Help Please. Rootkit.0access

bsites9 · November 18, 2012

From what I've seen, this has been a problem lately. Below are the logs requested. Thanks.

jeffce · November 18, 2012

Hi and Welcome!! My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete anything unless instructed to.

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:

These tools MUST be run from the executable (.exe) every time you run them

with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

---------

I need to let you know even though you seem to already...

**WARNING**Unfortunately one or more of the infections I have identified are Backdoor Trojans, IRCBots or other Malware capable of stealing very important information. You need to stop using all Internet Banking sites, change passwords to all sites with sensitive information from a clean computer and phone your bank to inform them that you may be a victim of identify theft. More often than not, we advise users that a full reinstallation of their Operating System is the only way to ensure that their computer will ever be 100% clean again.

Unfortunately I have found what is known as the ZeroAccess rootkit on your system. It is an especially nasty infection that can take quite some time to clean as well as may have damaged your system files itself. As a warning, during the cleaning (if you choose to do so) you may lose internet access with this computer and in the end we may need to reinstall the operating system anyway depending on the extent of the infection.

If you would like to continue with the cleaning, please continue with the following instructions and I will be more than happy to help.

----------

Please read through these instructions to familarize yourself with what to expect when this tool runs

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

4. If you get a message saying "Illegal operation attempted on a registry key that has been marked for deletion", please restart your computer.

----------

bsites9 · November 18, 2012

Ok, here's the combo fix log. Though it didn't give the prompts shown above. Guess it didn't need to?

ComboFix.txt

jeffce · November 18, 2012

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1

Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:filefind
Serial*
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

bsites9 · November 18, 2012

Here's systemlook.

SystemLook.txt

jeffce · November 18, 2012

Hi,

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the box below:

ClearJavaCache::
FCopy::
C:\WINDOWS\system32\dllcache\serial.sys | c:\windows\system32\drivers\Serial.sys
Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix may request an update; please allow it.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

----------

Please post the new ComboFix log.

bsites9 · November 19, 2012

Ok..here's the copy and paste. No attachment right?

ComboFix 12-11-16.02 - B. Sites 11/18/2012 18:53:57.2.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2038.1452 [GMT -5:00]

Running from: c:\documents and settings\B. Sites\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\B. Sites\Desktop\CFScript.txt

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

--------------- FCopy ---------------

.

c:\windows\system32\dllcache\serial.sys --> c:\windows\system32\drivers\Serial.sys

.

((((((((((((((((((((((((( Files Created from 2012-10-18 to 2012-11-18 )))))))))))))))))))))))))))))))

.

2012-11-18 23:53 . 2012-03-31 13:08 64512 ----a-w- c:\windows\system32\drivers\Serial.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-11-15 20:13 . 2012-01-31 15:24 139096 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys

2012-11-15 20:13 . 2012-01-31 15:24 202008 ----a-w- c:\windows\system32\PnkBstrB.exe

2012-09-29 23:54 . 2011-01-03 00:24 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-08-28 15:14 . 2008-08-21 12:00 916992 ----a-w- c:\windows\system32\wininet.dll

2012-08-28 15:14 . 2008-08-21 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll

2012-08-28 15:14 . 2008-08-21 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl

2012-08-28 12:07 . 2008-08-21 12:00 385024 ----a-w- c:\windows\system32\html.iec

2012-08-24 13:53 . 2008-08-21 12:00 177664 ----a-w- c:\windows\system32\wintrust.dll

2012-08-21 13:33 . 2008-08-21 12:00 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe

2012-08-21 12:58 . 2008-04-14 00:01 2027520 ----a-w- c:\windows\system32\ntkrnlpa.exe

2011-04-14 16:26 . 2011-05-07 00:32 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[-] 2008-08-21 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys

[-] 2008-04-14 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\atapi.sys

[-] 2008-04-14 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\drivers\atapi.sys

.

[-] 2008-08-21 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\asyncmac.sys

[-] 2008-08-21 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\system32\drivers\asyncmac.sys

.

[-] 2008-08-21 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\dllcache\beep.sys

[-] 2008-08-21 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\drivers\beep.sys

.

[-] 2008-08-21 . 463C1EC80CD17420A542B7F36A36F128 . 24576 . . [5.1.2600.5512] . . c:\windows\system32\drivers\kbdclass.sys

.

[-] 2008-08-21 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ndis.sys

[-] 2008-08-21 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ndis.sys

.

[-] 2008-08-21 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ntfs.sys

[-] 2008-08-21 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ntfs.sys

.

[-] 2008-08-21 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\dllcache\null.sys

[-] 2008-08-21 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys

.

[-] 2008-08-21 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\system32\lsass.exe

[-] 2008-08-21 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\lsass.exe

.

[-] 2008-08-21 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\system32\netman.dll

[-] 2008-08-21 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\netman.dll

.

[-] 2008-08-21 12:00 . 1280A158C722FA95A80FB7AEBE78FA7D . 792064 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll

[-] 2008-08-21 12:00 . 1280A158C722FA95A80FB7AEBE78FA7D . 792064 . . [2001.12.4414.700] . . c:\windows\system32\dllcache\comres.dll

.

[-] 2008-08-21 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\qmgr.dll

[-] 2008-08-21 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\dllcache\qmgr.dll

.

[-] 2008-08-21 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe

[-] 2008-08-21 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\winlogon.exe

.

[-] 2008-08-21 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ipsec.sys

[-] 2008-08-21 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ipsec.sys

.

[-] 2008-08-21 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\system32\cryptsvc.dll

[-] 2008-08-21 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\cryptsvc.dll

.

[-] 2008-08-21 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\system32\imm32.dll

[-] 2008-08-21 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\imm32.dll

.

[-] 2008-08-21 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\linkinfo.dll

[-] 2008-08-21 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\linkinfo.dll

.

[-] 2008-08-21 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\system32\lpk.dll

[-] 2008-08-21 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\lpk.dll

.

[-] 2008-08-21 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\system32\msvcrt.dll

[-] 2008-08-21 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\system32\dllcache\msvcrt.dll

[-] 2008-08-21 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll

[-] 2008-08-21 . D7075E95AA599EE77B7A89D39296BD3D . 343040 . . [7.0.2600.5512] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll

.

[-] 2008-08-21 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\system32\netlogon.dll

[-] 2008-08-21 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\netlogon.dll

.

[-] 2008-08-21 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\system32\powrprof.dll

[-] 2008-08-21 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\powrprof.dll

.

[-] 2008-08-21 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\system32\scecli.dll

[-] 2008-08-21 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\scecli.dll

.

[-] 2008-08-21 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\system32\sfc.dll

[-] 2008-08-21 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\sfc.dll

.

[-] 2008-08-21 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\system32\svchost.exe

[-] 2008-08-21 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\svchost.exe

.

[-] 2008-08-21 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\system32\tapisrv.dll

[-] 2008-08-21 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\tapisrv.dll

.

[-] 2008-08-21 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll

[-] 2008-08-21 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\user32.dll

.

[-] 2008-08-21 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\system32\userinit.exe

[-] 2008-08-21 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\userinit.exe

.

[-] 2008-08-21 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\system32\ws2_32.dll

[-] 2008-08-21 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ws2_32.dll

.

[-] 2008-08-21 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\ws2help.dll

[-] 2008-08-21 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ws2help.dll

.

[-] 2008-08-21 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\explorer.exe

[-] 2008-08-21 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\system32\dllcache\explorer.exe

.

[-] 2008-08-21 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\regedit.exe

[-] 2008-08-21 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\regedit.exe

.

[-] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\system32\ksuser.dll

[-] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\system32\dllcache\ksuser.dll

.

[-] 2008-08-21 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe

[-] 2008-08-21 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ctfmon.exe

.

[-] 2008-08-21 . AFFC87E2501FCE8F09D4C10BA6421CCF . 4608 . . [5.1.2600.5512] . . c:\windows\system32\msimg32.dll

[-] 2008-08-21 . AFFC87E2501FCE8F09D4C10BA6421CCF . 4608 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\msimg32.dll

.

[-] 2008-08-21 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll

[-] 2008-08-21 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\srsvc.dll

.

[-] 2008-08-21 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\system32\wscntfy.exe

[-] 2008-08-21 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\wscntfy.exe

.

[-] 2008-08-21 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\system32\xmlprov.dll

[-] 2008-08-21 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\xmlprov.dll

.

[-] 2008-08-21 . 5733177BCF16EE78B99543C9B0AB81EA . 177152 . . [5.1.2600.5512] . . c:\windows\system32\MSCTFIME.IME

[-] 2008-08-21 . 5733177BCF16EE78B99543C9B0AB81EA . 177152 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\msctfime.ime

.

[-] 2008-08-21 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\system32\eventlog.dll

[-] 2008-08-21 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\eventlog.dll

.

[-] 2008-08-21 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

[-] 2008-08-21 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\sfcfiles.dll

.

[-] 2008-08-21 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ipsec.sys

[-] 2008-08-21 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ipsec.sys

.

[-] 2008-08-21 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\system32\regsvc.dll

[-] 2008-08-21 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\regsvc.dll

.

[-] 2008-08-21 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\system32\schedsvc.dll

[-] 2008-08-21 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\schedsvc.dll

.

[-] 2008-08-21 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\system32\ssdpsrv.dll

[-] 2008-08-21 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ssdpsrv.dll

.

[-] 2008-08-21 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\system32\termsrv.dll

[-] 2008-08-21 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\termsrv.dll

.

[-] 2008-08-21 . 3CB32D3B8CBE79899D63280BB7A83CD9 . 344064 . . [5.1.2600.5512] . . c:\windows\system32\hnetcfg.dll

[-] 2008-08-21 . 3CB32D3B8CBE79899D63280BB7A83CD9 . 344064 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\hnetcfg.dll

.

[-] 2008-08-21 . 9859C0F6936E723E4892D7141B1327D5 . 11648 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys

.

[-] 2008-04-14 06:09 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\system32\dllcache\aec.sys

[-] 2008-04-14 06:09 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\system32\drivers\aec.sys

.

[-] 2008-08-21 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\ip6fw.sys

[-] 2008-08-21 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ip6fw.sys

.

[-] 2008-08-21 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\system32\msgsvc.dll

[-] 2008-08-21 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\msgsvc.dll

.

[-] 2008-08-21 12:00 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\system32\ntmssvc.dll

[-] 2008-08-21 12:00 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\system32\dllcache\ntmssvc.dll

.

[-] 2008-08-21 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\system32\upnphost.dll

[-] 2008-08-21 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\upnphost.dll

.

[-] 2008-08-21 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:\windows\system32\dsound.dll

[-] 2008-08-21 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:\windows\system32\dllcache\dsound.dll

.

[-] 2008-08-21 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:\windows\system32\d3d9.dll

[-] 2008-08-21 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:\windows\system32\dllcache\d3d9.dll

.

[-] 2008-08-21 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512] . . c:\windows\system32\ddraw.dll

[-] 2008-08-21 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512] . . c:\windows\system32\dllcache\ddraw.dll

.

[-] 2008-08-21 12:00 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\system32\olepro32.dll

[-] 2008-08-21 12:00 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\olepro32.dll

.

[-] 2008-08-21 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\system32\perfctrs.dll

[-] 2008-08-21 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\perfctrs.dll

.

[-] 2008-08-21 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\version.dll

[-] 2008-08-21 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\version.dll

.

[-] 2008-08-21 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll

[-] 2008-08-21 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\srsvc.dll

.

[-] 2008-08-21 . 54AF4B1D5459500EF0937F6D33B1914F . 175104 . . [5.1.2600.5512] . . c:\windows\system32\w32time.dll

[-] 2008-08-21 . 54AF4B1D5459500EF0937F6D33B1914F . 175104 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\w32time.dll

.

[-] 2008-08-21 . 8BAD69CBAC032D4BBACFCE0306174C30 . 333824 . . [5.1.2600.5512] . . c:\windows\system32\wiaservc.dll

[-] 2008-08-21 . 8BAD69CBAC032D4BBACFCE0306174C30 . 333824 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\wiaservc.dll

.

[-] 2008-08-21 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\midimap.dll

[-] 2008-08-21 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\midimap.dll

.

[-] 2008-08-21 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512] . . c:\windows\system32\rasadhlp.dll

[-] 2008-08-21 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\rasadhlp.dll

.

[-] 2008-08-21 . 4E3D06D6E68EEDB52565080F55B460D3 . 19456 . . [5.1.2600.5512] . . c:\windows\system32\wshtcpip.dll

[-] 2008-08-21 . 4E3D06D6E68EEDB52565080F55B460D3 . 19456 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\wshtcpip.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]

"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-24 94208]

"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-24 77824]

"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-24 118784]

"HostManager"="c:\program files\Common Files\AOL\1293070401\ee\AOLSoftware.exe" [2010-03-08 41800]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-12-14 47904]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-07 421160]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-02-18 49208]

"dvd43"="c:\program files\dvd43\dvd43_tray.exe" [2009-10-23 827904]

"Memeo Instant Backup"="c:\program files\Memeo\AutoBackup\MemeoLauncher2.exe" [2010-04-23 136416]

"Seagate Dashboard"="c:\program files\Seagate\Seagate Dashboard\MemeoLauncher.exe" [2010-04-30 79112]

"MaxBlastMonitor.exe"="c:\program files\Maxtor\MaxBlast\MaxBlastMonitor.exe" [2008-06-27 1325800]

"AcronisTimounterMonitor"="c:\program files\Maxtor\MaxBlast\TimounterMonitor.exe" [2008-06-27 904776]

"Maxtor Scheduler2 Service"="c:\program files\Common Files\Maxtor\Schedule2\schedhlp.exe" [2008-06-27 136472]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-30 421888]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Camera Monitor HD.lnk - c:\program files\PIXELA\Everio MediaBrowser HD Edition\MBCameraMonitor.exe [2011-8-3 541976]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

.

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 11:27 AM 12880]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/12/2011 4:55 PM 67664]

R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [8/11/2011 6:38 PM 116608]

R2 hasplms;Sentinel Local License Manager;c:\windows\system32\hasplms.exe -run --> c:\windows\system32\hasplms.exe -run [?]

R2 MaxSch2Svc;Maxtor Scheduler2 Service;c:\program files\Common Files\Maxtor\Schedule2\schedul2.exe [6/27/2008 4:03 PM 431384]

R2 MemeoBackgroundService;MemeoBackgroundService;c:\program files\Memeo\AutoBackup\MemeoBackgroundService.exe [4/22/2010 7:33 PM 25824]

R2 SBKUPNT;SBKUPNT;c:\windows\system32\drivers\SBKUPNT.SYS [4/17/2011 11:39 AM 14976]

R2 SeagateDashboardService;Seagate Dashboard Service;c:\program files\Seagate\Seagate Dashboard\SeagateDashboardService.exe [4/30/2010 9:47 AM 14088]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - BITS

*NewlyCreated* - WUAUSERV

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

PCASp50

emclisrv

sscdserd

CXTUNE

hdaudbus

CiscoVpnInstallService

rpaservice

sskbfd

z525obex

ZDPNDIS5

dcfssvc

epstnt01

.

Contents of the 'Scheduled Tasks' folder

.

2012-11-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-06-12 15:03]

.

2012-11-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-06-12 15:03]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.aol.com/

uInternet Settings,ProxyOverride = *.local

TCP: DhcpNameServer = 192.168.1.1 192.168.1.1

FF - ProfilePath - c:\documents and settings\B. Sites\Application Data\Mozilla\Firefox\Profiles\58c1lo3x.default\

FF - prefs.js: network.proxy.type - 0

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-11-18 18:58

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(700)

c:\program files\SUPERAntiSpyware\SASWINLO.DLL

c:\windows\system32\WININET.dll

.

- - - - - - - > 'lsass.exe'(756)

c:\windows\system32\relog_ap.dll

.

- - - - - - - > 'explorer.exe'(1688)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2012-11-18 19:00:20

ComboFix-quarantined-files.txt 2012-11-19 00:00

ComboFix2.txt 2012-11-18 22:36

ComboFix3.txt 2012-04-05 16:18

.

Pre-Run: 388,292,952,064 bytes free

Post-Run: 388,316,516,352 bytes free

.

- - End Of File - - 356917068A5B50DDF99D6BF3C94539E0

jeffce · November 19, 2012

Hi,

Are you by chance having problems doing Windows updates?

bsites9 · November 19, 2012

well, not that I know of. What tipped me off, was I went out of town 2 weeks ago. I forgot to turn off the computer. So two days into my trip, I called my wife and asked her to turn the computer off. When I got back, as soon as I booted up and did my first google search, I got a redirect. So I ran my malware bytes program, and saw the rootkit. I then ran it again, and saw it was still there. Then googled the rootkit0access, and saw this website. So now I'm here.

So I'm not sure about the windows updates thing. How would I know?

jeffce · November 19, 2012

Hi,

Please download Farbar Service Scanner and run it on the computer with the issue.

Make sure the following options are checked:
- Internet Services
- Windows Firewall
- System Restore
- Security Center
- Windows Update
[*]Press "Scan".
[*]It will create a log (FSS.txt) in the same directory the tool is run.
[*]Please copy and paste the log to your reply.

bsites9 · November 19, 2012

Farbar Service Scanner Version: 09-11-2012

Ran by B. Sites (administrator) on 18-11-2012 at 20:05:15

Running from "C:\Documents and Settings\B. Sites\Desktop"

Microsoft Windows XP Service Pack 3 (X86)

Boot Mode: Normal

****************************************************************

Internet Services:

============

Connection Status:

==============

Localhost is accessible.

LAN connected.

Google IP is accessible.

Google.com is accessible.

Yahoo IP is accessible.

Yahoo.com is accessible.

Windows Firewall:

=============

Firewall Disabled Policy:

==================

System Restore:

============

System Restore Disabled Policy:

========================

Security Center:

============

Windows Update:

============

Windows Autoupdate Disabled Policy:

============================

File Check:

========

C:\WINDOWS\system32\dhcpcsvc.dll => MD5 is legit

C:\WINDOWS\system32\Drivers\afd.sys => MD5 is legit

C:\WINDOWS\system32\Drivers\netbt.sys => MD5 is legit

C:\WINDOWS\system32\Drivers\tcpip.sys => MD5 is legit

C:\WINDOWS\system32\Drivers\ipsec.sys => MD5 is legit

C:\WINDOWS\system32\dnsrslvr.dll => MD5 is legit

C:\WINDOWS\system32\ipnathlp.dll => MD5 is legit

C:\WINDOWS\system32\netman.dll => MD5 is legit

C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit

C:\WINDOWS\system32\srsvc.dll => MD5 is legit

C:\WINDOWS\system32\Drivers\sr.sys => MD5 is legit

C:\WINDOWS\system32\wscsvc.dll => MD5 is legit

C:\WINDOWS\system32\wbem\WMIsvc.dll => MD5 is legit

C:\WINDOWS\system32\wuauserv.dll => MD5 is legit

C:\WINDOWS\system32\qmgr.dll => MD5 is legit

C:\WINDOWS\system32\es.dll => MD5 is legit

C:\WINDOWS\system32\cryptsvc.dll => MD5 is legit

C:\WINDOWS\system32\svchost.exe => MD5 is legit

C:\WINDOWS\system32\rpcss.dll => MD5 is legit

C:\WINDOWS\system32\services.exe => MD5 is legit

Extra List:

=======

Gpc(3) IPSec(5) NetBT(6) PSched(7) Tcpip(4)

0x0700000005000000010000000200000003000000040000000600000007000000

IpSec Tag value is correct.

**** End of log ****

Ok, here's the FSS log...

jeffce · November 19, 2012

Hi,

It seems that we have some problems with your system that are not malware related that we need to take care of first. We need to fix your Windows XP Service pack 3 and to do that we need to remove it first....we will reinstall shortly.

Use the hidden $NtServicePackUninstall$ folder

Click Start, click Run, copy/paste the following into the open run box, then click OK.
c:\windows\$NtServicePackUninstall$\spuninst\spuninst.exe
When the Windows XP Service Pack 3 Removal Wizard starts, click Next.
Follow the instructions on the screen to remove Windows XP SP3.

----------

Once that has completed, please reboot your system.

Download Windows XP Service Pack 3 from here. Allow installation and then continue to download and install all updates that are shown.

Let me know when you get that finished up and if you have any problems.

bsites9 · November 19, 2012

Here is word for word the message I got when I attempted tio remove the service pack. I copied and pasted what you listed, this is what it told me in a pop up window.

C:\windows\$NServicePackUninstall$\ refers to a location that is unavailable. It could be on a hard drive on this computer, or on a network. Check to make sure that the diskis properly inserted, or that you are connected to the Internet or your network, and then try again. It if still cannot be located, the information might have been moved. to a different location.

jeffce · November 19, 2012

Ok....I am working with a colleague with looking over your system. I will return as quickly as I can.

jeffce · November 19, 2012

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1

Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:filefind
spuninst.exe
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

bsites9 · November 19, 2012

Ok, thank you.

bsites9 · November 19, 2012

Ok, here it is.

SystemLook 30.07.11 by jpshortstuff

Log created at 11:56 on 19/11/2012 by B. Sites

Administrator - Elevation successful

========== filefind ==========

Searching for "spuninst.exe"

C:\WINDOWS\$hf_mig$\KB2079403\spuninst.exe --a---- 231288 bytes [05:17 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2115168\spuninst.exe --a---- 231288 bytes [05:32 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2121546\spuninst.exe --a---- 231288 bytes [05:17 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2141007\spuninst.exe --a---- 231288 bytes [02:46 17/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2229593\spuninst.exe --a---- 231288 bytes [05:31 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2259922\spuninst.exe --a---- 231288 bytes [05:32 16/12/2010] [09:01 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2286198\spuninst.exe --a---- 231288 bytes [03:14 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2296199\spuninst.exe --a---- 231288 bytes [05:32 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2345886\spuninst.exe --a---- 231288 bytes [02:46 17/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2347290\spuninst.exe --a---- 231288 bytes [05:17 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2360131-IE8\spuninst.exe --a---- 231288 bytes [05:31 16/12/2010] [09:01 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2360937\spuninst.exe --a---- 231288 bytes [03:12 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2387149\spuninst.exe --a---- 231288 bytes [05:33 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2393802\spuninst.exe --a---- 231288 bytes [08:00 10/02/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2416400\spuninst.exe --a---- 231288 bytes [03:14 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2416400-IE8\spuninst.exe --a---- 231288 bytes [05:31 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2419632\spuninst.exe --a---- 231288 bytes [08:00 12/01/2011] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2423089\spuninst.exe --a---- 231288 bytes [03:12 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2436673\spuninst.exe --a---- 231288 bytes [05:16 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2440591\spuninst.exe --a---- 231288 bytes [02:46 17/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2443105\spuninst.exe --a---- 231288 bytes [05:31 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2447568-IE8\spuninst.exe --a---- 231288 bytes [05:31 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2467659\spuninst.exe --a---- 231288 bytes [03:14 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2476490\spuninst.exe --a---- 231288 bytes [06:15 17/06/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2476687\spuninst.exe --a---- 231288 bytes [08:00 10/02/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2478960\spuninst.exe --a---- 231288 bytes [08:00 10/02/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2478971\spuninst.exe --a---- 231288 bytes [08:01 10/02/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2479628\spuninst.exe --a---- 231288 bytes [08:01 10/02/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2479943\spuninst.exe --a---- 231288 bytes [08:01 09/03/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2481109\spuninst.exe --a---- 231288 bytes [08:00 09/03/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2482017-IE8\spuninst.exe --a---- 231288 bytes [08:00 11/02/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2483185\spuninst.exe --a---- 231288 bytes [08:01 10/02/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2485376\spuninst.exe --a---- 231288 bytes [08:01 10/02/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2485663\spuninst.exe --a---- 231288 bytes [07:14 15/04/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2497640-IE8\spuninst.exe --a---- 231288 bytes [07:11 15/04/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2503658\spuninst.exe --a---- 231288 bytes [07:06 15/04/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2503665\spuninst.exe --a---- 231288 bytes [06:14 17/06/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2506212\spuninst.exe --a---- 231288 bytes [07:06 15/04/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2506223\spuninst.exe --a---- 231288 bytes [07:14 15/04/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2507618\spuninst.exe --a---- 231288 bytes [07:06 15/04/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2507938\spuninst.exe --a---- 231288 bytes [07:01 13/07/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2508272\spuninst.exe --a---- 231288 bytes [07:06 15/04/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2508429\spuninst.exe --a---- 231288 bytes [07:06 15/04/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2509553\spuninst.exe --a---- 231288 bytes [07:00 15/04/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2510531-IE8\spuninst.exe --a---- 231288 bytes [07:00 15/04/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2511455\spuninst.exe --a---- 231288 bytes [07:06 15/04/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2524375\spuninst.exe --a---- 231288 bytes [07:00 24/03/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2530548-IE8\spuninst.exe --a---- 231288 bytes [06:14 17/06/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2535512\spuninst.exe --a---- 231288 bytes [06:14 17/06/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2536276\spuninst.exe --a---- 231288 bytes [06:14 17/06/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2536276-v2\spuninst.exe --a---- 231288 bytes [07:02 11/08/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2541763\spuninst.exe --a---- 231288 bytes [07:00 29/06/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2544521-IE8\spuninst.exe --a---- 231288 bytes [06:14 17/06/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2544893\spuninst.exe --a---- 231288 bytes [06:14 17/06/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2544893-v2\spuninst.exe --a---- 231288 bytes [08:01 10/11/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2555917\spuninst.exe --a---- 231288 bytes [07:00 13/07/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2559049-IE8\spuninst.exe --a---- 231288 bytes [07:00 11/08/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2562937\spuninst.exe --a---- 231288 bytes [07:00 11/08/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2566454\spuninst.exe --a---- 231288 bytes [07:00 11/08/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2567053\spuninst.exe --a---- 231288 bytes [07:01 13/10/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2567680\spuninst.exe --a---- 231288 bytes [07:02 11/08/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2570222\spuninst.exe --a---- 231288 bytes [07:02 11/08/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2570947\spuninst.exe --a---- 231288 bytes [07:00 16/09/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2584146\spuninst.exe --a---- 231288 bytes [08:00 12/01/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2585542\spuninst.exe --a---- 231288 bytes [08:00 01/02/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2586448-IE8\spuninst.exe --a---- 231288 bytes [07:00 13/10/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2592799\spuninst.exe --a---- 231288 bytes [07:00 13/10/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2598479\spuninst.exe --a---- 231288 bytes [08:03 12/01/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2603381\spuninst.exe --a---- 231288 bytes [08:00 12/01/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2607712\spuninst.exe --a---- 231288 bytes [07:00 08/09/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2616676\spuninst.exe --a---- 231288 bytes [07:01 16/09/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2618444-IE8\spuninst.exe --a---- 231288 bytes [08:02 15/12/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2618451\spuninst.exe --a---- 231288 bytes [08:00 15/12/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2619339\spuninst.exe --a---- 231288 bytes [08:00 15/12/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2620712\spuninst.exe --a---- 231288 bytes [08:00 15/12/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2621440\spuninst.exe --a---- 231288 bytes [07:00 14/03/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2624667\spuninst.exe --a---- 231288 bytes [08:02 15/12/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2631813\spuninst.exe --a---- 231288 bytes [08:05 12/01/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2633171\spuninst.exe --a---- 231288 bytes [08:00 15/12/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2639417\spuninst.exe --a---- 231288 bytes [08:02 15/12/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2641653\spuninst.exe --a---- 231288 bytes [07:02 14/03/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2641690\spuninst.exe --a---- 231288 bytes [08:00 11/11/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2646524\spuninst.exe --a---- 231288 bytes [08:05 12/01/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2647516-IE8\spuninst.exe --a---- 231288 bytes [08:00 16/02/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2647518\spuninst.exe --a---- 231288 bytes [07:00 14/03/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2653956\spuninst.exe --a---- 231288 bytes [07:00 12/04/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2655992\spuninst.exe --a---- 231288 bytes [07:02 11/07/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2660465\spuninst.exe --a---- 231288 bytes [08:00 16/02/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2661254-v2\spuninst.exe --a---- 231288 bytes [07:00 10/10/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2675157-IE8\spuninst.exe --a---- 231288 bytes [07:04 12/04/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2676562\spuninst.exe --a---- 231288 bytes [07:00 09/05/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2685939\spuninst.exe --a---- 231288 bytes [07:03 13/06/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2686509\spuninst.exe --a---- 231288 bytes [07:00 09/05/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2691442\spuninst.exe --a---- 231288 bytes [07:02 11/07/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2695962\spuninst.exe --a---- 231288 bytes [07:00 09/05/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2698365\spuninst.exe --a---- 231288 bytes [07:00 11/07/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2699988-IE8\spuninst.exe --a---- 231288 bytes [07:03 13/06/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2705219\spuninst.exe --a---- 231288 bytes [07:01 20/08/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2707511\spuninst.exe --a---- 231288 bytes [07:09 13/06/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2709162\spuninst.exe --a---- 231288 bytes [07:00 13/06/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2712808\spuninst.exe --a---- 231288 bytes [07:03 20/08/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2718523\spuninst.exe --a---- 231288 bytes [07:02 11/07/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2718704\spuninst.exe --a---- 231288 bytes [07:00 05/06/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2719985\spuninst.exe --a---- 231288 bytes [07:02 11/07/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2722913-IE8\spuninst.exe --a---- 231288 bytes [07:00 20/08/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2723135\spuninst.exe --a---- 231288 bytes [07:01 20/08/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2724197\spuninst.exe --a---- 231288 bytes [07:02 10/10/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2731847\spuninst.exe --a---- 231288 bytes [07:03 20/08/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2736233\spuninst.exe --a---- 231288 bytes [07:01 12/09/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2744842-IE8\spuninst.exe --a---- 231288 bytes [07:00 22/09/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB2749655\spuninst.exe --a---- 231288 bytes [07:00 10/10/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB898461\spuninst.exe --a---- 209632 bytes [02:53 16/12/2010] [03:35 25/02/2005] 944DA33BB28BE33FACD815D4592E8911

C:\WINDOWS\$hf_mig$\KB923561\spuninst.exe --a---- 231288 bytes [03:12 16/12/2010] [07:38 09/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB946648\spuninst.exe --a---- 231288 bytes [05:33 16/12/2010] [12:39 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB950762\spuninst.exe --a---- 231288 bytes [05:16 16/12/2010] [12:39 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB950974\spuninst.exe --a---- 231288 bytes [05:18 16/12/2010] [12:39 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB951376-v2\spuninst.exe --a---- 231288 bytes [05:33 16/12/2010] [11:18 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB951748\spuninst.exe --a---- 231288 bytes [03:14 16/12/2010] [12:39 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB951978\spuninst.exe --a---- 231288 bytes [05:32 16/12/2010] [12:39 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB952004\spuninst.exe --a---- 231288 bytes [05:17 16/12/2010] [12:39 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB952287\spuninst.exe --a---- 231288 bytes [05:16 16/12/2010] [11:18 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB952954\spuninst.exe --a---- 231288 bytes [05:33 16/12/2010] [12:39 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB954459\spuninst.exe --a---- 231288 bytes [05:16 16/12/2010] [12:39 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB955759\spuninst.exe --a---- 231288 bytes [05:32 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB956572\spuninst.exe --a---- 231288 bytes [05:18 16/12/2010] [07:38 09/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB956744\spuninst.exe --a---- 231288 bytes [05:18 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB956802\spuninst.exe --a---- 231288 bytes [03:13 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB956803\spuninst.exe --a---- 231288 bytes [05:33 16/12/2010] [11:18 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB956844\spuninst.exe --a---- 231288 bytes [05:17 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB958644\spuninst.exe --a---- 231288 bytes [03:13 16/12/2010] [11:18 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB959426\spuninst.exe --a---- 231288 bytes [05:33 16/12/2010] [12:39 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB960803\spuninst.exe --a---- 231288 bytes [03:13 16/12/2010] [12:39 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB960859\spuninst.exe --a---- 231288 bytes [05:32 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB961501\spuninst.exe --a---- 231288 bytes [05:17 16/12/2010] [07:38 09/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB967715\spuninst.exe --a---- 231288 bytes [05:16 16/12/2010] [07:38 09/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB968389\spuninst.exe --a---- 231288 bytes [03:12 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB969059\spuninst.exe --a---- 231288 bytes [05:32 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB970430\spuninst.exe --a---- 231288 bytes [02:46 17/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB971029\spuninst.exe --a---- 231288 bytes [07:00 16/03/2011] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB971657\spuninst.exe --a---- 231288 bytes [05:18 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB971737\spuninst.exe --a---- 231288 bytes [02:46 17/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB971961\spuninst.exe --a---- 231288 bytes [03:12 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB971961-IE8\spuninst.exe --a---- 231288 bytes [02:46 17/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB972270\spuninst.exe --a---- 231288 bytes [05:18 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB973507\spuninst.exe --a---- 231288 bytes [05:17 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB973687\spuninst.exe --a---- 231288 bytes [05:16 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB973815\spuninst.exe --a---- 231288 bytes [03:13 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB973869\spuninst.exe --a---- 231288 bytes [05:17 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB973904\spuninst.exe --a---- 231288 bytes [05:16 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB974112\spuninst.exe --a---- 231288 bytes [05:18 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB974318\spuninst.exe --a---- 231288 bytes [05:32 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB974392\spuninst.exe --a---- 231288 bytes [05:16 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB974571\spuninst.exe --a---- 231288 bytes [05:17 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB975025\spuninst.exe --a---- 231288 bytes [05:17 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB975467\spuninst.exe --a---- 231288 bytes [03:12 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB975560\spuninst.exe --a---- 231288 bytes [05:17 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB975562\spuninst.exe --a---- 231288 bytes [03:13 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB975713\spuninst.exe --a---- 231288 bytes [05:18 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB976662-IE8\spuninst.exe --a---- 231288 bytes [02:46 17/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB977816\spuninst.exe --a---- 231288 bytes [05:17 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB977914\spuninst.exe --a---- 231288 bytes [03:14 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB978037\spuninst.exe --a---- 231288 bytes [05:18 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB978338\spuninst.exe --a---- 231288 bytes [05:18 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB978542\spuninst.exe --a---- 231288 bytes [03:14 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB978601\spuninst.exe --a---- 231288 bytes [05:16 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB978706\spuninst.exe --a---- 231288 bytes [03:13 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB979309\spuninst.exe --a---- 231288 bytes [03:13 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB979482\spuninst.exe --a---- 231288 bytes [03:13 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB979687\spuninst.exe --a---- 231288 bytes [05:17 16/12/2010] [09:01 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB980195\spuninst.exe --a---- 231288 bytes [05:32 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB980232\spuninst.exe --a---- 231288 bytes [05:32 16/12/2010] [09:01 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB980436\spuninst.exe --a---- 231288 bytes [05:16 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB981322\spuninst.exe --a---- 231288 bytes [05:16 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB981332-IE8\spuninst.exe --a---- 231288 bytes [02:46 17/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB981349\spuninst.exe --a---- 231288 bytes [05:31 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB981852\spuninst.exe --a---- 231288 bytes [05:17 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB981997\spuninst.exe --a---- 231288 bytes [03:13 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB982132\spuninst.exe --a---- 231288 bytes [05:18 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB982214\spuninst.exe --a---- 231288 bytes [05:32 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB982381-IE8\spuninst.exe --a---- 231288 bytes [05:31 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$hf_mig$\KB982665\spuninst.exe --a---- 231288 bytes [03:12 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2079403$\spuninst\spuninst.exe --a--c- 231288 bytes [05:17 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2115168$\spuninst\spuninst.exe --a--c- 231288 bytes [05:32 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2121546$\spuninst\spuninst.exe --a--c- 231288 bytes [05:17 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2141007$\spuninst\spuninst.exe --a--c- 231288 bytes [02:46 17/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2229593$\spuninst\spuninst.exe --a--c- 231288 bytes [05:31 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2259922$\spuninst\spuninst.exe --a--c- 231288 bytes [05:32 16/12/2010] [09:01 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2286198$\spuninst\spuninst.exe --a--c- 231288 bytes [03:13 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2296011$\spuninst\spuninst.exe --a--c- 231288 bytes [05:32 16/12/2010] [09:01 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2296199$\spuninst\spuninst.exe --a--c- 231288 bytes [05:32 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2345886$\spuninst\spuninst.exe --a--c- 231288 bytes [02:46 17/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2347290$\spuninst\spuninst.exe --a--c- 231288 bytes [05:17 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2360937$\spuninst\spuninst.exe --a--c- 231288 bytes [03:12 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2378111_WM9$\spuninst\spuninst.exe --a--c- 231288 bytes [05:32 16/12/2010] [07:11 28/07/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2387149$\spuninst\spuninst.exe --a--c- 231288 bytes [05:33 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2393802$\spuninst\spuninst.exe --a--c- 231288 bytes [08:00 10/02/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2412687$\spuninst\spuninst.exe --a--c- 231288 bytes [07:11 15/04/2011] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2416400$\spuninst.exe --a--c- 231288 bytes [05:16 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2416400$\spuninst\spuninst.exe --a--c- 231288 bytes [03:14 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2419632$\spuninst\spuninst.exe --a--c- 231288 bytes [08:00 12/01/2011] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2423089$\spuninst\spuninst.exe --a--c- 231288 bytes [03:12 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2436673$\spuninst\spuninst.exe --a--c- 231288 bytes [05:16 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2440591$\spuninst\spuninst.exe --a--c- 231288 bytes [02:46 17/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2443105$\spuninst\spuninst.exe --a--c- 231288 bytes [05:31 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2443685$\spuninst\spuninst.exe --a--c- 231288 bytes [05:17 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2467659$\spuninst.exe --a--c- 231288 bytes [05:16 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2467659$\spuninst\spuninst.exe --a--c- 231288 bytes [03:14 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2476490$\spuninst\spuninst.exe --a--c- 231288 bytes [06:15 17/06/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2476687$\spuninst\spuninst.exe --a--c- 231288 bytes [08:00 10/02/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2478960$\spuninst\spuninst.exe --a--c- 231288 bytes [08:00 10/02/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2478971$\spuninst\spuninst.exe --a--c- 231288 bytes [08:01 10/02/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2479628$\spuninst\spuninst.exe --a--c- 231288 bytes [08:01 10/02/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2479943$\spuninst\spuninst.exe --a--c- 231288 bytes [08:01 09/03/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2481109$\spuninst\spuninst.exe --a--c- 231288 bytes [08:00 09/03/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2483185$\spuninst\spuninst.exe --a--c- 231288 bytes [08:01 10/02/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2485376$\spuninst\spuninst.exe --a--c- 231288 bytes [08:01 10/02/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2485663$\spuninst\spuninst.exe --a--c- 231288 bytes [07:14 15/04/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2503658$\spuninst\spuninst.exe --a--c- 231288 bytes [07:06 15/04/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2503665$\spuninst\spuninst.exe --a--c- 231288 bytes [06:14 17/06/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2506212$\spuninst\spuninst.exe --a--c- 231288 bytes [07:06 15/04/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2506223$\spuninst\spuninst.exe --a--c- 231288 bytes [07:14 15/04/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2507618$\spuninst\spuninst.exe --a--c- 231288 bytes [07:06 15/04/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2507938$\spuninst\spuninst.exe --a--c- 231288 bytes [07:01 13/07/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2508272$\spuninst\spuninst.exe --a--c- 231288 bytes [07:06 15/04/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2508429$\spuninst\spuninst.exe --a--c- 231288 bytes [07:06 15/04/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2509553$\spuninst\spuninst.exe --a--c- 231288 bytes [07:00 15/04/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2511455$\spuninst\spuninst.exe --a--c- 231288 bytes [07:06 15/04/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2524375$\spuninst\spuninst.exe --a--c- 231288 bytes [07:00 24/03/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2535512$\spuninst\spuninst.exe --a--c- 231288 bytes [06:14 17/06/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2536276$\spuninst\spuninst.exe --a--c- 231288 bytes [06:14 17/06/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2536276-v2$\spuninst\spuninst.exe --a--c- 231288 bytes [07:02 11/08/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2541763$\spuninst\spuninst.exe --a--c- 231288 bytes [07:00 29/06/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2544893$\spuninst\spuninst.exe --a--c- 231288 bytes [06:14 17/06/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2544893-v2$\spuninst\spuninst.exe --a--c- 231288 bytes [08:01 10/11/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2555917$\spuninst\spuninst.exe --a--c- 231288 bytes [07:00 13/07/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2562937$\spuninst\spuninst.exe --a--c- 231288 bytes [07:00 11/08/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2564958$\spuninst\spuninst.exe --a--c- 231288 bytes [07:04 13/10/2011] [17:51 12/08/2011] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2566454$\spuninst\spuninst.exe --a--c- 231288 bytes [07:00 11/08/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2567053$\spuninst\spuninst.exe --a--c- 231288 bytes [07:01 13/10/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2567680$\spuninst\spuninst.exe --a--c- 231288 bytes [07:02 11/08/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2570222$\spuninst\spuninst.exe --a--c- 231288 bytes [07:02 11/08/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2570791$\spuninst\spuninst.exe --a--c- 231288 bytes [07:00 24/08/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2570947$\spuninst\spuninst.exe --a--c- 231288 bytes [07:00 16/09/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2584146$\spuninst\spuninst.exe --a--c- 231288 bytes [08:00 12/01/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2585542$\spuninst\spuninst.exe --a--c- 231288 bytes [08:00 01/02/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2592799$\spuninst\spuninst.exe --a--c- 231288 bytes [07:00 13/10/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2598479$\spuninst\spuninst.exe --a--c- 231288 bytes [08:03 12/01/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2603381$\spuninst\spuninst.exe --a--c- 231288 bytes [08:00 12/01/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2607712$\spuninst\spuninst.exe --a--c- 231288 bytes [07:00 08/09/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2616676$\spuninst\spuninst.exe --a--c- 231288 bytes [07:01 16/09/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2618451$\spuninst\spuninst.exe --a--c- 231288 bytes [08:00 15/12/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2619339$\spuninst\spuninst.exe --a--c- 231288 bytes [08:00 15/12/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2620712$\spuninst\spuninst.exe --a--c- 231288 bytes [08:00 15/12/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2621440$\spuninst\spuninst.exe --a--c- 231288 bytes [07:00 14/03/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2624667$\spuninst\spuninst.exe --a--c- 231288 bytes [08:02 15/12/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2631813$\spuninst\spuninst.exe --a--c- 231288 bytes [08:05 12/01/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2633171$\spuninst\spuninst.exe --a--c- 231288 bytes [08:00 15/12/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2633952$\spuninst\spuninst.exe --a--c- 231288 bytes [08:00 15/12/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2639417$\spuninst\spuninst.exe --a--c- 231288 bytes [08:02 15/12/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2641653$\spuninst\spuninst.exe --a--c- 231288 bytes [07:02 14/03/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2641690$\spuninst\spuninst.exe --a--c- 231288 bytes [08:00 11/11/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2646524$\spuninst\spuninst.exe --a--c- 231288 bytes [08:05 12/01/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2647518$\spuninst\spuninst.exe --a--c- 231288 bytes [07:00 14/03/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2653956$\spuninst\spuninst.exe -----c- 231288 bytes [07:00 12/04/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2655992$\spuninst\spuninst.exe -----c- 231288 bytes [07:02 11/07/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2659262$\spuninst\spuninst.exe -----c- 231288 bytes [07:06 09/05/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2660465$\spuninst\spuninst.exe --a--c- 231288 bytes [08:00 16/02/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2661254-v2$\spuninst\spuninst.exe -----c- 231288 bytes [07:00 10/10/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2676562$\spuninst\spuninst.exe -----c- 231288 bytes [07:00 09/05/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2685939$\spuninst\spuninst.exe -----c- 231288 bytes [07:03 13/06/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2686509$\spuninst\spuninst.exe -----c- 231288 bytes [07:00 09/05/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2691442$\spuninst\spuninst.exe -----c- 231288 bytes [07:02 11/07/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2695962$\spuninst\spuninst.exe -----c- 231288 bytes [07:00 09/05/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2698365$\spuninst\spuninst.exe -----c- 231288 bytes [07:00 11/07/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2705219$\spuninst\spuninst.exe -----c- 231288 bytes [07:01 20/08/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2707511$\spuninst\spuninst.exe -----c- 231288 bytes [07:09 13/06/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2709162$\spuninst\spuninst.exe -----c- 231288 bytes [07:00 13/06/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2712808$\spuninst\spuninst.exe -----c- 231288 bytes [07:03 20/08/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2718523$\spuninst\spuninst.exe -----c- 231288 bytes [07:02 11/07/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2718704$\spuninst\spuninst.exe -----c- 231288 bytes [07:00 05/06/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2719985$\spuninst\spuninst.exe -----c- 231288 bytes [07:02 11/07/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2723135$\spuninst\spuninst.exe -----c- 231288 bytes [07:01 20/08/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2724197$\spuninst\spuninst.exe -----c- 231288 bytes [07:02 10/10/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2731847$\spuninst\spuninst.exe -----c- 231288 bytes [07:03 20/08/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2736233$\spuninst\spuninst.exe -----c- 231288 bytes [07:01 12/09/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2749655$\spuninst\spuninst.exe -----c- 231288 bytes [07:00 10/10/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB2756822$\spuninst\spuninst.exe -----c- 231288 bytes [07:00 10/10/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe --a--c- 209632 bytes [02:53 16/12/2010] [03:35 25/02/2005] 944DA33BB28BE33FACD815D4592E8911

C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe --a--c- 231288 bytes [03:12 16/12/2010] [07:38 09/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe --a--c- 213216 bytes [06:43 26/12/2010] [18:23 28/06/2005] B5FF6305E3B6FDFC91057D2FAC100E4C

C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe --a--c- 213216 bytes [06:43 26/12/2010] [18:23 28/06/2005] B5FF6305E3B6FDFC91057D2FAC100E4C

C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe --a--c- 213216 bytes [11:00 22/12/2010] [00:39 28/10/2007] B5FF6305E3B6FDFC91057D2FAC100E4C

C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe --a--c- 231288 bytes [05:33 16/12/2010] [12:39 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe --a--c- 231288 bytes [05:16 16/12/2010] [12:39 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe --a--c- 231288 bytes [05:18 16/12/2010] [12:39 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe --a--c- 231288 bytes [05:33 16/12/2010] [11:18 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe --a--c- 231288 bytes [03:14 16/12/2010] [12:39 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe --a--c- 231288 bytes [05:32 16/12/2010] [12:39 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe --a--c- 231288 bytes [05:17 16/12/2010] [12:39 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe --a--c- 231288 bytes [03:14 16/12/2010] [17:41 27/07/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe --a--c- 231288 bytes [05:16 16/12/2010] [11:18 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe --a--c- 231288 bytes [05:33 16/12/2010] [12:39 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe --a--c- 231288 bytes [06:43 26/12/2010] [18:41 27/07/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe --a--c- 231288 bytes [05:18 16/12/2010] [18:41 27/07/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe --a--c- 231288 bytes [05:16 16/12/2010] [12:39 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB955759$\spuninst\spuninst.exe --a--c- 231288 bytes [05:32 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe --a--c- 231288 bytes [05:18 16/12/2010] [07:38 09/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe --a--c- 231288 bytes [05:18 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe --a--c- 231288 bytes [03:13 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe --a--c- 231288 bytes [05:33 16/12/2010] [11:18 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe --a--c- 231288 bytes [05:17 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe --a--c- 231288 bytes [03:13 16/12/2010] [11:18 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe --a--c- 231288 bytes [05:32 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe --a--c- 231288 bytes [05:33 16/12/2010] [12:39 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe --a--c- 231288 bytes [03:13 16/12/2010] [12:39 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe --a--c- 231288 bytes [05:32 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe --a--c- 231288 bytes [07:14 15/04/2011] [11:18 30/11/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe --a--c- 231288 bytes [05:17 16/12/2010] [07:38 09/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe --a--c- 231288 bytes [05:16 16/12/2010] [07:38 09/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe --a--c- 231288 bytes [03:12 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe --a--c- 231288 bytes [05:32 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB970430$\spuninst\spuninst.exe --a--c- 231288 bytes [02:46 17/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB971029$\spuninst\spuninst.exe --a--c- 231288 bytes [07:00 16/03/2011] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe --a--c- 231288 bytes [05:18 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB971737$\spuninst\spuninst.exe --a--c- 231288 bytes [02:46 17/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe --a--c- 231288 bytes [03:12 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB972270$\spuninst\spuninst.exe --a--c- 231288 bytes [05:18 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe --a--c- 231288 bytes [05:17 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe --a--c- 231288 bytes [05:16 16/12/2010] [18:41 27/07/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB973687$\spuninst\spuninst.exe --a--c- 231288 bytes [05:16 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe --a--c- 231288 bytes [03:13 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe --a--c- 231288 bytes [05:17 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB973904$\spuninst\spuninst.exe --a--c- 231288 bytes [05:16 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe --a--c- 231288 bytes [05:18 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB974318$\spuninst\spuninst.exe --a--c- 231288 bytes [05:32 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB974392$\spuninst\spuninst.exe --a--c- 231288 bytes [05:16 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe --a--c- 231288 bytes [05:17 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe --a--c- 231288 bytes [05:17 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe --a--c- 231288 bytes [03:12 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB975558_WM8$\spuninst\spuninst.exe --a--c- 231288 bytes [05:32 16/12/2010] [07:11 28/07/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB975560$\spuninst\spuninst.exe --a--c- 231288 bytes [05:17 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB975562$\spuninst\spuninst.exe --a--c- 231288 bytes [03:13 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB975713$\spuninst\spuninst.exe --a--c- 231288 bytes [05:18 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB977816$\spuninst\spuninst.exe --a--c- 231288 bytes [05:17 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB977914$\spuninst\spuninst.exe --a--c- 231288 bytes [03:14 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB978037$\spuninst\spuninst.exe --a--c- 231288 bytes [05:18 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB978338$\spuninst\spuninst.exe --a--c- 231288 bytes [05:18 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB978542$\spuninst\spuninst.exe --a--c- 231288 bytes [03:14 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB978601$\spuninst\spuninst.exe --a--c- 231288 bytes [05:16 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB978695_WM9$\spuninst\spuninst.exe --a--c- 231288 bytes [05:16 16/12/2010] [07:11 28/07/2007] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB978706$\spuninst\spuninst.exe --a--c- 231288 bytes [03:13 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB979309$\spuninst\spuninst.exe --a--c- 231288 bytes [03:13 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB979482$\spuninst\spuninst.exe --a--c- 231288 bytes [03:13 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB979687$\spuninst\spuninst.exe --a--c- 231288 bytes [05:17 16/12/2010] [09:01 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB980195$\spuninst\spuninst.exe --a--c- 231288 bytes [05:32 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB980232$\spuninst\spuninst.exe --a--c- 231288 bytes [05:32 16/12/2010] [09:01 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB980436$\spuninst\spuninst.exe --a--c- 231288 bytes [05:16 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB981322$\spuninst\spuninst.exe --a--c- 231288 bytes [05:16 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB981349$\spuninst\spuninst.exe --a--c- 231288 bytes [05:31 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB981852$\spuninst\spuninst.exe --a--c- 231288 bytes [05:17 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB981997$\spuninst\spuninst.exe --a--c- 231288 bytes [03:13 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB982132$\spuninst\spuninst.exe --a--c- 231288 bytes [05:18 16/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB982214$\spuninst\spuninst.exe --a--c- 231288 bytes [05:32 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallKB982665$\spuninst\spuninst.exe --a--c- 231288 bytes [03:12 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe --a--c- 221488 bytes [00:01 26/12/2010] [01:58 26/09/2006] A9882FE31BA3BBB3557BBB2FF429A46E

C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe --a--c- 213216 bytes [00:00 26/12/2010] [02:11 17/05/2006] B5FF6305E3B6FDFC91057D2FAC100E4C

C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe --a--c- 213216 bytes [00:01 26/12/2010] [02:11 17/05/2006] B5FF6305E3B6FDFC91057D2FAC100E4C

C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe --a--c- 221488 bytes [00:00 26/12/2010] [09:05 16/09/2006] A9882FE31BA3BBB3557BBB2FF429A46E

C:\WINDOWS\ie8\spuninst\spuninst.exe --a--c- 231456 bytes [05:30 16/12/2010] [02:20 08/01/2009] AD8EF61AF3B6654899BEA533AC7F6D9E

C:\WINDOWS\ie8updates\KB2360131-IE8\spuninst\spuninst.exe --a--c- 231288 bytes [05:31 16/12/2010] [09:01 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\ie8updates\KB2416400-IE8\spuninst\spuninst.exe --a--c- 231288 bytes [05:31 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\ie8updates\KB2447568-IE8\spuninst\spuninst.exe --a--c- 231288 bytes [05:31 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\ie8updates\KB2482017-IE8\spuninst\spuninst.exe --a--c- 231288 bytes [08:00 11/02/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\ie8updates\KB2497640-IE8\spuninst\spuninst.exe --a--c- 231288 bytes [07:11 15/04/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\ie8updates\KB2510531-IE8\spuninst\spuninst.exe --a--c- 231288 bytes [07:00 15/04/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\ie8updates\KB2530548-IE8\spuninst\spuninst.exe --a--c- 231288 bytes [06:14 17/06/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\ie8updates\KB2544521-IE8\spuninst\spuninst.exe --a--c- 231288 bytes [06:14 17/06/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\ie8updates\KB2559049-IE8\spuninst\spuninst.exe --a--c- 231288 bytes [07:00 11/08/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\ie8updates\KB2586448-IE8\spuninst\spuninst.exe --a--c- 231288 bytes [07:00 13/10/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\ie8updates\KB2618444-IE8\spuninst\spuninst.exe --a--c- 231288 bytes [08:02 15/12/2011] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\ie8updates\KB2647516-IE8\spuninst\spuninst.exe --a--c- 231288 bytes [08:00 16/02/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\ie8updates\KB2675157-IE8\spuninst\spuninst.exe -----c- 231288 bytes [07:04 12/04/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\ie8updates\KB2699988-IE8\spuninst\spuninst.exe -----c- 231288 bytes [07:03 13/06/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\ie8updates\KB2722913-IE8\spuninst\spuninst.exe -----c- 231288 bytes [07:00 20/08/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\ie8updates\KB2744842-IE8\spuninst\spuninst.exe -----c- 231288 bytes [07:00 22/09/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\ie8updates\KB971961-IE8\spuninst\spuninst.exe --a--c- 231288 bytes [02:46 17/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\ie8updates\KB976662-IE8\spuninst\spuninst.exe --a--c- 231288 bytes [02:46 17/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\ie8updates\KB981332-IE8\spuninst\spuninst.exe --a--c- 231288 bytes [02:46 17/12/2010] [11:40 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\ie8updates\KB982381-IE8\spuninst\spuninst.exe --a--c- 231288 bytes [05:31 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\SoftwareDistribution\Download\063b47bf6f88ac7c22d205795e466d3f\spuninst.exe --a---- 231288 bytes [05:27 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\SoftwareDistribution\Download\14416207f25267e02d72101f02975325\spuninst.exe --a---- 231288 bytes [15:06 19/11/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\SoftwareDistribution\Download\c0b2667570bfaadca71db300b030c7f4\spuninst.exe --a---- 231288 bytes [05:26 16/12/2010] [09:01 26/05/2009] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\SoftwareDistribution\Download\c702dd15b98e4352bb8c9cf103c48253\spuninst.exe --a---- 231288 bytes [15:06 19/11/2012] [13:15 05/07/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\SoftwareDistribution\Download\e4c2b7cb00daebf4f81844527ed9b20a\spuninst.exe --a---- 231288 bytes [05:29 16/12/2010] [14:23 22/02/2010] 78141AD888BA82E3ABC854D229A59F07

C:\WINDOWS\SoftwareDistribution\Download\e9e3bc7b49018c1f53cc0d1bd73cad37\spuninst.exe --a---- 231288 bytes [05:24 16/12/2010] [13:02 08/07/2008] 78141AD888BA82E3ABC854D229A59F07

-= EOF =-

jeffce · November 20, 2012

Hi,

Unfortunately there are some serious issues with your system that we may not be able to overcome in the end. I am just laying it all out there so there aren't any surprises.

We need to get Windows XP Service Pack 3 properly installed on your system. Please go here and download Service Pack 3 directly to your Desktop.

Once it is on your Desktop, I want you to boot to Safe Mode and then install the Service Pack accepting any prompts that you might receive. When you have it installed I want you to check for any updates that there may be and be sure to download and install them all.

When you get that completed or if you have problems please let me know.

bsites9 · November 20, 2012

I understand. I bought this as a refurbished unit, and had issues from day one. Before I do the above step, I do have a cd with the service pack on it, if that helps?

bsites9 · November 20, 2012

Oh, 2 more quick questions too please. Should I boot in Safe mode with networking? Or regular Safe Mode? And then, once installed, how do I check for updates?

bsites9 · November 20, 2012

Ok, I went ahead and downloaded from the link you provided. I kept getting an automatic update window, that said it was restart the computer, and had a timer counting back, so I closed that since it would restart before my download was complete.

So, once the download was complete, I went ahead and rebooted in regular Safemode, and ran the download program. I get a popup window that says

"C:\Documents and Settings\B. Sites\Desktop\WindowssXP-KB936929-SP3-x86-ENU.exe is not a valid Win32 application".

So obviously, it's not letting me install the service pack. Like I mentioned above, I do have the disc with the service pack on it if that helps with this. Thanks

jeffce · November 20, 2012

Go ahead and use the disk to install Service Pack 3 and let me know how that goes.

Didn't see this... >>

Should I boot in Safe mode with networking? Or regular Safe Mode?

When you get the disk boot to Safe Mode with Networking....after the installation of SP 3 the updates might start automatically.

bsites9 · November 20, 2012

Ok, I'm not really sure how to do that. I open the disk, since it won't run by itself. Click SETUP, then it gives me a few options, the top one being "Install Windows XP". Is that what I want to do?

And if so, does this put the computer back the way it was when I bought it? Meaning, I lose everything on the system as of right now?

jeffce · November 20, 2012

If you're installing SP3 from the Service Pack 3 CD, insert the disc into your computer with your current version ofWindows XP running, and the Software Update Installation Wizard should automatically appear. If this wizard doesn't appear, click Start, double-click My

Computer, right-click your CD or DVD drive, and then clickAutoPlay.

On the Windows XP Service Pack 3 page, click Next.

Follow the instructions that appear on your screen.

After the installation is complete, click Finish to restart your computer.

If you disabled your antivirus software, enable it again.

--------

This is just my opinion....the infection that you had on your system was quite significant and there is no telling how much damage has been done. If I were you I would be prepared for the worst....having to format your hard drive and install the operating system fresh.

bsites9 · November 21, 2012

I apologize for being ignorant, but I'm not seeing things that I should be seeing I guess.The disc isn't strictly the Service Pack 3, it says WINDOWS XP HOME EDITION...then in small print it says "Includes Service Pack 3".

So it doesn't autorun...nothing has autorun for a long time. Even when I click start, My Computer, and right click the D:\ drive, there is no AutoPlay option. But I click OPEN, then SETUP. And it brings up a screen with these options.

INSTALL WINDOWS XP

LEARN MORE ABOUTTHE SETUP PROCESS

INSTALL OPTIONAL WINDOWS COMPONENTS

PERFORM ADDITIONAL TASKS

CHECK SYSTEM COMPATIBILITY

I'm guessing I have the wrong disc, because it doesn't show an option or page just for the service pack.

Help Please. Rootkit.0access

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information