkService\Local Settings\Application Data\*.* >[/color]
  854.  
  855. [color=#A23BEC]< C:\Documents and Settings\NetworkService\Local Settings\Application Data\*. >[/color]
  856. [2006/01/20 18:03:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
  857.  
  858. [color=#A23BEC]< C:\Documents and Settings\NetworkService\Local Settings\temp\*.tlb >[/color]
  859.  
  860. [color=#A23BEC]< C:\Documents and Settings\Guest Access\*.exe /s >[/color]
  861.  
  862. [color=#A23BEC]< C:\Documents and Settings\Guest Access\*.* >[/color]
  863.  
  864. [color=#A23BEC]< C:\Documents and Settings\Guest Access\Application Data\*.* >[/color]
  865.  
  866. [color=#A23BEC]< C:\Documents and Settings\Guest Access\Application Data\*. >[/color]
  867.  
  868. [color=#A23BEC]< C:\Documents and Settings\Guest Access\Local Settings\*.* >[/color]
  869.  
  870. [color=#A23BEC]< C:\Documents and Settings\Guest Access\Local Settings\*. >[/color]
  871.  
  872. [color=#A23BEC]< C:\Documents and Settings\Guest Access\Local Settings\Application Data\*.* >[/color]
  873.  
  874. [color=#A23BEC]< C:\Documents and Settings\Guest Access\Local Settings\Application Data\*. >[/color]
  875.  
  876. [color=#A23BEC]< C:\Documents and Settings\Guest Access\Local Settings\temp\*.tlb >[/color]
  877.  
  878. [color=#A23BEC]< %CommonProgramFiles%\*.exe >[/color]
  879.  
  880. [color=#A23BEC]< %CommonProgramFiles%\ComObjects\*.* >[/color]
  881.  
  882. [color=#A23BEC]< %PROGRAMFILES%\*.* >[/color]
  883.  
  884. [color=#A23BEC]< %PROGRAMFILES%\*. >[/color]
  885. [2013/01/09 11:17:33 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
  886. [2006/05/25 09:20:25 | 000,000,000 | ---D | M] -- C:\Program Files\APC
  887. [2012/11/06 16:18:48 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
  888. [2006/01/20 17:55:08 | 000,000,000 | ---D | M] -- C:\Program Files\ComPlus Applications
  889. [2013/02/25 16:03:51 | 000,000,000 | ---D | M] -- C:\Program Files\Dropbox
  890. [2011/04/25 14:23:28 | 000,000,000 | ---D | M] -- C:\Program Files\FileZilla FTP Client
  891. [2011/05/19 17:16:12 | 000,000,000 | ---D | M] -- C:\Program Files\Fotosizer
  892. [2012/01/04 15:40:07 | 000,000,000 | ---D | M] -- C:\Program Files\Garmin
  893. [2013/05/13 09:05:39 | 000,000,000 | ---D | M] -- C:\Program Files\GIMP 2
  894. [2007/10/31 09:44:09 | 000,000,000 | ---D | M] -- C:\Program Files\InfoRad Wireless
  895. [2010/11/23 17:17:44 | 000,000,000 | ---D | M] -- C:\Program Files\InfoTronics
  896. [2006/05/25 09:20:19 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
  897. [2014/03/14 03:19:21 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
  898. [2011/04/25 14:16:24 | 000,000,000 | ---D | M] -- C:\Program Files\iq
  899. [2012/02/20 17:00:35 | 000,000,000 | ---D | M] -- C:\Program Files\Java
  900. [2014/03/13 10:18:36 | 000,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
  901. [2012/10/11 06:30:36 | 000,000,000 | ---D | M] -- C:\Program Files\McAfee
  902. [2013/01/15 17:36:58 | 000,000,000 | ---D | M] -- C:\Program Files\Messenger
  903. [2012/11/06 16:19:28 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft ActiveSync
  904. [2006/01/21 22:02:49 | 000,000,000 | ---D | M] -- C:\Program Files\microsoft frontpage
  905. [2012/11/06 16:18:51 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office
  906. [2012/11/06 16:11:46 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft.NET
  907. [2013/05/13 09:01:06 | 000,000,000 | ---D | M] -- C:\Program Files\Mioplanet
  908. [2013/01/16 08:18:12 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
  909. [2014/02/18 11:26:51 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
  910. [2014/02/18 16:50:09 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Maintenance Service
  911. [2012/10/11 09:54:59 | 000,000,000 | ---D | M] -- C:\Program Files\MSBuild
  912. [2011/02/28 12:46:45 | 000,000,000 | ---D | M] -- C:\Program Files\MSECache
  913. [2006/01/20 17:54:02 | 000,000,000 | ---D | M] -- C:\Program Files\MSN
  914. [2006/01/20 17:54:45 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Gaming Zone
  915. [2006/01/20 18:16:14 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 4.0
  916. [2012/10/11 09:49:56 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 6.0
  917. [2013/01/15 17:30:47 | 000,000,000 | ---D | M] -- C:\Program Files\NetMeeting
  918. [2013/01/04 10:32:02 | 000,000,000 | ---D | M] -- C:\Program Files\Notepad++
  919. [2006/01/20 17:57:19 | 000,000,000 | ---D | M] -- C:\Program Files\Online Services
  920. [2012/02/20 17:04:54 | 000,000,000 | ---D | M] -- C:\Program Files\OpenOffice.org 3
  921. [2013/01/16 08:05:14 | 000,000,000 | ---D | M] -- C:\Program Files\Outlook Express
  922. [2006/01/20 18:22:37 | 000,000,000 | ---D | M] -- C:\Program Files\Realtek
  923. [2012/10/11 09:54:45 | 000,000,000 | ---D | M] -- C:\Program Files\Reference Assemblies
  924. [2011/11/08 14:43:22 | 000,000,000 | ---D | M] -- C:\Program Files\RoughDraft
  925. [2013/01/11 09:42:35 | 000,000,000 | ---D | M] -- C:\Program Files\Symantec
  926. [2006/01/20 18:11:39 | 000,000,000 | -H-D | M] -- C:\Program Files\Uninstall Information
  927. [2011/01/12 14:44:43 | 000,000,000 | ---D | M] -- C:\Program Files\Winamp
  928. [2011/01/12 14:43:35 | 000,000,000 | ---D | M] -- C:\Program Files\Winamp Detect
  929. [2007/05/09 14:53:52 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Connect 2
  930. [2013/01/15 17:30:44 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Player
  931. [2013/01/15 17:30:44 | 000,000,000 | ---D | M] -- C:\Program Files\Windows NT
  932. [2006/01/20 17:57:23 | 000,000,000 | -H-D | M] -- C:\Program Files\WindowsUpdate
  933. [2006/01/20 17:59:33 | 000,000,000 | ---D | M] -- C:\Program Files\xerox
  934.  
  935. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\*.* >[/color]
  936. [2006/01/20 18:44:38 | 000,262,144 | ---- | M] () -- C:\WINDOWS\system32\config\systemprofile\ntuser.dat
  937. [2007/04/04 11:37:07 | 000,001,024 | -H-- | M] () -- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
  938.  
  939. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\*. >[/color]
  940. [2006/01/21 01:46:41 | 000,000,000 | RH-D | M] -- C:\WINDOWS\system32\config\systemprofile\Application Data
  941. [2006/01/20 18:05:22 | 000,000,000 | --SD | M] -- C:\WINDOWS\system32\config\systemprofile\Cookies
  942. [2006/01/21 01:46:41 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\config\systemprofile\Desktop
  943. [2006/01/21 01:46:41 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\config\systemprofile\Favorites
  944. [2006/01/21 01:46:41 | 000,000,000 | RH-D | M] -- C:\WINDOWS\system32\config\systemprofile\Local Settings
  945. [2006/01/21 01:46:41 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\config\systemprofile\My Documents
  946. [2006/01/21 01:46:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\system32\config\systemprofile\NetHood
  947. [2006/01/21 01:46:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\system32\config\systemprofile\PrintHood
  948. [2006/01/21 01:46:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\system32\config\systemprofile\Recent
  949. [2006/01/20 17:57:39 | 000,000,000 | RH-D | M] -- C:\WINDOWS\system32\config\systemprofile\SendTo
  950. [2006/01/21 01:46:41 | 000,000,000 | R--D | M] -- C:\WINDOWS\system32\config\systemprofile\Start Menu
  951. [2006/01/20 17:54:36 | 000,000,000 | -H-D | M] -- C:\WINDOWS\system32\config\systemprofile\Templates
  952.  
  953. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\*.exe /s >[/color]
  954.  
  955. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\Application Data\*.* >[/color]
  956. [2006/01/21 01:46:41 | 000,000,062 | -HS- | M] () -- C:\WINDOWS\system32\config\systemprofile\Application Data\desktop.ini
  957.  
  958. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\Application Data\*. >[/color]
  959. [2006/01/21 01:46:20 | 000,000,000 | --SD | M] -- C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft
  960.  
  961. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\Local Settings\*.* >[/color]
  962. [2006/01/21 01:46:41 | 000,000,062 | -HS- | M] () -- C:\WINDOWS\system32\config\systemprofile\Local Settings\desktop.ini
  963.  
  964. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\Local Settings\*. >[/color]
  965. [2006/01/21 01:46:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data
  966. [2006/01/20 18:05:22 | 000,000,000 | --SD | M] -- C:\WINDOWS\system32\config\systemprofile\Local Settings\History
  967. [2014/02/12 04:29:17 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp
  968. [2006/01/20 18:05:22 | 000,000,000 | --SD | M] -- C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files
  969.  
  970. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\Local Settings\Application Data\*.* >[/color]
  971.  
  972. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\Local Settings\Application Data\*. >[/color]
  973. [2013/01/16 04:01:55 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft
  974.  
  975. [color=#A23BEC]< %systemroot%\system32\config\systemprofile\Local Settings\Temp\*.tlb >[/color]
  976.  
  977. [color=#A23BEC]< %windir%\temp\*.exe /s >[/color]
  978.  
  979. [color=#A23BEC]< %windir%\temp\*.* >[/color]
  980. [2012/10/12 03:03:39 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00000.log
  981. [2012/10/12 03:08:46 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00001.log
  982. [2012/10/12 03:17:51 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00002.log
  983. [2012/10/13 03:05:34 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00003.log
  984. [2013/01/16 08:09:03 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00004.log
  985. [2013/01/16 08:17:01 | 000,005,930 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00005.log
  986. [2013/01/16 08:34:07 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00006.log
  987. [2013/01/16 08:39:08 | 000,005,930 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00007.log
  988. [2013/01/17 04:03:35 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00008.log
  989. [2013/01/17 04:17:38 | 000,005,930 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00009.log
  990. [2013/01/17 04:36:09 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00010.log
  991. [2013/01/17 04:40:08 | 000,005,930 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00011.log
  992. [2013/01/17 05:03:22 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00012.log
  993. [2013/02/13 04:03:23 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00013.log
  994. [2013/05/15 03:12:11 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00014.log
  995. [2013/07/11 03:04:38 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00015.log
  996. [2013/07/11 03:25:17 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00016.log
  997. [2013/08/16 03:03:49 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00017.log
  998. [2013/10/10 03:08:02 | 000,005,930 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00018.log
  999. [2013/10/10 03:20:54 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00019.log
  1000. [2014/02/12 04:03:57 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00020.log
  1001. [2014/02/12 04:14:39 | 000,005,930 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00021.log
  1002. [2014/02/12 04:20:00 | 000,003,310 | ---- | M] () -- C:\WINDOWS\temp\ASPNETSetup_00022.log
  1003. [2014/02/12 04:29:14 | 000,211,321 | ---- | M] () -- C:\WINDOWS\temp\dd_clwireg.txt
  1004. [2013/01/17 04:18:24 | 000,547,348 | ---- | M] () -- C:\WINDOWS\temp\dd_vcredistMSI7455.txt
  1005. [2013/01/17 04:18:24 | 000,013,598 | ---- | M] () -- C:\WINDOWS\temp\dd_vcredistUI7455.txt
  1006. [2013/01/16 08:16:34 | 000,004,500 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_CA_smci_20130116_121633_500.txt
  1007. [2013/01/16 08:38:41 | 000,004,500 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_CA_smci_20130116_123840_734.txt
  1008. [2013/01/17 04:17:02 | 000,003,448 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_CA_smci_20130117_081702_078.txt
  1009. [2013/01/17 04:39:26 | 000,004,500 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_CA_smci_20130117_083926_187.txt
  1010. [2013/10/10 03:07:29 | 000,004,500 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_CA_smci_20131010_070728_937.txt
  1011. [2014/02/12 04:14:11 | 000,003,448 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_CA_smci_20140212_081411_929.txt
  1012. [2012/10/12 03:09:57 | 000,004,198 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_retCA2663.txt
  1013. [2012/10/12 03:11:57 | 000,004,198 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_retCA3D13.txt
  1014. [2013/07/11 03:01:03 | 000,004,196 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_retCA596F.txt
  1015. [2013/01/17 04:26:20 | 000,004,196 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_retCA5C9A.txt
  1016. [2012/10/13 03:06:54 | 000,004,198 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_retCA6019.txt
  1017. [2013/01/17 04:32:50 | 000,004,196 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_retCA61C9.txt
  1018. [2013/01/16 08:29:09 | 000,004,196 | ---- | M] () -- C:\WINDOWS\temp\dd_wcf_retCA7322.txt
  1019. [2009/09/11 18:21:23 | 000,000,966 | ---- | M] () -- C:\WINDOWS\temp\myAgent.log
  1020. [2013/06/13 03:19:57 | 000,016,384 | ---- | M] () -- C:\WINDOWS\temp\Perflib_Perfdata_10c.dat
  1021. [2012/08/30 07:08:54 | 000,016,384 | ---- | M] () -- C:\WINDOWS\temp\Perflib_Perfdata_14c.dat
  1022. [2013/01/15 18:00:07 | 000,016,384 | ---- | M] () -- C:\WINDOWS\temp\Perflib_Perfdata_664.dat
  1023. [2013/12/12 04:21:24 | 000,016,384 | ---- | M] () -- C:\WINDOWS\temp\Perflib_Perfdata_6b4.dat
  1024. [2012/10/15 02:52:58 | 000,016,384 | ---- | M] () -- C:\WINDOWS\temp\Perflib_Perfdata_6f8.dat
  1025. [2013/01/10 11:33:22 | 000,016,384 | ---- | M] () -- C:\WINDOWS\temp\Perflib_Perfdata_6fc.dat
  1026. [2013/01/17 07:31:57 | 000,016,384 | ---- | M] () -- C:\WINDOWS\temp\Perflib_Perfdata_770.dat
  1027. [2014/03/14 17:34:34 | 000,016,384 | ---- | M] () -- C:\WINDOWS\temp\Perflib_Perfdata_788.dat
  1028. [2013/11/14 10:56:28 | 000,016,384 | ---- | M] () -- C:\WINDOWS\temp\Perflib_Perfdata_b4.dat
  1029. [2013/01/16 08:23:28 | 000,016,384 | ---- | M] () -- C:\WINDOWS\temp\Perflib_Perfdata_ea8.dat
  1030. [2014/03/17 15:05:37 | 000,000,511 | ---- | M] () -- C:\WINDOWS\temp\WGAErrLog.txt
  1031. [2013/01/15 16:25:42 | 000,000,409 | ---- | M] () -- C:\WINDOWS\temp\WGANotify.settings
  1032. [1 C:\WINDOWS\temp\*.tmp files -> C:\WINDOWS\temp\*.tmp -> ]
  1033.  
  1034. [color=#A23BEC]< %windir%\temp\*. >[/color]
  1035. [2007/07/17 22:28:12 | 000,000,000 | --SD | M] -- C:\WINDOWS\temp\Cookies
  1036. [2007/07/17 22:28:12 | 000,000,000 | --SD | M] -- C:\WINDOWS\temp\History
  1037. [2013/01/16 08:37:59 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2487367_10.0.30319
  1038. [2013/01/16 08:22:37 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2604121_10.0.30319
  1039. [2013/01/16 08:10:29 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2656351_10.0.30319
  1040. [2013/01/17 04:18:36 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2729449_10.0.30319
  1041. [2013/01/17 04:36:44 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2736428_10.0.30319
  1042. [2013/01/17 04:28:29 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2737019_10.0.30319
  1043. [2013/01/17 04:05:53 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2742595_10.0.30319
  1044. [2013/02/13 04:03:43 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2789642_10.0.30319
  1045. [2013/05/15 03:02:31 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2804576_10.0.30319
  1046. [2013/07/11 03:15:57 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2832407_10.0.30319
  1047. [2013/07/11 03:27:26 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2835393_10.0.30319
  1048. [2013/08/16 03:06:50 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2840628v2_10.0.30319
  1049. [2013/07/11 03:05:16 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2840628_10.0.30319
  1050. [2013/10/10 03:00:35 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2858302v2_10.0.30319
  1051. [2013/10/10 03:12:48 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2861188_10.0.30319
  1052. [2014/02/12 04:20:18 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2898855v2_10.0.30319
  1053. [2014/02/12 04:07:31 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\KB2901110v2_10.0.30319
  1054. [2007/07/17 22:28:12 | 000,000,000 | --SD | M] -- C:\WINDOWS\temp\Temporary Internet Files
  1055. [2011/11/12 16:29:24 | 000,000,000 | ---D | M] -- C:\WINDOWS\temp\UPD32.tmp
  1056.  
  1057. [color=#A23BEC]< %windir%\*. >[/color]
  1058. [2013/05/15 03:01:28 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$hf_mig$
  1059. [2013/01/15 17:26:59 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtServicePackUninstall$
  1060. [2013/01/17 04:24:26 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2115168$
  1061. [2013/01/15 17:36:35 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2229593$
  1062. [2011/12/02 04:15:06 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2229593_0$
  1063. [2013/01/17 04:24:47 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2296011$
  1064. [2013/01/17 04:27:58 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2345886$
  1065. [2013/01/16 08:36:32 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2347290$
  1066. [2013/01/16 08:05:04 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2360937$
  1067. [2013/01/17 04:05:36 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2378111_WM9$
  1068. [2013/01/17 04:36:33 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2387149$
  1069. [2013/01/16 08:05:47 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2393802$
  1070. [2013/01/16 08:21:07 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2419632$
  1071. [2013/01/16 08:05:13 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2423089$
  1072. [2013/01/16 08:41:16 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2440591$
  1073. [2013/01/17 04:05:19 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2443105$
  1074. [2013/01/17 04:55:43 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2467659$
  1075. [2013/01/16 08:36:53 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2476490$
  1076. [2013/01/16 08:05:58 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2478960$
  1077. [2013/01/17 04:31:48 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2478971$
  1078. [2013/01/17 04:32:17 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2479943$
  1079. [2013/01/16 08:41:44 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2481109$
  1080. [2013/01/16 08:36:21 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2483185$
  1081. [2013/01/16 08:41:35 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2485663$
  1082. [2013/01/16 08:19:54 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2506212$
  1083. [2013/01/16 08:37:24 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2507938$
  1084. [2013/01/16 08:20:57 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2508429$
  1085. [2013/01/16 08:10:19 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2509553$
  1086. [2013/01/16 08:37:13 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2510581$
  1087. [2013/01/16 08:30:10 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2535512$
  1088. [2013/01/17 04:25:52 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2536276-v2$
  1089. [2013/01/16 08:06:05 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2544521$
  1090. [2013/01/17 04:28:07 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2544893-v2$
  1091. [2013/01/17 04:31:58 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2564958$
  1092. [2013/01/16 08:05:33 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2566454$
  1093. [2013/01/16 08:29:22 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2570947$
  1094. [2014/03/13 15:30:12 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2584146$
  1095. [2013/01/17 04:25:21 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2585542$
  1096. [2013/01/16 08:31:02 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2592799$
  1097. [2013/01/16 08:41:24 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2598479$
  1098. [2013/01/16 08:21:45 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2603381$
  1099. [2013/01/16 08:17:57 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2618451$
  1100. [2013/01/16 08:19:09 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2619339$
  1101. [2013/01/16 08:05:39 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2620712$
  1102. [2013/01/16 08:35:52 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2624667$
  1103. [2013/01/17 04:24:56 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2631813$
  1104. [2013/01/17 04:25:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2646524$
  1105. [2013/01/16 08:20:49 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2653956$
  1106. [2013/01/17 04:05:04 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2655992$
  1107. [2013/01/17 04:32:05 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2659262$
  1108. [2013/01/16 08:17:50 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2661254-v2$
  1109. [2013/01/16 08:05:26 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2661637$
  1110. [2013/01/16 08:10:07 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2676562$
  1111. [2013/01/16 08:40:45 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2686509$
  1112. [2013/01/17 04:24:36 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2691442$
  1113. [2013/01/16 08:19:29 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2698365$
  1114. [2013/01/16 08:18:59 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2705219-v2$
  1115. [2013/01/17 04:36:24 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2712808$
  1116. [2013/01/16 08:31:12 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2719985$
  1117. [2013/01/16 08:18:04 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2723135-v2$
  1118. [2013/01/16 08:43:39 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2724197$
  1119. [2013/01/16 08:18:38 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2727528$
  1120. [2013/01/16 08:41:08 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2736233$
  1121. [2013/01/16 08:20:42 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2749655$
  1122. [2013/01/16 08:30:51 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2753842-v2$
  1123. [2013/01/16 08:21:18 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2757638$
  1124. [2013/01/17 04:28:18 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2758857$
  1125. [2013/01/16 08:30:30 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2761465$
  1126. [2013/01/16 08:30:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2770660$
  1127. [2013/02/13 04:12:29 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2778344$
  1128. [2013/01/17 04:25:31 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2779030$
  1129. [2013/01/17 04:18:08 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2779562$
  1130. [2013/02/13 04:10:38 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2780091$
  1131. [2013/01/16 08:40:57 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2799329$
  1132. [2013/02/13 04:11:15 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2799494$
  1133. [2013/02/13 04:10:55 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2802968$
  1134. [2013/03/22 03:01:34 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2807986$
  1135. [2013/04/10 03:02:29 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2808735$
  1136. [2013/04/10 03:01:19 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2813170$
  1137. [2013/04/10 03:01:32 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2813345$
  1138. [2013/05/15 03:01:30 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2820197$
  1139. [2013/04/10 03:02:21 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2820917$
  1140. [2013/05/15 03:01:20 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2829361$
  1141. [2013/07/11 03:26:59 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2834886$
  1142. [2013/08/29 03:00:23 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$
  1143. [2013/07/11 03:27:09 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2834904_WM11$
  1144. [2013/06/13 03:02:35 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2839229$
  1145. [2013/07/11 03:25:44 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2845187$
  1146. [2013/10/10 03:16:50 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2847311$
  1147. [2013/08/16 03:05:26 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2849470$
  1148. [2013/07/11 03:26:10 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2850851$
  1149. [2013/08/16 03:06:32 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2850869$
  1150. [2013/08/16 03:06:22 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2859537$
  1151. [2013/11/14 04:03:49 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2862152$
  1152. [2013/10/10 03:10:09 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2862330$
  1153. [2013/10/10 03:16:31 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2862335$
  1154. [2013/08/16 03:06:13 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2863058$
  1155. [2013/09/11 03:04:20 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2864063$
  1156. [2013/10/10 03:12:26 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2868038$
  1157. [2013/11/14 04:05:02 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2868626$
  1158. [2013/09/11 03:04:29 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2876217$
  1159. [2013/09/11 03:04:38 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2876315$
  1160. [2013/11/14 04:02:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2876331$
  1161. [2013/10/10 03:10:18 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2883150$
  1162. [2013/12/12 04:02:25 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2892075$
  1163. [2013/12/12 04:02:43 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2893294$
  1164. [2013/12/12 04:02:35 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2893984$
  1165. [2013/12/12 04:03:02 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2898715$
  1166. [2013/11/14 04:04:49 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2900986$
  1167. [2013/12/12 04:02:52 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2904266$
  1168. [2014/01/16 04:02:20 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2914368$
  1169. [2014/02/12 04:30:30 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2916036$
  1170. [2014/03/14 03:02:26 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2929961$
  1171. [2014/03/14 03:02:06 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB2930275$
  1172. [2007/11/15 11:29:36 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB921503$
  1173. [2013/01/15 17:36:44 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB923561$
  1174. [2011/12/02 04:01:55 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB923561_0$
  1175. [2012/10/12 03:11:11 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB925720$
  1176. [2007/11/15 11:30:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB933360$
  1177. [2007/11/15 11:31:20 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB933729$
  1178. [2007/11/15 11:31:12 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB936021$
  1179. [2007/11/15 11:30:08 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB936782_WMP11$
  1180. [2007/11/15 11:30:32 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB938127$
  1181. [2007/11/15 11:29:23 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB938828$
  1182. [2007/11/15 11:29:44 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB938829$
  1183. [2007/11/15 11:31:43 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB939653$
  1184. [2007/11/15 11:31:00 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB939683$
  1185. [2007/11/15 11:31:29 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB941202$
  1186. [2011/12/02 04:10:09 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB941569$
  1187. [2007/11/15 11:32:00 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB943460$
  1188. [2011/12/02 04:02:09 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB944338-v2$
  1189. [2013/01/15 17:36:56 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB946648$
  1190. [2011/12/02 04:18:54 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB946648_0$
  1191. [2013/01/15 17:37:15 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB950762$
  1192. [2011/12/02 04:09:02 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB950762_0$
  1193. [2013/01/15 17:37:23 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB950974$
  1194. [2011/12/02 04:14:54 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB950974_0$
  1195. [2013/01/15 17:37:30 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB951376-v2$
  1196. [2011/12/02 04:19:27 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB951376-v2_0$
  1197. [2013/01/15 17:37:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB951748$
  1198. [2011/12/02 04:07:02 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB951748_0$
  1199. [2013/01/17 04:05:28 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB951978$
  1200. [2013/01/15 17:37:50 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB952004$
  1201. [2011/12/02 04:11:01 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB952004_0$
  1202. [2011/12/02 04:11:56 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB952069_WM9$
  1203. [2013/01/15 17:37:59 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB952287$
  1204. [2011/12/02 04:08:18 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB952287_0$
  1205. [2013/01/15 17:38:08 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB952954$
  1206. [2011/12/02 04:19:17 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB952954_0$
  1207. [2011/12/02 04:02:17 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB954154_WM11$
  1208. [2011/12/02 04:17:17 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB954155_WM9$
  1209. [2013/01/15 17:38:16 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB955069$
  1210. [2011/12/02 04:03:45 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB955069_0$
  1211. [2013/01/15 17:38:35 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB955759$
  1212. [2011/12/02 04:16:18 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB955759_0$
  1213. [2013/01/15 17:38:44 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB956572$
  1214. [2011/12/02 04:12:52 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB956572_0$
  1215. [2013/01/16 08:37:03 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB956744$
  1216. [2013/01/15 17:38:59 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB956802$
  1217. [2011/12/02 04:03:35 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB956802_0$
  1218. [2013/01/15 17:39:09 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB956803$
  1219. [2011/12/02 04:18:38 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB956803_0$
  1220. [2013/01/15 17:39:17 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB956844$
  1221. [2011/12/02 04:12:30 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB956844_0$
  1222. [2011/12/02 04:05:31 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB958470$
  1223. [2013/01/15 17:39:25 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB958644$
  1224. [2011/12/02 04:03:57 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB958644_0$
  1225. [2011/12/02 04:17:25 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB958869$
  1226. [2013/01/15 17:39:34 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB959426$
  1227. [2011/12/02 04:19:05 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB959426_0$
  1228. [2013/01/15 17:39:48 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB960225$
  1229. [2011/12/02 04:13:56 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB960225_0$
  1230. [2013/01/15 17:39:57 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB960803$
  1231. [2011/12/02 04:05:17 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB960803_0$
  1232. [2013/01/15 17:40:08 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB960859$
  1233. [2011/12/02 04:18:27 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB960859_0$
  1234. [2013/01/15 17:40:19 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB961118$
  1235. [2012/10/12 03:12:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB961118_0$
  1236. [2013/01/15 17:40:46 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB961501$
  1237. [2011/12/02 04:12:19 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB961501_0$
  1238. [2013/01/15 17:40:56 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB967715$
  1239. [2011/12/02 04:07:50 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB967715_0$
  1240. [2013/01/15 17:41:07 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB968389$
  1241. [2011/12/02 04:01:22 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB968389_0$
  1242. [2013/01/15 17:41:17 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB969059$
  1243. [2011/12/02 04:15:17 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB969059_0$
  1244. [2013/01/15 17:41:26 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB970238$
  1245. [2011/12/02 04:06:25 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB970238_0$
  1246. [2013/01/15 17:41:34 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB970430$
  1247. [2011/12/02 20:16:52 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB970430_0$
  1248. [2013/01/16 08:20:08 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB971029$
  1249. [2011/12/02 04:04:13 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB971032$
  1250. [2013/01/15 17:41:43 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB971468$
  1251. [2011/12/02 04:18:10 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB971468_0$
  1252. [2013/01/15 17:41:52 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB971657$
  1253. [2011/12/02 04:14:22 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB971657_0$
  1254. [2013/01/15 17:42:03 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB971737$
  1255. [2011/12/02 20:16:31 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB971737_0$
  1256. [2011/12/02 04:06:50 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB971961$
  1257. [2013/01/15 17:42:17 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB972270$
  1258. [2011/12/02 04:13:46 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB972270_0$
  1259. [2013/01/15 17:42:30 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB973507$
  1260. [2011/12/02 04:10:21 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB973507_0$
  1261. [2011/12/02 04:11:15 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB973540_WM9L$
  1262. [2013/01/15 17:42:43 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB973687$
  1263. [2011/12/02 04:09:13 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB973687_0$
  1264. [2013/01/15 17:38:25 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB973687_1$
  1265. [2013/01/15 17:42:54 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB973815$
  1266. [2011/12/02 04:05:06 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB973815_0$
  1267. [2013/01/15 17:43:08 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB973869$
  1268. [2011/12/02 04:11:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB973869_0$
  1269. [2011/12/02 04:08:06 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB973904$
  1270. [2013/01/15 17:43:23 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB974112$
  1271. [2011/12/02 04:13:35 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB974112_0$
  1272. [2013/01/15 17:43:36 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB974318$
  1273. [2011/12/02 04:15:29 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB974318_0$
  1274. [2013/01/15 17:43:49 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB974392$
  1275. [2011/12/02 04:07:37 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB974392_0$
  1276. [2013/01/15 17:44:02 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB974571$
  1277. [2011/12/02 04:10:48 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB974571_0$
  1278. [2013/01/15 17:44:13 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975025$
  1279. [2011/12/02 04:11:30 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975025_0$
  1280. [2013/01/15 17:44:25 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975467$
  1281. [2011/12/02 04:01:44 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975467_0$
  1282. [2013/01/17 04:18:27 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975558_WM8$
  1283. [2013/01/15 17:44:35 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975560$
  1284. [2011/12/02 04:10:36 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975560_0$
  1285. [2013/01/15 17:44:44 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975561$
  1286. [2011/12/02 04:12:07 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975561_0$
  1287. [2013/01/15 17:44:52 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975562$
  1288. [2011/12/02 04:04:54 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975562_0$
  1289. [2013/01/15 17:45:00 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975713$
  1290. [2011/12/02 04:14:32 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB975713_0$
  1291. [2011/12/02 04:09:24 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB977816$
  1292. [2013/01/15 17:45:11 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB977914$
  1293. [2011/12/02 04:07:25 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB977914_0$
  1294. [2013/01/15 17:45:20 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB978037$
  1295. [2011/12/02 04:14:44 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB978037_0$
  1296. [2013/01/15 17:45:28 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB978338$
  1297. [2011/12/02 04:14:07 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB978338_0$
  1298. [2013/01/15 17:45:36 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB978542$
  1299. [2011/12/02 04:06:37 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB978542_0$
  1300. [2013/01/15 17:45:45 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB978601$
  1301. [2011/12/02 04:08:44 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB978601_0$
  1302. [2011/12/02 04:06:06 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB978695_WM9$
  1303. [2013/01/15 17:45:53 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB978706$
  1304. [2011/12/02 04:05:46 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB978706_0$
  1305. [2013/01/15 17:46:02 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB979309$
  1306. [2011/12/02 04:06:15 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB979309_0$
  1307. [2013/01/15 17:46:10 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB979482$
  1308. [2011/12/02 04:05:58 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB979482_0$
  1309. [2013/01/15 17:46:17 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB979559$
  1310. [2011/12/02 04:08:29 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB979559_0$
  1311. [2013/01/15 17:46:26 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB979683$
  1312. [2011/12/02 04:17:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB979683_0$
  1313. [2013/01/16 08:34:22 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB979687$
  1314. [2011/12/02 04:17:10 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB980195$
  1315. [2013/01/15 17:46:39 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB980218$
  1316. [2011/12/02 04:19:38 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB980218_0$
  1317. [2013/01/15 17:46:46 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB980232$
  1318. [2011/12/02 04:16:41 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB980232_0$
  1319. [2013/01/16 08:22:20 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB981322$
  1320. [2012/08/30 08:51:08 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB981350$
  1321. [2011/12/02 04:08:51 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB981793$
  1322. [2013/01/16 08:18:11 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB981997$
  1323. [2013/01/16 08:40:37 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB982132$
  1324. [2013/01/15 17:46:56 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB982381$
  1325. [2011/12/02 04:03:01 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB982381_0$
  1326. [2013/01/16 08:09:56 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallKB982665$
  1327. [2012/01/04 15:18:35 | 000,000,000 | -H-D | M] -- C:\WINDOWS\$NtUninstallWIC$
  1328. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\addins
  1329. [2013/01/15 17:58:42 | 000,000,000 | ---D | M] -- C:\WINDOWS\AppPatch
  1330. [2014/02/12 04:54:19 | 000,000,000 | R-SD | M] -- C:\WINDOWS\assembly
  1331. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\Config
  1332. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\Connection Wizard
  1333. [2006/01/20 18:17:58 | 000,000,000 | -HSD | M] -- C:\WINDOWS\CSC
  1334. [2006/01/20 17:54:41 | 000,000,000 | ---D | M] -- C:\WINDOWS\Cursors
  1335. [2011/12/01 13:30:27 | 000,000,000 | ---D | M] -- C:\WINDOWS\Debug
  1336. [2013/01/15 15:53:26 | 000,000,000 | --SD | M] -- C:\WINDOWS\Downloaded Program Files
  1337. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\Driver Cache
  1338. [2013/01/15 17:24:19 | 000,000,000 | ---D | M] -- C:\WINDOWS\ehome
  1339. [2013/01/16 04:02:34 | 000,000,000 | R-SD | M] -- C:\WINDOWS\Fonts
  1340. [2013/01/17 05:20:12 | 000,000,000 | ---D | M] -- C:\WINDOWS\Help
  1341. [2013/01/17 04:54:12 | 000,000,000 | -H-D | M] -- C:\WINDOWS\ie8
  1342. [2013/01/17 04:55:17 | 000,000,000 | ---D | M] -- C:\WINDOWS\ie8updates
  1343. [2013/01/15 17:33:01 | 000,000,000 | ---D | M] -- C:\WINDOWS\ime
  1344. [2014/03/17 15:05:26 | 000,000,000 | -H-D | M] -- C:\WINDOWS\inf
  1345. [2014/02/12 04:30:08 | 000,000,000 | -HSD | M] -- C:\WINDOWS\Installer
  1346. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\java
  1347. [2013/01/15 17:32:50 | 000,000,000 | ---D | M] -- C:\WINDOWS\l2schemas
  1348. [2011/01/12 14:43:54 | 000,000,000 | ---D | M] -- C:\WINDOWS\Logs
  1349. [2013/01/17 04:54:22 | 000,000,000 | ---D | M] -- C:\WINDOWS\Media
  1350. [2014/02/12 04:54:19 | 000,000,000 | ---D | M] -- C:\WINDOWS\Microsoft.NET
  1351. [2013/01/15 17:30:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\msagent
  1352. [2006/01/21 22:02:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\msapps
  1353. [2013/01/15 17:30:50 | 000,000,000 | ---D | M] -- C:\WINDOWS\mui
  1354. [2013/01/15 17:33:01 | 000,000,000 | ---D | M] -- C:\WINDOWS\network diagnostic
  1355. [2006/01/20 17:57:36 | 000,000,000 | R--D | M] -- C:\WINDOWS\Offline Web Pages
  1356. [2006/01/20 18:26:53 | 000,000,000 | ---D | M] -- C:\WINDOWS\OPTIONS
  1357. [2009/04/27 01:31:24 | 000,000,000 | ---D | M] -- C:\WINDOWS\pchealth
  1358. [2013/01/15 17:32:50 | 000,000,000 | ---D | M] -- C:\WINDOWS\PeerNet
  1359. [2014/03/17 08:15:17 | 000,000,000 | -H-D | M] -- C:\WINDOWS\PIF
  1360. [2014/03/17 15:07:00 | 000,000,000 | ---D | M] -- C:\WINDOWS\Prefetch
  1361. [2012/08/30 08:51:08 | 000,000,000 | ---D | M] -- C:\WINDOWS\Provisioning
  1362. [2008/12/22 17:35:37 | 000,000,000 | ---D | M] -- C:\WINDOWS\pss
  1363. [2006/01/20 17:58:47 | 000,000,000 | ---D | M] -- C:\WINDOWS\Registration
  1364. [2006/01/20 17:59:32 | 000,000,000 | ---D | M] -- C:\WINDOWS\repair
  1365. [2013/05/13 08:53:55 | 000,000,000 | ---D | M] -- C:\WINDOWS\Resources
  1366. [2013/01/15 17:58:03 | 000,000,000 | ---D | M] -- C:\WINDOWS\security
  1367. [2013/01/15 17:30:58 | 000,000,000 | ---D | M] -- C:\WINDOWS\ServicePackFiles
  1368. [2012/11/06 16:19:36 | 000,000,000 | ---D | M] -- C:\WINDOWS\SHELLNEW
  1369. [2013/01/15 15:52:44 | 000,000,000 | ---D | M] -- C:\WINDOWS\SoftwareDistribution
  1370. [2013/01/15 17:30:48 | 000,000,000 | ---D | M] -- C:\WINDOWS\srchasst
  1371. [2012/04/25 07:35:27 | 000,000,000 | ---D | M] -- C:\WINDOWS\Sun
  1372. [2013/01/15 17:30:19 | 000,000,000 | ---D | M] -- C:\WINDOWS\system
  1373. [2014/03/16 13:43:36 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32
  1374. [2014/03/14 17:23:58 | 000,000,000 | --SD | M] -- C:\WINDOWS\Tasks
  1375. [2014/03/14 17:34:34 | 000,000,000 | ---D | M] -- C:\WINDOWS\Temp
  1376. [2014/03/13 10:18:12 | 000,000,000 | ---D | M] -- C:\WINDOWS\twain_32
  1377. [2013/01/17 04:54:32 | 000,000,000 | ---D | M] -- C:\WINDOWS\WBEM
  1378. [2006/01/20 17:57:39 | 000,000,000 | R--D | M] -- C:\WINDOWS\Web
  1379. [2014/02/12 04:22:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\WinSxS
  1380.  
  1381. [color=#A23BEC]< %windir%\AppPatch\*.exe >[/color]
  1382.  
  1383. [color=#A23BEC]< %windir%\ShellNew\*.exe >[/color]
  1384.  
  1385. [color=#A23BEC]< %windir%\installer\*. >[/color]
  1386. [2011/03/10 11:41:20 | 000,000,000 | -HSD | M] -- C:\WINDOWS\installer\$PatchCache$
  1387. [2013/01/15 17:32:50 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\tsclientmsitrans
  1388. [2012/01/04 15:40:20 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{028BB5A9-6385-4CF6-A6FF-D512D5015DBA}
  1389. [2006/01/20 18:11:48 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}
  1390. [2006/11/27 12:36:17 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
  1391. [2012/02/20 17:08:00 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{3E171899-0175-47CC-84C4-562ACDD4C021}
  1392. [2012/10/12 03:13:29 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{56EA8BC0-3751-4B93-BC9D-6651CC36E5AA}
  1393. [2006/01/20 18:16:15 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{716E0306-8318-4364-8B8F-0CC4E9376BAC}
  1394. [2011/12/02 04:02:36 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
  1395. [2014/01/16 04:03:41 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{90110409-6000-11D3-8CFE-0150048383C9}
  1396. [2014/01/16 04:03:52 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{90120000-0020-0409-0000-0000000FF1CE}
  1397. [2013/09/14 03:00:26 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{95120000-0038-0409-0000-0000000FF1CE}
  1398. [2011/03/22 16:36:37 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{AC76BA86-1033-0000-7760-000000000001}
  1399. [2013/01/09 11:18:29 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{AC76BA86-7AD7-1033-7B44-AB0000000001}
  1400. [2007/11/15 11:30:25 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{C04E32E0-0416-434D-AFB9-6969D703A9EF}
  1401. [2010/11/23 17:16:25 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{CD392969-DEFB-4AB2-BA5D-2DAF65DCD432}
  1402. [2011/12/02 04:02:29 | 000,000,000 | ---D | M] -- C:\WINDOWS\installer\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
  1403.  
  1404. [color=#A23BEC]< %windir%\system32\*. >[/color]
  1405. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\1025
  1406. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\1028
  1407. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\1031
  1408. [2006/01/21 01:40:28 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\1033
  1409. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\1037
  1410. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\1041
  1411. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\1042
  1412. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\1054
  1413. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\2052
  1414. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\3076
  1415. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\3com_dmi
  1416. [2011/03/16 16:41:58 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\appmgmt
  1417. [2013/01/15 17:32:50 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\bits
  1418. [2013/01/15 17:46:59 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\CatRoot
  1419. [2014/03/17 08:15:19 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\CatRoot2
  1420. [2013/01/15 17:30:46 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\Com
  1421. [2013/01/17 04:54:38 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\config
  1422. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\dhcp
  1423. [2011/01/12 14:44:21 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\DirectX
  1424. [2014/03/14 03:03:19 | 000,000,000 | RHSD | M] -- C:\WINDOWS\system32\dllcache
  1425. [2014/03/14 17:27:09 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\drivers
  1426. [2013/01/15 17:32:50 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\en
  1427. [2013/01/17 04:54:32 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\en-US
  1428. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\export
  1429. [2006/01/20 17:58:34 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\ias
  1430. [2006/01/21 01:41:03 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\icsxml
  1431. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\IME
  1432. [2013/01/15 17:33:01 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\inetsrv
  1433. [2014/03/17 15:05:47 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\Lang
  1434. [2007/05/09 14:52:13 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\LogFiles
  1435. [2006/01/20 17:56:22 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\Macromed
  1436. [2006/05/22 10:42:18 | 000,000,000 | --SD | M] -- C:\WINDOWS\system32\Microsoft
  1437. [2006/01/20 17:55:00 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\MsDtc
  1438. [2012/01/04 15:27:16 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\mui
  1439. [2013/01/15 17:30:50 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\npp
  1440. [2013/01/15 17:30:21 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\oobe
  1441. [2006/01/20 18:32:29 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\PreInstall
  1442. [2006/01/21 01:41:08 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\ras
  1443. [2010/06/22 02:25:15 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\ReinstallBackups
  1444. [2013/01/15 17:30:50 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\Restore
  1445. [2006/01/20 18:24:12 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\RTCOM
  1446. [2013/01/15 17:32:50 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\scripting
  1447. [2013/01/15 17:58:42 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\Setup
  1448. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\ShellExt
  1449. [2006/01/20 18:30:48 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\SoftwareDistribution
  1450. [2012/10/11 09:54:14 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\spool
  1451. [2013/01/15 17:32:51 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\usmt
  1452. [2013/09/11 08:47:37 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\wbem
  1453. [2006/01/21 01:38:49 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\wins
  1454. [2006/01/20 17:59:33 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\xircom
  1455. [2013/07/11 03:00:52 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\XPSViewer
  1456.  
  1457. [color=#A23BEC]< %Temp%\smtmp\1\*.* >[/color]
  1458.  
  1459. [color=#A23BEC]< %Temp%\smtmp\2\*.* >[/color]
  1460.  
  1461. [color=#A23BEC]< %Temp%\smtmp\3\*.* >[/color]
  1462.  
  1463. [color=#A23BEC]< %Temp%\smtmp\4\*.* >[/color]
  1464.  
  1465. [color=#A23BEC]< %systemroot%\system32\*.dll /lockedfiles >[/color]
  1466. [1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
  1467.  
  1468. [color=#A23BEC]< %systemroot%\Tasks\*.job /lockedfiles >[/color]
  1469.  
  1470. [color=#A23BEC]< %systemroot%\system32\drivers\*.sys /90 >[/color]
  1471. [2014/03/14 17:35:56 | 000,052,312 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\system32\drivers\mbamchameleon.sys
  1472. [2014/03/14 17:36:18 | 000,107,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
  1473.  
  1474. [color=#A23BEC]< %systemroot%\system32\drivers\*.sys /lockedfiles >[/color]
  1475.  
  1476. [color=#A23BEC]< %SYSTEMDRIVE%\*. /rp /s >[/color]
  1477.  
  1478. [color=#A23BEC]< %systemroot%\assembly\tmp\*.* /S /MD5 >[/color]
  1479.  
  1480. [color=#A23BEC]< %systemroot%\assembly\temp\*.* /S /MD5 >[/color]
  1481.  
  1482. [color=#A23BEC]< %systemroot%\assembly\GAC\*.ini >[/color]
  1483.  
  1484. [color=#A23BEC]< %systemroot%\assembly\GAC_32\*.ini >[/color]
  1485.  
  1486. [color=#A23BEC]< %SystemRoot%\assembly\GAC_MSIL\*.ini >[/color]
  1487.  
  1488. [color=#A23BEC]< wsSystemRoot|l,n,u,@;True;False;True;$,{ /fn >[/color]
  1489.  
  1490. [color=#A23BEC]< %systemdrive%\$Recycle.Bin|@;true;true;true /fp >[/color]
  1491.  
  1492. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24} /s >[/color]
  1493. "" = PSFactoryBuffer
  1494. [HKEY_CLASSES_ROOT\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32]
  1495. "" = C:\WINDOWS\system32\wbem\wbemsvc.dll -- [2008/04/13 20:12:08 | 000,043,520 | ---- | M] (Microsoft Corporation)
  1496. "ThreadingModel" = Both
  1497.  
  1498. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s >[/color]
  1499. "" = Microsoft WBEM New Event Subsystem
  1500. [HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32]
  1501. "" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008/04/13 20:12:08 | 000,273,920 | ---- | M] (Microsoft Corporation)
  1502. "ThreadingModel" = Both
  1503.  
  1504. [color=#A23BEC]< HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s >[/color]
  1505.  
  1506. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s >[/color]
  1507. "" = Microsoft WBEM New Event Subsystem
  1508. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32]
  1509. "" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008/04/13 20:12:08 | 000,273,920 | ---- | M] (Microsoft Corporation)
  1510. "ThreadingModel" = Both
  1511.  
  1512. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s >[/color]
  1513. "" = MruPidlList
  1514. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
  1515. "" = %SystemRoot%\system32\shdocvw.dll -- [2012/10/31 07:33:26 | 001,510,400 | ---- | M] (Microsoft Corporation)
  1516. "ThreadingModel" = Apartment
  1517.  
  1518. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} /s >[/color]
  1519. "" = Start Menu Pin
  1520. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}\InProcServer32]
  1521. "" = %SystemRoot%\system32\SHELL32.dll -- [2012/06/08 10:26:20 | 008,462,848 | ---- | M] (Microsoft Corporation)
  1522. "ThreadingModel" = Apartment
  1523.  
  1524. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24} /s >[/color]
  1525. "" = PSFactoryBuffer
  1526. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32]
  1527. "" = C:\WINDOWS\system32\wbem\wbemsvc.dll -- [2008/04/13 20:12:08 | 000,043,520 | ---- | M] (Microsoft Corporation)
  1528. "ThreadingModel" = Both
  1529.  
  1530. [color=#A23BEC]< HKEY_CLASSES_ROOT\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /s >[/color]
  1531. "" = Microsoft WBEM _WbemFetchRefresherMgr Proxy Helper
  1532. [HKEY_CLASSES_ROOT\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32]
  1533. "" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 08:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
  1534. "ThreadingModel" = Free
  1535.  
  1536. [color=#A23BEC]< HKEY_CLASSES_ROOT\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9} /s >[/color]
  1537. "" = ShellFolder for CD Burning
  1538. [HKEY_CLASSES_ROOT\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
  1539. "" = %SystemRoot%\system32\SHELL32.dll -- [2012/06/08 10:26:20 | 008,462,848 | ---- | M] (Microsoft Corporation)
  1540. "ThreadingModel" = Apartment
  1541. [HKEY_CLASSES_ROOT\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\MergedFolder]
  1542. "Attributes" = 0x0
  1543. "AttributeMask" = 0xffffffff
  1544. "Location" = @shell32.dll,-12589 -- [2012/06/08 10:26:20 | 008,462,848 | ---- | M] (Microsoft Corporation)
  1545. "ConflictOverlayIcon" = %SystemRoot%\system32\SHELL32.dll,-232 -- [2012/06/08 10:26:20 | 008,462,848 | ---- | M] (Microsoft Corporation)
  1546.  
  1547. [color=#A23BEC]< HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9} /s >[/color]
  1548.  
  1549. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F} /s >[/color]
  1550. "" = Microsoft WBEM _WbemFetchRefresherMgr Proxy Helper
  1551. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32]
  1552. "" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 08:10:48 | 000,473,600 | ---- | M] (Microsoft Corporation)
  1553. "ThreadingModel" = Free
  1554.  
  1555. [color=#A23BEC]< HKEY_CURRENT_USER\Software\Microsoft\Command Processor /s >[/color]
  1556. "CompletionChar" = 9
  1557. "DefaultColor" = 0
  1558. "EnableExtensions" = 1
  1559.  
  1560. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor /s >[/color]
  1561. "AutoRun" =
  1562. "CompletionChar" = 64
  1563. "DefaultColor" = 0
  1564. "EnableExtensions" = 1
  1565. "PathCompletionChar" = 64
  1566.  
  1567. [color=#A23BEC]< HKCU\Software\Classes\CLSID\{ECD4FC4D-521C-11D0-B792-00A0C90312E1}\InprocServer32 /s >[/color]
  1568.  
  1569. [color=#A23BEC]< HKLM\Software\Classes\CLSID\{E6BB64BE-0618-4353-9193-0AFE606D6F0C}\InprocServer32 /s >[/color]
  1570.  
  1571. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\scsimap /s >[/color]
  1572.  
  1573. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{118BEDCC-A901-4203-B4F2-ADCB957D1887} /s >[/color]
  1574.  
  1575. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{312BED3C-A901-4203-B4F2-ADCB957D1887} /s >[/color]
  1576.  
  1577. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{F12BE2CC-A901-4203-B4F2-ADCB957D1887} /s >[/color]
  1578.  
  1579. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{312BFDCE-A901-4203-B4F2-ADCB957D1887} /s >[/color]
  1580.  
  1581. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{212B3DCC-A901-4203-B4F2-ADCB957D1887} /s >[/color]
  1582.  
  1583. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{A12BEDCC-A901-4203-B4F2-ADCB957D1887} /s >[/color]
  1584.  
  1585. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D188F} /s >[/color]
  1586.  
  1587. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{118BEDCA-A901-4203-B4F2-ADCB957D188B} /s >[/color]
  1588.  
  1589. [color=#A23BEC]< HKEY_CLASSES_ROOT\CLSID\{3543619C-D563-43f7-95EA-4DA7E1CC396A} /s >[/color]
  1590.  
  1591. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3543619C-D563-43f7-95EA-4DA7E1CC396A} /s >[/color]
  1592.  
  1593. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{3543619C-D563-43f7-95EA-4DA7E1CC396A} /s >[/color]
  1594.  
  1595. [color=#A23BEC]< HKEY_CLASSES_ROOT\Directory\shellex\CopyHookHandlers /s >[/color]
  1596. [HKEY_CLASSES_ROOT\Directory\shellex\CopyHookHandlers\CDF]
  1597. "" = {67EA19A0-CCEF-11d0-8024-00C04FD75D13}
  1598. [HKEY_CLASSES_ROOT\Directory\shellex\CopyHookHandlers\FileSystem]
  1599. "" = {217FC9C0-3AEA-1069-A2DB-08002B30309D}
  1600. [HKEY_CLASSES_ROOT\Directory\shellex\CopyHookHandlers\FileZilla3CopyHook]
  1601. "" = {DB70412E-EEC9-479C-BBA9-BE36BFDDA41B}
  1602. [HKEY_CLASSES_ROOT\Directory\shellex\CopyHookHandlers\MyDocuments]
  1603. "" = {ECF03A33-103D-11d2-854D-006008059367}
  1604. [HKEY_CLASSES_ROOT\Directory\shellex\CopyHookHandlers\Sharing]
  1605. "" = {40dd6e20-7c17-11ce-a804-00aa003ca9f6}
  1606.  
  1607. [color=#A23BEC]< HKEY_CLASSES_ROOT\Directory\Shellex\CopyHookHandlers\MSCopy /s >[/color]
  1608.  
  1609. [color=#A23BEC]< HKEY_CURRENT_USER\Software\Classes\Directory\shellex\CopyHookHandlers /s >[/color]
  1610.  
  1611. [color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers /s >[/color]
  1612. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\CDF]
  1613. "" = {67EA19A0-CCEF-11d0-8024-00C04FD75D13}
  1614. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\FileSystem]
  1615. "" = {217FC9C0-3AEA-1069-A2DB-08002B30309D}
  1616. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\FileZilla3CopyHook]
  1617. "" = {DB70412E-EEC9-479C-BBA9-BE36BFDDA41B}
  1618. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\MyDocuments]
  1619. "" = {ECF03A33-103D-11d2-854D-006008059367}
  1620. [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers\Sharing]
  1621. "" = {40dd6e20-7c17-11ce-a804-00aa003ca9f6}
  1622.  
  1623. [color=#A23BEC]< HKEY_CURRENT_USER\Software\MSOLoad /s >[/color]
  1624.  
  1625. [color=#A23BEC]< type C:\WINDOWS\system.ini >> test.txt /c >[/color]
  1626. ; for 16-bit app support
  1627. [drivers]
  1628. wave=mmdrv.dll
  1629. timer=timer.drv
  1630. [mci]
  1631. [driver32]
  1632. [386enh]
  1633. woafont=dosapp.FON
  1634. EGA80WOA.FON=EGA80WOA.FON
  1635. EGA40WOA.FON=EGA40WOA.FON
  1636. CGA80WOA.FON=CGA80WOA.FON
  1637. CGA40WOA.FON=CGA40WOA.FON
  1638.  
  1639. [color=#A23BEC]< type c:\diskreport.txt /c >[/color]
  1640. Microsoft DiskPart version 5.1.3565
  1641. Copyright (C) 1999-2003 Microsoft Corporation.
  1642. On computer: JCRAIG
  1643. Volume ### Ltr Label Fs Type Size Status Info
  1644. ---------- --- ----------- ----- ---------- ------- --------- --------
  1645. Volume 0 C NTFS Partition 37 GB Healthy System
  1646. Volume 1 D WORK_WELL FAT Removeable 498 MB
  1647.  
  1648. [color=#A23BEC]< MD5 for: AFD.SYS >[/color]
  1649. [2011/08/17 09:49:54 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=1E44BC1E83D8FD2305F8D452DB109CF9 -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\afd.sys
  1650. [2011/08/17 09:49:54 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=1E44BC1E83D8FD2305F8D452DB109CF9 -- C:\WINDOWS\system32\dllcache\afd.sys
  1651. [2011/08/17 09:49:54 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=1E44BC1E83D8FD2305F8D452DB109CF9 -- C:\WINDOWS\system32\drivers\afd.sys
  1652. [2008/04/13 15:19:23 | 000,138,112 | ---- | M] (Microsoft Corporation) MD5=322D0E36693D6E24A2398BEE62A268CD -- C:\WINDOWS\$NtUninstallKB951748$\afd.sys
  1653. [2008/04/13 15:19:23 | 000,138,112 | ---- | M] (Microsoft Corporation) MD5=322D0E36693D6E24A2398BEE62A268CD -- C:\WINDOWS\ServicePackFiles\i386\afd.sys
  1654. [2008/10/16 11:07:58 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=38D7B715504DA4741DF35E3594FE2099 -- C:\WINDOWS\$hf_mig$\KB2509553\SP3QFE\afd.sys
  1655. [2008/08/14 06:34:26 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=4D43E74F2A1239D53929B82600F1971C -- C:\WINDOWS\$hf_mig$\KB956803\SP3QFE\afd.sys
  1656. [2008/08/14 05:51:43 | 000,138,368 | ---- | M] (Microsoft Corporation) MD5=55E6E1C51B6D30E54335750955453702 -- C:\WINDOWS\$NtServicePackUninstall$\afd.sys
  1657. [2004/08/03 23:14:16 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=5AC495F4CB807B2B98AD2AD591E6D92E -- C:\WINDOWS\$NtUninstallKB951748_0$\afd.sys
  1658. [2008/08/14 05:48:52 | 000,138,368 | ---- | M] (Microsoft Corporation) MD5=6A0397376853E604DE8E1E7A87FC08AC -- C:\WINDOWS\$hf_mig$\KB956803\SP2QFE\afd.sys
  1659. [2008/10/16 10:43:01 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=7618D5218F2A614672EC61A80D854A37 -- C:\WINDOWS\$NtUninstallKB2592799$\afd.sys
  1660. [2008/08/14 06:04:36 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=7E775010EF291DA96AD17CA4B17137D7 -- C:\WINDOWS\$hf_mig$\KB956803\SP3GDR\afd.sys
  1661. [2008/08/14 06:04:36 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=7E775010EF291DA96AD17CA4B17137D7 -- C:\WINDOWS\$NtUninstallKB2509553$\afd.sys
  1662. [2008/06/20 06:44:38 | 000,138,368 | ---- | M] (Microsoft Corporation) MD5=944CA435BFCFC82CC1ED9E3A7D731AA9 -- C:\WINDOWS\$NtUninstallKB956803_0$\afd.sys
  1663. [2008/06/20 07:48:03 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=D6EE6014241D034E63C49A50CB2B442A -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\afd.sys
  1664. [2008/06/20 06:44:08 | 000,138,368 | ---- | M] (Microsoft Corporation) MD5=D99DDFFB33DEACDCF20717CB520379F6 -- C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\afd.sys
  1665. [2008/06/20 07:40:08 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=E3049B90FE06F3F740B7CFDA44995E2C -- C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\afd.sys
  1666. [2008/06/20 07:40:08 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=E3049B90FE06F3F740B7CFDA44995E2C -- C:\WINDOWS\$NtUninstallKB956803$\afd.sys
  1667. [2011/08/17 09:41:46 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=F6B7B1ECD7B41736BDB6FF4B092BCB79 -- C:\WINDOWS\$hf_mig$\KB2592799\SP3QFE\afd.sys
  1668.  
  1669. [color=#A23BEC]< MD5 for: ATAPI.SYS >[/color]
  1670. [2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
  1671. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
  1672. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
  1673. [2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\atapi.sys
  1674. [2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
  1675. [2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
  1676. [2004/08/03 23:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
  1677. [2004/08/03 22:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0000\DriverFiles\i386\atapi.sys
  1678.  
  1679. [color=#A23BEC]< MD5 for: DISK.SYS >[/color]
  1680. [2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:disk.sys
  1681. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:disk.sys
  1682. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:disk.sys
  1683. [2004/08/03 22:59:56 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=00CA44E4534865F8A3B64F7C0984BFF0 -- C:\WINDOWS\$NtServicePackUninstall$\disk.sys
  1684. [2008/04/13 14:40:47 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\disk.sys
  1685. [2008/04/13 14:40:47 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\ServicePackFiles\i386\disk.sys
  1686. [2008/04/13 14:40:47 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\system32\drivers\disk.sys
  1687.  
  1688. [color=#A23BEC]< MD5 for: EVENTLOG.DLL >[/color]
  1689. [2008/04/13 20:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
  1690. [2008/04/13 20:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll
  1691. [2004/08/04 00:56:44 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
  1692.  
  1693. [color=#A23BEC]< MD5 for: EXPLORER.EXE >[/color]
  1694. [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe
  1695. [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
  1696. [2007/06/13 07:26:03 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
  1697. [2007/06/13 06:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
  1698. [2004/08/04 00:56:50 | 001,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
  1699.  
  1700. [color=#A23BEC]< MD5 for: FASTFAT.SYS >[/color]
  1701. [2004/08/03 23:14:18 | 000,143,360 | ---- | M] (Microsoft Corporation) MD5=3117F595E9615E04F05A54FC15A03B20 -- C:\WINDOWS\$NtServicePackUninstall$\fastfat.sys
  1702. [2008/04/13 15:14:29 | 000,143,744 | ---- | M] (Microsoft Corporation) MD5=38D332A6D56AF32635675F132548343E -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\Fastfat.sys
  1703. [2008/04/13 15:14:29 | 000,143,744 | ---- | M] (Microsoft Corporation) MD5=38D332A6D56AF32635675F132548343E -- C:\WINDOWS\ServicePackFiles\i386\fastfat.sys
  1704. [2008/04/13 15:14:29 | 000,143,744 | ---- | M] (Microsoft Corporation) MD5=38D332A6D56AF32635675F132548343E -- C:\WINDOWS\system32\drivers\fastfat.sys
  1705.  
  1706. [color=#A23BEC]< MD5 for: I8042PRT.SYS >[/color]
  1707. [2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:i8042prt.sys
  1708. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:i8042prt.sys
  1709. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:i8042prt.sys
  1710. [2008/04/13 15:18:00 | 000,052,480 | ---- | M] (Microsoft Corporation) MD5=4A0B06AA8943C1E332520F7440C0AA30 -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\i8042prt.sys
  1711. [2008/04/13 15:18:00 | 000,052,480 | ---- | M] (Microsoft Corporation) MD5=4A0B06AA8943C1E332520F7440C0AA30 -- C:\WINDOWS\ServicePackFiles\i386\i8042prt.sys
  1712. [2008/04/13 15:18:00 | 000,052,480 | ---- | M] (Microsoft Corporation) MD5=4A0B06AA8943C1E332520F7440C0AA30 -- C:\WINDOWS\system32\drivers\i8042prt.sys
  1713. [2004/08/03 23:14:38 | 000,052,736 | ---- | M] (Microsoft Corporation) MD5=5502B58EEF7486EE6F93F3F164DCB808 -- C:\WINDOWS\$NtServicePackUninstall$\i8042prt.sys
  1714.  
  1715. [color=#A23BEC]< MD5 for: IMAPI.SYS >[/color]
  1716. [2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:imapi.sys
  1717. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:imapi.sys
  1718. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:imapi.sys
  1719. [2008/04/13 14:40:58 | 000,042,112 | ---- | M] (Microsoft Corporation) MD5=083A052659F5310DD8B6A6CB05EDCF8E -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\imapi.sys
  1720. [2008/04/13 14:40:58 | 000,042,112 | ---- | M] (Microsoft Corporation) MD5=083A052659F5310DD8B6A6CB05EDCF8E -- C:\WINDOWS\ServicePackFiles\i386\imapi.sys
  1721. [2008/04/13 14:40:58 | 000,042,112 | ---- | M] (Microsoft Corporation) MD5=083A052659F5310DD8B6A6CB05EDCF8E -- C:\WINDOWS\system32\drivers\imapi.sys
  1722. [2004/08/03 23:00:16 | 000,041,856 | ---- | M] (Microsoft Corporation) MD5=F8AA320C6A0409C0380E5D8A99D76EC6 -- C:\WINDOWS\$NtServicePackUninstall$\imapi.sys
  1723.  
  1724. [color=#A23BEC]< MD5 for: IPSEC.SYS >[/color]
  1725. [2008/04/13 15:19:42 | 000,075,264 | ---- | M] (Microsoft Corporation) MD5=23C74D75E36E7158768DD63D92789A91 -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\ipsec.sys
  1726. [2008/04/13 15:19:42 | 000,075,264 | ---- | M] (Microsoft Corporation) MD5=23C74D75E36E7158768DD63D92789A91 -- C:\WINDOWS\ServicePackFiles\i386\ipsec.sys
  1727. [2008/04/13 15:19:42 | 000,075,264 | ---- | M] (Microsoft Corporation) MD5=23C74D75E36E7158768DD63D92789A91 -- C:\WINDOWS\system32\drivers\ipsec.sys
  1728. [2004/08/03 23:14:30 | 000,074,752 | ---- | M] (Microsoft Corporation) MD5=64537AA5C003A6AFEEE1DF819062D0D1 -- C:\WINDOWS\$NtServicePackUninstall$\ipsec.sys
  1729.  
  1730. [color=#A23BEC]< MD5 for: KBDCLASS.SYS >[/color]
  1731. [2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:kbdclass.sys
  1732. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:kbdclass.sys
  1733. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:kbdclass.sys
  1734. [2008/04/13 14:39:47 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=463C1EC80CD17420A542B7F36A36F128 -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\kbdclass.sys
  1735. [2008/04/13 14:39:47 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=463C1EC80CD17420A542B7F36A36F128 -- C:\WINDOWS\ServicePackFiles\i386\kbdclass.sys
  1736. [2008/04/13 14:39:47 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=463C1EC80CD17420A542B7F36A36F128 -- C:\WINDOWS\system32\drivers\kbdclass.sys
  1737. [2004/08/03 22:58:34 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=EBDEE8A2EE5393890A1ACEE971C4C246 -- C:\WINDOWS\$NtServicePackUninstall$\kbdclass.sys
  1738.  
  1739. [color=#A23BEC]< MD5 for: LSASS.EXE >[/color]
  1740. [2004/08/04 00:56:52 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=84885F9B82F4D55C6146EBF6065D75D2 -- C:\WINDOWS\$NtServicePackUninstall$\lsass.exe
  1741. [2008/04/13 20:12:24 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=BF2466B3E18E970D8A976FB95FC1CA85 -- C:\WINDOWS\ServicePackFiles\i386\lsass.exe
  1742. [2008/04/13 20:12:24 | 000,013,312 | ---- | M] (Microsoft Corporation) MD5=BF2466B3E18E970D8A976FB95FC1CA85 -- C:\WINDOWS\system32\lsass.exe
  1743.  
  1744. [color=#A23BEC]< MD5 for: MOUCLASS.SYS >[/color]
  1745. [2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:mouclass.sys
  1746. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:mouclass.sys
  1747. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:mouclass.sys
  1748. [2004/08/04 01:05:44 | 000,023,040 | ---- | M] (Microsoft Corporation) MD5=34E1F0031153E491910E12551400192C -- C:\WINDOWS\$NtServicePackUninstall$\mouclass.sys
  1749. [2008/04/13 14:39:47 | 000,023,040 | ---- | M] (Microsoft Corporation) MD5=35C9E97194C8CFB8430125F8DBC34D04 -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\mouclass.sys
  1750. [2008/04/13 14:39:47 | 000,023,040 | ---- | M] (Microsoft Corporation) MD5=35C9E97194C8CFB8430125F8DBC34D04 -- C:\WINDOWS\ServicePackFiles\i386\mouclass.sys
  1751. [2008/04/13 14:39:47 | 000,023,040 | ---- | M] (Microsoft Corporation) MD5=35C9E97194C8CFB8430125F8DBC34D04 -- C:\WINDOWS\system32\drivers\mouclass.sys
  1752.  
  1753. [color=#A23BEC]< MD5 for: NETBT.SYS >[/color]
  1754. [2004/08/03 23:14:38 | 000,162,816 | ---- | M] (Microsoft Corporation) MD5=0C80E410CD2F47134407EE7DD19CC86B -- C:\WINDOWS\$NtServicePackUninstall$\netbt.sys
  1755. [2008/04/13 15:21:00 | 000,162,816 | ---- | M] (Microsoft Corporation) MD5=74B2B2F5BEA5E9A3DC021D685551BD3D -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\netbt.sys
  1756. [2008/04/13 15:21:00 | 000,162,816 | ---- | M] (Microsoft Corporation) MD5=74B2B2F5BEA5E9A3DC021D685551BD3D -- C:\WINDOWS\ServicePackFiles\i386\netbt.sys
  1757. [2008/04/13 15:21:00 | 000,162,816 | ---- | M] (Microsoft Corporation) MD5=74B2B2F5BEA5E9A3DC021D685551BD3D -- C:\WINDOWS\system32\drivers\netbt.sys
  1758.  
  1759. [color=#A23BEC]< MD5 for: NETLOGON.DLL >[/color]
  1760. [2008/04/13 20:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
  1761. [2008/04/13 20:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
  1762. [2009/02/06 14:46:09 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
  1763. [2009/02/06 14:46:09 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll
  1764. [2004/08/04 00:56:46 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
  1765.  
  1766. [color=#A23BEC]< MD5 for: REDBOOK.SYS >[/color]
  1767. [2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:redbook.sys
  1768. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:redbook.sys
  1769. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:redbook.sys
  1770. [2004/08/03 18:59:38 | 000,057,472 | ---- | M] (Microsoft Corporation) MD5=B31B4588E4086D8D84ADBF9845C2402B -- C:\WINDOWS\$NtServicePackUninstall$\redbook.sys
  1771. [2008/04/13 14:40:27 | 000,057,600 | ---- | M] (Microsoft Corporation) MD5=F828DD7E1419B6653894A8F97A0094C5 -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\redbook.sys
  1772. [2008/04/13 14:40:27 | 000,057,600 | ---- | M] (Microsoft Corporation) MD5=F828DD7E1419B6653894A8F97A0094C5 -- C:\WINDOWS\ServicePackFiles\i386\redbook.sys
  1773. [2008/04/13 14:40:27 | 000,057,600 | ---- | M] (Microsoft Corporation) MD5=F828DD7E1419B6653894A8F97A0094C5 -- C:\WINDOWS\system32\drivers\redbook.sys
  1774.  
  1775. [color=#A23BEC]< MD5 for: SCECLI.DLL >[/color]
  1776. [2004/08/04 00:56:46 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
  1777. [2008/04/13 20:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
  1778. [2008/04/13 20:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll
  1779.  
  1780. [color=#A23BEC]< MD5 for: SERIAL.SYS >[/color]
  1781. [2004/08/04 01:05:44 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:serial.sys
  1782. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:serial.sys
  1783. [2013/01/15 17:24:18 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:serial.sys
  1784. [2008/04/13 15:15:45 | 000,064,512 | ---- | M] (Microsoft Corporation) MD5=CCA207A8896D4C6A0C9CE29A4AE411A7 -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\serial.sys
  1785. [2008/04/13 15:15:45 | 000,064,512 | ---- | M] (Microsoft Corporation) MD5=CCA207A8896D4C6A0C9CE29A4AE411A7 -- C:\WINDOWS\ServicePackFiles\i386\serial.sys
  1786. [2008/04/13 15:15:45 | 000,064,512 | ---- | M] (Microsoft Corporation) MD5=CCA207A8896D4C6A0C9CE29A4AE411A7 -- C:\WINDOWS\system32\drivers\serial.sys
  1787. [2004/08/03 23:15:54 | 000,064,896 | ---- | M] (Microsoft Corporation) MD5=CD9404D115A00D249F70A371B46D5A26 -- C:\WINDOWS\$NtServicePackUninstall$\serial.sys
  1788.  
  1789. [color=#A23BEC]< MD5 for: SERVICES.EXE >[/color]
  1790. [2009/02/06 07:06:24 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=020CEAAEDC8EB655B6506B8C70D53BB6 -- C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe
  1791. [2008/04/13 20:12:34 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 -- C:\WINDOWS\$NtUninstallKB956572$\services.exe
  1792. [2008/04/13 20:12:34 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 -- C:\WINDOWS\ServicePackFiles\i386\services.exe
  1793. [2009/02/06 13:14:03 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=37561F8D4160D62DA86D24AE41FAE8DE -- C:\WINDOWS\$NtServicePackUninstall$\services.exe
  1794. [2009/02/06 06:22:21 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=4712531AB7A01B7EE059853CA17D39BD -- C:\WINDOWS\$hf_mig$\KB956572\SP2QFE\services.exe
  1795. [2009/02/06 07:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\$hf_mig$\KB956572\SP3GDR\services.exe
  1796. [2009/02/06 07:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\system32\dllcache\services.exe
  1797. [2009/02/06 07:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\system32\services.exe
  1798. [2004/08/04 00:56:56 | 000,108,032 | ---- | M] (Microsoft Corporation) MD5=C6CE6EEC82F187615D1002BB3BB50ED4 -- C:\WINDOWS\$NtUninstallKB956572_0$\services.exe
  1799.  
  1800. [color=#A23BEC]< MD5 for: SMSS.EXE >[/color]
  1801. [2008/04/13 20:12:36 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=5F816C1F539266D2D4C78694239DA0B5 -- C:\WINDOWS\ServicePackFiles\i386\smss.exe
  1802. [2008/04/13 20:12:36 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=5F816C1F539266D2D4C78694239DA0B5 -- C:\WINDOWS\system32\smss.exe
  1803. [2004/08/04 00:56:58 | 000,050,688 | ---- | M] (Microsoft Corporation) MD5=BD7FB0957C716F1A60333AEE04DE2178 -- C:\WINDOWS\$NtServicePackUninstall$\smss.exe
  1804.  
  1805. [color=#A23BEC]< MD5 for: SVCHOST.EXE >[/color]
  1806. [2008/04/13 20:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\ServicePackFiles\i386\svchost.exe
  1807. [2008/04/13 20:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\system32\svchost.exe
  1808. [2004/08/04 00:56:58 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 -- C:\WINDOWS\$NtServicePackUninstall$\svchost.exe
  1809. [2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
  1810.  
  1811. [color=#A23BEC]< MD5 for: TCPIP.SYS >[/color]
  1812. [2006/04/20 07:51:50 | 000,359,808 | ---- | M] (Microsoft Corporation) MD5=1DBF125862891817F374F407626967F4 -- C:\WINDOWS\$NtUninstallKB951748_0$\tcpip.sys
  1813. [2008/06/20 06:45:13 | 000,360,320 | ---- | M] (Microsoft Corporation) MD5=2A5554FC5B1E04E131230E3CE035C3F9 -- C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
  1814. [2006/01/13 13:07:08 | 000,360,448 | ---- | M] (Microsoft Corporation) MD5=5562CC0A47B2AEF06D3417B733F3C195 -- C:\WINDOWS\$hf_mig$\KB913446\SP2QFE\tcpip.sys
  1815. [2005/05/25 15:07:12 | 000,359,936 | ---- | M] (Microsoft Corporation) MD5=63FDFEA54EB53DE2D863EE454937CE1E -- C:\WINDOWS\$hf_mig$\KB893066\SP2QFE\tcpip.sys
  1816. [2008/06/20 06:44:42 | 000,360,960 | ---- | M] (Microsoft Corporation) MD5=744E57C99232201AE98C49168B918F48 -- C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys
  1817. [2008/04/13 15:20:16 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys
  1818. [2008/04/13 15:20:16 | 000,361,344 | ---- | M] (Microsoft Corporation) MD5=93EA8D04EC73A85DB02EB8805988F733 -- C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
  1819. [2008/06/20 07:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\tcpip.sys
  1820. [2008/06/20 07:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys
  1821. [2008/06/20 07:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\dllcache\tcpip.sys
  1822. [2008/06/20 07:51:12 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=9AEFA14BD6B182D61E3119FA5F436D3D -- C:\WINDOWS\system32\drivers\tcpip.sys
  1823. [2008/06/20 07:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\$hf_mig$\KB2509553\SP3QFE\tcpip.sys
  1824. [2008/06/20 07:59:02 | 000,361,600 | ---- | M] (Microsoft Corporation) MD5=AD978A1B783B5719720CFF204B666C8E -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
  1825. [2006/04/20 08:18:35 | 000,360,576 | ---- | M] (Microsoft Corporation) MD5=B2220C618B42A2212A59D91EBD6FC4B4 -- C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
  1826.  
  1827. [color=#A23BEC]< MD5 for: USERINIT.EXE >[/color]
  1828. [2004/08/04 00:56:58 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
  1829. [2008/04/13 20:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
  1830. [2008/04/13 20:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe
  1831.  
  1832. [color=#A23BEC]< MD5 for: VOLSNAP.SYS >[/color]
  1833. [2008/04/13 14:41:01 | 000,052,352 | ---- | M] (Microsoft Corporation) MD5=4C8FCB5CC53AAB716D810740FE59D025 -- C:\Documents and Settings\John Craig\Application Data\FixZeroAccess\Archive\VolSnap.sys
  1834. [2008/04/13 14:41:01 | 000,052,352 | ---- | M] (Microsoft Corporation) MD5=4C8FCB5CC53AAB716D810740FE59D025 -- C:\WINDOWS\ServicePackFiles\i386\volsnap.sys
  1835. [2008/04/13 14:41:01 | 000,052,352 | ---- | M] (Microsoft Corporation) MD5=4C8FCB5CC53AAB716D810740FE59D025 -- C:\WINDOWS\system32\drivers\volsnap.sys
  1836. [2004/08/03 23:00:18 | 000,052,352 | ---- | M] (Microsoft Corporation) MD5=EE4660083DEBA849FF6C485D944B379B -- C:\WINDOWS\$NtServicePackUninstall$\volsnap.sys
  1837.  
  1838. [color=#A23BEC]< MD5 for: WINLOGON.EXE >[/color]
  1839. [2004/08/04 00:56:58 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
  1840. [2013/04/04 14:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
  1841. [2008/04/13 20:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
  1842. [2008/04/13 20:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe
  1843.  
  1844. [color=#E56717]========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========[/color]
  1845. [C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a] -> C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790 -> Junction
  1846. [C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a] -> C:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e -> Junction
  1847. [C:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a] -> C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492 -> Junction
  1848. [C:\WINDOWS\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35] -> C:\WINDOWS\WinSxS\MSIL_Microsoft.Workflow.Compiler_31bf3856ad364e35_4.0.0.0_x-ww_97359ba5 -> Junction
  1849.  
  1850. < End of report >
RAW Paste Data