phast2 - More Virus Problems

  1. 22-09-2009  #1
    phast2
    phast2 is offline Full Member

    phast2 - More Virus Problems

    Hi, I was having similar problems as described by JuniorLu in his recent post. I've been infected with Windows Police, among other things. I was unable to run Spybot S&D. Other problems include clicking on Google search results would send me off to random websites, etc. Also, my computer has two users set up, "Pat" and "Sharon" (and I added a third user, "Pat2," as a test). Anyway, after booting up and selecting one of the users - usually "Pat" - I could then not Switch Users to "Sharon" (or to "Pat2" after adding that in as a test).

    Anyway, I took the advice given to JuniorLu and have gone ahead and downloaded and run Combo-Fix (renamed with the dash in the name), and I have run HijackThis. I have included both log files below:

    Combo-Fix log
    =================
    ComboFix 09-09-20.04 - Pat 09/21/2009 22:19.2.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.735.449 [GMT -5:00]
    Running from: c:\documents and settings\Pat\Desktop\Combo-Fix.exe
    AV: avast! antivirus 4.8.1351 [VPS 090921-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\LocalService\Application Data\twain_32
    c:\documents and settings\LocalService\Application Data\twain_32\user.ds
    c:\documents and settings\Sharon\Application Data\twain_32
    c:\documents and settings\Sharon\Application Data\twain_32\user.ds
    c:\windows\Install.txt
    c:\windows\ppp3.dat
    c:\windows\ppp4.dat
    c:\windows\system\C3DMOUSE55.DLL
    c:\windows\system32\6to4v32.dll
    c:\windows\system32\bennuar.old
    c:\windows\system32\bincd32.dat
    c:\windows\system32\certstore.dat
    c:\windows\system32\drivers\gasfkycyuvbawo.sys
    c:\windows\system32\drivers\gasfkyewwgptng.sys
    c:\windows\system32\FInstall.sys
    c:\windows\system32\gasfkyoibiqrcv.dll
    c:\windows\system32\gasfkysbivmswu.dll
    c:\windows\system32\gasfkyspyfgkpx.dll
    c:\windows\system32\gasfkywkbphemx.dat
    c:\windows\system32\gasfkywmxnnxnx.dll
    c:\windows\system32\gasfkyyxjlkmov.dat
    c:\windows\system32\Install.txt
    c:\windows\system32\sonhelp.htm
    c:\windows\system32\sysnet.dat
    c:\windows\system32\twain_32
    c:\windows\system32\twain_32\local.ds
    c:\windows\system32\twain_32\user.ds
    c:\windows\system32\twext.exe
    c:\windows\system32\wiwow64.exe
    c:\windows\Tasks\At1.job
    c:\windows\Tasks\At10.job
    c:\windows\Tasks\At11.job
    c:\windows\Tasks\At12.job
    c:\windows\Tasks\At13.job
    c:\windows\Tasks\At14.job
    c:\windows\Tasks\At15.job
    c:\windows\Tasks\At16.job
    c:\windows\Tasks\At17.job
    c:\windows\Tasks\At18.job
    c:\windows\Tasks\At19.job
    c:\windows\Tasks\At2.job
    c:\windows\Tasks\At20.job
    c:\windows\Tasks\At21.job
    c:\windows\Tasks\At22.job
    c:\windows\Tasks\At23.job
    c:\windows\Tasks\At24.job
    c:\windows\Tasks\At3.job
    c:\windows\Tasks\At4.job
    c:\windows\Tasks\At5.job
    c:\windows\Tasks\At6.job
    c:\windows\Tasks\At7.job
    c:\windows\Tasks\At8.job
    c:\windows\Tasks\At9.job
    c:\windows\TEMP\mta71483.dll
    c:\windows\wpd99.drv

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Service_gasfkylotewswv
    -------\Legacy_gasfkylotewswv
    -------\Legacy_6TO4
    -------\Legacy_OREANS32
    -------\Service_6to4
    -------\Service_oreans32


    ((((((((((((((((((((((((( Files Created from 2009-08-22 to 2009-09-22 )))))))))))))))))))))))))))))))
    .

    2009-09-20 13:46 . 2009-09-20 13:46 2198 ----a-w- C:\M9gVPsTv.bat
    2009-09-09 04:04 . 2009-06-21 21:44 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
    2009-09-07 01:34 . 2009-09-07 01:34 -------- d-----w- c:\documents and settings\LocalService\Application Data\Lexmark Productivity Studio
    2009-09-02 02:33 . 2009-09-02 02:52 33824 ----a-w- c:\windows\system32\drivers\oreans32.sys
    2009-08-28 05:46 . 2008-05-16 15:06 40960 ----a-w- c:\windows\system32\lxdwvs.dll
    2009-08-28 05:46 . 2008-04-23 16:34 360448 ----a-w- c:\windows\system32\lxdwcoin.dll
    2009-08-28 05:45 . 2008-05-09 11:07 81920 ----a-w- c:\windows\system32\lxdwcaps.dll
    2009-08-28 05:45 . 2008-05-09 11:07 1036288 ----a-w- c:\windows\system32\lxdwdrs.dll
    2009-08-28 05:45 . 2008-05-09 10:52 69632 ----a-w- c:\windows\system32\lxdwcnv4.dll
    2009-08-28 05:44 . 2009-08-28 05:44 -------- d-----w- c:\program files\Lexmark Toolbar
    2009-08-28 05:44 . 2009-08-28 05:44 -------- d-----w- c:\program files\Lexmark Printable Web
    2009-08-28 05:44 . 2008-05-16 15:32 17064 ----a-w- c:\windows\system32\LXDWwupd.exe
    2009-08-28 05:44 . 2008-04-15 11:08 352256 ----a-w- c:\windows\system32\LXDWwupd.dll
    2009-08-27 01:47 . 2009-08-27 01:47 -------- d-----w- c:\documents and settings\Sharon\Application Data\7600 Series
    2009-08-26 23:17 . 2009-08-26 23:17 -------- d-----w- c:\documents and settings\Pat\Application Data\7600 Series
    2009-08-26 23:09 . 2008-05-21 15:13 98345 ----a-w- c:\windows\system32\IMHOST32.DLL
    2009-08-26 23:09 . 2008-05-21 15:13 339968 ----a-w- c:\windows\system32\IMGMAN32.DLL
    2009-08-26 23:09 . 2009-08-26 23:09 -------- d-----w- c:\documents and settings\All Users\Application Data\7600 Series
    2009-08-26 23:08 . 2009-08-28 04:51 -------- d-----w- c:\program files\Abbyy FineReader 6.0 Sprint

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
    .
    2009-09-22 03:34 . 2009-05-06 20:03 -------- d-----w- c:\program files\DNA
    2009-09-22 03:34 . 2009-05-06 20:03 -------- d-----w- c:\documents and settings\Pat\Application Data\DNA
    2009-09-22 01:09 . 2008-07-30 12:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-09-22 01:09 . 2008-07-30 12:41 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2009-09-19 12:15 . 2009-05-06 20:04 -------- d-----w- c:\documents and settings\Pat\Application Data\BitTorrent
    2009-09-13 13:36 . 2009-04-05 21:47 -------- d-----w- c:\documents and settings\All Users\Application Data\pdf995
    2009-08-28 05:51 . 2009-01-07 16:51 -------- d-----w- c:\documents and settings\Pat\Application Data\Lexmark Productivity Studio
    2009-08-28 05:49 . 2009-08-28 05:43 -------- d-----w- c:\program files\Lexmark 7600 Series
    2009-08-28 05:35 . 2009-06-11 12:06 -------- d-----w- c:\program files\QuickTime
    2009-08-28 05:35 . 2008-06-26 23:41 -------- d-----w- c:\program files\Ahead
    2009-08-27 23:34 . 2009-01-08 00:28 -------- d-----w- c:\documents and settings\Sharon\Application Data\Lexmark Productivity Studio
    2009-08-27 23:34 . 2008-11-18 13:03 19024 ----a-w- c:\documents and settings\Sharon\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-08-22 16:37 . 2008-08-25 05:39 19024 ----a-w- c:\documents and settings\Pat\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-08-22 08:09 . 2009-08-22 08:09 -------- d-----w- c:\program files\MSBuild
    2009-08-22 08:09 . 2009-08-22 08:09 -------- d-----w- c:\program files\Reference Assemblies
    2009-08-21 12:41 . 2009-06-20 14:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
    2009-08-20 12:35 . 2009-08-19 02:12 -------- d-----w- c:\documents and settings\Pat\Application Data\SanDisk
    2009-08-17 16:10 . 2009-06-20 15:40 1279456 ----a-w- c:\windows\system32\aswBoot.exe
    2009-08-17 16:06 . 2009-06-20 15:40 93392 ----a-w- c:\windows\system32\drivers\aswmon.sys
    2009-08-17 16:06 . 2009-06-20 15:40 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
    2009-08-17 16:05 . 2009-06-20 15:40 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
    2009-08-17 16:05 . 2009-06-20 15:40 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
    2009-08-17 16:04 . 2009-06-20 15:40 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys
    2009-08-17 16:04 . 2009-06-20 15:40 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
    2009-08-17 16:03 . 2009-06-20 15:40 26944 ----a-w- c:\windows\system32\drivers\aavmker4.sys
    2009-08-17 16:02 . 2009-06-20 15:40 97480 ----a-w- c:\windows\system32\AvastSS.scr
    2009-08-16 13:47 . 2009-08-16 13:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Lexmark 7600 Series
    2009-08-16 02:01 . 2008-06-23 23:06 -------- d-----w- c:\program files\Java
    2009-08-16 01:56 . 2008-12-26 20:13 -------- d-----w- c:\documents and settings\Pat\Application Data\Apple Computer
    2009-08-15 18:49 . 2009-08-15 18:48 -------- d-----w- c:\program files\iTunes
    2009-08-15 18:48 . 2009-08-15 18:48 -------- d-----w- c:\program files\iPod
    2009-08-15 18:48 . 2009-06-11 12:02 -------- d-----w- c:\program files\Common Files\Apple
    2009-08-14 22:26 . 2009-08-14 22:26 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
    2009-08-11 21:52 . 2009-08-11 21:52 -------- d-----w- c:\documents and settings\Pat\Application Data\Malwarebytes
    2009-08-11 21:52 . 2009-08-10 23:10 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2009-08-11 12:17 . 2009-08-11 12:09 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
    2009-08-11 12:11 . 2009-08-11 12:11 -------- d-----w- c:\program files\Common Files\Adobe AIR
    2009-08-10 23:10 . 2009-08-10 23:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-08-05 09:01 . 2008-06-21 20:26 204800 ----a-w- c:\windows\system32\mswebdvd.dll
    2009-08-03 18:36 . 2009-08-10 23:10 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-08-03 18:36 . 2009-08-10 23:10 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-08-03 13:03 . 2009-08-03 13:03 330558 ----a-w- c:\documents and settings\All Users\SPLE7.tmp
    2009-08-03 13:01 . 2009-08-03 13:01 330558 ----a-w- c:\documents and settings\All Users\SPLD9.tmp
    2009-08-01 18:12 . 2008-06-23 21:12 -------- d-----w- c:\documents and settings\Pat\Application Data\Move Networks
    2009-07-25 10:23 . 2008-12-09 00:29 411368 ----a-w- c:\windows\system32\deploytk.dll
    2009-07-17 19:01 . 2008-06-21 20:24 58880 ----a-w- c:\windows\system32\atl.dll
    2009-07-14 04:43 . 2008-06-21 20:27 286208 ----a-w- c:\windows\system32\wmpdxm.dll
    2009-06-29 16:12 . 2008-06-21 20:27 827392 ----a-w- c:\windows\system32\wininet.dll
    2009-06-29 16:12 . 2008-06-21 20:25 78336 ----a-w- c:\windows\system32\ieencode.dll
    2009-06-29 16:12 . 2008-06-21 20:25 17408 ----a-w- c:\windows\system32\corpol.dll
    2009-06-25 08:25 . 2008-06-21 20:27 54272 ----a-w- c:\windows\system32\wdigest.dll
    2009-06-25 08:25 . 2008-06-21 20:26 56832 ----a-w- c:\windows\system32\secur32.dll
    2009-06-25 08:25 . 2008-06-21 20:26 147456 ----a-w- c:\windows\system32\schannel.dll
    2009-06-25 08:25 . 2008-06-21 20:26 136192 ----a-w- c:\windows\system32\msv1_0.dll
    2009-06-25 08:25 . 2008-06-21 20:25 730112 ----a-w- c:\windows\system32\lsasrv.dll
    2009-06-25 08:25 . 2008-06-21 20:25 301568 ----a-w- c:\windows\system32\kerberos.dll
    2009-06-24 11:18 . 2008-06-21 20:25 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
    .

    ((((((((((((((((((((((((((((( SnapShot@2009-08-12_17.53.53 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-08-28 05:45 . 2008-05-09 10:52 69632 c:\windows\twain_32\Lexmark\7600 Series\lxdwcnv4.dll
    - 2008-12-20 22:44 . 2008-05-09 16:52 69632 c:\windows\twain_32\Lexmark\7600 Series\lxdwcnv4.dll
    - 2008-12-20 22:44 . 2008-05-09 16:52 77906 c:\windows\twain_32\Lexmark\7600 Series\lxdwcfg.dll
    + 2009-08-28 05:45 . 2008-05-09 10:52 77906 c:\windows\twain_32\Lexmark\7600 Series\lxdwcfg.dll
    - 2008-12-20 22:44 . 2008-05-09 17:07 81920 c:\windows\twain_32\Lexmark\7600 Series\lxdwcaps.dll
    + 2009-08-28 05:45 . 2008-05-09 11:07 81920 c:\windows\twain_32\Lexmark\7600 Series\lxdwcaps.dll
    + 2009-09-22 03:28 . 2009-09-22 03:28 16384 c:\windows\Temp\Perflib_Perfdata_5f0.dat
    + 2009-09-22 03:28 . 2009-09-22 03:28 16384 c:\windows\Temp\Perflib_Perfdata_170.dat
    + 2008-06-22 02:49 . 2009-07-14 11:03 46080 c:\windows\system32\tzchange.exe
    + 2008-07-30 02:10 . 2008-07-30 02:10 26112 c:\windows\system32\TsWpfWrp.exe
    + 2008-06-21 21:38 . 2007-11-30 11:18 26488 c:\windows\system32\spupdsvc.exe
    - 2008-06-21 21:38 . 2007-07-27 15:41 26488 c:\windows\system32\spupdsvc.exe
    + 2009-08-22 08:08 . 2008-07-06 12:06 89088 c:\windows\system32\spool\prtprocs\w32x86\filterpi pelineprintproc.dll
    + 2009-08-28 05:46 . 2008-04-15 11:15 44032 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwwbgc.dll
    - 2008-12-20 22:44 . 2008-04-15 17:15 44032 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwwbgc.dll
    + 2009-08-28 05:46 . 2008-05-16 15:32 82600 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwview.exe
    - 2008-12-20 22:44 . 2008-05-16 21:32 82600 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwview.exe
    - 2008-12-20 22:44 . 2008-04-15 17:14 43520 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwuplr.dll
    + 2009-08-28 05:46 . 2008-04-15 11:14 43520 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwuplr.dll
    + 2009-08-28 05:46 . 2008-05-16 15:33 82600 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwupld.exe
    - 2008-12-20 22:44 . 2008-05-16 21:33 82600 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwupld.exe
    + 2009-08-28 05:46 . 2008-05-16 15:33 82600 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwtime.exe
    - 2008-12-20 22:44 . 2008-05-16 21:33 82600 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwtime.exe
    + 2009-08-28 05:46 . 2008-05-16 14:50 98304 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwtime.dll
    - 2008-12-20 22:44 . 2008-05-16 20:50 98304 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwtime.dll
    + 2009-08-28 05:46 . 2008-05-16 15:32 98984 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwserv.exe
    - 2008-12-20 22:44 . 2008-05-16 21:32 98984 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwserv.exe
    + 2009-08-28 05:46 . 2008-05-06 21:50 36864 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwcur.dll
    - 2008-12-20 22:44 . 2008-05-07 03:50 36864 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwcur.dll
    + 2009-08-28 05:46 . 2008-05-06 21:47 90112 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwcub.dll
    - 2008-12-20 22:44 . 2008-05-07 03:47 90112 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwcub.dll
    - 2008-12-20 22:44 . 2008-05-07 03:46 81920 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwcu.dll
    + 2009-08-28 05:46 . 2008-05-06 21:46 81920 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwcu.dll
    - 2008-12-20 22:44 . 2008-05-09 16:52 77906 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwcfg.dll
    + 2009-08-28 05:45 . 2008-05-09 10:52 77906 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwcfg.dll
    + 2009-08-28 05:46 . 2008-05-16 14:50 73728 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwcats.dll
    - 2008-12-20 22:44 . 2008-05-16 20:50 73728 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwcats.dll
    - 2008-12-20 22:44 . 2008-05-16 21:04 45056 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwbubl.dll
    + 2009-08-28 05:46 . 2008-05-16 15:04 45056 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwbubl.dll
    - 2008-12-20 22:43 . 2008-05-16 21:32 17064 c:\windows\system32\spool\drivers\w32x86\3\LXDWwup d.exe
    + 2009-08-28 05:44 . 2008-05-16 15:32 17064 c:\windows\system32\spool\drivers\w32x86\3\LXDWwup d.exe
    + 2009-08-28 05:46 . 2008-04-15 11:15 44032 c:\windows\system32\spool\drivers\w32x86\3\lxdwwbg c.dll
    - 2008-12-20 22:44 . 2008-04-15 17:15 44032 c:\windows\system32\spool\drivers\w32x86\3\lxdwwbg c.dll
    + 2009-08-28 05:46 . 2008-05-16 15:32 82600 c:\windows\system32\spool\drivers\w32x86\3\lxdwvie w.exe
    - 2008-12-20 22:44 . 2008-05-16 21:32 82600 c:\windows\system32\spool\drivers\w32x86\3\lxdwvie w.exe
    - 2008-12-20 22:43 . 2008-04-15 17:09 13312 c:\windows\system32\spool\drivers\w32x86\3\LXDWupt r.dll
    + 2009-08-28 05:44 . 2008-04-15 11:09 13312 c:\windows\system32\spool\drivers\w32x86\3\LXDWupt r.dll
    + 2009-08-28 05:46 . 2008-04-15 11:14 43520 c:\windows\system32\spool\drivers\w32x86\3\lxdwupl r.dll
    - 2008-12-20 22:44 . 2008-04-15 17:14 43520 c:\windows\system32\spool\drivers\w32x86\3\lxdwupl r.dll
    - 2008-12-20 22:44 . 2008-05-16 21:33 82600 c:\windows\system32\spool\drivers\w32x86\3\lxdwupl d.exe
    + 2009-08-28 05:46 . 2008-05-16 15:33 82600 c:\windows\system32\spool\drivers\w32x86\3\lxdwupl d.exe
    - 2008-12-20 22:44 . 2008-05-16 21:33 82600 c:\windows\system32\spool\drivers\w32x86\3\lxdwtim e.exe
    + 2009-08-28 05:46 . 2008-05-16 15:33 82600 c:\windows\system32\spool\drivers\w32x86\3\lxdwtim e.exe
    - 2008-12-20 22:44 . 2008-05-16 20:50 98304 c:\windows\system32\spool\drivers\w32x86\3\lxdwtim e.dll
    + 2009-08-28 05:46 . 2008-05-16 14:50 98304 c:\windows\system32\spool\drivers\w32x86\3\lxdwtim e.dll
    + 2009-08-28 05:46 . 2008-05-16 15:32 98984 c:\windows\system32\spool\drivers\w32x86\3\lxdwser v.exe
    - 2008-12-20 22:44 . 2008-05-16 21:32 98984 c:\windows\system32\spool\drivers\w32x86\3\lxdwser v.exe
    - 2008-12-20 22:44 . 2008-05-07 03:50 36864 c:\windows\system32\spool\drivers\w32x86\3\lxdwcur .dll
    + 2009-08-28 05:46 . 2008-05-06 21:50 36864 c:\windows\system32\spool\drivers\w32x86\3\lxdwcur .dll
    - 2008-12-20 22:44 . 2008-05-07 03:47 90112 c:\windows\system32\spool\drivers\w32x86\3\lxdwcub .dll
    + 2009-08-28 05:46 . 2008-05-06 21:47 90112 c:\windows\system32\spool\drivers\w32x86\3\lxdwcub .dll
    + 2009-08-28 05:46 . 2008-05-06 21:46 81920 c:\windows\system32\spool\drivers\w32x86\3\lxdwcu. dll
    - 2008-12-20 22:44 . 2008-05-07 03:46 81920 c:\windows\system32\spool\drivers\w32x86\3\lxdwcu. dll
    - 2008-12-20 22:42 . 2008-05-09 16:52 77906 c:\windows\system32\spool\drivers\w32x86\3\lxdwcfg .dll
    + 2009-08-28 05:43 . 2008-05-09 10:52 77906 c:\windows\system32\spool\drivers\w32x86\3\lxdwcfg .dll
    + 2009-08-28 05:46 . 2008-05-16 14:50 73728 c:\windows\system32\spool\drivers\w32x86\3\lxdwcat s.dll
    - 2008-12-20 22:44 . 2008-05-16 20:50 73728 c:\windows\system32\spool\drivers\w32x86\3\lxdwcat s.dll
    - 2008-12-20 22:44 . 2008-05-16 21:04 45056 c:\windows\system32\spool\drivers\w32x86\3\lxdwbub l.dll
    + 2009-08-28 05:46 . 2008-05-16 15:04 45056 c:\windows\system32\spool\drivers\w32x86\3\lxdwbub l.dll
    + 2008-07-13 04:36 . 2007-07-27 15:41 16760 c:\windows\system32\spmsg.dll
    + 2004-08-04 12:00 . 2004-08-04 12:00 94720 c:\windows\system32\sofatnet.exe
    + 2009-08-15 18:45 . 2009-06-05 16:42 39424 c:\windows\system32\ReinstallBackups\0005\DriverFi les\usbaapl.sys
    + 2008-07-30 00:59 . 2008-07-30 00:59 43544 c:\windows\system32\PresentationHostProxy.dll
    + 2004-08-24 09:13 . 2009-08-22 08:15 71904 c:\windows\system32\perfc009.dat
    + 2008-07-25 16:17 . 2008-07-25 16:17 15360 c:\windows\system32\mui\0409\mscorees.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 83968 c:\windows\system32\mscories.dll
    + 2009-08-28 05:43 . 2008-05-06 21:50 36864 c:\windows\system32\lxdwcur.dll
    - 2008-12-20 22:42 . 2008-05-07 03:50 36864 c:\windows\system32\lxdwcur.dll
    - 2008-12-20 22:42 . 2008-05-07 03:47 90112 c:\windows\system32\lxdwcub.dll
    + 2009-08-28 05:43 . 2008-05-06 21:47 90112 c:\windows\system32\lxdwcub.dll
    - 2008-12-20 22:42 . 2008-05-07 03:46 81920 c:\windows\system32\lxdwcu.dll
    + 2009-08-28 05:43 . 2008-05-06 21:46 81920 c:\windows\system32\lxdwcu.dll
    + 2009-08-28 05:43 . 2008-02-21 05:11 77906 c:\windows\system32\LXDWcfg.dll
    - 2008-12-20 22:42 . 2008-02-21 12:11 77906 c:\windows\system32\LXDWcfg.dll
    + 2004-08-04 12:00 . 2004-08-04 12:00 40960 c:\windows\system32\lsm32.sys
    + 2008-07-30 00:24 . 2008-07-30 00:24 97800 c:\windows\system32\infocardapi.dll
    + 2008-07-30 00:24 . 2008-07-30 00:24 11264 c:\windows\system32\icardres.dll
    + 2008-07-30 02:10 . 2008-07-30 02:10 73720 c:\windows\system32\dxva2.dll
    + 2009-06-25 08:25 . 2009-06-25 08:25 54272 c:\windows\system32\dllcache\wdigest.dll
    + 2009-02-03 19:59 . 2009-06-25 08:25 56832 c:\windows\system32\dllcache\secur32.dll
    - 2009-02-03 19:59 . 2009-02-03 19:59 56832 c:\windows\system32\dllcache\secur32.dll
    + 2009-06-24 11:18 . 2009-06-24 11:18 92928 c:\windows\system32\dllcache\ksecdd.sys
    + 2009-08-22 08:08 . 2008-07-06 12:06 89088 c:\windows\system32\dllcache\filterpipelineprintpr oc.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 96760 c:\windows\system32\dfshim.dll
    + 2009-09-19 13:44 . 2009-09-19 13:44 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009091920090 920\index.dat
    - 2004-08-24 09:29 . 2009-08-12 08:07 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    + 2004-08-24 09:29 . 2009-09-22 01:11 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    - 2004-08-24 09:29 . 2009-08-12 08:07 32768 c:\windows\system32\config\systemprofile\Cookies\i ndex.dat
    + 2004-08-24 09:29 . 2009-09-22 01:11 32768 c:\windows\system32\config\systemprofile\Cookies\i ndex.dat
    + 2004-08-04 12:00 . 2004-08-04 12:00 46592 c:\windows\system32\BtwSrv.dll
    + 2008-07-30 04:40 . 2008-07-30 04:40 70648 c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
    + 2008-07-30 04:40 . 2008-07-30 04:40 91136 c:\windows\Microsoft.NET\Framework\v3.5\MSBuild.ex e
    + 2008-07-30 04:40 . 2008-07-30 04:40 41984 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft. VisualC.STLCLR.dll
    + 2008-07-30 04:40 . 2008-07-30 04:40 40960 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft. Data.Entity.Build.Tasks.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 89080 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.2052.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 92664 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1042.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 95224 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1041.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 89592 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1028.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 84480 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.2052.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 94720 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1042.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 97792 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1041.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 84992 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1028.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 97280 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\DeleteTemp.exe
    + 2008-07-30 04:40 . 2008-07-30 04:40 95224 c:\windows\Microsoft.NET\Framework\v3.5\EdmGen.exe
    + 2008-07-30 04:40 . 2008-07-30 04:40 78856 c:\windows\Microsoft.NET\Framework\v3.5\DataSvcUti l.exe
    + 2008-07-30 04:40 . 2008-07-30 04:40 41984 c:\windows\Microsoft.NET\Framework\v3.5\AddInUtil. exe
    + 2008-07-30 04:40 . 2008-07-30 04:40 41992 c:\windows\Microsoft.NET\Framework\v3.5\AddInProce ss32.exe
    + 2008-07-30 04:40 . 2008-07-30 04:40 41992 c:\windows\Microsoft.NET\Framework\v3.5\AddInProce ss.exe
    + 2008-07-30 02:10 . 2008-07-30 02:10 46104 c:\windows\Microsoft.NET\Framework\v3.0\WPF\Presen tationFontCache.exe
    + 2008-07-30 00:59 . 2008-07-30 00:59 32768 c:\windows\Microsoft.NET\Framework\v3.0\WPF\Presen tationCFFRasterizer.dll
    + 2008-07-30 02:10 . 2008-07-30 02:10 71160 c:\windows\Microsoft.NET\Framework\v3.0\WPF\PenIMC .dll
    + 2008-07-30 00:32 . 2008-07-30 00:32 17448 c:\windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\PerformanceCounterInstaller.exe
    + 2008-07-30 00:16 . 2008-07-30 00:16 32768 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.WasHosting.dll
    + 2008-07-30 00:16 . 2008-07-30 00:16 73728 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.Install.dll
    + 2008-07-30 00:16 . 2008-07-30 00:16 20504 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceMonikerSupport.dll
    + 2008-07-30 00:16 . 2008-07-30 00:16 11280 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelEvents.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 37896 c:\windows\Microsoft.NET\Framework\v2.0.50727\WMIN et_Utils.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 81400 c:\windows\Microsoft.NET\Framework\v2.0.50727\TLBR EF.DLL
    + 2008-07-25 16:17 . 2008-07-25 16:17 77824 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Web.RegularExpressions.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 57392 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.EnterpriseServices.Thunk.dll
    - 2005-09-23 12:28 . 2005-09-23 12:28 81920 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Drawing.Design.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 81920 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Drawing.Design.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 81920 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Configuration.Install.dll
    - 2005-09-23 12:28 . 2005-09-23 12:28 81920 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Configuration.Install.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 95232 c:\windows\Microsoft.NET\Framework\v2.0.50727\ShFu sRes.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 16896 c:\windows\Microsoft.NET\Framework\v2.0.50727\sbsc mp20_mscorlib.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 61952 c:\windows\Microsoft.NET\Framework\v2.0.50727\regt libv12.exe
    - 2005-09-23 12:28 . 2005-09-23 12:28 32768 c:\windows\Microsoft.NET\Framework\v2.0.50727\RegS vcs.exe
    + 2008-07-25 16:17 . 2008-07-25 16:17 32768 c:\windows\Microsoft.NET\Framework\v2.0.50727\RegS vcs.exe
    + 2008-07-25 16:17 . 2008-07-25 16:17 53248 c:\windows\Microsoft.NET\Framework\v2.0.50727\RegA sm.exe
    - 2005-09-23 12:28 . 2005-09-23 12:28 53248 c:\windows\Microsoft.NET\Framework\v2.0.50727\RegA sm.exe
    + 2008-07-25 16:17 . 2008-07-25 16:17 88584 c:\windows\Microsoft.NET\Framework\v2.0.50727\Perf Counter.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 24584 c:\windows\Microsoft.NET\Framework\v2.0.50727\norm alization.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 31744 c:\windows\Microsoft.NET\Framework\v2.0.50727\MUI\ 0409\mscorsecr.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 19456 c:\windows\Microsoft.NET\Framework\v2.0.50727\msco rtim.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 69632 c:\windows\Microsoft.NET\Framework\v2.0.50727\msco rsvw.exe
    + 2008-07-25 16:16 . 2008-07-25 16:16 18944 c:\windows\Microsoft.NET\Framework\v2.0.50727\msco rsn.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 77312 c:\windows\Microsoft.NET\Framework\v2.0.50727\msco rsec.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 94208 c:\windows\Microsoft.NET\Framework\v2.0.50727\msco rld.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 46592 c:\windows\Microsoft.NET\Framework\v2.0.50727\msco rie.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 83456 c:\windows\Microsoft.NET\Framework\v2.0.50727\msco rdbc.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 69632 c:\windows\Microsoft.NET\Framework\v2.0.50727\MSBu ild.exe
    - 2005-09-23 12:28 . 2005-09-23 12:28 69632 c:\windows\Microsoft.NET\Framework\v2.0.50727\MSBu ild.exe
    + 2008-07-25 16:16 . 2008-07-25 16:16 97792 c:\windows\Microsoft.NET\Framework\v2.0.50727\MmcA spExt.dll
    - 2005-09-23 12:28 . 2005-09-23 12:28 12800 c:\windows\Microsoft.NET\Framework\v2.0.50727\Micr osoft.Vsa.Vb.CodeDOMProcessor.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 12800 c:\windows\Microsoft.NET\Framework\v2.0.50727\Micr osoft.Vsa.Vb.CodeDOMProcessor.dll
    - 2005-09-23 12:28 . 2005-09-23 12:28 32768 c:\windows\Microsoft.NET\Framework\v2.0.50727\Micr osoft.Vsa.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 32768 c:\windows\Microsoft.NET\Framework\v2.0.50727\Micr osoft.Vsa.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 28672 c:\windows\Microsoft.NET\Framework\v2.0.50727\Micr osoft.VisualBasic.Vsa.dll
    - 2005-09-23 12:28 . 2005-09-23 12:28 28672 c:\windows\Microsoft.NET\Framework\v2.0.50727\Micr osoft.VisualBasic.Vsa.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 77824 c:\windows\Microsoft.NET\Framework\v2.0.50727\Micr osoft.Build.Utilities.dll
    - 2005-09-23 12:28 . 2005-09-23 12:28 36864 c:\windows\Microsoft.NET\Framework\v2.0.50727\Micr osoft.Build.Framework.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 36864 c:\windows\Microsoft.NET\Framework\v2.0.50727\Micr osoft.Build.Framework.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 40960 c:\windows\Microsoft.NET\Framework\v2.0.50727\jsc. exe
    - 2005-09-23 12:28 . 2005-09-23 12:28 40960 c:\windows\Microsoft.NET\Framework\v2.0.50727\jsc. exe
    + 2008-07-25 16:17 . 2008-07-25 16:17 72192 c:\windows\Microsoft.NET\Framework\v2.0.50727\ISym Wrapper.dll
    - 2005-09-23 12:28 . 2005-09-23 12:28 72192 c:\windows\Microsoft.NET\Framework\v2.0.50727\ISym Wrapper.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 65032 c:\windows\Microsoft.NET\Framework\v2.0.50727\Inst allUtilLib.dll
    - 2007-04-13 08:21 . 2007-04-13 08:21 28672 c:\windows\Microsoft.NET\Framework\v2.0.50727\Inst allUtil.exe
    + 2008-07-25 16:17 . 2008-07-25 16:17 28672 c:\windows\Microsoft.NET\Framework\v2.0.50727\Inst allUtil.exe
    + 2008-07-25 16:17 . 2008-07-25 16:17 77824 c:\windows\Microsoft.NET\Framework\v2.0.50727\IEHo st.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 18936 c:\windows\Microsoft.NET\Framework\v2.0.50727\fusi on.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 62968 c:\windows\Microsoft.NET\Framework\v2.0.50727\dfdl l.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 35320 c:\windows\Microsoft.NET\Framework\v2.0.50727\cvtr es.exe
    + 2008-07-25 16:17 . 2008-07-25 16:17 69120 c:\windows\Microsoft.NET\Framework\v2.0.50727\Cust omMarshalers.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 27136 c:\windows\Microsoft.NET\Framework\v2.0.50727\Cult ure.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 13312 c:\windows\Microsoft.NET\Framework\v2.0.50727\csco mpmgd.dll
    - 2005-09-23 12:28 . 2005-09-23 12:28 13312 c:\windows\Microsoft.NET\Framework\v2.0.50727\csco mpmgd.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 80376 c:\windows\Microsoft.NET\Framework\v2.0.50727\csc. exe
    + 2008-07-25 16:17 . 2008-07-25 16:17 89608 c:\windows\Microsoft.NET\Framework\v2.0.50727\CORP erfMonExt.dll
    + 2008-11-25 09:59 . 2008-11-25 09:59 31560 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspn et_wp.exe
    + 2008-07-25 16:16 . 2008-07-25 16:16 34312 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspn et_state.exe
    + 2008-07-25 16:16 . 2008-07-25 16:16 33288 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspn et_regiis.exe
    + 2008-07-25 16:16 . 2008-07-25 16:16 24576 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspn et_regbrowsers.exe
    + 2008-07-25 16:16 . 2008-07-25 16:16 84480 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspn et_rc.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 33800 c:\windows\Microsoft.NET\Framework\v2.0.50727\Aspn et_perf.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 17416 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspn et_isapi.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 22024 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspn et_filter.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 36864 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspn et_compiler.exe
    - 2005-09-23 12:28 . 2005-09-23 12:28 36864 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspn et_compiler.exe
    + 2008-07-25 16:17 . 2008-07-25 16:17 58880 c:\windows\Microsoft.NET\Framework\v2.0.50727\AppL aunch.exe
    + 2008-07-25 16:16 . 2008-07-25 16:16 98808 c:\windows\Microsoft.NET\Framework\v2.0.50727\alin k.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 10752 c:\windows\Microsoft.NET\Framework\v2.0.50727\Acce ssibility.dll
    - 2005-09-23 12:28 . 2005-09-23 12:28 10752 c:\windows\Microsoft.NET\Framework\v2.0.50727\Acce ssibility.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 13824 c:\windows\Microsoft.NET\Framework\v2.0.50727\1033 \CvtResUI.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 28672 c:\windows\Microsoft.NET\Framework\v2.0.50727\1033 \alinkui.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 96768 c:\windows\Microsoft.NET\Framework\v1.0.3705\mscor mmc.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 16896 c:\windows\Microsoft.NET\Framework\SharedReg12.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 16896 c:\windows\Microsoft.NET\Framework\sbscmp20_perfco unter.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 16896 c:\windows\Microsoft.NET\Framework\sbscmp20_mscorw ks.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 16896 c:\windows\Microsoft.NET\Framework\sbscmp10.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 82944 c:\windows\Microsoft.NET\Framework\NETFXSBS10.exe
    + 2008-07-30 02:07 . 2008-07-30 02:07 23040 c:\windows\Installer\42a133a.msp
    + 2009-08-22 08:06 . 2009-08-22 08:06 88576 c:\windows\Installer\423a495.msi
    + 2009-08-26 23:09 . 2009-08-26 23:09 61440 c:\windows\Installer\{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}\ARPPRODUCTICON.exe
    + 2009-08-26 23:09 . 2009-08-26 23:09 61440 c:\windows\Installer\{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}\_SHCT_Sprint.exe.exe
    - 2008-06-22 04:52 . 2008-06-27 05:23 23040 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
    + 2008-06-22 04:52 . 2009-08-30 17:21 23040 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
    + 2008-06-22 04:52 . 2009-08-30 17:21 27136 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
    - 2008-06-22 04:52 . 2008-06-27 05:23 27136 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
    - 2008-06-22 04:52 . 2008-06-27 05:23 11264 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
    + 2008-06-22 04:52 . 2009-08-30 17:21 11264 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
    - 2008-06-22 04:52 . 2008-06-27 05:23 12288 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
    + 2008-06-22 04:52 . 2009-08-30 17:21 12288 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
    + 2009-08-22 08:08 . 2008-07-06 12:06 89088 c:\windows\Driver Cache\i386\filterpipelineprintproc.dll
    + 2009-08-22 08:21 . 2009-08-22 08:21 60928 c:\windows\assembly\NativeImages_v2.0.50727_32\UIA utomationProvider\a715aa442ef87ae99b3ade185599249d \UIAutomationProvider.ni.dll
    + 2009-08-22 08:35 . 2009-08-22 08:35 37888 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Windows.Pres#\423f794d1f4ed6e120fbb02e436491cb \System.Windows.Presentation.ni.dll
    + 2009-08-22 08:34 . 2009-08-22 08:34 36864 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Web.DynamicD#\19ca1747c1ea18a3b639b302bca8df93 \System.Web.DynamicData.Design.ni.dll
    + 2009-08-22 08:32 . 2009-08-22 08:32 94208 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.ComponentMod#\532438e2acfcadc469a4d468c51f8451 \System.ComponentModel.DataAnnotations.ni.dll
    + 2009-08-22 08:31 . 2009-08-22 08:31 82944 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.AddIn.Contra#\597b20e1b053d6a510cfe033c07a63e6 \System.AddIn.Contract.ni.dll
    + 2009-08-22 08:19 . 2009-08-22 08:19 47104 c:\windows\assembly\NativeImages_v2.0.50727_32\Pre sentationFontCac#\2d7408a0232f2e2efd0d7adf5dfa733a \PresentationFontCache.ni.exe
    + 2009-08-22 08:18 . 2009-08-22 08:18 39424 c:\windows\assembly\NativeImages_v2.0.50727_32\Pre sentationCFFRast#\c8fd2d9233f8ea3031fb16f697635231 \PresentationCFFRasterizer.ni.dll
    + 2009-08-22 08:33 . 2009-08-22 08:33 55296 c:\windows\assembly\NativeImages_v2.0.50727_32\Mic rosoft.Vsa\790cf1edb17ee41b59be62ecbd59613b\Micros oft.Vsa.ni.dll
    + 2009-08-22 08:31 . 2009-08-22 08:31 65024 c:\windows\assembly\NativeImages_v2.0.50727_32\Mic rosoft.Build.Fra#\e9aba2eab90d647356f65e66053da02b \Microsoft.Build.Framework.ni.dll
    + 2009-08-22 08:31 . 2009-08-22 08:31 74752 c:\windows\assembly\NativeImages_v2.0.50727_32\Mic rosoft.Build.Fra#\28343d470d992f169ca0e7cdb3cc3117 \Microsoft.Build.Framework.ni.dll
    + 2009-08-22 08:31 . 2009-08-22 08:31 14336 c:\windows\assembly\NativeImages_v2.0.50727_32\dfs vc\f4e38208e88cb4cc314a1d6543b9fcc6\dfsvc.ni.exe
    + 2009-08-22 08:31 . 2009-08-22 08:31 25600 c:\windows\assembly\NativeImages_v2.0.50727_32\Acc essibility\11eb4f6606ba01e5128805759121ea6c\Access ibility.ni.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 94208 c:\windows\assembly\GAC_MSIL\WindowsFormsIntegrati on\3.0.0.0__31bf3856ad364e35\WindowsFormsIntegrati on.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 98304 c:\windows\assembly\GAC_MSIL\UIAutomationTypes\3.0 .0.0__31bf3856ad364e35\UIAutomationTypes.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 40960 c:\windows\assembly\GAC_MSIL\UIAutomationProvider\ 3.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll
    + 2009-08-22 08:10 . 2009-08-22 08:10 12288 c:\windows\assembly\GAC_MSIL\System.Windows.Presen tation\3.5.0.0__b77a5c561934e089\System.Windows.Pr esentation.dll
    + 2009-08-22 08:11 . 2009-08-22 08:11 61440 c:\windows\assembly\GAC_MSIL\System.Web.Routing\3. 5.0.0__31bf3856ad364e35\System.Web.Routing.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 77824 c:\windows\assembly\GAC_MSIL\System.Web.RegularExp ressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.Regu larExpressions.dll
    + 2009-08-22 08:11 . 2009-08-22 08:11 32768 c:\windows\assembly\GAC_MSIL\System.Web.DynamicDat a.Design\3.5.0.0__31bf3856ad364e35\System.Web.Dyna micData.Design.dll
    + 2009-08-22 08:11 . 2009-08-22 08:11 77824 c:\windows\assembly\GAC_MSIL\System.Web.Abstractio ns\3.5.0.0__31bf3856ad364e35\System.Web.Abstractio ns.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 32768 c:\windows\assembly\GAC_MSIL\System.ServiceModel.W asHosting\3.0.0.0__b77a5c561934e089\System.Service Model.WasHosting.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 73728 c:\windows\assembly\GAC_MSIL\System.ServiceModel.I nstall\3.0.0.0__b77a5c561934e089\System.ServiceMod el.Install.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 81920 c:\windows\assembly\GAC_MSIL\System.Drawing.Design \2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.d ll
    - 2008-07-13 04:45 . 2008-07-13 04:45 81920 c:\windows\assembly\GAC_MSIL\System.Drawing.Design \2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.d ll
    + 2009-08-22 08:10 . 2009-08-22 08:10 53248 c:\windows\assembly\GAC_MSIL\System.Data.DataSetEx tensions\3.5.0.0__b77a5c561934e089\System.Data.Dat aSetExtensions.dll
    - 2008-07-13 04:45 . 2008-07-13 04:45 81920 c:\windows\assembly\GAC_MSIL\System.Configuration. Install\2.0.0.0__b03f5f7f11d50a3a\System.Configura tion.Install.dll
    + 2009-08-22 08:15 . 2009-08-22 08:15 81920 c:\windows\assembly\GAC_MSIL\System.Configuration. Install\2.0.0.0__b03f5f7f11d50a3a\System.Configura tion.Install.dll
    + 2009-08-22 08:11 . 2009-08-22 08:11 57344 c:\windows\assembly\GAC_MSIL\System.ComponentModel .DataAnnotations\3.5.0.0__31bf3856ad364e35\System. ComponentModel.DataAnnotations.dll
    + 2009-08-22 08:10 . 2009-08-22 08:10 45056 c:\windows\assembly\GAC_MSIL\System.AddIn.Contract \2.0.0.0__b03f5f7f11d50a3a\System.AddIn.Contract.d ll
    + 2009-08-22 08:09 . 2009-08-22 08:09 46104 c:\windows\assembly\GAC_MSIL\PresentationFontCache \3.0.0.0__31bf3856ad364e35\PresentationFontCache.e xe
    + 2009-08-22 08:09 . 2009-08-22 08:09 32768 c:\windows\assembly\GAC_MSIL\PresentationCFFRaster izer\3.0.0.0__31bf3856ad364e35\PresentationCFFRast erizer.dll
    - 2008-07-13 04:44 . 2008-07-13 04:44 32768 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0 __b03f5f7f11d50a3a\Microsoft.Vsa.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 32768 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0 __b03f5f7f11d50a3a\Microsoft.Vsa.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 12800 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.Code DOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.V sa.Vb.CodeDOMProcessor.dll
    - 2008-07-13 04:44 . 2008-07-13 04:44 12800 c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.Code DOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.V sa.Vb.CodeDOMProcessor.dll
    + 2009-08-22 08:10 . 2009-08-22 08:10 41984 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC.STL CLR\1.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.ST LCLR.dll
    - 2008-07-13 04:44 . 2008-07-13 04:44 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic .Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBas ic.Vsa.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 28672 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic .Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBas ic.Vsa.dll
    + 2009-08-22 08:15 . 2009-08-22 08:15 77824 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utili ties\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Uti lities.dll
    + 2009-08-22 08:10 . 2009-08-22 08:10 94208 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utili ties.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Buil d.Utilities.v3.5.dll
    + 2009-08-22 08:10 . 2009-08-22 08:10 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Frame work\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Fra mework.dll
    + 2009-08-22 08:15 . 2009-08-22 08:15 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Frame work\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Fra mework.dll
    - 2008-07-13 04:45 . 2008-07-13 04:45 36864 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Frame work\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Fra mework.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 77824 c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5 f7f11d50a3a\IEHost.dll
    - 2008-07-13 04:44 . 2008-07-13 04:44 13312 c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b0 3f5f7f11d50a3a\cscompmgd.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 13312 c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b0 3f5f7f11d50a3a\cscompmgd.dll
    - 2008-07-13 04:45 . 2008-07-13 04:45 10752 c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0 __b03f5f7f11d50a3a\Accessibility.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 10752 c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0 __b03f5f7f11d50a3a\Accessibility.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 72192 c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b0 3f5f7f11d50a3a\ISymWrapper.dll
    - 2008-07-13 04:45 . 2008-07-13 04:45 72192 c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b0 3f5f7f11d50a3a\ISymWrapper.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 69120 c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0. 0__b03f5f7f11d50a3a\CustomMarshalers.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 8192 c:\windows\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a 3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
    + 2008-06-21 20:25 . 2008-04-14 00:11 2304 c:\windows\system32\mfsdisk.sys
    + 2008-07-30 04:40 . 2008-07-30 04:40 5632 c:\windows\Microsoft.NET\Framework\v3.5\Sentinel.v 3.5Client.dll
    - 2005-09-23 12:28 . 2005-09-23 12:28 7168 c:\windows\Microsoft.NET\Framework\v2.0.50727\Micr osoft_VsaVb.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 7168 c:\windows\Microsoft.NET\Framework\v2.0.50727\Micr osoft_VsaVb.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 5632 c:\windows\Microsoft.NET\Framework\v2.0.50727\Micr osoft.VisualC.Dll
    - 2005-09-23 12:29 . 2005-09-23 12:29 5632 c:\windows\Microsoft.NET\Framework\v2.0.50727\Micr osoft.VisualC.Dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 6656 c:\windows\Microsoft.NET\Framework\v2.0.50727\IIEH ost.dll
    - 2005-09-23 12:28 . 2005-09-23 12:28 8192 c:\windows\Microsoft.NET\Framework\v2.0.50727\IEEx ecRemote.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 8192 c:\windows\Microsoft.NET\Framework\v2.0.50727\IEEx ecRemote.dll
    - 2007-04-13 08:21 . 2007-04-13 08:21 9728 c:\windows\Microsoft.NET\Framework\v2.0.50727\IEEx ec.exe
    + 2008-07-25 16:17 . 2008-07-25 16:17 9728 c:\windows\Microsoft.NET\Framework\v2.0.50727\IEEx ec.exe
    - 2007-04-13 08:20 . 2007-04-13 08:20 5120 c:\windows\Microsoft.NET\Framework\v2.0.50727\dfsv c.exe
    + 2008-07-25 16:16 . 2008-07-25 16:16 5120 c:\windows\Microsoft.NET\Framework\v2.0.50727\dfsv c.exe
    + 2008-06-22 04:52 . 2009-08-30 17:21 4096 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
    - 2008-06-22 04:52 . 2008-06-27 05:23 4096 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
    + 2009-08-22 08:10 . 2009-08-22 08:10 5632 c:\windows\assembly\GAC_MSIL\Sentinel.v3.5Client\3 .5.0.0__b03f5f7f11d50a3a\Sentinel.v3.5Client.dll
    - 2008-07-13 04:44 . 2008-07-13 04:44 7168 c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0 .0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 7168 c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0 .0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
    - 2008-07-13 04:45 . 2008-07-13 04:45 5632 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0 .0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
    + 2009-08-22 08:15 . 2009-08-22 08:15 5632 c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0 .0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 6656 c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f 5f7f11d50a3a\IIEHost.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 8192 c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0_ _b03f5f7f11d50a3a\IEExecRemote.dll
    - 2008-07-13 04:45 . 2008-07-13 04:45 8192 c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0_ _b03f5f7f11d50a3a\IEExecRemote.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 113664 c:\windows\WinSxS\x86_System.EnterpriseServices_b0 3f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
    - 2008-07-13 04:44 . 2008-07-13 04:44 258048 c:\windows\WinSxS\x86_System.EnterpriseServices_b0 3f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 258048 c:\windows\WinSxS\x86_System.EnterpriseServices_b0 3f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
    + 2007-11-07 07:19 . 2007-11-07 07:19 655872 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a 1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcr90.dll
    + 2007-11-07 07:19 . 2007-11-07 07:19 568832 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a 1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcp90.dll
    + 2007-11-07 02:23 . 2007-11-07 02:23 224768 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a 1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcm90.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 635904 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a 1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcr80.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 558080 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a 1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcp80.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 479232 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a 1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcm80.dll
    - 2008-12-20 22:44 . 2008-05-09 17:06 520192 c:\windows\twain_32\Lexmark\7600 Series\lxdwTWUI.dll
    + 2009-08-28 05:45 . 2008-05-09 11:06 520192 c:\windows\twain_32\Lexmark\7600 Series\lxdwTWUI.dll
    + 2009-08-28 05:45 . 2008-05-09 11:06 331776 c:\windows\twain_32\Lexmark\7600 Series\lxdwTwPro.dll
    - 2008-12-20 22:44 . 2008-05-09 17:06 331776 c:\windows\twain_32\Lexmark\7600 Series\lxdwTwPro.dll
    - 2008-12-20 22:44 . 2008-05-09 17:05 380928 c:\windows\twain_32\Lexmark\7600 Series\lxdwIPTK.dll
    + 2009-08-28 05:45 . 2008-05-09 11:05 380928 c:\windows\twain_32\Lexmark\7600 Series\lxdwIPTK.dll
    + 2008-07-30 02:26 . 2008-07-30 02:26 301568 c:\windows\system32\XPSViewer\XPSViewer.exe
    + 2009-08-22 08:08 . 2008-07-06 12:06 575488 c:\windows\system32\xpsshhdr.dll
    + 2004-08-04 12:00 . 2004-08-04 12:00 132096 c:\windows\system32\wmdtc.exe
    + 2008-07-30 00:59 . 2008-07-30 00:59 161296 c:\windows\system32\UIAutomationCore.dll
    + 2009-08-22 08:08 . 2008-07-06 12:06 765440 c:\windows\system32\spool\XPSEP\i386\mxdwdrv.dll
    + 2009-08-22 08:08 . 2008-07-06 12:06 765440 c:\windows\system32\spool\XPSEP\i386\i386\mxdwdrv. dll
    + 2009-08-22 08:08 . 2008-07-06 12:06 748032 c:\windows\system32\spool\XPSEP\amd64\mxdwdrv.dll
    + 2009-08-22 08:08 . 2008-07-06 12:06 748032 c:\windows\system32\spool\XPSEP\amd64\amd64\mxdwdr v.dll
    + 2009-08-22 08:08 . 2008-07-06 12:06 147456 c:\windows\system32\spool\prtprocs\x64\filterpipel ineprintproc.dll
    + 2009-08-22 08:08 . 2008-07-06 10:50 597504 c:\windows\system32\spool\prtprocs\w32x86\printfil terpipelinesvc.exe
    - 2008-12-20 22:44 . 2008-05-16 21:06 121856 c:\windows\system32\spool\prtprocs\w32x86\lxdwdrpp .dll
    + 2009-08-28 05:46 . 2008-05-16 15:06 121856 c:\windows\system32\spool\prtprocs\w32x86\lxdwdrpp .dll
    + 2009-08-26 23:09 . 2007-05-15 08:08 761344 c:\windows\system32\spool\drivers\w32x86\unires.dl l
    + 2009-08-26 23:09 . 2008-04-14 00:12 744448 c:\windows\system32\spool\drivers\w32x86\unidrvui. dll
    + 2009-08-26 23:09 . 2008-04-14 00:12 373248 c:\windows\system32\spool\drivers\w32x86\unidrv.dl l
    - 2008-12-20 22:44 . 2008-05-16 21:06 122880 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwxmlu.dll
    + 2009-08-28 05:46 . 2008-05-16 15:06 122880 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwxmlu.dll
    - 2008-12-20 22:44 . 2008-05-16 21:32 144040 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwwbgw.exe
    + 2009-08-28 05:46 . 2008-05-16 15:32 144040 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwwbgw.exe
    + 2009-08-28 05:46 . 2008-05-06 21:44 524288 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwutil.dll
    - 2008-12-20 22:44 . 2008-05-07 03:44 524288 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwutil.dll
    - 2008-12-20 22:44 . 2008-05-16 20:50 364544 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwuldr.dll
    + 2009-08-28 05:46 . 2008-05-16 14:50 364544 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwuldr.dll
    - 2008-12-20 22:44 . 2007-07-26 03:25 253952 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwsk0.dll
    + 2009-08-28 05:46 . 2007-07-25 21:25 253952 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwsk0.dll
    + 2009-08-28 05:46 . 2008-05-16 14:50 327680 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwretv.dll
    - 2008-12-20 22:44 . 2008-05-16 20:50 327680 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwretv.dll
    + 2009-08-28 05:46 . 2008-05-16 15:04 811008 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwptpc.dll
    - 2008-12-20 22:44 . 2008-05-16 21:04 811008 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwptpc.dll
    + 2009-08-28 05:46 . 2008-05-16 15:33 766632 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwpswx.exe
    - 2008-12-20 22:44 . 2008-05-16 21:33 766632 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwpswx.exe
    - 2008-12-20 22:44 . 2008-05-07 03:50 147456 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwpswr.dll
    + 2009-08-28 05:46 . 2008-05-06 21:50 147456 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwpswr.dll
    - 2008-12-20 22:44 . 2008-05-07 03:45 720896 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwpsw.dll
    + 2009-08-28 05:46 . 2008-05-06 21:45 720896 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwpsw.dll
    + 2009-08-28 05:46 . 2008-05-06 21:50 155648 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwprpr.dll
    - 2008-12-20 22:44 . 2008-05-07 03:50 155648 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwprpr.dll
    + 2009-08-28 05:46 . 2008-05-06 21:45 946176 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwprp.dll
    - 2008-12-20 22:44 . 2008-05-07 03:45 946176 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwprp.dll
    + 2009-08-28 05:46 . 2008-05-16 15:06 544768 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwppx.dll
    - 2008-12-20 22:44 . 2008-05-16 21:06 544768 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwppx.dll
    + 2009-08-28 05:46 . 2008-05-06 21:49 237568 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwlpar.dll
    - 2008-12-20 22:44 . 2008-05-07 03:49 237568 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwlpar.dll
    - 2008-12-20 22:44 . 2008-05-16 21:05 126976 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwlnks.dll
    + 2009-08-28 05:46 . 2008-05-16 15:05 126976 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwlnks.dll
    - 2008-12-20 22:44 . 2008-05-16 21:33 709288 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwjswx.exe
    + 2009-08-28 05:46 . 2008-05-16 15:33 709288 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwjswx.exe
    - 2008-12-20 22:44 . 2008-05-07 03:49 147456 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwjswr.dll
    + 2009-08-28 05:46 . 2008-05-06 21:49 147456 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwjswr.dll
    + 2009-08-28 05:46 . 2008-05-06 21:45 196608 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwjswo.dll
    - 2008-12-20 22:44 . 2008-05-07 03:45 196608 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwjswo.dll
    - 2008-12-20 22:44 . 2008-05-07 03:47 688128 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwjswb.dll
    + 2009-08-28 05:46 . 2008-05-06 21:47 688128 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwjswb.dll
    - 2008-12-20 22:44 . 2008-05-07 03:50 106496 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwinsr.dll
    + 2009-08-28 05:46 . 2008-05-06 21:50 106496 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwinsr.dll
    - 2008-12-20 22:44 . 2008-05-07 03:47 200704 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwinsb.dll
    + 2009-08-28 05:46 . 2008-05-06 21:47 200704 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwinsb.dll
    - 2008-12-20 22:44 . 2008-05-07 03:46 176128 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwins.dll
    + 2009-08-28 05:46 . 2008-05-06 21:46 176128 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwins.dll
    - 2008-12-20 22:44 . 2008-04-14 23:37 282624 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwibuf.dll
    + 2009-08-28 05:46 . 2008-04-14 17:37 282624 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwibuf.dll
    - 2008-12-20 22:44 . 2008-05-03 01:26 438272 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwhcp.dll
    + 2009-08-28 05:46 . 2008-05-02 19:26 438272 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwhcp.dll
    - 2008-12-20 22:44 . 2007-07-26 03:25 983121 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwgf.dll
    + 2009-08-28 05:46 . 2007-07-25 21:25 983121 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwgf.dll
    + 2009-08-28 05:46 . 2007-08-13 23:01 434176 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwedf.dll
    - 2008-12-20 22:44 . 2007-08-14 05:01 434176 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwedf.dll
    + 2009-08-28 05:46 . 2008-05-16 15:06 149504 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwdrui.dll
    - 2008-12-20 22:44 . 2008-05-16 21:06 149504 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwdrui.dll
    - 2008-12-20 22:44 . 2008-05-16 21:06 198144 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwdr.dll
    + 2009-08-28 05:46 . 2008-05-16 15:06 198144 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwdr.dll
    + 2009-08-28 05:46 . 2008-05-16 14:50 188416 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwdatr.dll
    - 2008-12-20 22:44 . 2008-05-16 20:50 188416 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwdatr.dll
    + 2009-08-28 05:46 . 2008-05-16 15:06 335872 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwcomx.dll
    - 2008-12-20 22:44 . 2008-05-16 21:06 335872 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwcomx.dll
    + 2009-08-28 05:46 . 2008-05-16 15:34 116416 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwcfgx.exe
    - 2008-12-20 22:44 . 2008-05-16 21:34 116416 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwcfgx.exe
    + 2009-08-22 08:08 . 2008-03-13 04:52 761344 c:\windows\system32\spool\drivers\w32x86\3\unires. dll
    + 2009-08-22 08:08 . 2008-07-06 12:06 744960 c:\windows\system32\spool\drivers\w32x86\3\unidrvu i.dll
    + 2009-08-22 08:08 . 2008-07-06 12:06 373248 c:\windows\system32\spool\drivers\w32x86\3\unidrv. dll
    + 2009-08-22 08:08 . 2008-07-06 12:06 198656 c:\windows\system32\spool\drivers\w32x86\3\mxdwdui .dll
    + 2009-08-22 08:08 . 2008-07-06 12:06 765440 c:\windows\system32\spool\drivers\w32x86\3\mxdwdrv .dll
    - 2008-12-20 22:43 . 2008-04-14 22:14 626688 c:\windows\system32\spool\drivers\w32x86\3\msvcr80 .dll
    + 2009-08-28 05:44 . 2008-04-14 16:14 626688 c:\windows\system32\spool\drivers\w32x86\3\msvcr80 .dll
    + 2009-08-28 05:44 . 2008-04-14 16:14 548864 c:\windows\system32\spool\drivers\w32x86\3\msvcp80 .dll
    - 2008-12-20 22:43 . 2008-04-14 22:14 548864 c:\windows\system32\spool\drivers\w32x86\3\msvcp80 .dll
    + 2009-08-28 05:44 . 2008-04-14 16:14 479232 c:\windows\system32\spool\drivers\w32x86\3\msvcm80 .dll
    - 2008-12-20 22:43 . 2008-04-14 22:14 479232 c:\windows\system32\spool\drivers\w32x86\3\msvcm80 .dll
    - 2008-12-20 22:44 . 2008-05-16 21:06 122880 c:\windows\system32\spool\drivers\w32x86\3\lxdwxml u.dll
    + 2009-08-28 05:46 . 2008-05-16 15:06 122880 c:\windows\system32\spool\drivers\w32x86\3\lxdwxml u.dll
    - 2008-12-20 22:43 . 2008-04-16 05:08 352256 c:\windows\system32\spool\drivers\w32x86\3\LXDWwup d.dll
    + 2009-08-28 05:44 . 2008-04-15 11:08 352256 c:\windows\system32\spool\drivers\w32x86\3\LXDWwup d.dll
    - 2008-12-20 22:44 . 2008-05-16 21:32 144040 c:\windows\system32\spool\drivers\w32x86\3\lxdwwbg w.exe
    + 2009-08-28 05:46 . 2008-05-16 15:32 144040 c:\windows\system32\spool\drivers\w32x86\3\lxdwwbg w.exe
    - 2008-12-20 22:44 . 2008-05-07 03:44 524288 c:\windows\system32\spool\drivers\w32x86\3\lxdwuti l.dll
    + 2009-08-28 05:46 . 2008-05-06 21:44 524288 c:\windows\system32\spool\drivers\w32x86\3\lxdwuti l.dll
    - 2008-12-20 22:44 . 2008-05-16 20:50 364544 c:\windows\system32\spool\drivers\w32x86\3\lxdwuld r.dll
    + 2009-08-28 05:46 . 2008-05-16 14:50 364544 c:\windows\system32\spool\drivers\w32x86\3\lxdwuld r.dll
    + 2009-08-28 05:46 . 2007-07-25 21:25 253952 c:\windows\system32\spool\drivers\w32x86\3\lxdwsk0 .dll
    - 2008-12-20 22:44 . 2007-07-26 03:25 253952 c:\windows\system32\spool\drivers\w32x86\3\lxdwsk0 .dll
    + 2009-08-28 05:46 . 2008-05-16 14:50 327680 c:\windows\system32\spool\drivers\w32x86\3\lxdwret v.dll
    - 2008-12-20 22:44 . 2008-05-16 20:50 327680 c:\windows\system32\spool\drivers\w32x86\3\lxdwret v.dll
    - 2008-12-20 22:44 . 2008-05-16 21:04 811008 c:\windows\system32\spool\drivers\w32x86\3\lxdwptp c.dll
    + 2009-08-28 05:46 . 2008-05-16 15:04 811008 c:\windows\system32\spool\drivers\w32x86\3\lxdwptp c.dll
    - 2008-12-20 22:44 . 2008-05-16 21:33 766632 c:\windows\system32\spool\drivers\w32x86\3\lxdwpsw x.exe
    + 2009-08-28 05:46 . 2008-05-16 15:33 766632 c:\windows\system32\spool\drivers\w32x86\3\lxdwpsw x.exe
    - 2008-12-20 22:44 . 2008-05-07 03:50 147456 c:\windows\system32\spool\drivers\w32x86\3\lxdwpsw r.dll
    + 2009-08-28 05:46 . 2008-05-06 21:50 147456 c:\windows\system32\spool\drivers\w32x86\3\lxdwpsw r.dll
    - 2008-12-20 22:44 . 2008-05-07 03:45 720896 c:\windows\system32\spool\drivers\w32x86\3\lxdwpsw .dll
    + 2009-08-28 05:46 . 2008-05-06 21:45 720896 c:\windows\system32\spool\drivers\w32x86\3\lxdwpsw .dll
    - 2008-12-20 22:44 . 2008-05-07 03:50 155648 c:\windows\system32\spool\drivers\w32x86\3\lxdwprp r.dll
    + 2009-08-28 05:46 . 2008-05-06 21:50 155648 c:\windows\system32\spool\drivers\w32x86\3\lxdwprp r.dll
    + 2009-08-28 05:46 . 2008-05-06 21:45 946176 c:\windows\system32\spool\drivers\w32x86\3\lxdwprp .dll
    - 2008-12-20 22:44 . 2008-05-07 03:45 946176 c:\windows\system32\spool\drivers\w32x86\3\lxdwprp .dll
    + 2009-08-28 05:46 . 2008-05-16 15:06 544768 c:\windows\system32\spool\drivers\w32x86\3\lxdwppx .dll
    - 2008-12-20 22:44 . 2008-05-16 21:06 544768 c:\windows\system32\spool\drivers\w32x86\3\lxdwppx .dll
    - 2008-12-20 22:44 . 2008-05-07 03:49 237568 c:\windows\system32\spool\drivers\w32x86\3\lxdwlpa r.dll
    + 2009-08-28 05:46 . 2008-05-06 21:49 237568 c:\windows\system32\spool\drivers\w32x86\3\lxdwlpa r.dll
    - 2008-12-20 22:44 . 2008-05-16 21:05 126976 c:\windows\system32\spool\drivers\w32x86\3\lxdwlnk s.dll
    + 2009-08-28 05:46 . 2008-05-16 15:05 126976 c:\windows\system32\spool\drivers\w32x86\3\lxdwlnk s.dll
    + 2009-08-28 05:46 . 2008-05-16 15:33 709288 c:\windows\system32\spool\drivers\w32x86\3\lxdwjsw x.exe
    - 2008-12-20 22:44 . 2008-05-16 21:33 709288 c:\windows\system32\spool\drivers\w32x86\3\lxdwjsw x.exe
    + 2009-08-28 05:46 . 2008-05-06 21:49 147456 c:\windows\system32\spool\drivers\w32x86\3\lxdwjsw r.dll
    - 2008-12-20 22:44 . 2008-05-07 03:49 147456 c:\windows\system32\spool\drivers\w32x86\3\lxdwjsw r.dll
    + 2009-08-28 05:46 . 2008-05-06 21:45 196608 c:\windows\system32\spool\drivers\w32x86\3\lxdwjsw o.dll
    - 2008-12-20 22:44 . 2008-05-07 03:45 196608 c:\windows\system32\spool\drivers\w32x86\3\lxdwjsw o.dll
    + 2009-08-28 05:46 . 2008-05-06 21:47 688128 c:\windows\system32\spool\drivers\w32x86\3\lxdwjsw b.dll
    - 2008-12-20 22:44 . 2008-05-07 03:47 688128 c:\windows\system32\spool\drivers\w32x86\3\lxdwjsw b.dll
    + 2009-08-28 05:46 . 2008-05-06 21:50 106496 c:\windows\system32\spool\drivers\w32x86\3\lxdwins r.dll
    - 2008-12-20 22:44 . 2008-05-07 03:50 106496 c:\windows\system32\spool\drivers\w32x86\3\lxdwins r.dll
    + 2009-08-28 05:46 . 2008-05-06 21:47 200704 c:\windows\system32\spool\drivers\w32x86\3\lxdwins b.dll
    - 2008-12-20 22:44 . 2008-05-07 03:47 200704 c:\windows\system32\spool\drivers\w32x86\3\lxdwins b.dll
    - 2008-12-20 22:44 . 2008-05-07 03:46 176128 c:\windows\system32\spool\drivers\w32x86\3\lxdwins .dll
    + 2009-08-28 05:46 . 2008-05-06 21:46 176128 c:\windows\system32\spool\drivers\w32x86\3\lxdwins .dll
    - 2008-12-20 22:44 . 2008-04-14 23:37 282624 c:\windows\system32\spool\drivers\w32x86\3\lxdwibu f.dll
    + 2009-08-28 05:46 . 2008-04-14 17:37 282624 c:\windows\system32\spool\drivers\w32x86\3\lxdwibu f.dll
    + 2009-08-28 05:46 . 2008-05-02 19:26 438272 c:\windows\system32\spool\drivers\w32x86\3\lxdwhcp .dll
    - 2008-12-20 22:44 . 2008-05-03 01:26 438272 c:\windows\system32\spool\drivers\w32x86\3\lxdwhcp .dll
    - 2008-12-20 22:44 . 2007-07-26 03:25 983121 c:\windows\system32\spool\drivers\w32x86\3\lxdwgf. dll
    + 2009-08-28 05:46 . 2007-07-25 21:25 983121 c:\windows\system32\spool\drivers\w32x86\3\lxdwgf. dll
    - 2008-12-20 22:44 . 2007-08-14 05:01 434176 c:\windows\system32\spool\drivers\w32x86\3\lxdwedf .dll
    + 2009-08-28 05:46 . 2007-08-13 23:01 434176 c:\windows\system32\spool\drivers\w32x86\3\lxdwedf .dll
    + 2009-08-28 05:46 . 2008-05-16 15:06 149504 c:\windows\system32\spool\drivers\w32x86\3\lxdwdru i.dll
    - 2008-12-20 22:44 . 2008-05-16 21:06 149504 c:\windows\system32\spool\drivers\w32x86\3\lxdwdru i.dll
    - 2008-12-20 22:44 . 2008-05-16 21:06 198144 c:\windows\system32\spool\drivers\w32x86\3\lxdwdr. dll
    + 2009-08-28 05:46 . 2008-05-16 15:06 198144 c:\windows\system32\spool\drivers\w32x86\3\lxdwdr. dll
    + 2009-08-28 05:46 . 2008-05-16 14:50 188416 c:\windows\system32\spool\drivers\w32x86\3\lxdwdat r.dll
    - 2008-12-20 22:44 . 2008-05-16 20:50 188416 c:\windows\system32\spool\drivers\w32x86\3\lxdwdat r.dll
    - 2008-12-20 22:44 . 2008-05-16 21:06 335872 c:\windows\system32\spool\drivers\w32x86\3\lxdwcom x.dll
    + 2009-08-28 05:46 . 2008-05-16 15:06 335872 c:\windows\system32\spool\drivers\w32x86\3\lxdwcom x.dll
    + 2009-08-28 05:46 . 2008-05-16 15:34 116416 c:\windows\system32\spool\drivers\w32x86\3\lxdwcfg x.exe
    - 2008-12-20 22:44 . 2008-05-16 21:34 116416 c:\windows\system32\spool\drivers\w32x86\3\lxdwcfg x.exe
    + 2006-08-24 21:15 . 2006-08-24 21:15 150808 c:\windows\system32\rgb9rast_2.dll
    + 2009-08-22 08:08 . 2008-07-06 12:06 117760 c:\windows\system32\prntvpt.dll
    + 2008-07-30 00:59 . 2008-07-30 00:59 781344 c:\windows\system32\PresentationNative_v0300.dll
    + 2008-07-30 01:35 . 2008-07-30 01:35 326160 c:\windows\system32\PresentationHost.exe
    + 2008-07-30 00:59 . 2008-07-30 00:59 105016 c:\windows\system32\PresentationCFFRasterizerNativ e_v0300.dll
    + 2004-08-24 09:13 . 2009-08-22 08:15 444028 c:\windows\system32\perfh009.dat
    + 2008-07-25 16:16 . 2008-07-25 16:16 158720 c:\windows\system32\mscorier.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 282112 c:\windows\system32\mscoree.dll
    + 2009-08-28 05:43 . 2008-05-06 21:44 524288 c:\windows\system32\lxdwutil.dll
    - 2008-12-20 22:42 . 2008-05-07 03:44 524288 c:\windows\system32\lxdwutil.dll
    + 2009-08-28 05:43 . 2008-05-16 15:05 851968 c:\windows\system32\lxdwusb1.dll
    - 2008-12-20 22:42 . 2008-05-16 21:05 851968 c:\windows\system32\lxdwusb1.dll
    + 2009-08-28 05:43 . 2008-05-16 15:05 651264 c:\windows\system32\lxdwpmui.dll
    - 2008-12-20 22:42 . 2008-05-16 21:05 651264 c:\windows\system32\lxdwpmui.dll
    + 2009-08-28 05:43 . 2008-05-16 15:05 577536 c:\windows\system32\lxdwlmpm.dll
    - 2008-12-20 22:42 . 2008-05-16 21:05 577536 c:\windows\system32\lxdwlmpm.dll
    + 2009-08-28 05:43 . 2008-05-06 21:49 147456 c:\windows\system32\lxdwjswr.dll
    - 2008-12-20 22:42 . 2008-05-07 03:49 147456 c:\windows\system32\lxdwjswr.dll
    - 2008-12-20 22:42 . 2008-05-03 01:25 389120 c:\windows\system32\LXDWinst.dll
    + 2009-08-28 05:43 . 2008-05-02 19:25 389120 c:\windows\system32\LXDWinst.dll
    + 2009-08-28 05:43 . 2008-05-06 21:50 106496 c:\windows\system32\lxdwinsr.dll
    - 2008-12-20 22:42 . 2008-05-07 03:50 106496 c:\windows\system32\lxdwinsr.dll
    + 2009-08-28 05:43 . 2008-05-06 21:47 200704 c:\windows\system32\lxdwinsb.dll
    - 2008-12-20 22:42 . 2008-05-07 03:47 200704 c:\windows\system32\lxdwinsb.dll
    - 2008-12-20 22:42 . 2008-05-07 03:46 176128 c:\windows\system32\lxdwins.dll
    + 2009-08-28 05:43 . 2008-05-06 21:46 176128 c:\windows\system32\lxdwins.dll
    + 2009-08-28 05:43 . 2008-05-16 15:05 364544 c:\windows\system32\lxdwinpa.dll
    - 2008-12-20 22:42 . 2008-05-16 21:05 364544 c:\windows\system32\lxdwinpa.dll
    + 2009-08-28 05:43 . 2008-05-16 15:33 328360 c:\windows\system32\lxdwih.exe
    - 2008-12-20 22:42 . 2008-05-16 21:33 328360 c:\windows\system32\lxdwih.exe
    - 2008-12-20 22:42 . 2008-05-16 21:05 339968 c:\windows\system32\lxdwiesc.dll
    + 2009-08-28 05:43 . 2008-05-16 15:05 339968 c:\windows\system32\lxdwiesc.dll
    + 2009-08-28 05:43 . 2008-05-02 19:26 438272 c:\windows\system32\LXDWhcp.dll
    - 2008-12-20 22:42 . 2008-05-03 01:26 438272 c:\windows\system32\LXDWhcp.dll
    - 2008-12-20 22:42 . 2008-05-16 21:05 679936 c:\windows\system32\lxdwhbn3.dll
    + 2009-08-28 05:43 . 2008-05-16 15:05 679936 c:\windows\system32\lxdwhbn3.dll
    + 2009-08-28 05:43 . 2008-05-16 14:54 208896 c:\windows\system32\lxdwgrd.dll
    - 2008-12-20 22:42 . 2008-05-16 20:54 208896 c:\windows\system32\lxdwgrd.dll
    + 2009-08-28 05:43 . 2007-07-25 21:25 983121 c:\windows\system32\lxdwgf.dll
    - 2008-12-20 22:42 . 2007-07-26 03:25 983121 c:\windows\system32\lxdwgf.dll
    - 2008-12-20 22:42 . 2008-05-16 21:33 594600 c:\windows\system32\lxdwcoms.exe
    + 2009-08-28 05:43 . 2008-05-16 15:33 594600 c:\windows\system32\lxdwcoms.exe
    - 2008-12-20 22:42 . 2008-05-16 21:05 376832 c:\windows\system32\lxdwcomm.dll
    + 2009-08-28 05:43 . 2008-05-16 15:05 376832 c:\windows\system32\lxdwcomm.dll
    - 2008-12-20 22:42 . 2008-05-16 21:05 765952 c:\windows\system32\lxdwcomc.dll
    + 2009-08-28 05:43 . 2008-05-16 15:05 765952 c:\windows\system32\lxdwcomc.dll
    - 2008-12-20 22:42 . 2008-05-16 21:33 369320 c:\windows\system32\lxdwcfg.exe
    + 2009-08-28 05:43 . 2008-05-16 15:33 369320 c:\windows\system32\lxdwcfg.exe
    + 2008-06-21 20:25 . 2009-08-13 15:16 512000 c:\windows\system32\jscript.dll
    - 2008-06-21 20:25 . 2008-05-09 10:53 512000 c:\windows\system32\jscript.dll
    + 2008-07-30 00:24 . 2008-07-30 00:24 622080 c:\windows\system32\icardagt.exe
    + 2004-08-24 02:19 . 2009-08-22 08:24 117360 c:\windows\system32\FNTCACHE.DAT
    + 2008-07-30 02:10 . 2008-07-30 02:10 493048 c:\windows\system32\evr.dll
    + 2009-08-22 08:08 . 2008-07-06 12:06 575488 c:\windows\system32\dllcache\xpsshhdr.dll
    + 2008-12-05 06:54 . 2009-06-25 08:25 147456 c:\windows\system32\dllcache\schannel.dll
    + 2009-08-22 08:08 . 2008-07-06 10:50 597504 c:\windows\system32\dllcache\printfilterpipelinesv c.exe
    + 2009-06-25 08:25 . 2009-06-25 08:25 136192 c:\windows\system32\dllcache\msv1_0.dll
    + 2009-04-15 23:38 . 2009-06-25 08:25 730112 c:\windows\system32\dllcache\lsasrv.dll
    + 2009-06-25 08:25 . 2009-06-25 08:25 301568 c:\windows\system32\dllcache\kerberos.dll
    - 2008-05-09 10:53 . 2008-05-09 10:53 512000 c:\windows\system32\dllcache\jscript.dll
    + 2008-05-09 10:53 . 2009-08-13 15:16 512000 c:\windows\system32\dllcache\jscript.dll
    + 2004-08-24 09:29 . 2009-09-22 01:11 573440 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    - 2004-08-24 09:29 . 2009-08-12 08:07 573440 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    + 2008-07-30 04:40 . 2008-07-30 04:40 196104 c:\windows\Microsoft.NET\Framework\v3.5\WFServices Reg.exe
    + 2008-07-30 04:40 . 2008-07-30 04:40 802816 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft. Build.Tasks.v3.5.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 984056 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapUI.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 107512 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 111096 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.3082.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 110072 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.2070.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 106488 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1055.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 105976 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1053.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 107000 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1049.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 107512 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1046.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 109048 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1045.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 106488 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1044.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 108536 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1043.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 110072 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1040.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 111096 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1038.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 101368 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1037.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 112120 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1036.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 106488 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1035.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 113656 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1032.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 111608 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1031.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 108536 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1030.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 108536 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1029.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 102904 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\WapRes.1025.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 689152 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vsscenario.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 413184 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vsbasereqs.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 632320 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vs70uimgr.dll
    + 2009-08-22 08:10 . 2009-08-22 08:10 652800 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vs_setup.msi
    + 2008-07-29 23:47 . 2008-07-29 23:47 110080 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 131584 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.3082.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 131072 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.2070.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 121344 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1055.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 121344 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1053.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 123904 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1049.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 122880 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1046.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 128512 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1045.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 121856 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1044.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 129024 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1043.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 128512 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1040.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 132096 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1038.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 111104 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1037.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 133120 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1036.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 122368 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1035.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 137728 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1032.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 130048 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1031.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 126464 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1030.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 125440 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1029.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 113152 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setupres.1025.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 269304 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
    + 2008-07-29 23:47 . 2008-07-29 23:47 177152 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\HtmlLite.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 276984 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\dlmgr.dll
    + 2008-07-30 04:15 . 2008-07-30 04:15 225490 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\baseline.dat
    + 2008-07-30 04:40 . 2008-07-30 04:40 233976 c:\windows\Microsoft.NET\Framework\v3.5\1033\vbc7u i.dll
    + 2008-07-30 04:40 . 2008-07-30 04:40 168448 c:\windows\Microsoft.NET\Framework\v3.5\1033\cscom pui.dll
    + 2008-07-30 01:35 . 2008-07-30 01:35 864256 c:\windows\Microsoft.NET\Framework\v3.0\WPF\Presen tationUI.dll
    + 2008-07-30 00:59 . 2008-07-30 00:59 132120 c:\windows\Microsoft.NET\Framework\v3.0\WPF\Presen tationHostDLL.dll
    + 2008-07-30 02:10 . 2008-07-30 02:10 806928 c:\windows\Microsoft.NET\Framework\v3.0\WPF\Natura lLanguage6.dll
    + 2008-07-30 00:16 . 2008-07-30 00:16 152576 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe
    + 2008-07-30 00:16 . 2008-07-30 00:16 966656 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.Runtime.Serialization.dll
    + 2008-07-30 00:16 . 2008-07-30 00:16 132096 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
    + 2008-07-30 00:16 . 2008-07-30 00:16 110592 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMdiagnostics.dll
    + 2008-07-30 00:16 . 2008-07-30 00:16 156688 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe
    + 2008-07-30 00:16 . 2008-07-30 00:16 163840 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\Microsoft.Transactions.Bridge.Dtc.dll
    + 2008-07-30 00:16 . 2008-07-30 00:16 397312 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\Microsoft.Transactions.Bridge.dll
    + 2008-07-30 00:24 . 2008-07-30 00:24 881664 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
    + 2008-07-30 00:16 . 2008-07-30 00:16 168968 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe
    + 2008-11-25 09:59 . 2008-11-25 09:59 436040 c:\windows\Microsoft.NET\Framework\v2.0.50727\webe ngine.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 839680 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Web.Services.dll
    - 2005-09-23 12:28 . 2005-09-23 12:28 835584 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Web.Mobile.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 835584 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Web.Mobile.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 261632 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Transactions.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 114688 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.ServiceProcess.dll
    - 2005-09-23 12:28 . 2005-09-23 12:28 114688 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.ServiceProcess.dll
    - 2005-09-23 12:28 . 2005-09-23 12:28 258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Security.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Security.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 131072 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Runtime.Serialization.Formatters.Soap.dll
    - 2005-09-23 12:28 . 2005-09-23 12:28 131072 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Runtime.Serialization.Formatters.Soap.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 303104 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Runtime.Remoting.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Messaging.dll
    - 2005-09-23 12:28 . 2005-09-23 12:28 258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Messaging.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 372736 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Management.dll
    - 2007-04-13 08:21 . 2007-04-13 08:21 372736 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Management.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 113664 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.EnterpriseServices.Wrapper.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.EnterpriseServices.dll
    - 2007-04-13 08:21 . 2007-04-13 08:21 258048 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.EnterpriseServices.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 626688 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Drawing.dll
    - 2007-04-13 08:21 . 2007-04-13 08:21 188416 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.DirectoryServices.Protocols.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 188416 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.DirectoryServices.Protocols.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 401408 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.DirectoryServices.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 970752 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Deployment.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 745472 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Data.SqlXml.dll
    + 2008-11-25 09:59 . 2008-11-25 09:59 486400 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Data.OracleClient.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 425984 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.configuration.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 110592 c:\windows\Microsoft.NET\Framework\v2.0.50727\sysg lobl.dll
    - 2007-04-13 08:21 . 2007-04-13 08:21 110592 c:\windows\Microsoft.NET\Framework\v2.0.50727\sysg lobl.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 392184 c:\windows\Microsoft.NET\Framework\v2.0.50727\SOS. dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 118784 c:\windows\Microsoft.NET\Framework\v2.0.50727\shfu sion.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 143360 c:\windows\Microsoft.NET\Framework\v2.0.50727\peve rify.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 100856 c:\windows\Microsoft.NET\Framework\v2.0.50727\ngen .exe
    + 2008-07-25 16:17 . 2008-07-25 16:17 230912 c:\windows\Microsoft.NET\Framework\v2.0.50727\msco rsvc.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 345600 c:\windows\Microsoft.NET\Framework\v2.0.50727\msco rrc.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 114176 c:\windows\Microsoft.NET\Framework\v2.0.50727\msco rpe.dll
    + 2008-11-25 09:59 . 2008-11-25 09:59 364872 c:\windows\Microsoft.NET\Framework\v2.0.50727\msco rjit.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 308224 c:\windows\Microsoft.NET\Framework\v2.0.50727\msco rdbi.dll
    + 2008-11-25 09:59 . 2008-11-25 09:59 990032 c:\windows\Microsoft.NET\Framework\v2.0.50727\msco rdacwks.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 659456 c:\windows\Microsoft.NET\Framework\v2.0.50727\Micr osoft.VisualBasic.dll
    - 2005-09-23 12:29 . 2005-09-23 12:29 372736 c:\windows\Microsoft.NET\Framework\v2.0.50727\Micr osoft.VisualBasic.Compatibility.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 372736 c:\windows\Microsoft.NET\Framework\v2.0.50727\Micr osoft.VisualBasic.Compatibility.dll
    - 2005-09-23 12:29 . 2005-09-23 12:29 110592 c:\windows\Microsoft.NET\Framework\v2.0.50727\Micr osoft.VisualBasic.Compatibility.Data.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 110592 c:\windows\Microsoft.NET\Framework\v2.0.50727\Micr osoft.VisualBasic.Compatibility.Data.dll
    - 2007-04-13 08:21 . 2007-04-13 08:21 749568 c:\windows\Microsoft.NET\Framework\v2.0.50727\Micr osoft.JScript.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 749568 c:\windows\Microsoft.NET\Framework\v2.0.50727\Micr osoft.JScript.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 655360 c:\windows\Microsoft.NET\Framework\v2.0.50727\Micr osoft.Build.Tasks.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 348160 c:\windows\Microsoft.NET\Framework\v2.0.50727\Micr osoft.Build.Engine.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 230904 c:\windows\Microsoft.NET\Framework\v2.0.50727\ilas m.exe
    + 2008-07-25 16:17 . 2008-07-25 16:17 798224 c:\windows\Microsoft.NET\Framework\v2.0.50727\Even tLogMessages.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 575496 c:\windows\Microsoft.NET\Framework\v2.0.50727\dias ymreader.dll
    - 2005-09-23 12:28 . 2005-09-23 12:28 106496 c:\windows\Microsoft.NET\Framework\v2.0.50727\CasP ol.exe
    + 2008-07-25 16:17 . 2008-07-25 16:17 106496 c:\windows\Microsoft.NET\Framework\v2.0.50727\CasP ol.exe
    - 2007-04-13 08:20 . 2007-04-13 08:20 507904 c:\windows\Microsoft.NET\Framework\v2.0.50727\AspN etMMCExt.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 507904 c:\windows\Microsoft.NET\Framework\v2.0.50727\AspN etMMCExt.dll
    - 2005-09-23 12:28 . 2005-09-23 12:28 106496 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspn et_regsql.exe
    + 2008-07-25 16:16 . 2008-07-25 16:16 106496 c:\windows\Microsoft.NET\Framework\v2.0.50727\aspn et_regsql.exe
    + 2008-07-25 16:17 . 2008-07-25 16:17 147968 c:\windows\Microsoft.NET\Framework\v2.0.50727\AdoN etDiag.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 218112 c:\windows\Microsoft.NET\Framework\v2.0.50727\1033 \Vsavb7rtUI.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 193016 c:\windows\Microsoft.NET\Framework\v2.0.50727\1033 \vbc7ui.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 145408 c:\windows\Microsoft.NET\Framework\v2.0.50727\1033 \cscompui.dll
    + 2009-03-20 16:48 . 2009-03-20 16:48 183808 c:\windows\Installer\46022dd.msp
    + 2008-12-13 14:58 . 2008-12-13 14:58 754688 c:\windows\Installer\42b726b.msp
    + 2009-08-22 08:11 . 2009-08-22 08:11 648192 c:\windows\Installer\42b7242.msi
    + 2008-07-30 02:23 . 2008-07-30 02:23 250880 c:\windows\Installer\42a1343.msp
    + 2008-07-30 02:28 . 2008-07-30 02:28 278016 c:\windows\Installer\42a1341.msp
    + 2008-07-30 00:40 . 2008-07-30 00:40 291840 c:\windows\Installer\42a133f.msp
    + 2009-08-22 08:10 . 2009-08-22 08:10 137728 c:\windows\Installer\42a1339.msi
    + 2008-07-29 22:35 . 2008-07-29 22:35 553472 c:\windows\Installer\423a49a.msp
    + 2008-07-29 22:33 . 2008-07-29 22:33 506368 c:\windows\Installer\423a498.msp
    + 2008-07-29 22:37 . 2008-07-29 22:37 911360 c:\windows\Installer\423a497.msp
    + 2009-08-15 18:49 . 2009-08-15 18:49 102400 c:\windows\Installer\{99ECF41F-5CCA-42BD-B8B8-A8333E2E2944}\iTunesIco.exe
    + 2008-06-22 04:52 . 2009-08-30 17:21 409600 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
    - 2008-06-22 04:52 . 2008-06-27 05:23 409600 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
    - 2008-06-22 04:52 . 2008-06-27 05:23 286720 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
    + 2008-06-22 04:52 . 2009-08-30 17:21 286720 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
    + 2008-06-22 04:52 . 2009-08-30 17:21 249856 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
    - 2008-06-22 04:52 . 2008-06-27 05:23 249856 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
    - 2008-06-22 04:52 . 2008-06-27 05:23 794624 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
    + 2008-06-22 04:52 . 2009-08-30 17:21 794624 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
    - 2008-06-22 04:52 . 2008-06-27 05:23 135168 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe
    + 2008-06-22 04:52 . 2009-08-30 17:21 135168 c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe
    + 2009-08-22 08:08 . 2008-03-13 04:52 761344 c:\windows\Driver Cache\i386\unires.dll
    + 2009-08-22 08:08 . 2008-07-06 12:06 744960 c:\windows\Driver Cache\i386\unidrvui.dll
    + 2009-08-22 08:08 . 2008-07-06 12:06 373248 c:\windows\Driver Cache\i386\unidrv.dll
    + 2009-08-22 08:08 . 2008-07-06 12:06 198656 c:\windows\Driver Cache\i386\mxdwdui.dll
    + 2009-08-22 08:08 . 2008-07-06 12:06 765440 c:\windows\Driver Cache\i386\mxdwdrv.dll
    + 2009-08-22 08:31 . 2009-08-22 08:31 321536 c:\windows\assembly\NativeImages_v2.0.50727_32\Wsa tConfig\2ef5bc3a2edd7570bb23886a4f32294a\WsatConfi g.ni.exe
    + 2009-08-22 08:21 . 2009-08-22 08:21 240128 c:\windows\assembly\NativeImages_v2.0.50727_32\Win dowsFormsIntegra#\6a818099f0386e2356ae94f886a2196f \WindowsFormsIntegration.ni.dll
    + 2009-08-22 08:21 . 2009-08-22 08:21 187904 c:\windows\assembly\NativeImages_v2.0.50727_32\UIA utomationTypes\a6d9503962d47c722231c1478f180695\UI AutomationTypes.ni.dll
    + 2009-08-22 08:21 . 2009-08-22 08:21 447488 c:\windows\assembly\NativeImages_v2.0.50727_32\UIA utomationClient\5c028c3d8db6c0f0277673ea4a2d89fb\U IAutomationClient.ni.dll
    + 2009-08-22 08:35 . 2009-08-22 08:35 400896 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Xml.Linq\c338a470b14851ce5987bb0f0869c310\Syst em.Xml.Linq.ni.dll
    + 2009-08-22 08:34 . 2009-08-22 08:34 129536 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Web.Routing\bb77ea11f46ab438b2b7ed7c180011a1\S ystem.Web.Routing.ni.dll
    + 2009-08-22 08:34 . 2009-08-22 08:34 202240 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Web.RegularE#\6ee255220d90dcbe80c990e443051cc5 \System.Web.RegularExpressions.ni.dll
    + 2009-08-22 08:34 . 2009-08-22 08:34 859648 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Web.Extensio#\58f62044fa702ea6f936071aa5520baa \System.Web.Extensions.Design.ni.dll
    + 2009-08-22 08:34 . 2009-08-22 08:34 328704 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Web.Entity\79c29ac85dd57dd485ab60118ac292ff\Sy stem.Web.Entity.ni.dll
    + 2009-08-22 08:34 . 2009-08-22 08:34 301056 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Web.Entity.D#\d3d65e34fa60f0b6c72ca0d12ec89933 \System.Web.Entity.Design.ni.dll
    + 2009-08-22 08:34 . 2009-08-22 08:34 547328 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Web.DynamicD#\b7891f5659db299dbd1b3c72db7edb9f \System.Web.DynamicData.ni.dll
    + 2009-08-22 08:34 . 2009-08-22 08:34 141312 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Web.Abstract#\00ec08741a765c707bd9169346064a81 \System.Web.Abstractions.ni.dll
    + 2009-08-22 08:34 . 2009-08-22 08:34 627200 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Transactions\5a555c9ae6984c40157cf940bb519f7c\ System.Transactions.ni.dll
    + 2009-08-22 08:33 . 2009-08-22 08:33 212992 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.ServiceProce#\ea3366939280c1715f1c620e33ee3c8a \System.ServiceProcess.ni.dll
    + 2009-08-22 08:31 . 2009-08-22 08:31 676352 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Security\1c8df2da33222c048d683017f2095f04\Syst em.Security.ni.dll
    + 2009-08-22 08:33 . 2009-08-22 08:33 311296 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Runtime.Seri#\bfd6e16d8c3589cd2bd3f8d46f0a5402 \System.Runtime.Serialization.Formatters.Soap.ni.d ll
    + 2009-08-22 08:33 . 2009-08-22 08:33 621056 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Net\519d9c618341b136f9b963ffb7495308\System.Ne t.ni.dll
    + 2009-08-22 08:33 . 2009-08-22 08:33 998400 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Management\8642fdfbf02a6cb6f01169fe6fdb5d11\Sy stem.Management.ni.dll
    + 2009-08-22 08:33 . 2009-08-22 08:33 330752 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Management.I#\1d3fbbd23ce1e8637ef4f40a8d23cd32 \System.Management.Instrumentation.ni.dll
    + 2009-08-22 08:23 . 2009-08-22 08:23 381440 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.IO.Log\7c367a96b10d626ec8cbf8149272d845\System .IO.Log.ni.dll
    + 2009-08-22 08:23 . 2009-08-22 08:23 212992 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.IdentityMode#\68e71147704ef0d34d9a4bece7767fc5 \System.IdentityModel.Selectors.ni.dll
    + 2009-08-22 08:33 . 2009-08-22 08:33 280064 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.EnterpriseSe#\4267bd908175603006c6c90bb5d900c7 \System.EnterpriseServices.Wrapper.dll
    + 2009-08-22 08:33 . 2009-08-22 08:33 627712 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.EnterpriseSe#\4267bd908175603006c6c90bb5d900c7 \System.EnterpriseServices.ni.dll
    + 2009-08-22 08:20 . 2009-08-22 08:20 208384 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Drawing.Desi#\18bbe2b6717e7f1d1dd672526e9889ee \System.Drawing.Design.ni.dll
    + 2009-08-22 08:33 . 2009-08-22 08:33 455680 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.DirectorySer#\c434a07332ce490711c27fd0edb7562f \System.DirectoryServices.Protocols.ni.dll
    + 2009-08-22 08:33 . 2009-08-22 08:33 881152 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.DirectorySer#\8b3bb7a2c2f3ffe94c866283f1cd5957 \System.DirectoryServices.AccountManagement.ni.dll
    + 2009-08-22 08:33 . 2009-08-22 08:33 939008 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Data.Service#\a4b887f476fa4b8746a93a9fc2208560 \System.Data.Services.Client.ni.dll
    + 2009-08-22 08:33 . 2009-08-22 08:33 354816 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Data.Service#\1cf3acad6553d6c59df576794f4e8bd6 \System.Data.Services.Design.ni.dll
    + 2009-08-22 08:33 . 2009-08-22 08:33 756736 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Data.Entity.#\392de34573f9f8ec885714f2f3e7f07f \System.Data.Entity.Design.ni.dll
    + 2009-08-22 08:32 . 2009-08-22 08:32 135680 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Data.DataSet#\1db495ff00bbd14df4af6680c4de0653 \System.Data.DataSetExtensions.ni.dll
    + 2009-08-22 08:31 . 2009-08-22 08:31 971264 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Configuration\b82c00e2d24305ad6cb08556e3779b75 \System.Configuration.ni.dll
    + 2009-08-22 08:33 . 2009-08-22 08:33 141312 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Configuratio#\de514e484e49b04b016949d57ffac03e \System.Configuration.Install.ni.dll
    + 2009-08-22 08:31 . 2009-08-22 08:31 633856 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.AddIn\ce984d754e3c0b6be4504b785cc43574\System. AddIn.ni.dll
    + 2009-08-22 08:31 . 2009-08-22 08:31 366080 c:\windows\assembly\NativeImages_v2.0.50727_32\SMS vcHost\045dd501b7257b1cc26083538ae69045\SMSvcHost. ni.exe
    + 2009-08-22 08:31 . 2009-08-22 08:31 256000 c:\windows\assembly\NativeImages_v2.0.50727_32\SMD iagnostics\9790551187e294b4ed3aaa1c221891c7\SMDiag nostics.ni.dll
    + 2009-08-22 08:31 . 2009-08-22 08:31 320512 c:\windows\assembly\NativeImages_v2.0.50727_32\Ser viceModelReg\10a0c9707876fc1f65e64b811a28b020\Serv iceModelReg.ni.exe
    + 2009-08-22 08:19 . 2009-08-22 08:19 224768 c:\windows\assembly\NativeImages_v2.0.50727_32\Pre sentationFramewo#\f475294d8c7dc2dd4febeef27bc0417e \PresentationFramework.Classic.ni.dll
    + 2009-08-22 08:19 . 2009-08-22 08:19 539648 c:\windows\assembly\NativeImages_v2.0.50727_32\Pre sentationFramewo#\8003abaf6bcf70f7eb620d06837e897b \PresentationFramework.Luna.ni.dll
    + 2009-08-22 08:19 . 2009-08-22 08:19 368128 c:\windows\assembly\NativeImages_v2.0.50727_32\Pre sentationFramewo#\59a67874d8d8475faa5be1d993083d12 \PresentationFramework.Aero.ni.dll
    + 2009-08-22 08:19 . 2009-08-22 08:19 258048 c:\windows\assembly\NativeImages_v2.0.50727_32\Pre sentationFramewo#\2c980c9a5051d723c6ec2a78a3d0e2b3 \PresentationFramework.Royale.ni.dll
    + 2009-08-22 08:31 . 2009-08-22 08:31 133632 c:\windows\assembly\NativeImages_v2.0.50727_32\MSB uild\6d38e317128608bc4516ea46ab94590e\MSBuild.ni.e xe
    + 2009-08-22 08:31 . 2009-08-22 08:31 386560 c:\windows\assembly\NativeImages_v2.0.50727_32\Mic rosoft.Transacti#\1820d6a012fc0e16c3e1d29d973cd2d0 \Microsoft.Transactions.Bridge.Dtc.ni.dll
    + 2009-08-22 08:31 . 2009-08-22 08:31 144384 c:\windows\assembly\NativeImages_v2.0.50727_32\Mic rosoft.Build.Uti#\55b9eff9e23359faed4351386c062238 \Microsoft.Build.Utilities.ni.dll
    + 2009-08-22 08:31 . 2009-08-22 08:31 175104 c:\windows\assembly\NativeImages_v2.0.50727_32\Mic rosoft.Build.Uti#\4217124db1ea5de5f1a1f3eea75e8d32 \Microsoft.Build.Utilities.v3.5.ni.dll
    + 2009-08-22 08:31 . 2009-08-22 08:31 839680 c:\windows\assembly\NativeImages_v2.0.50727_32\Mic rosoft.Build.Eng#\96825c34d7e1f7df1923ff2123bed8da \Microsoft.Build.Engine.ni.dll
    + 2009-08-22 08:31 . 2009-08-22 08:31 222720 c:\windows\assembly\NativeImages_v2.0.50727_32\Mic rosoft.Build.Con#\9b321ebf67587237f576df6104a32588 \Microsoft.Build.Conversion.v3.5.ni.dll
    + 2009-08-22 08:31 . 2009-08-22 08:31 220672 c:\windows\assembly\NativeImages_v2.0.50727_32\Cus tomMarshalers\9bea05938bee3555c5aa8763d89a68f9\Cus tomMarshalers.ni.dll
    + 2009-08-22 08:30 . 2009-08-22 08:30 410112 c:\windows\assembly\NativeImages_v2.0.50727_32\Com SvcConfig\12629e2f3e315459bee67cbbaac85cb2\ComSvcC onfig.ni.exe
    + 2009-08-22 08:31 . 2009-08-22 08:31 842240 c:\windows\assembly\NativeImages_v2.0.50727_32\Asp NetMMCExt\b5b2feadc3943e3976daebc0bcd2b5e2\AspNetM MCExt.ni.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 385024 c:\windows\assembly\GAC_MSIL\UIAutomationClientsid eProviders\3.0.0.0__31bf3856ad364e35\UIAutomationC lientsideProviders.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 167936 c:\windows\assembly\GAC_MSIL\UIAutomationClient\3. 0.0.0__31bf3856ad364e35\UIAutomationClient.dll
    + 2009-08-22 08:10 . 2009-08-22 08:10 139264 c:\windows\assembly\GAC_MSIL\System.Xml.Linq\3.5.0 .0__b77a5c561934e089\System.Xml.Linq.dll
    + 2009-08-22 08:10 . 2009-08-22 08:10 507904 c:\windows\assembly\GAC_MSIL\System.WorkflowServic es\3.5.0.0__31bf3856ad364e35\System.WorkflowServic es.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 540672 c:\windows\assembly\GAC_MSIL\System.Workflow.Runti me\3.0.0.0__31bf3856ad364e35\System.Workflow.Runti me.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 839680 c:\windows\assembly\GAC_MSIL\System.Web.Services\2 .0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
    - 2008-07-13 04:45 . 2008-07-13 04:45 835584 c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0 .0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 835584 c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0 .0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
    + 2009-08-22 08:11 . 2009-08-22 08:11 335872 c:\windows\assembly\GAC_MSIL\System.Web.Extensions .Design\3.5.0.0__31bf3856ad364e35\System.Web.Exten sions.Design.dll
    + 2009-08-22 08:17 . 2009-08-22 08:17 139264 c:\windows\assembly\GAC_MSIL\System.Web.Entity\3.5 .0.0__b77a5c561934e089\System.Web.Entity.dll
    + 2009-08-22 08:10 . 2009-08-22 08:10 131072 c:\windows\assembly\GAC_MSIL\System.Web.Entity.Des ign\3.5.0.0__b77a5c561934e089\System.Web.Entity.De sign.dll
    + 2009-08-22 08:17 . 2009-08-22 08:17 229376 c:\windows\assembly\GAC_MSIL\System.Web.DynamicDat a\3.5.0.0__31bf3856ad364e35\System.Web.DynamicData .dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 688128 c:\windows\assembly\GAC_MSIL\System.Speech\3.0.0.0 __31bf3856ad364e35\System.Speech.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 114688 c:\windows\assembly\GAC_MSIL\System.ServiceProcess \2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.d ll
    - 2008-07-13 04:45 . 2008-07-13 04:45 114688 c:\windows\assembly\GAC_MSIL\System.ServiceProcess \2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.d ll
    + 2009-08-22 08:10 . 2009-08-22 08:10 569344 c:\windows\assembly\GAC_MSIL\System.ServiceModel.W eb\3.5.0.0__31bf3856ad364e35\System.ServiceModel.W eb.dll
    - 2008-07-13 04:45 . 2008-07-13 04:45 258048 c:\windows\assembly\GAC_MSIL\System.Security\2.0.0 .0__b03f5f7f11d50a3a\System.Security.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 258048 c:\windows\assembly\GAC_MSIL\System.Security\2.0.0 .0__b03f5f7f11d50a3a\System.Security.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 966656 c:\windows\assembly\GAC_MSIL\System.Runtime.Serial ization\3.0.0.0__b77a5c561934e089\System.Runtime.S erialization.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 131072 c:\windows\assembly\GAC_MSIL\System.Runtime.Serial ization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\ System.Runtime.Serialization.Formatters.Soap.dll
    - 2008-07-13 04:45 . 2008-07-13 04:45 131072 c:\windows\assembly\GAC_MSIL\System.Runtime.Serial ization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\ System.Runtime.Serialization.Formatters.Soap.dll
    + 2009-08-22 08:15 . 2009-08-22 08:15 303104 c:\windows\assembly\GAC_MSIL\System.Runtime.Remoti ng\2.0.0.0__b77a5c561934e089\System.Runtime.Remoti ng.dll
    + 2009-08-22 08:11 . 2009-08-22 08:11 233472 c:\windows\assembly\GAC_MSIL\System.Net\3.5.0.0__b 03f5f7f11d50a3a\System.Net.dll
    + 2009-08-22 08:15 . 2009-08-22 08:15 258048 c:\windows\assembly\GAC_MSIL\System.Messaging\2.0. 0.0__b03f5f7f11d50a3a\System.Messaging.dll
    - 2008-07-13 04:45 . 2008-07-13 04:45 258048 c:\windows\assembly\GAC_MSIL\System.Messaging\2.0. 0.0__b03f5f7f11d50a3a\System.Messaging.dll
    - 2008-07-13 04:45 . 2008-07-13 04:45 372736 c:\windows\assembly\GAC_MSIL\System.Management\2.0 .0.0__b03f5f7f11d50a3a\System.Management.dll
    + 2009-08-22 08:15 . 2009-08-22 08:15 372736 c:\windows\assembly\GAC_MSIL\System.Management\2.0 .0.0__b03f5f7f11d50a3a\System.Management.dll
    + 2009-08-22 08:10 . 2009-08-22 08:10 143360 c:\windows\assembly\GAC_MSIL\System.Management.Ins trumentation\3.5.0.0__b77a5c561934e089\System.Mana gement.Instrumentation.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 131072 c:\windows\assembly\GAC_MSIL\System.IO.Log\3.0.0.0 __b03f5f7f11d50a3a\System.IO.Log.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 430080 c:\windows\assembly\GAC_MSIL\System.IdentityModel\ 3.0.0.0__b77a5c561934e089\System.IdentityModel.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 126976 c:\windows\assembly\GAC_MSIL\System.IdentityModel. Selectors\3.0.0.0__b77a5c561934e089\System.Identit yModel.Selectors.dll
    + 2009-08-22 08:15 . 2009-08-22 08:15 626688 c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0. 0__b03f5f7f11d50a3a\System.Drawing.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 401408 c:\windows\assembly\GAC_MSIL\System.DirectoryServi ces\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServ ices.dll
    - 2008-07-13 04:45 . 2008-07-13 04:45 188416 c:\windows\assembly\GAC_MSIL\System.DirectoryServi ces.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.Dir ectoryServices.Protocols.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 188416 c:\windows\assembly\GAC_MSIL\System.DirectoryServi ces.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.Dir ectoryServices.Protocols.dll
    + 2009-08-22 08:10 . 2009-08-22 08:10 286720 c:\windows\assembly\GAC_MSIL\System.DirectoryServi ces.AccountManagement\3.5.0.0__b77a5c561934e089\Sy stem.DirectoryServices.AccountManagement.dll
    + 2009-08-22 08:15 . 2009-08-22 08:15 970752 c:\windows\assembly\GAC_MSIL\System.Deployment\2.0 .0.0__b03f5f7f11d50a3a\System.Deployment.dll
    + 2009-08-22 08:15 . 2009-08-22 08:15 745472 c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2. 0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
    + 2009-08-22 08:17 . 2009-08-22 08:17 442368 c:\windows\assembly\GAC_MSIL\System.Data.Services\ 3.5.0.0__b77a5c561934e089\System.Data.Services.dll
    + 2009-08-22 08:10 . 2009-08-22 08:10 114688 c:\windows\assembly\GAC_MSIL\System.Data.Services. Design\3.5.0.0__b77a5c561934e089\System.Data.Servi ces.Design.dll
    + 2009-08-22 08:17 . 2009-08-22 08:17 294912 c:\windows\assembly\GAC_MSIL\System.Data.Services. Client\3.5.0.0__b77a5c561934e089\System.Data.Servi ces.Client.dll
    + 2009-08-22 08:10 . 2009-08-22 08:10 684032 c:\windows\assembly\GAC_MSIL\System.Data.Linq\3.5. 0.0__b77a5c561934e089\System.Data.Linq.dll
    + 2009-08-22 08:10 . 2009-08-22 08:10 229376 c:\windows\assembly\GAC_MSIL\System.Data.Entity.De sign\3.5.0.0__b77a5c561934e089\System.Data.Entity. Design.dll
    + 2009-08-22 08:10 . 2009-08-22 08:10 667648 c:\windows\assembly\GAC_MSIL\System.Core\3.5.0.0__ b77a5c561934e089\System.Core.dll
    + 2009-08-22 08:15 . 2009-08-22 08:15 425984 c:\windows\assembly\GAC_MSIL\System.Configuration\ 2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
    + 2009-08-22 08:10 . 2009-08-22 08:10 163840 c:\windows\assembly\GAC_MSIL\System.AddIn\3.5.0.0_ _b77a5c561934e089\System.AddIn.dll
    + 2009-08-22 08:15 . 2009-08-22 08:15 110592 c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03 f5f7f11d50a3a\sysglobl.dll
    - 2008-07-13 04:45 . 2008-07-13 04:45 110592 c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03 f5f7f11d50a3a\sysglobl.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 110592 c:\windows\assembly\GAC_MSIL\SMDiagnostics\3.0.0.0 __b77a5c561934e089\SMdiagnostics.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 528384 c:\windows\assembly\GAC_MSIL\ReachFramework\3.0.0. 0__31bf3856ad364e35\ReachFramework.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 864256 c:\windows\assembly\GAC_MSIL\PresentationUI\3.0.0. 0__31bf3856ad364e35\PresentationUI.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 163840 c:\windows\assembly\GAC_MSIL\PresentationFramework .Royale\3.0.0.0__31bf3856ad364e35\PresentationFram ework.Royale.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 397312 c:\windows\assembly\GAC_MSIL\PresentationFramework .Luna\3.0.0.0__31bf3856ad364e35\PresentationFramew ork.Luna.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 139264 c:\windows\assembly\GAC_MSIL\PresentationFramework .Classic\3.0.0.0__31bf3856ad364e35\PresentationFra mework.Classic.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 196608 c:\windows\assembly\GAC_MSIL\PresentationFramework .Aero\3.0.0.0__31bf3856ad364e35\PresentationFramew ork.Aero.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 598016 c:\windows\assembly\GAC_MSIL\PresentationBuildTask s\3.0.0.0__31bf3856ad364e35\PresentationBuildTasks .dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 659456 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic \8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.d ll
    + 2009-08-22 08:14 . 2009-08-22 08:14 372736 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic .Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft .VisualBasic.Compatibility.dll
    - 2008-07-13 04:45 . 2008-07-13 04:45 372736 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic .Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft .VisualBasic.Compatibility.dll
    - 2008-07-13 04:45 . 2008-07-13 04:45 110592 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic .Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Micr osoft.VisualBasic.Compatibility.Data.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 110592 c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic .Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Micr osoft.VisualBasic.Compatibility.Data.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 397312 c:\windows\assembly\GAC_MSIL\Microsoft.Transaction s.Bridge\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Trans actions.Bridge.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 749568 c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0 .0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
    - 2008-07-13 04:45 . 2008-07-13 04:45 749568 c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0 .0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
    + 2009-08-22 08:15 . 2009-08-22 08:15 655360 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks \2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.d ll
    + 2009-08-22 08:10 . 2009-08-22 08:10 802816 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks .v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Ta sks.v3.5.dll
    + 2009-08-22 08:10 . 2009-08-22 08:10 733184 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engin e\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine .dll
    + 2009-08-22 08:15 . 2009-08-22 08:15 348160 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engin e\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine .dll
    + 2009-08-22 08:10 . 2009-08-22 08:10 106496 c:\windows\assembly\GAC_MSIL\Microsoft.Build.Conve rsion.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Bui ld.Conversion.v3.5.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 507904 c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0_ _b03f5f7f11d50a3a\AspNetMMCExt.dll
    - 2008-07-13 04:44 . 2008-07-13 04:44 507904 c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0_ _b03f5f7f11d50a3a\AspNetMMCExt.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 261632 c:\windows\assembly\GAC_32\System.Transactions\2.0 .0.0__b77a5c561934e089\System.Transactions.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 368640 c:\windows\assembly\GAC_32\System.Printing\3.0.0.0 __31bf3856ad364e35\System.Printing.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 113664 c:\windows\assembly\GAC_32\System.EnterpriseServic es\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServ ices.Wrapper.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 258048 c:\windows\assembly\GAC_32\System.EnterpriseServic es\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServ ices.dll
    - 2008-07-13 04:44 . 2008-07-13 04:44 258048 c:\windows\assembly\GAC_32\System.EnterpriseServic es\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServ ices.dll
    + 2009-08-22 08:15 . 2009-08-22 08:15 486400 c:\windows\assembly\GAC_32\System.Data.OracleClien t\2.0.0.0__b77a5c561934e089\System.Data.OracleClie nt.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 163840 c:\windows\assembly\GAC_32\Microsoft.Transactions. Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Tra nsactions.Bridge.Dtc.dll
    - 2008-12-20 22:44 . 2008-05-09 17:07 1036288 c:\windows\twain_32\Lexmark\7600 Series\lxdwdrs.dll
    + 2009-08-28 05:45 . 2008-05-09 11:07 1036288 c:\windows\twain_32\Lexmark\7600 Series\lxdwdrs.dll
    + 2009-09-22 03:28 . 2009-06-29 16:12 1159680 c:\windows\Temp\mta64901.dll
    + 2009-08-22 08:08 . 2008-07-06 12:06 1676288 c:\windows\system32\xpssvcs.dll
    + 2008-06-21 20:27 . 2009-05-20 09:56 2458112 c:\windows\system32\WMVCore.dll
    - 2008-06-21 20:27 . 2008-06-18 11:03 2458112 c:\windows\system32\WMVCore.dll
    + 2009-08-22 08:08 . 2008-07-06 12:06 1676288 c:\windows\system32\spool\XPSEP\i386\xpssvcs.dll
    + 2009-08-22 08:08 . 2008-07-06 12:06 1676288 c:\windows\system32\spool\XPSEP\i386\i386\xpssvcs. dll
    + 2009-08-22 08:08 . 2008-07-06 22:36 2936832 c:\windows\system32\spool\XPSEP\amd64\xpssvcs.dll
    + 2009-08-22 08:08 . 2008-07-06 22:36 2936832 c:\windows\system32\spool\XPSEP\amd64\amd64\xpssvc s.dll
    - 2008-12-20 22:44 . 2008-05-07 03:48 1482752 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwpswb.dll
    + 2009-08-28 05:46 . 2008-05-06 21:48 1482752 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwpswb.dll
    + 2009-08-28 05:46 . 2008-05-06 21:47 4038656 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwprpb.dll
    - 2008-12-20 22:44 . 2008-05-07 03:47 4038656 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwprpb.dll
    - 2008-12-20 22:44 . 2008-05-07 03:47 3702784 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwlpab.dll
    + 2009-08-28 05:46 . 2008-05-06 21:47 3702784 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwlpab.dll
    - 2008-12-20 22:44 . 2008-05-07 03:46 1388544 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwlpa.dll
    + 2009-08-28 05:46 . 2008-05-06 21:46 1388544 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwlpa.dll
    - 2008-12-20 22:44 . 2008-04-02 21:03 1400832 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwhpec.dll
    + 2009-08-28 05:46 . 2008-04-02 15:03 1400832 c:\windows\system32\spool\drivers\w32x86\lexmark76 00_seriesb64d\lxdwhpec.dll
    + 2009-08-22 08:08 . 2008-07-06 12:06 1676288 c:\windows\system32\spool\drivers\w32x86\3\XpsSvcs .dll
    - 2008-12-20 22:43 . 2008-04-14 22:14 1079808 c:\windows\system32\spool\drivers\w32x86\3\mfc80u. dll
    + 2009-08-28 05:44 . 2008-04-14 16:14 1079808 c:\windows\system32\spool\drivers\w32x86\3\mfc80u. dll
    + 2009-08-28 05:46 . 2008-05-06 21:48 1482752 c:\windows\system32\spool\drivers\w32x86\3\lxdwpsw b.dll
    - 2008-12-20 22:44 . 2008-05-07 03:48 1482752 c:\windows\system32\spool\drivers\w32x86\3\lxdwpsw b.dll
    + 2009-08-28 05:46 . 2008-05-06 21:47 4038656 c:\windows\system32\spool\drivers\w32x86\3\lxdwprp b.dll
    - 2008-12-20 22:44 . 2008-05-07 03:47 4038656 c:\windows\system32\spool\drivers\w32x86\3\lxdwprp b.dll
    - 2008-12-20 22:44 . 2008-05-07 03:47 3702784 c:\windows\system32\spool\drivers\w32x86\3\lxdwlpa b.dll
    + 2009-08-28 05:46 . 2008-05-06 21:47 3702784 c:\windows\system32\spool\drivers\w32x86\3\lxdwlpa b.dll
    - 2008-12-20 22:44 . 2008-05-07 03:46 1388544 c:\windows\system32\spool\drivers\w32x86\3\lxdwlpa .dll
    + 2009-08-28 05:46 . 2008-05-06 21:46 1388544 c:\windows\system32\spool\drivers\w32x86\3\lxdwlpa .dll
    + 2009-08-28 05:46 . 2008-04-02 15:03 1400832 c:\windows\system32\spool\drivers\w32x86\3\lxdwhpe c.dll
    - 2008-12-20 22:44 . 2008-04-02 21:03 1400832 c:\windows\system32\spool\drivers\w32x86\3\lxdwhpe c.dll
    + 2009-08-15 18:45 . 2009-06-05 16:42 2060288 c:\windows\system32\ReinstallBackups\0005\DriverFi les\usbaaplrc.dll
    + 2009-08-28 05:43 . 2008-05-16 15:05 1069056 c:\windows\system32\lxdwserv.dll
    - 2008-12-20 22:42 . 2008-05-16 21:05 1069056 c:\windows\system32\lxdwserv.dll
    + 2009-08-22 08:08 . 2008-07-06 12:06 1676288 c:\windows\system32\dllcache\xpssvcs.dll
    - 2008-06-21 20:27 . 2008-06-18 11:03 2458112 c:\windows\system32\dllcache\WMVCore.dll
    + 2008-06-21 20:27 . 2009-05-20 09:56 2458112 c:\windows\system32\dllcache\WMVCore.dll
    + 2008-07-30 04:40 . 2008-07-30 04:40 1720824 c:\windows\Microsoft.NET\Framework\v3.5\vbc.exe
    + 2008-07-29 23:47 . 2008-07-29 23:47 1054208 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vs_setup.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 1364992 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\SITSetup.dll
    + 2008-07-29 23:47 . 2008-07-29 23:47 1064448 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\gencomp.dll
    + 2008-07-30 04:40 . 2008-07-30 04:40 1548280 c:\windows\Microsoft.NET\Framework\v3.5\csc.exe
    + 2008-12-06 00:35 . 2008-12-06 00:35 1736528 c:\windows\Microsoft.NET\Framework\v3.0\WPF\wpfgfx _v0300.dll
    + 2008-07-30 02:10 . 2008-07-30 02:10 2637840 c:\windows\Microsoft.NET\Framework\v3.0\WPF\NlsLex icons0009.dll
    + 2008-07-30 02:10 . 2008-07-30 02:10 4883464 c:\windows\Microsoft.NET\Framework\v3.0\WPF\NlsDat a0009.dll
    + 2008-12-06 01:12 . 2008-12-06 01:12 5931008 c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\System.ServiceModel.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 1344000 c:\windows\Microsoft.NET\Framework\v2.0.50727\VsaV b7rt.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 1172472 c:\windows\Microsoft.NET\Framework\v2.0.50727\vbc. exe
    + 2008-11-25 09:59 . 2008-11-25 09:59 2048000 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.XML.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 5025792 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Windows.Forms.dll
    + 2008-11-25 09:59 . 2008-11-25 09:59 5242880 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Web.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 3149824 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 5062656 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Design.dll
    + 2008-07-25 16:17 . 2008-07-25 16:17 2933248 c:\windows\Microsoft.NET\Framework\v2.0.50727\Syst em.Data.dll
    + 2008-11-25 09:59 . 2008-11-25 09:59 5813576 c:\windows\Microsoft.NET\Framework\v2.0.50727\msco rwks.dll
    + 2008-11-25 09:59 . 2008-11-25 09:59 4546560 c:\windows\Microsoft.NET\Framework\v2.0.50727\msco rlib.dll
    + 2008-07-25 16:16 . 2008-07-25 16:16 1163768 c:\windows\Microsoft.NET\Framework\v2.0.50727\csco mp.dll
    + 2009-08-26 23:09 . 2009-08-26 23:09 1591808 c:\windows\Installer\983d2.msi
    + 2009-08-15 18:49 . 2009-08-15 18:49 4945408 c:\windows\Installer\43a17f3.msi
    + 2009-08-15 18:45 . 2009-08-15 18:45 3295232 c:\windows\Installer\43a14a0.msi
    + 2009-08-15 18:41 . 2009-08-15 18:41 1665024 c:\windows\Installer\43a1479.msi
    + 2008-12-13 14:57 . 2008-12-13 14:57 8397824 c:\windows\Installer\42b7252.msp
    + 2008-07-30 00:26 . 2008-07-30 00:26 1043456 c:\windows\Installer\42a1342.msp
    + 2008-07-30 01:37 . 2008-07-30 01:37 2679808 c:\windows\Installer\42a1340.msp
    + 2008-07-30 02:15 . 2008-07-30 02:15 3697664 c:\windows\Installer\42a133e.msp
    + 2008-07-30 00:34 . 2008-07-30 00:34 1448448 c:\windows\Installer\42a133d.msp
    + 2008-07-30 01:22 . 2008-07-30 01:22 4137984 c:\windows\Installer\42a133c.msp
    + 2008-07-30 00:18 . 2008-07-30 00:18 3376640 c:\windows\Installer\42a133b.msp
    + 2008-07-29 22:45 . 2008-07-29 22:45 2543616 c:\windows\Installer\423a49e.msp
    + 2008-07-29 22:29 . 2008-07-29 22:29 2926080 c:\windows\Installer\423a49d.msp
    + 2008-07-29 22:41 . 2008-07-29 22:41 6487040 c:\windows\Installer\423a49c.msp
    + 2008-07-29 22:39 . 2008-07-29 22:39 3403264 c:\windows\Installer\423a49b.msp
    + 2008-07-29 22:43 . 2008-07-29 22:43 1013248 c:\windows\Installer\423a499.msp
    + 2008-07-29 22:31 . 2008-07-29 22:31 6083072 c:\windows\Installer\423a496.msp
    + 2009-08-22 08:18 . 2009-08-22 08:18 3313664 c:\windows\assembly\NativeImages_v2.0.50727_32\Win dowsBase\14cd5f4b61d35f9b76327d6be9853755\WindowsB ase.ni.dll
    + 2009-08-22 08:21 . 2009-08-22 08:21 1049600 c:\windows\assembly\NativeImages_v2.0.50727_32\UIA utomationClients#\f3c7957351aec85f526a3350c9718b1e \UIAutomationClientsideProviders.ni.dll
    + 2009-08-22 08:18 . 2009-08-22 08:18 7868416 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem\80978a322d7dd39f0a71be1251ae395a\System.ni.dll
    + 2009-08-22 08:21 . 2009-08-22 08:21 5450752 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Xml\773a9786013451d3baaeff003dc4230f\System.Xm l.ni.dll
    + 2009-08-22 08:35 . 2009-08-22 08:35 1356288 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.WorkflowServ#\ac1750e78d79520dcf19195772eff1b6 \System.WorkflowServices.ni.dll
    + 2009-08-22 08:35 . 2009-08-22 08:35 1908224 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Workflow.Run#\d265da36954fcb4cb7ad5adc693ea0f2 \System.Workflow.Runtime.ni.dll
    + 2009-08-22 08:35 . 2009-08-22 08:35 4514304 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Workflow.Com#\693a8fbe6f7ad6e4e429052da4317e59 \System.Workflow.ComponentModel.ni.dll
    + 2009-08-22 08:35 . 2009-08-22 08:35 2992640 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Workflow.Act#\cc99fbbac0b6e4e9ca62093e49b0c16b \System.Workflow.Activities.ni.dll
    + 2009-08-22 08:34 . 2009-08-22 08:34 1840640 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Web.Services\b57bb002a655920cbfa2bee29d1e22b7\ System.Web.Services.ni.dll
    + 2009-08-22 08:34 . 2009-08-22 08:34 2209280 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Web.Mobile\81197e32ec931f439b3114e9031b65d6\Sy stem.Web.Mobile.ni.dll
    + 2009-08-22 08:34 . 2009-08-22 08:34 2403328 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Web.Extensio#\7f64c9d25471b72e1e957bdfe67947c8 \System.Web.Extensions.ni.dll
    + 2009-08-22 08:21 . 2009-08-22 08:21 1917440 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Speech\63cf639b6e0a3c25c1643c85016e7422\System .Speech.ni.dll
    + 2009-08-22 08:33 . 2009-08-22 08:33 1706496 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.ServiceModel#\340cad17fe57947eacbc8fa2cea780da \System.ServiceModel.Web.ni.dll
    + 2009-08-22 08:30 . 2009-08-22 08:30 2338304 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Runtime.Seri#\034c91b133dee73d452652c52767b5ea \System.Runtime.Serialization.ni.dll
    + 2009-08-22 08:20 . 2009-08-22 08:20 1035264 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Printing\646ab52eef343380aa002c220dc31e13\Syst em.Printing.ni.dll
    + 2009-08-22 08:22 . 2009-08-22 08:22 1056768 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.IdentityModel\c2de8479e54852f56996f79bc93acb13 \System.IdentityModel.ni.dll
    + 2009-08-22 08:20 . 2009-08-22 08:20 1587200 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Drawing\3da96ee075bab9202626ae44c18d226c\Syste m.Drawing.ni.dll
    + 2009-08-22 08:33 . 2009-08-22 08:33 1116672 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.DirectorySer#\543aced762f6b0c3f8e037955941afc6 \System.DirectoryServices.ni.dll
    + 2009-08-22 08:33 . 2009-08-22 08:33 1801216 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Deployment\a6b58624486714fa71e5e35186850ff0\Sy stem.Deployment.ni.dll
    + 2009-08-22 08:20 . 2009-08-22 08:20 6616576 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Data\c70731047b0022638b3f9fb158948a03\System.D ata.ni.dll
    + 2009-08-22 08:31 . 2009-08-22 08:31 2510336 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Data.SqlXml\826b09ab0d0e36f4d631b4cd335df511\S ystem.Data.SqlXml.ni.dll
    + 2009-08-22 08:33 . 2009-08-22 08:33 1328128 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Data.Services\956a513dcbd44d5a6801840ef2b0b47b \System.Data.Services.ni.dll
    + 2009-08-22 08:20 . 2009-08-22 08:20 2516480 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Data.Linq\0bbec79460b1137df5313f9baf7b246f\Sys tem.Data.Linq.ni.dll
    + 2009-08-22 08:33 . 2009-08-22 08:33 9924096 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Data.Entity\6479f975b105808a8d9e7a7fdc762551\S ystem.Data.Entity.ni.dll
    + 2009-08-22 08:20 . 2009-08-22 08:20 2295296 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Core\47d87251e93256c635eb73403b8db33e\System.C ore.ni.dll
    + 2009-08-22 08:20 . 2009-08-22 08:20 2128896 c:\windows\assembly\NativeImages_v2.0.50727_32\Rea chFramework\4bfb3048bf200a6a8592d1b4ba861a7f\Reach Framework.ni.dll
    + 2009-08-22 08:19 . 2009-08-22 08:19 1657856 c:\windows\assembly\NativeImages_v2.0.50727_32\Pre sentationUI\6bafb1a2a73794ddb9761cb321c9e7e2\Prese ntationUI.ni.dll
    + 2009-08-22 08:18 . 2009-08-22 08:18 1451008 c:\windows\assembly\NativeImages_v2.0.50727_32\Pre sentationBuildTa#\e634bc4c4a00635a0a254febab0e2e2c \PresentationBuildTasks.ni.dll
    + 2009-08-22 08:31 . 2009-08-22 08:31 1712128 c:\windows\assembly\NativeImages_v2.0.50727_32\Mic rosoft.VisualBas#\1c86afc399d0fdd8e069266ffbe748d1 \Microsoft.VisualBasic.ni.dll
    + 2009-08-22 08:31 . 2009-08-22 08:31 1093120 c:\windows\assembly\NativeImages_v2.0.50727_32\Mic rosoft.Transacti#\6b2f62f5e981913fce1d223f645d9ddf \Microsoft.Transactions.Bridge.ni.dll
    + 2009-08-22 08:33 . 2009-08-22 08:33 2332160 c:\windows\assembly\NativeImages_v2.0.50727_32\Mic rosoft.JScript\b261961046545831aa60963e84905968\Mi crosoft.JScript.ni.dll
    + 2009-08-22 08:31 . 2009-08-22 08:31 1620992 c:\windows\assembly\NativeImages_v2.0.50727_32\Mic rosoft.Build.Tas#\bd241492d96db39f20e758c13c845033 \Microsoft.Build.Tasks.ni.dll
    + 2009-08-22 08:31 . 2009-08-22 08:31 1966080 c:\windows\assembly\NativeImages_v2.0.50727_32\Mic rosoft.Build.Tas#\a47100d8f4574bed2d49d83d0ab8964e \Microsoft.Build.Tasks.v3.5.ni.dll
    + 2009-08-22 08:31 . 2009-08-22 08:31 1888768 c:\windows\assembly\NativeImages_v2.0.50727_32\Mic rosoft.Build.Eng#\6cfe582681724965fb817e8ece5f0909 \Microsoft.Build.Engine.ni.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 1245184 c:\windows\assembly\GAC_MSIL\WindowsBase\3.0.0.0__ 31bf3856ad364e35\WindowsBase.dll
    + 2009-08-22 08:15 . 2009-08-22 08:15 3149824 c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5 c561934e089\System.dll
    + 2009-08-22 08:15 . 2009-08-22 08:15 2048000 c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b 77a5c561934e089\System.XML.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 1630208 c:\windows\assembly\GAC_MSIL\System.Workflow.Compo nentModel\3.0.0.0__31bf3856ad364e35\System.Workflo w.ComponentModel.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 1138688 c:\windows\assembly\GAC_MSIL\System.Workflow.Activ ities\3.0.0.0__31bf3856ad364e35\System.Workflow.Ac tivities.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 5025792 c:\windows\assembly\GAC_MSIL\System.Windows.Forms\ 2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
    + 2009-08-22 08:17 . 2009-08-22 08:17 1277952 c:\windows\assembly\GAC_MSIL\System.Web.Extensions \3.5.0.0__31bf3856ad364e35\System.Web.Extensions.d ll
    + 2009-08-22 08:16 . 2009-08-22 08:16 5931008 c:\windows\assembly\GAC_MSIL\System.ServiceModel\3 .0.0.0__b77a5c561934e089\System.ServiceModel.dll
    + 2009-08-22 08:14 . 2009-08-22 08:14 5062656 c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0 __b03f5f7f11d50a3a\System.Design.dll
    + 2009-08-22 08:10 . 2009-08-22 08:10 2879488 c:\windows\assembly\GAC_MSIL\System.Data.Entity\3. 5.0.0__b77a5c561934e089\System.Data.Entity.dll
    + 2009-08-22 08:16 . 2009-08-22 08:16 5283840 c:\windows\assembly\GAC_MSIL\PresentationFramework \3.0.0.0__31bf3856ad364e35\PresentationFramework.d ll
    + 2009-08-22 08:14 . 2009-08-22 08:14 5242880 c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03 f5f7f11d50a3a\System.Web.dll
    + 2009-08-22 08:15 . 2009-08-22 08:15 2933248 c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b7 7a5c561934e089\System.Data.dll
    + 2009-08-22 08:09 . 2009-08-22 08:09 4210688 c:\windows\assembly\GAC_32\PresentationCore\3.0.0. 0__31bf3856ad364e35\PresentationCore.dll
    + 2009-08-22 08:15 . 2009-08-22 08:15 4546560 c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5 c561934e089\mscorlib.dll
    + 2008-06-22 03:44 . 2009-08-28 21:38 24689600 c:\windows\system32\MRT.exe
    + 2008-12-13 15:21 . 2008-12-13 15:21 10473472 c:\windows\Installer\42b725e.msp
    + 2009-08-22 08:21 . 2009-08-22 08:21 12430848 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Windows.Forms\63406259e94d5c0ff5b79401dfe113ce \System.Windows.Forms.ni.dll
    + 2009-08-22 08:34 . 2009-08-22 08:34 11796992 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Web\3963ce03d445a8619abbf388d590134b\System.We b.ni.dll
    + 2009-08-22 08:30 . 2009-08-22 08:30 17317888 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.ServiceModel\4146033013edebd7e0cb604e504ebfee\ System.ServiceModel.ni.dll
    + 2009-08-22 08:20 . 2009-08-22 08:20 10683392 c:\windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Design\8ee220bc3cce4f7bbd7818946519ed7f\System .Design.ni.dll
    + 2009-08-22 08:19 . 2009-08-22 08:19 14327808 c:\windows\assembly\NativeImages_v2.0.50727_32\Pre sentationFramewo#\96e710f47c601cba3f2348a8d11ddede \PresentationFramework.ni.dll
    + 2009-08-22 08:19 . 2009-08-22 08:19 12216320 c:\windows\assembly\NativeImages_v2.0.50727_32\Pre sentationCore\956375d487cbef36165b3250030e3574\Pre sentationCore.ni.dll
    + 2009-08-22 08:18 . 2009-08-22 08:18 11486720 c:\windows\assembly\NativeImages_v2.0.50727_32\msc orlib\6d667f19d687361886990f3ca0f49816\mscorlib.ni .dll
    .
    -- Snapshot reset to current date --
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
    "OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2008-05-15 95536]
    "BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-05-06 321344]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
    "Omnipage"="c:\program files\ScanSoft\OmniPageSE\opware32.exe" [2002-02-21 49152]
    "NeroFilterCheck"="c:\windows\system32\NeroCheck.e xe" [2001-07-10 155648]
    "InCD"="c:\program files\Ahead\InCD\InCD.exe" [2004-02-09 1265714]
    "Sprint SmartView"="c:\program files\Sprint\Sprint SmartView\SprintSV.exe" [2008-03-10 17672]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-16 198160]
    "DXM6Patch_981116"="c:\windows\p_981116.exe" [1998-11-30 497376]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
    "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp. exe" [2009-08-17 81000]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-05-21 177472]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
    "lxdwmon.exe"="c:\program files\Lexmark 7600 Series\lxdwmon.exe" [2008-05-21 676520]
    "lxdwamon"="c:\program files\Lexmark 7600 Series\lxdwamon.exe" [2008-05-21 16040]
    "VTTimer"="VTTimer.exe" - c:\windows\system32\VTTimer.exe [2004-08-03 49152]
    "VTTrayp"="VTtrayp.exe" - c:\windows\system32\VTTrayp.exe [2004-08-03 143360]

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\DNA\\btdna.exe"=
    "c:\\Program Files\\BitTorrent\\bittorrent.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\WINDOWS\\system32\\lxdwcoms.exe"=

    R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [6/20/2009 10:40 AM 114768]
    R1 GearAspiSys;GearAspiSys;c:\windows\system32\driver s\GEARASPISYS.SYS [8/3/2008 4:11 PM 53412]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswF sBlk.sys [6/20/2009 10:40 AM 20560]
    R2 BtwSrv;BtwSrv;c:\windows\system32\svchost.exe -k netsvcs [6/21/2008 3:26 PM 14336]
    R2 lxdw_device;lxdw_device;c:\windows\system32\lxdwco ms.exe -service --> c:\windows\system32\lxdwcoms.exe -service [?]
    R2 sofatnet;sofatnet Service;c:\windows\system32\sofatnet.exe [8/4/2004 7:00 AM 94720]
    R2 vpnagent;Cisco AnyConnect VPN Agent;c:\program files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe [4/23/2007 4:12 AM 336944]
    S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
    S2 AntipPolice_;AntiPol;c:\windows\svchast.exe --> c:\windows\svchast.exe [?]
    S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\program files\Lavasoft\Ad-Aware\AAWService.exe" --> c:\program files\Lavasoft\Ad-Aware\AAWService.exe [?]
    S2 lxdwCATSCustConnectService;lxdwCATSCustConnectServ ice;c:\windows\system32\spool\drivers\w32x86\3\lxd wserv.exe [8/28/2009 12:46 AM 98984]
    S3 mamotou;mamotou;c:\windows\system32\drivers\mamoto u.sys [7/23/2008 5:17 PM 49489]
    S3 mamovec;mamovec;c:\windows\system32\drivers\mamove c.sys [7/22/2008 12:17 PM 24784]
    S3 mamovem;mamovem;c:\windows\system32\drivers\mamove m.sys [7/22/2008 12:17 PM 25044]
    S3 mamoveu;mamoveu;c:\windows\system32\drivers\mamove u.sys [7/22/2008 12:17 PM 48853]
    S3 mfsdisk;mfsdisk;c:\windows\system32\mfsdisk.sys [6/21/2008 3:25 PM 2304]
    S3 pgusbmme;usb-audio.de MME-Adapter;c:\windows\system32\drivers\pgusbmm3.sys --> c:\windows\system32\drivers\pgusbmm3.sys [?]
    S3 pgusbwdm;usb-audio.de driver (commercial V2.6.1);c:\windows\system32\Drivers\pgusbwdm.sys --> c:\windows\system32\Drivers\pgusbwdm.sys [?]
    S3 TNET1130;802.11 WLAN;c:\windows\system32\drivers\TNET1130.sys [12/1/2004 6:35 PM 438912]
    S3 vpnva;Cisco AnyConnect VPN Virtual Miniport Adapter for Windows;c:\windows\system32\drivers\vpnva.sys [4/23/2007 4:09 AM 24176]

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    BtwSrv
    .
    Contents of the 'Scheduled Tasks' folder

    2009-09-21 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    uInternet Settings,ProxyOverride = *.local
    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
    DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} - hxxps://remote.cmh.edu/CACHE/stc/1/binaries/vpnweb.cab
    .

    ************************************************** ************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
    Rootkit scan 2009-09-21 22:34
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    ************************************************** ************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1911415 6-8E9A-4D4E-9EE9-17A0E48D3BBB}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\WINDOWS\\system32\\Macrome d\\Flash\\FlashUtil10c.exe,-101"

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1911415 6-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
    "Enabled"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1911415 6-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
    @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUt il10c.exe"

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1911415 6-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4 C8A81-B7AC-460A-8C23-98713C41D6B3}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker3"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4 C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4 C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'explorer.exe'(3724)
    c:\windows\system32\WININET.dll
    c:\program files\ScanSoft\OmniPageSE\ophook32.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Ahead\InCD\incdsrv.exe
    c:\program files\Alwil Software\Avast4\aswUpdSv.exe
    c:\program files\Alwil Software\Avast4\ashServ.exe
    c:\program files\Alwil Software\Avast4\Setup\avast.setup
    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\windows\system32\lxdwcoms.exe
    c:\windows\system32\lxdwcoms.exe
    c:\windows\system32\MsPMSPSv.exe
    c:\program files\Lexmark 7600 Series\lxdwmsdmon.exe
    .
    ************************************************** ************************
    .
    Completion time: 2009-09-22 22:39 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-09-22 03:38
    ComboFix2.txt 2009-08-12 17:59

    Pre-Run: 8,745,562,112 bytes free
    Post-Run: 9,089,409,024 bytes free

    1221 --- E O F --- 2009-09-09 08:05


    HiJackThis log:
    ====================
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:48:07 PM, on 9/21/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16876)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Ahead\InCD\InCDsrv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\lxdwcoms.exe
    C:\WINDOWS\system32\sofatnet.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\WINDOWS\system32\VTTimer.exe
    C:\WINDOWS\system32\VTtrayp.exe
    C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
    C:\Program Files\Ahead\InCD\InCD.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Lexmark 7600 Series\lxdwmon.exe
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\Lexmark 7600 Series\lxdwMsdMon.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\imapi.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\wmdtc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, News, Sport, Music, Movies, Money, Cars, Shopping, Windows Live from MSN UK
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, News, Sport, Music, Movies, Money, Cars, Shopping, Windows Live from MSN UK
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: Lexmark Printable Web - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
    O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [Sprint SmartView] "C:\Program Files\Sprint\Sprint SmartView\SprintSV.exe" -a
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [lxdwmon.exe] "C:\Program Files\Lexmark 7600 Series\lxdwmon.exe"
    O4 - HKLM\..\Run: [lxdwamon] "C:\Program Files\Lexmark 7600 Series\lxdwamon.exe"
    O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01...s/MSNPUpld.cab
    O16 - DPF: {528C14CD-CF9E-489C-A365-5999F17B69B9} (LightSurfUploadCtl Class) - http://pictures.sprintpcs.com/active...oadControl.cab
    O16 - DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} (Cisco AnyConnect VPN Client Web Control) - https://remote.cmh.edu/CACHE/stc/1/binaries/vpnweb.cab
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O23 - Service: AntiPol (AntipPolice_) - Unknown owner - C:\WINDOWS\svchast.exe (file missing)
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Lavasoft Ad-Aware Service - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (file missing)
    O23 - Service: lxdwCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdwse rv.exe
    O23 - Service: lxdw_device - - C:\WINDOWS\system32\lxdwcoms.exe
    O23 - Service: sofatnet Service (sofatnet) - Sigma Designs In - C:\WINDOWS\system32\sofatnet.exe
    O23 - Service: Sprint RcAppSvc (SprintRcAppSvc) - PCTEL - C:\Program Files\Sprint\Sprint SmartView\RcAppSvc.exe
    O23 - Service: Cisco AnyConnect VPN Agent (vpnagent) - Cisco Systems, Inc. - C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe

    --
    End of file - 8567 bytes

  3. 22-09-2009  #2
    phast2
    phast2 is offline Full Member
    Forgot to mention that the system seems to be a lot better now after running Combo-Fix. Hopefully that took care of the problem, but please review the log files from my last post. Thanks!
  4. 22-09-2009  #3
    Neal
    Neal is offline Dedicated Member
    Download SDFIX and save it to your Desktop.

    Double click SDFix.exe and choose Install to extract it to its own folder on the Desktop. Please then reboot your computer in Safe Mode by doing the following :
    • Restart your computer
    • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
    • Instead of Windows loading as normal, a menu with options should appear;
    • Select the first option, to run Windows in Safe Mode, then press "Enter".
    • Choose your usual account.
    • In Safe Mode, right click the SDFix.zip folder and choose Extract All,
    • Open the extracted folder and double click RunThis.bat to start the script.
    • Type Y to begin the script.
    • It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
    • Press any Key and it will restart the PC.
    • Your system will take longer that normal to restart as the fixtool will be running and removing files.
    • When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons.
    • Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt back onto the forum with a new HijackThis log



    * Please download Malwarebytes' Anti-Malware from HERE or HERE

    Double Click mbam-setup.exe to install the application.

    * Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and zLaunch Malwarebytes Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select "Perform Full Scan", then click Scan.
    * The scan may take some time to finish,so please be patient.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Make sure that everything is checked, and click Remove Selected.
    * When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
    * The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    * Copy&Paste the entire report in your next reply along with a fresh HijackThis log.


    Extra Note:
    If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.
  5. 23-09-2009  #4
    phast2
    phast2 is offline Full Member
    SDFix report:
    ===============================================

    SDFix: Version 1.240
    Run by Pat on Tue 09/22/2009 at 08:10 PM

    Microsoft Windows XP [Version 5.1.2600]
    Running From: C:\Documents and Settings\Pat\Desktop\SDFix

    Checking Services :


    Restoring Default Security Values
    Restoring Default Hosts File

    Rebooting


    Checking Files :

    No Trojan Files Found






    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
    Rootkit scan 2009-09-22 20:46:52
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    scanning hidden registry entries ...

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0


    Remaining Services :




    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\servic es\sharedaccess\parameters\firewallpolicy\standard profile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\syste m32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
    "C:\\Program Files\\DNA\\btdna.exe"="C:\\Program Files\\DNA\\btdna.exe:*:EnabledNA"
    "C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTor rent"
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjou r"
    "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
    "C:\\WINDOWS\\system32\\lxdwcoms.exe"="C:\\WINDOWS \\system32\\lxdwcoms.exe:*:Enabled:7600 Series Server"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\servic es\sharedaccess\parameters\firewallpolicy\domainpr ofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\syste m32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

    Remaining Files :



    Files with Hidden Attributes :

    Mon 7 Sep 2009 1,570,648 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\advcheck.dll"
    Mon 26 Jan 2009 1,740,632 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
    Mon 26 Jan 2009 5,365,592 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
    Tue 26 Aug 2008 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
    Sat 12 Jul 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
    Fri 11 Jan 2008 319,456 A..H. --- "C:\Program Files\Common Files\Motorola Shared\MotPCSDrivers\difxapi.dll"
    Wed 1 Apr 2009 0 ...H. --- "C:\Documents and Settings\Pat\Application Data\Microsoft\Word\~WRL0005.tmp"

    Finished!


    New HijackThis log 1:
    =======================================
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:22:45 PM, on 9/22/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16876)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Ahead\InCD\InCDsrv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\lxdwcoms.exe
    C:\WINDOWS\system32\sofatnet.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\VTTimer.exe
    C:\WINDOWS\system32\VTtrayp.exe
    C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
    C:\Program Files\Ahead\InCD\InCD.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Lexmark 7600 Series\lxdwmon.exe
    C:\Program Files\Lexmark 7600 Series\lxdwMsdMon.exe
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, News, Sport, Music, Movies, Money, Cars, Shopping, Windows Live from MSN UK
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, News, Sport, Music, Movies, Money, Cars, Shopping, Windows Live from MSN UK
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: Lexmark Printable Web - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
    O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [Sprint SmartView] "C:\Program Files\Sprint\Sprint SmartView\SprintSV.exe" -a
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [lxdwmon.exe] "C:\Program Files\Lexmark 7600 Series\lxdwmon.exe"
    O4 - HKLM\..\Run: [lxdwamon] "C:\Program Files\Lexmark 7600 Series\lxdwamon.exe"
    O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01...s/MSNPUpld.cab
    O16 - DPF: {528C14CD-CF9E-489C-A365-5999F17B69B9} (LightSurfUploadCtl Class) - http://pictures.sprintpcs.com/active...oadControl.cab
    O16 - DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} (Cisco AnyConnect VPN Client Web Control) - https://remote.cmh.edu/CACHE/stc/1/binaries/vpnweb.cab
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O23 - Service: AntiPol (AntipPolice_) - Unknown owner - C:\WINDOWS\svchast.exe (file missing)
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Lavasoft Ad-Aware Service - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (file missing)
    O23 - Service: lxdwCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdwse rv.exe
    O23 - Service: lxdw_device - - C:\WINDOWS\system32\lxdwcoms.exe
    O23 - Service: sofatnet Service (sofatnet) - Sigma Designs In - C:\WINDOWS\system32\sofatnet.exe
    O23 - Service: Sprint RcAppSvc (SprintRcAppSvc) - PCTEL - C:\Program Files\Sprint\Sprint SmartView\RcAppSvc.exe
    O23 - Service: Cisco AnyConnect VPN Agent (vpnagent) - Cisco Systems, Inc. - C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe

    --
    End of file - 8517 bytes


    Mbam Log:
    ========================================
    Malwarebytes' Anti-Malware 1.41
    Database version: 2845
    Windows 5.1.2600 Service Pack 3

    9/22/2009 10:25:39 PM
    mbam-log-2009-09-22 (22-25-39).txt

    Scan type: Full Scan (C:\|D:\|)
    Objects scanned: 194296
    Time elapsed: 48 minute(s), 10 second(s)

    Memory Processes Infected: 1
    Memory Modules Infected: 1
    Registry Keys Infected: 7
    Registry Values Infected: 11
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 28

    Memory Processes Infected:
    C:\WINDOWS\system32\sofatnet.exe (Backdoor.Bot) -> Unloaded process successfully.

    Memory Modules Infected:
    c:\WINDOWS\system32\BtwSrv.dll (Trojan.Agent) -> Delete on reboot.

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\b twsrv (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\b twsrv (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\btwsrv (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\s ofatnet (Backdoor.Bot) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\s ofatnet (Backdoor.Bot) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\sofatnet (Backdoor.Bot) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\AntipPolice_ (Trojan.FakeAlert) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\BuildW (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\FirstIn stallFlag (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\guid (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\i (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\mEv (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\mso (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\udso (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\uid (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Ulrn (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Update (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\UpdateN ew (Malware.Trace) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    c:\WINDOWS\system32\BtwSrv.dll (Trojan.Agent) -> Delete on reboot.
    C:\WINDOWS\system32\sofatnet.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\20GDBD32\w[1].bin (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\FDMYN07H\w[1].bin (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\gasfkyoibi qrcv.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\gasfkysbiv mswu.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\gasfkyspyf gkpx.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\gasfkywmxn nxnx.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\wiwow64.ex e.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\ga sfkycyuvbawo.sys.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\ga sfkyewwgptng.sys.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7D607B74-8182-4A0E-99A6-1FF5338755DA}\RP463\A0074556.sys (Rootkit.TDSS) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7D607B74-8182-4A0E-99A6-1FF5338755DA}\RP463\A0074557.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7D607B74-8182-4A0E-99A6-1FF5338755DA}\RP463\A0074558.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7D607B74-8182-4A0E-99A6-1FF5338755DA}\RP463\A0074559.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7D607B74-8182-4A0E-99A6-1FF5338755DA}\RP463\A0075567.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7D607B74-8182-4A0E-99A6-1FF5338755DA}\RP463\A0075568.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7D607B74-8182-4A0E-99A6-1FF5338755DA}\RP464\A0075599.sys (Rootkit.TDSS) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7D607B74-8182-4A0E-99A6-1FF5338755DA}\RP464\A0075601.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7D607B74-8182-4A0E-99A6-1FF5338755DA}\RP464\A0075604.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7D607B74-8182-4A0E-99A6-1FF5338755DA}\RP464\A0075735.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7D607B74-8182-4A0E-99A6-1FF5338755DA}\RP464\A0075742.dll (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7D607B74-8182-4A0E-99A6-1FF5338755DA}\RP464\A0075743.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7D607B74-8182-4A0E-99A6-1FF5338755DA}\RP464\A0078820.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7D607B74-8182-4A0E-99A6-1FF5338755DA}\RP464\A0078823.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\wiwow64.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\wmdtc.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\FInstall.sys (Backdoor.Bot) -> Quarantined and deleted successfully.


    New HijackThis Log 2:
    ============================================
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 1017 PM, on 9/22/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16876)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Ahead\InCD\InCDsrv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\lxdwcoms.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\VTTimer.exe
    C:\WINDOWS\system32\VTtrayp.exe
    C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
    C:\Program Files\Ahead\InCD\InCD.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Lexmark 7600 Series\lxdwmon.exe
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Lexmark 7600 Series\lxdwMsdMon.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, News, Sport, Music, Movies, Money, Cars, Shopping, Windows Live from MSN UK
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, News, Sport, Music, Movies, Money, Cars, Shopping, Windows Live from MSN UK
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: Lexmark Printable Web - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
    O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [Sprint SmartView] "C:\Program Files\Sprint\Sprint SmartView\SprintSV.exe" -a
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [lxdwmon.exe] "C:\Program Files\Lexmark 7600 Series\lxdwmon.exe"
    O4 - HKLM\..\Run: [lxdwamon] "C:\Program Files\Lexmark 7600 Series\lxdwamon.exe"
    O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
    O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01...s/MSNPUpld.cab
    O16 - DPF: {528C14CD-CF9E-489C-A365-5999F17B69B9} (LightSurfUploadCtl Class) - http://pictures.sprintpcs.com/active...oadControl.cab
    O16 - DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} (Cisco AnyConnect VPN Client Web Control) - https://remote.cmh.edu/CACHE/stc/1/binaries/vpnweb.cab
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Lavasoft Ad-Aware Service - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (file missing)
    O23 - Service: lxdwCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdwse rv.exe
    O23 - Service: lxdw_device - - C:\WINDOWS\system32\lxdwcoms.exe
    O23 - Service: Sprint RcAppSvc (SprintRcAppSvc) - PCTEL - C:\Program Files\Sprint\Sprint SmartView\RcAppSvc.exe
    O23 - Service: Cisco AnyConnect VPN Agent (vpnagent) - Cisco Systems, Inc. - C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe

    --
    End of file - 8435 bytes
  6. 23-09-2009  #5
    phast2
    phast2 is offline Full Member
    Forgot to mention one remaining problem that I've noticed: I reboot the system, select my user login, and then wait for my desktop to load. So far, so good. I then click open an Internet Explorer (with my home page set to Google). This first IE window just sits there and "spins" for quite awhile (at least 5 minutes or so) before it finally completes and loads up the standard Google search box. After that, subsequent IE windows load normally without any delays. Other than that, the rest of the system seems to be operating OK now. (Crossing my fingers!) Thanks.
  7. 23-09-2009  #6
    Neal
    Neal is offline Dedicated Member
    Try uninstalling Adaware and see if that makes things faster, also...

    Please download ATF Cleaner by Atribune to desktop.
    http://www.atribune.org/public-beta/ATF-Cleaner.exe

    Double-click ATF-Cleaner.exe to run the program.

    If you would like to keep your cookies don't check that item

    * Under Main "Select Files to Delete" choose: Select All.
    * Click the Empty Selected button.
    * If you use Firefox browser click Firefox at the top and choose: Select All
    * Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    * If you use Opera browser click Opera at the top and choose: Select All
    * Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click No at the prompt.

    Click Exit on the Main menu to close the program.
  8. 24-09-2009  #7
    phast2
    phast2 is offline Full Member
    As far as I can see, Ad-Aware has been uninstalled from my system since the last time you helped with viruses a month or two ago. However, Lavasoft Ad-Aware is still listed under my Computer Management->Services, so I have now set it to Disabled at startup. (Hopefully it will stay that way.) I do not really see how to remove it permanently from the list of Services.

    I ran ATF-Cleaner, and here's my [hopefully] final HijackThis log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 7:50:15 PM, on 9/23/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16876)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Ahead\InCD\InCDsrv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\VTTimer.exe
    C:\WINDOWS\system32\VTtrayp.exe
    C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
    C:\Program Files\Ahead\InCD\InCD.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Lexmark 7600 Series\lxdwmon.exe
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\Lexmark 7600 Series\lxdwMsdMon.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\lxdwcoms.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
    C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, News, Sport, Music, Movies, Money, Cars, Shopping, Windows Live from MSN UK
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, News, Sport, Music, Movies, Money, Cars, Shopping, Windows Live from MSN UK
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: Lexmark Printable Web - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
    O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [Sprint SmartView] "C:\Program Files\Sprint\Sprint SmartView\SprintSV.exe" -a
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [lxdwmon.exe] "C:\Program Files\Lexmark 7600 Series\lxdwmon.exe"
    O4 - HKLM\..\Run: [lxdwamon] "C:\Program Files\Lexmark 7600 Series\lxdwamon.exe"
    O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
    O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-21-3693919942-3041326170-3679489256-1007\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Sharon')
    O4 - HKUS\S-1-5-21-3693919942-3041326170-3679489256-1007\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Sharon')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01...s/MSNPUpld.cab
    O16 - DPF: {528C14CD-CF9E-489C-A365-5999F17B69B9} (LightSurfUploadCtl Class) - http://pictures.sprintpcs.com/active...oadControl.cab
    O16 - DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} (Cisco AnyConnect VPN Client Web Control) - https://remote.cmh.edu/CACHE/stc/1/binaries/vpnweb.cab
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: lxdwCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdwse rv.exe
    O23 - Service: lxdw_device - - C:\WINDOWS\system32\lxdwcoms.exe
    O23 - Service: Sprint RcAppSvc (SprintRcAppSvc) - PCTEL - C:\Program Files\Sprint\Sprint SmartView\RcAppSvc.exe
    O23 - Service: Cisco AnyConnect VPN Agent (vpnagent) - Cisco Systems, Inc. - C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe

    --
    End of file - 8680 bytes
  9. 24-09-2009  #8
    phast2
    phast2 is offline Full Member
    I rebooted again and the Lavasoft Ad-Aware Service still shows as Disabled in the Computer Management->Services list. However, when I click open my first Internet Explorer window (with the home page set to Google), it still takes about 10 minutes for this first window to "spin" until it finally displays the Google page. Subsequent IE windows display the Google page right away and just fine.
  10. 24-09-2009  #9
    phast2
    phast2 is offline Full Member
    Save 20% on AVG Internet Security 2012 Suite!
    One more thing I noticed: My Internet Explorer windows used to have an option under Tools called "Diagnose Connection Problems..." I know I used that a couple of times recently to "diagnose" and/or "repair" my network connection. That option seems to have disappeared somewhere along the way in this recent virus episode. (I'm at work right now, but I believe my home computer in question is using IE7 - and I haven't upgraded it recently or anything.) Thanks.
+ Reply to Thread
« [Active] Slow PC | Internet Explorer opening »