worried about keystroke logger malware

michelazul · December 22, 2010

Hi,

I found out that my World of Warcraft login has been compromised. Since I haven't given my information to anyone, I assume I may have a keystroke logger malware on my computer.

I ran malwarebytes twice, once a quick, once a full scan. Nothing showed up.

I ran an avira scan once. Nothing showed up.

I ran an ESET online full scan. One file was quarantined and deleted - something described as a variant of win32/agent trojan.

I have changed passwords and such but I am still uncomfortable thinking there may be a keystroke logger software still on my computer. I don't want to go through the hassle of reinstalling Windows, but I have the disks if I need to do it.

I am running Windows 7.

I downloaded HijackThis and my log is below. What do you recommend I do next?

Thank you for your help!

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 11:56:11 AM, on 12/22/2010

Platform: Windows 7 (WinNT 6.00.3504)

MSIE: Internet Explorer v8.00 (8.00.7600.16700)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\Digital Line Detect\DLG.exe

C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE

C:\Program Files (x86)\Motorola\MotoConnectService\MotoConnect.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe

D:\Program Files (x86)\Dell\Reader 2.1\DellBtrEvent.exe

C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Alwil Software\Avast5\AvastUI.exe

C:\Program Files (x86)\PC Tools Firewall Plus\FirewallGUI.exe

C:\PROGRA~2\MIF5BA~1\Office14\EXCEL.EXE

C:\Users\katydid\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\SysWOW64\ctfmon.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Users\katydid\Downloads\HijackThis.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USREL/1

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/USREL/1

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

F2 - REG:system.ini: UserInit=userinit.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MIF5BA~1\Office14\GROOVEEX.DLL

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MIF5BA~1\Office14\URLREDIR.DLL

O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: @C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll

O4 - HKLM\..\Run: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe"

O4 - HKLM\..\Run: [DellBtrEvent] D:\Program Files (x86)\Dell\Reader 2.1\DellBtrEvent.exe

O4 - HKLM\..\Run: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [bCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices

O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui

O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files (x86)\PC Tools Firewall Plus\FirewallGUI.exe" -s

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

O4 - HKCU\..\Run: [updateMgr] C:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe AcStd7_0_0 -reboot 1

O4 - HKCU\..\Run: [Google Update] "C:\Users\katydid\AppData\Local\Google\Update\GoogleUpdate.exe" /c

O4 - Startup: OneNote 2010 Screen Clipper and Launcher.lnk = C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE

O4 - Global Startup: Dell ControlPoint System Manager.lnk = C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe

O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files (x86)\Digital Line Detect\DLG.exe

O4 - Global Startup: TdmNotify.lnk = C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmNotify.exe

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MIF5BA~1\Office14\EXCEL.EXE/3000

O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~2\MIF5BA~1\Office14\ONBttnIE.dll/105

O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_e085d3cd5b474ba6\AESTSr64.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

O23 - Service: Dell ControlPoint Button Service (buttonsvc64) - Dell Inc. - c:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe

O23 - Service: Credential Vault Host Control Service - Broadcom Corporation - C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe

O23 - Service: Credential Vault Host Storage - Broadcom Corporation - C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe

O23 - Service: Dell ControlPoint System Manager (dcpsysmgrsvc) - Dell Inc. - c:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe

O23 - Service: DeviceVM Meta Data Export Service (DvmMDES) - DeviceVM, Inc. - D:\Program Files (x86)\Dell\Reader 2.1\DVMExportService.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

O23 - Service: FF Install Filter Service (InstallFilterService) - Unknown owner - C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\InstallFilterService.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: MotoConnect Service - Unknown owner - C:\Program Files (x86)\Motorola\MotoConnectService\MotoConnectService.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)

O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - Unknown owner - C:\Program Files (x86)\PC Tools Firewall Plus\FWService.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: SecureStorageService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_e085d3cd5b474ba6\STacSV64.exe

O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe

O23 - Service: NTRU TSS v1.2.1.29 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files (x86)\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe

O23 - Service: TdmService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: DW WLAN Tray Service (wltrysvc) - Unknown owner - C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

O23 - Service: Novell XTier Service Manager (XTSvcMgr) - Unknown owner - C:\Program Files (x86)\Novell\Client\XTier\Services\XTSvcMgr.exe (file missing)

--

End of file - 14208 bytes

LDTate · December 24, 2010

Please do not attach the scan results from Combofx. Use copy/paste.

DO NOT use any TOOLS such as Combofix, or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

XP Users

Double-click My Computer.

Click the Tools menu, and then click Folder Options.

Click the View tab.

Uncheck "Hide file extensions for known file types."

Under the "Hidden files" folder, select "Show hidden files and folders."

Uncheck "Hide protected operating system files."

Click Apply, and then click OK.

Vista Users

To enable the viewing of hidden and protected system files in Windows Vista please follow these steps:

Close all programs so that you are at your desktop.

Click on the Start button. This is the small round button with the Windows flag in the lower left corner.

Click on the Control Panel menu option.

When the control panel opens you can either be in Classic View or Control Panel Home view:

If you are in the Classic View do the following:

Double-click on the Folder Options icon.

Click on the View tab.

If you are in the Control Panel Home view do the following:

Click on the Appearance and Personalization link.

Click on Show Hidden Files or Folders.

Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.

Remove the checkmark from the checkbox labeled Hide extensions for known file types.

Remove the checkmark from the checkbox labeled Hide protected operating system files.

Please do not delete anything unless instructed to.

Next:

Please download ATF Cleaner by Atribune.

Download - ATF Cleaner

michelazul · December 24, 2010

Hi,

I ran the ATF cleaner for both the main and firefox menus, since I use chrome and firefox. I then ran ComboFix. Below are my results. ComboFix rebooted my computer in error recovery mode, but my computer otherwise is acting just as it was before.

Thank you for your assistance.

ComboFix 10-12-23.05 - katydid 12/24/2010 10:42:42.1.4 - x64

Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.4022.2220 [GMT -5:00]

Running from: c:\users\katydid\Desktop\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}

FW: PC Tools Firewall Plus *Enabled* {175D0B73-9F8F-2CA9-8BF1-62277A276DC9}

SP: avast! Antivirus *Disabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files (x86)\explorer

c:\program files (x86)\explorer\AddressParser\AddressParserConfiguration.xml

c:\program files (x86)\explorer\AddressParser\parser_andorra.xml

c:\program files (x86)\explorer\AddressParser\parser_austria.xml

c:\program files (x86)\explorer\AddressParser\parser_belgium.xml

c:\program files (x86)\explorer\AddressParser\parser_canada.xml

c:\program files (x86)\explorer\AddressParser\parser_denmark.xml

c:\program files (x86)\explorer\AddressParser\parser_france.xml

c:\program files (x86)\explorer\AddressParser\parser_germany.xml

c:\program files (x86)\explorer\AddressParser\parser_ireland.xml

c:\program files (x86)\explorer\AddressParser\parser_italy.xml

c:\program files (x86)\explorer\AddressParser\parser_liechtenstein.xml

c:\program files (x86)\explorer\AddressParser\parser_luxembourg.xml

c:\program files (x86)\explorer\AddressParser\parser_monaco.xml

c:\program files (x86)\explorer\AddressParser\parser_netherlands.xml

c:\program files (x86)\explorer\AddressParser\parser_norway.xml

c:\program files (x86)\explorer\AddressParser\parser_portugal.xml

c:\program files (x86)\explorer\AddressParser\parser_spain.xml

c:\program files (x86)\explorer\AddressParser\parser_sweden.xml

c:\program files (x86)\explorer\AddressParser\parser_switzerland.xml

c:\program files (x86)\explorer\AddressParser\parser_uk.xml

c:\program files (x86)\explorer\AddressParser\parser_usa.xml

c:\program files (x86)\explorer\basemaps\basemaps.de.xml

c:\program files (x86)\explorer\basemaps\basemaps.es.xml

c:\program files (x86)\explorer\basemaps\basemaps.fr.xml

c:\program files (x86)\explorer\basemaps\basemaps.ja-jp.xml

c:\program files (x86)\explorer\basemaps\basemaps.xml

c:\program files (x86)\explorer\basemaps\basemaps.zh-CN.xml

c:\program files (x86)\explorer\basemaps\Server\basemap0.nmf

c:\program files (x86)\explorer\basemaps\Server\basemap0.png

c:\program files (x86)\explorer\basemaps\Server\basemap1.nmf

c:\program files (x86)\explorer\basemaps\Server\basemap1.png

c:\program files (x86)\explorer\basemaps\Server\basemap10.nmf

c:\program files (x86)\explorer\basemaps\Server\basemap10.png

c:\program files (x86)\explorer\basemaps\Server\basemap11.nmf

c:\program files (x86)\explorer\basemaps\Server\basemap11.png

c:\program files (x86)\explorer\basemaps\Server\basemap2.nmf

c:\program files (x86)\explorer\basemaps\Server\basemap2.png

c:\program files (x86)\explorer\basemaps\Server\basemap3.nmf

c:\program files (x86)\explorer\basemaps\Server\basemap3.png

c:\program files (x86)\explorer\basemaps\Server\basemap4.nmf

c:\program files (x86)\explorer\basemaps\Server\basemap4.png

c:\program files (x86)\explorer\basemaps\Server\basemap5.nmf

c:\program files (x86)\explorer\basemaps\Server\basemap5.png

c:\program files (x86)\explorer\basemaps\Server\basemap6.nmf

c:\program files (x86)\explorer\basemaps\Server\basemap6.png

c:\program files (x86)\explorer\basemaps\Server\basemap7.nmf

c:\program files (x86)\explorer\basemaps\Server\basemap7.png

c:\program files (x86)\explorer\basemaps\Server\basemap8.nmf

c:\program files (x86)\explorer\basemaps\Server\basemap8.png

c:\program files (x86)\explorer\basemaps\Server\basemap9.nmf

c:\program files (x86)\explorer\basemaps\Server\basemap9.png

c:\program files (x86)\explorer\basemaps\Server\basemaps.de.xml

c:\program files (x86)\explorer\basemaps\Server\basemaps.es.xml

c:\program files (x86)\explorer\basemaps\Server\basemaps.fr.xml

c:\program files (x86)\explorer\basemaps\Server\basemaps.ja-jp.xml

c:\program files (x86)\explorer\basemaps\Server\basemaps.xml

c:\program files (x86)\explorer\basemaps\Server\basemaps.zh-CN.xml

c:\program files (x86)\explorer\bin\3dAnalystUtil.dll

c:\program files (x86)\explorer\bin\3DSymbols.dll

c:\program files (x86)\explorer\bin\3DSymbolsLib.dll

c:\program files (x86)\explorer\bin\AfCore.dll

c:\program files (x86)\explorer\bin\AfUtil.dll

c:\program files (x86)\explorer\bin\AGSClient.dll

c:\program files (x86)\explorer\bin\aibase.dll

c:\program files (x86)\explorer\bin\aifeat.dll

c:\program files (x86)\explorer\bin\AISClient.dll

c:\program files (x86)\explorer\bin\AISGlobalLib.dll

c:\program files (x86)\explorer\bin\aishape.dll

c:\program files (x86)\explorer\bin\Animation.dll

c:\program files (x86)\explorer\bin\AnnoLayer.dll

c:\program files (x86)\explorer\bin\Annotation.dll

c:\program files (x86)\explorer\bin\AnnotationLib.dll

c:\program files (x86)\explorer\bin\AoInitializer.dll

c:\program files (x86)\explorer\bin\AppInitializerLib.dll

c:\program files (x86)\explorer\bin\ApplicationConfigurationManager.exe

c:\program files (x86)\explorer\bin\ArcGISExplorer.ISCConfig

c:\program files (x86)\explorer\bin\atl71.dll

c:\program files (x86)\explorer\bin\BasemapLayer.dll

c:\program files (x86)\explorer\bin\BasicRasterPicture.dll

c:\program files (x86)\explorer\bin\BGLAPI.dll

c:\program files (x86)\explorer\bin\BGLAPILib.dll

c:\program files (x86)\explorer\bin\BGLFontEngine.dll

c:\program files (x86)\explorer\bin\BGLGeomChestLib.dll

c:\program files (x86)\explorer\bin\BGLGeometricEffects.dll

c:\program files (x86)\explorer\bin\BGLImageCoders.dll

c:\program files (x86)\explorer\bin\BGLRasterizerLib.dll

c:\program files (x86)\explorer\bin\BGLRasterizerSW.dll

c:\program files (x86)\explorer\bin\BGLSymbols.dll

c:\program files (x86)\explorer\bin\BGLSymbolsLib.dll

c:\program files (x86)\explorer\bin\BGLToGDIHelper.dll

c:\program files (x86)\explorer\bin\bin.zreg

c:\program files (x86)\explorer\bin\CacheRasterDB.dll

c:\program files (x86)\explorer\bin\CadastralFabric.dll

c:\program files (x86)\explorer\bin\CadastralFabricLayer.dll

c:\program files (x86)\explorer\bin\CadEngine.dll

c:\program files (x86)\explorer\bin\CadFDB.dll

c:\program files (x86)\explorer\bin\CadLayer.dll

c:\program files (x86)\explorer\bin\CadWorkspaceFactory.dll

c:\program files (x86)\explorer\bin\Camera.dll

c:\program files (x86)\explorer\bin\CartoControlsLib.dll

c:\program files (x86)\explorer\bin\CartoConverter.dll

c:\program files (x86)\explorer\bin\CartoXLib.dll

c:\program files (x86)\explorer\bin\CIM.dll

c:\program files (x86)\explorer\bin\CIMLib.dll

c:\program files (x86)\explorer\bin\Color.dll

c:\program files (x86)\explorer\bin\ComplexSymbols.dll

c:\program files (x86)\explorer\bin\CompressedDataFile.dll

c:\program files (x86)\explorer\bin\Configuration\CATID\esri.catid.ecfg

c:\program files (x86)\explorer\bin\Configuration\CLSID\esri.clsid.ecfg

c:\program files (x86)\explorer\bin\DADFLib.dll

c:\program files (x86)\explorer\bin\DaeFile.dll

c:\program files (x86)\explorer\bin\DataConverterLib.dll

c:\program files (x86)\explorer\bin\dbghelp.dll

c:\program files (x86)\explorer\bin\de\ApplicationConfigurationManager.resources.dll

c:\program files (x86)\explorer\bin\de\DADFRes.dll

c:\program files (x86)\explorer\bin\de\ESRI.ArcGISExplorer.Application.resources.dll

c:\program files (x86)\explorer\bin\de\ESRI.ArcGISExplorer.MapCenter.resources.dll

c:\program files (x86)\explorer\bin\de\ESRI.ArcGISExplorer.resources.dll

c:\program files (x86)\explorer\bin\de\ResToolkitPro.dll

c:\program files (x86)\explorer\bin\DECoreLib.dll

c:\program files (x86)\explorer\bin\DFORRT.DLL

c:\program files (x86)\explorer\bin\Display.dll

c:\program files (x86)\explorer\bin\DisplayFeedback.dll

c:\program files (x86)\explorer\bin\DisplayGraph.dll

c:\program files (x86)\explorer\bin\DisplayLib.dll

c:\program files (x86)\explorer\bin\DistributedGeodbLib.dll

c:\program files (x86)\explorer\bin\DynamicDisplay.dll

c:\program files (x86)\explorer\bin\e3.config.xml

c:\program files (x86)\explorer\bin\E3.exe

c:\program files (x86)\explorer\bin\E3.exe.config

c:\program files (x86)\explorer\bin\E3Control.dll

c:\program files (x86)\explorer\bin\E3EmailHelper.exe

c:\program files (x86)\explorer\bin\EngineGraphics.dll

c:\program files (x86)\explorer\bin\EnginePackager.dll

c:\program files (x86)\explorer\bin\es\ApplicationConfigurationManager.resources.dll

c:\program files (x86)\explorer\bin\es\DADFRes.dll

c:\program files (x86)\explorer\bin\es\ESRI.ArcGISExplorer.Application.resources.dll

c:\program files (x86)\explorer\bin\es\ESRI.ArcGISExplorer.MapCenter.resources.dll

c:\program files (x86)\explorer\bin\es\ESRI.ArcGISExplorer.resources.dll

c:\program files (x86)\explorer\bin\es\ResToolkitPro.dll

c:\program files (x86)\explorer\bin\ESRI.ArcGIS.Utilities.Compression.dll

c:\program files (x86)\explorer\bin\ESRI.ArcGISExplorer.Application.dll

c:\program files (x86)\explorer\bin\ESRI.ArcGISExplorer.dll

c:\program files (x86)\explorer\bin\ESRI.ArcGISExplorer.MapCenter.dll

c:\program files (x86)\explorer\bin\ESRI.DADF.Core.dll

c:\program files (x86)\explorer\bin\ESRI.DADF.dll

c:\program files (x86)\explorer\bin\esrizip.exe

c:\program files (x86)\explorer\bin\Export.dll

c:\program files (x86)\explorer\bin\ExtTopoEngine.dll

c:\program files (x86)\explorer\bin\FdaCore.dll

c:\program files (x86)\explorer\bin\FdaCoreLib.dll

c:\program files (x86)\explorer\bin\FdaRel.dll

c:\program files (x86)\explorer\bin\FeatureDataConverter.dll

c:\program files (x86)\explorer\bin\FeatureDataElements.dll

c:\program files (x86)\explorer\bin\FeatureLayer.dll

c:\program files (x86)\explorer\bin\FeatureLayerLib.dll

c:\program files (x86)\explorer\bin\FgdbRasterDB.dll

c:\program files (x86)\explorer\bin\FgdbUtilLib.dll

c:\program files (x86)\explorer\bin\FileDataElements.dll

c:\program files (x86)\explorer\bin\FileDBCoreLib.dll

c:\program files (x86)\explorer\bin\FileGDB.dll

c:\program files (x86)\explorer\bin\FileGDBWorkspaceFactory.dll

c:\program files (x86)\explorer\bin\fr\ApplicationConfigurationManager.resources.dll

c:\program files (x86)\explorer\bin\fr\DADFRes.dll

c:\program files (x86)\explorer\bin\fr\ESRI.ArcGISExplorer.Application.resources.dll

c:\program files (x86)\explorer\bin\fr\ESRI.ArcGISExplorer.MapCenter.resources.dll

c:\program files (x86)\explorer\bin\fr\ESRI.ArcGISExplorer.resources.dll

c:\program files (x86)\explorer\bin\fr\ResToolkitPro.dll

c:\program files (x86)\explorer\bin\FunctionRasterDB.dll

c:\program files (x86)\explorer\bin\gdal16.dll

c:\program files (x86)\explorer\bin\GdalRasterDB.dll

c:\program files (x86)\explorer\bin\GdbCatalog.dll

c:\program files (x86)\explorer\bin\GdbCore.dll

c:\program files (x86)\explorer\bin\GdbCoreLib.dll

c:\program files (x86)\explorer\bin\GdbNet.dll

c:\program files (x86)\explorer\bin\GdbTopo.dll

c:\program files (x86)\explorer\bin\GeoDataExtraction.dll

c:\program files (x86)\explorer\bin\GeoDataServer.dll

c:\program files (x86)\explorer\bin\GeoDataTransfer.dll

c:\program files (x86)\explorer\bin\Geometry.dll

c:\program files (x86)\explorer\bin\GeoprocessingLib.dll

c:\program files (x86)\explorer\bin\GeoProcessor.dll

c:\program files (x86)\explorer\bin\GeoRSSPlugin.dll

c:\program files (x86)\explorer\bin\glew32.dll

c:\program files (x86)\explorer\bin\Globe.dll

c:\program files (x86)\explorer\bin\GlobeCamera.dll

c:\program files (x86)\explorer\bin\GlobeClient.dll

c:\program files (x86)\explorer\bin\GlobeCoreLib.dll

c:\program files (x86)\explorer\bin\GlobeDisplay.dll

c:\program files (x86)\explorer\bin\GlobeLayers.dll

c:\program files (x86)\explorer\bin\GlobeServer.dll

c:\program files (x86)\explorer\bin\GlobeServerLayer.dll

c:\program files (x86)\explorer\bin\GlobeViewerCoreLib.dll

c:\program files (x86)\explorer\bin\GPClient.dll

c:\program files (x86)\explorer\bin\GpObjects.dll

c:\program files (x86)\explorer\bin\GpPythonCore.dll

c:\program files (x86)\explorer\bin\GPRasterFunctions.dll

c:\program files (x86)\explorer\bin\GraphicElements.dll

c:\program files (x86)\explorer\bin\hd420m.dll

c:\program files (x86)\explorer\bin\hdf5dll.dll

c:\program files (x86)\explorer\bin\hm420m.dll

c:\program files (x86)\explorer\bin\icudt40.dll

c:\program files (x86)\explorer\bin\icuin40.dll

c:\program files (x86)\explorer\bin\icuio40.dll

c:\program files (x86)\explorer\bin\icule40.dll

c:\program files (x86)\explorer\bin\icuuc40.dll

c:\program files (x86)\explorer\bin\ImageAccessLib.dll

c:\program files (x86)\explorer\bin\ImageClient.dll

c:\program files (x86)\explorer\bin\ImageServer.dll

c:\program files (x86)\explorer\bin\ImageServerLayer.dll

c:\program files (x86)\explorer\bin\IMSConnector.dll

c:\program files (x86)\explorer\bin\ImsFDB.dll

c:\program files (x86)\explorer\bin\IMSLayer.dll

c:\program files (x86)\explorer\bin\IMSLayerLib.dll

c:\program files (x86)\explorer\bin\IMSServiceLib.dll

c:\program files (x86)\explorer\bin\ImsWorkspaceFactory.dll

c:\program files (x86)\explorer\bin\InMemoryWorkspaceFactory.dll

c:\program files (x86)\explorer\bin\InputDevice3Dx.dll

c:\program files (x86)\explorer\bin\ja-JP\ApplicationConfigurationManager.resources.dll

c:\program files (x86)\explorer\bin\ja-JP\DADFRes.dll

c:\program files (x86)\explorer\bin\ja-JP\ESRI.ArcGISExplorer.Application.resources.dll

c:\program files (x86)\explorer\bin\ja-JP\ESRI.ArcGISExplorer.MapCenter.resources.dll

c:\program files (x86)\explorer\bin\ja-JP\ESRI.ArcGISExplorer.resources.dll

c:\program files (x86)\explorer\bin\ja-JP\ResToolkitPro.dll

c:\program files (x86)\explorer\bin\kdu61.dll

c:\program files (x86)\explorer\bin\KmlLayer.dll

c:\program files (x86)\explorer\bin\LabelPlacement.dll

c:\program files (x86)\explorer\bin\Layer.dll

c:\program files (x86)\explorer\bin\LayerLib.dll

c:\program files (x86)\explorer\bin\lcms117lib.dll

c:\program files (x86)\explorer\bin\libcollada14dom21.dll

c:\program files (x86)\explorer\bin\libcurl.dll

c:\program files (x86)\explorer\bin\lti_dsdk_dll.dll

c:\program files (x86)\explorer\bin\Map.dll

c:\program files (x86)\explorer\bin\MapClient.dll

c:\program files (x86)\explorer\bin\MapDB.dll

c:\program files (x86)\explorer\bin\MapElements.dll

c:\program files (x86)\explorer\bin\MaplexEngineLib.dll

c:\program files (x86)\explorer\bin\MapLib.dll

c:\program files (x86)\explorer\bin\MappingCore.dll

c:\program files (x86)\explorer\bin\MappingCoreLib.dll

c:\program files (x86)\explorer\bin\MappingServicesLib.dll

c:\program files (x86)\explorer\bin\MapServer.dll

c:\program files (x86)\explorer\bin\MapServerLayer.dll

c:\program files (x86)\explorer\bin\Marker3DFile.dll

c:\program files (x86)\explorer\bin\MessageSupport.dll

c:\program files (x86)\explorer\bin\Microsoft.VC90.ATL\atl90.dll

c:\program files (x86)\explorer\bin\Microsoft.VC90.ATL\Microsoft.VC90.ATL.manifest

c:\program files (x86)\explorer\bin\Microsoft.VC90.CRT\Microsoft.VC90.CRT.manifest

c:\program files (x86)\explorer\bin\Microsoft.VC90.CRT\msvcm90.dll

c:\program files (x86)\explorer\bin\Microsoft.VC90.CRT\msvcp90.dll

c:\program files (x86)\explorer\bin\Microsoft.VC90.CRT\msvcr90.dll

c:\program files (x86)\explorer\bin\Microsoft.VC90.MFC\mfc90.dll

c:\program files (x86)\explorer\bin\Microsoft.VC90.MFC\mfc90u.dll

c:\program files (x86)\explorer\bin\Microsoft.VC90.MFC\mfcm90.dll

c:\program files (x86)\explorer\bin\Microsoft.VC90.MFC\mfcm90u.dll

c:\program files (x86)\explorer\bin\Microsoft.VC90.MFC\Microsoft.VC90.MFC.manifest

c:\program files (x86)\explorer\bin\Microsoft.VC90.MFCLOC\MFC90CHS.dll

c:\program files (x86)\explorer\bin\Microsoft.VC90.MFCLOC\MFC90CHT.dll

c:\program files (x86)\explorer\bin\Microsoft.VC90.MFCLOC\MFC90DEU.dll

c:\program files (x86)\explorer\bin\Microsoft.VC90.MFCLOC\MFC90ENU.dll

c:\program files (x86)\explorer\bin\Microsoft.VC90.MFCLOC\MFC90ESN.dll

c:\program files (x86)\explorer\bin\Microsoft.VC90.MFCLOC\MFC90ESP.dll

c:\program files (x86)\explorer\bin\Microsoft.VC90.MFCLOC\MFC90FRA.dll

c:\program files (x86)\explorer\bin\Microsoft.VC90.MFCLOC\MFC90ITA.dll

c:\program files (x86)\explorer\bin\Microsoft.VC90.MFCLOC\MFC90JPN.dll

c:\program files (x86)\explorer\bin\Microsoft.VC90.MFCLOC\MFC90KOR.dll

c:\program files (x86)\explorer\bin\Microsoft.VC90.MFCLOC\Microsoft.VC90.MFCLOC.manifest

c:\program files (x86)\explorer\bin\Microsoft.VC90.OPENMP\Microsoft.VC90.OpenMP.manifest

c:\program files (x86)\explorer\bin\Microsoft.VC90.OPENMP\vcomp90.dll

c:\program files (x86)\explorer\bin\MosaicDB.dll

c:\program files (x86)\explorer\bin\msvcp71.dll

c:\program files (x86)\explorer\bin\msvcr71.dll

c:\program files (x86)\explorer\bin\Navigation.dll

c:\program files (x86)\explorer\bin\NetEngine80.dll

c:\program files (x86)\explorer\bin\Network.dll

c:\program files (x86)\explorer\bin\NetworkAnalystSolvers.dll

c:\program files (x86)\explorer\bin\NetworkDataset.dll

c:\program files (x86)\explorer\bin\OGCClient.dll

c:\program files (x86)\explorer\bin\OutputLib.dll

c:\program files (x86)\explorer\bin\PageLayout.dll

c:\program files (x86)\explorer\bin\pe.dll

c:\program files (x86)\explorer\bin\PlugInDataSource.dll

c:\program files (x86)\explorer\bin\PlugInWorkspaceFactory.dll

c:\program files (x86)\explorer\bin\PrintOut.dll

c:\program files (x86)\explorer\bin\RasterAnalysisUtilLib.dll

c:\program files (x86)\explorer\bin\RasterCatalog.dll

c:\program files (x86)\explorer\bin\RasterCoreLib.dll

c:\program files (x86)\explorer\bin\RasterDB.dll

c:\program files (x86)\explorer\bin\RasterEngine.dll

c:\program files (x86)\explorer\bin\RasterFormats.dat

c:\program files (x86)\explorer\bin\RasterGraphicElements.dll

c:\program files (x86)\explorer\bin\RasterIO.dll

c:\program files (x86)\explorer\bin\RasterLayer.dll

c:\program files (x86)\explorer\bin\RasterRenderer.dll

c:\program files (x86)\explorer\bin\RasterWorkspaceFactory.dll

c:\program files (x86)\explorer\bin\Renderers.dll

c:\program files (x86)\explorer\bin\RepresentationDB.dll

c:\program files (x86)\explorer\bin\RepresentationEffects.dll

c:\program files (x86)\explorer\bin\RepresentationLayer.dll

c:\program files (x86)\explorer\bin\RepresentationLib.dll

c:\program files (x86)\explorer\bin\RepresentationSymbols.dll

c:\program files (x86)\explorer\bin\SceneFilters.dll

c:\program files (x86)\explorer\bin\SceneGraph.dll

c:\program files (x86)\explorer\bin\sdcdbx.dll

c:\program files (x86)\explorer\bin\SDCPlugIn.dll

c:\program files (x86)\explorer\bin\sde.dll

c:\program files (x86)\explorer\bin\SdeFDB.dll

c:\program files (x86)\explorer\bin\SdeRasterDB.dll

c:\program files (x86)\explorer\bin\sdesetup.dll

c:\program files (x86)\explorer\bin\SdeWorkspaceFactory.dll

c:\program files (x86)\explorer\bin\ServerStyleGallery.dll

c:\program files (x86)\explorer\bin\sg.dll

c:\program files (x86)\explorer\bin\ShapefileFDB.dll

c:\program files (x86)\explorer\bin\ShapefileWorkspaceFactory.dll

c:\program files (x86)\explorer\bin\SimpleDataConverter.dll

c:\program files (x86)\explorer\bin\StyleGalleryClasses.dll

c:\program files (x86)\explorer\bin\SystemUIUtil.dll

c:\program files (x86)\explorer\bin\Terrain.dll

c:\program files (x86)\explorer\bin\TerrainLayer.dll

c:\program files (x86)\explorer\bin\TextureCookerService.exe

c:\program files (x86)\explorer\bin\TinDb.dll

c:\program files (x86)\explorer\bin\TinEngine.dll

c:\program files (x86)\explorer\bin\TinLayer.dll

c:\program files (x86)\explorer\bin\TinRenderer.dll

c:\program files (x86)\explorer\bin\TinWorkspaceFactory.dll

c:\program files (x86)\explorer\bin\ViewerCoreLib.dll

c:\program files (x86)\explorer\bin\VpfFDB.dll

c:\program files (x86)\explorer\bin\VpfWorkspaceFactory.dll

c:\program files (x86)\explorer\bin\WebServices.dll

c:\program files (x86)\explorer\bin\WMSLayer.dll

c:\program files (x86)\explorer\bin\xerces-c_2_7.dll

c:\program files (x86)\explorer\bin\XmlSupport.dat

c:\program files (x86)\explorer\bin\XMLSupport.dll

c:\program files (x86)\explorer\bin\zh-CN\applicationconfigurationmanager.resources.dll

c:\program files (x86)\explorer\bin\zh-CN\DADFRes.dll

c:\program files (x86)\explorer\bin\zh-CN\ESRI.ArcGISExplorer.Application.resources.dll

c:\program files (x86)\explorer\bin\zh-CN\ESRI.ArcGISExplorer.MapCenter.resources.dll

c:\program files (x86)\explorer\bin\zh-CN\ESRI.ArcGISExplorer.resources.dll

c:\program files (x86)\explorer\bin\zh-CN\ResToolkitPro.dll

c:\program files (x86)\explorer\bin\zlib1.dll

c:\program files (x86)\explorer\bin\zlibwapi.dll

c:\program files (x86)\explorer\ColorProfiles\esriGray22.icc

c:\program files (x86)\explorer\ColorProfiles\Lab2Lab.icm

c:\program files (x86)\explorer\ColorProfiles\sRGB_IEC61966-2-1_noBPC.icc

c:\program files (x86)\explorer\ColorProfiles\USWebCoatedSWOP.icc

c:\program files (x86)\explorer\ColorProfiles\Xyz2Xyz.icm

c:\program files (x86)\explorer\com\com.zreg

c:\program files (x86)\explorer\com\esriE3.olb

c:\program files (x86)\explorer\license\ExplorerEnglishLicense.pdf

c:\program files (x86)\explorer\license\ExplorerFrenchLicense.pdf

c:\program files (x86)\explorer\license\ExplorerGermanLicense.pdf

c:\program files (x86)\explorer\license\ExplorerJapaneseLicense.pdf

c:\program files (x86)\explorer\license\ExplorerSimplChineseLicense.pdf

c:\program files (x86)\explorer\license\ExplorerSpanishLicense.pdf

c:\program files (x86)\explorer\PackageTemplates\ArcGISExplorer.stylesheet

c:\program files (x86)\explorer\PackageTemplates\Package931.template

c:\program files (x86)\explorer\pedata\gdaldata\coordinate_axis.csv

c:\program files (x86)\explorer\pedata\gdaldata\cubewerx_extra.wkt

c:\program files (x86)\explorer\pedata\gdaldata\ecw_cs.dat

c:\program files (x86)\explorer\pedata\gdaldata\ellipsoid.csv

c:\program files (x86)\explorer\pedata\gdaldata\epsg.wkt

c:\program files (x86)\explorer\pedata\gdaldata\esri_extra.wkt

c:\program files (x86)\explorer\pedata\gdaldata\gcs.csv

c:\program files (x86)\explorer\pedata\gdaldata\gdal_datum.csv

c:\program files (x86)\explorer\pedata\gdaldata\gdalicon.png

c:\program files (x86)\explorer\pedata\gdaldata\pcs.csv

c:\program files (x86)\explorer\pedata\gdaldata\prime_meridian.csv

c:\program files (x86)\explorer\pedata\gdaldata\projop_wparm.csv

c:\program files (x86)\explorer\pedata\gdaldata\s57attributes.csv

c:\program files (x86)\explorer\pedata\gdaldata\s57expectedinput.csv

c:\program files (x86)\explorer\pedata\gdaldata\s57objectclasses.csv

c:\program files (x86)\explorer\pedata\gdaldata\seed_2d.dgn

c:\program files (x86)\explorer\pedata\gdaldata\seed_3d.dgn

c:\program files (x86)\explorer\pedata\gdaldata\stateplane.csv

c:\program files (x86)\explorer\pedata\gdaldata\unit_of_measure.csv

c:\program files (x86)\explorer\plugins\explorerCore.ecfg

c:\program files (x86)\explorer\schemas\ExplorerAddIn.xsd

c:\program files (x86)\explorer\schemas\ExplorerGeometry.xsd

c:\program files (x86)\explorer\schemas\NmfDocument.xsd

c:\program files (x86)\explorer\Styles\default.css

c:\program files (x86)\explorer\Styles\Directions\CheckeredFlag16.png

c:\program files (x86)\explorer\Styles\Directions\GreenFlag16.png

c:\program files (x86)\explorer\Styles\Directions\Print16.png

c:\program files (x86)\explorer\Styles\ExplorerColors.de.xml

c:\program files (x86)\explorer\Styles\ExplorerColors.es.xml

c:\program files (x86)\explorer\Styles\ExplorerColors.fr.xml

c:\program files (x86)\explorer\Styles\ExplorerColors.ja-JP.xml

c:\program files (x86)\explorer\Styles\ExplorerColors.xml

c:\program files (x86)\explorer\Styles\ExplorerColors.zh-CN.xml

c:\program files (x86)\explorer\Styles\ExplorerSymbols.de.xml

c:\program files (x86)\explorer\Styles\ExplorerSymbols.es.xml

c:\program files (x86)\explorer\Styles\ExplorerSymbols.fr.xml

c:\program files (x86)\explorer\Styles\ExplorerSymbols.ja-JP.xml

c:\program files (x86)\explorer\Styles\ExplorerSymbols.xml

c:\program files (x86)\explorer\Styles\ExplorerSymbols.zh-CN.xml

c:\program files (x86)\explorer\Styles\kml.css

c:\program files (x86)\explorer\Styles\KMLIcons\american-flag.png

c:\program files (x86)\explorer\Styles\KMLIcons\arrow.png

c:\program files (x86)\explorer\Styles\KMLIcons\asian-flag.png

c:\program files (x86)\explorer\Styles\KMLIcons\auto-service.png

c:\program files (x86)\explorer\Styles\KMLIcons\auto.png

c:\program files (x86)\explorer\Styles\KMLIcons\bang.png

c:\program files (x86)\explorer\Styles\KMLIcons\bars.png

c:\program files (x86)\explorer\Styles\KMLIcons\building.png

c:\program files (x86)\explorer\Styles\KMLIcons\coffee_house_16.png

c:\program files (x86)\explorer\Styles\KMLIcons\crosshair.png

c:\program files (x86)\explorer\Styles\KMLIcons\dining.png

c:\program files (x86)\explorer\Styles\KMLIcons\dining_16.png

c:\program files (x86)\explorer\Styles\KMLIcons\dot.png

c:\program files (x86)\explorer\Styles\KMLIcons\fast-food.png

c:\program files (x86)\explorer\Styles\KMLIcons\four-dollars.png

c:\program files (x86)\explorer\Styles\KMLIcons\french-flag.png

c:\program files (x86)\explorer\Styles\KMLIcons\hand.png

c:\program files (x86)\explorer\Styles\KMLIcons\high_res_places.png

c:\program files (x86)\explorer\Styles\KMLIcons\highway_16.png

c:\program files (x86)\explorer\Styles\KMLIcons\italian-flag.png

c:\program files (x86)\explorer\Styles\KMLIcons\large_traffic_count_16.png

c:\program files (x86)\explorer\Styles\KMLIcons\mexican-flag.png

c:\program files (x86)\explorer\Styles\KMLIcons\misc_dining.png

c:\program files (x86)\explorer\Styles\KMLIcons\note.png

c:\program files (x86)\explorer\Styles\KMLIcons\one-dollar.png

c:\program files (x86)\explorer\Styles\KMLIcons\palette-2.png

c:\program files (x86)\explorer\Styles\KMLIcons\palette-3.png

c:\program files (x86)\explorer\Styles\KMLIcons\palette-4.png

c:\program files (x86)\explorer\Styles\KMLIcons\palette-5.png

c:\program files (x86)\explorer\Styles\KMLIcons\parks.png

c:\program files (x86)\explorer\Styles\KMLIcons\recreation.png

c:\program files (x86)\explorer\Styles\KMLIcons\school_16.png

c:\program files (x86)\explorer\Styles\KMLIcons\search.png

c:\program files (x86)\explorer\Styles\KMLIcons\streamed_layer.png

c:\program files (x86)\explorer\Styles\KMLIcons\streamed_layers.png

c:\program files (x86)\explorer\Styles\KMLIcons\terrain_16.png

c:\program files (x86)\explorer\Styles\KMLIcons\three-dollars.png

c:\program files (x86)\explorer\Styles\KMLIcons\transportation.png

c:\program files (x86)\explorer\Styles\KMLIcons\two-dollars.png

c:\program files (x86)\explorer\Styles\KMLIcons\webcam_16.png

c:\program files (x86)\explorer\Styles\SlideTitleStyles.de.xml

c:\program files (x86)\explorer\Styles\SlideTitleStyles.es.xml

c:\program files (x86)\explorer\Styles\SlideTitleStyles.fr.xml

c:\program files (x86)\explorer\Styles\SlideTitleStyles.ja-JP.xml

c:\program files (x86)\explorer\Styles\SlideTitleStyles.xml

c:\program files (x86)\explorer\Styles\SlideTitleStyles.zh-CN.xml

c:\program files (x86)\explorer\Styles\StyleSheet.xsl

c:\program files (x86)\explorer\Styles\SymbolImages\Civic\ATM.png

c:\program files (x86)\explorer\Styles\SymbolImages\Civic\Bank.png

c:\program files (x86)\explorer\Styles\SymbolImages\Civic\Bell.png

c:\program files (x86)\explorer\Styles\SymbolImages\Civic\Cemetery.png

c:\program files (x86)\explorer\Styles\SymbolImages\Civic\City.png

c:\program files (x86)\explorer\Styles\SymbolImages\Civic\Clue.png

c:\program files (x86)\explorer\Styles\SymbolImages\Civic\Crowd.png

c:\program files (x86)\explorer\Styles\SymbolImages\Civic\GhostTown.png

c:\program files (x86)\explorer\Styles\SymbolImages\Civic\Horn.png

c:\program files (x86)\explorer\Styles\SymbolImages\Civic\Housing.png

c:\program files (x86)\explorer\Styles\SymbolImages\Civic\MailPost.png

c:\program files (x86)\explorer\Styles\SymbolImages\Civic\Office.png

c:\program files (x86)\explorer\Styles\SymbolImages\Civic\Radioactive.png

c:\program files (x86)\explorer\Styles\SymbolImages\Civic\School.png

c:\program files (x86)\explorer\Styles\SymbolImages\Civic\StarsStripes.png

c:\program files (x86)\explorer\Styles\SymbolImages\Flag\CheckeredFlag.png

c:\program files (x86)\explorer\Styles\SymbolImages\Flag\GreenFlag.png

c:\program files (x86)\explorer\Styles\SymbolImages\Flag\RedFlag.png

c:\program files (x86)\explorer\Styles\SymbolImages\Flag\WhiteFlag.png

c:\program files (x86)\explorer\Styles\SymbolImages\Flag\YellowFlag.png

c:\program files (x86)\explorer\Styles\SymbolImages\Health\AidStation.png

c:\program files (x86)\explorer\Styles\SymbolImages\Health\Ambulance.png

c:\program files (x86)\explorer\Styles\SymbolImages\Health\Doctor.png

c:\program files (x86)\explorer\Styles\SymbolImages\Health\Health.png

c:\program files (x86)\explorer\Styles\SymbolImages\Health\Hospital.png

c:\program files (x86)\explorer\Styles\SymbolImages\Health\Pharmacy.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\AmberBeacon.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\BlackBeacon.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\BlueBeacon.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\BoatsKeepOut.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\ControlledArea.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\Danger.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\DiverDown.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\GreenBeacon.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\GreenDiamondDaymark.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\GreenRedBeacon.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\GreenSquareDaymark.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\GreenWhiteBeacon.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\OrangeBeacon.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\PersonOverboard.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\RadioBeacon.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\RedBeacon.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\RedDiamondDaymark.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\RedGreenBeacon.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\RedSquareDaymark.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\RedTriangleDaymark.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\RedWhiteBeacon.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\SkullandCrossbones.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\UnderwaterOperations.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\VioletBeacon.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\WhiteBeacon.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\WhiteDiamondDaymark.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\WhiteGreenBeacon.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\WhiteRedBeacon.png

c:\program files (x86)\explorer\Styles\SymbolImages\Marine\Wreck.png

c:\program files (x86)\explorer\Styles\SymbolImages\Placemark\ArrowYellow.png

c:\program files (x86)\explorer\Styles\SymbolImages\Placemark\Capital1.png

c:\program files (x86)\explorer\Styles\SymbolImages\Placemark\Capital2.png

c:\program files (x86)\explorer\Styles\SymbolImages\Placemark\CircleX.png

c:\program files (x86)\explorer\Styles\SymbolImages\Placemark\CrossHair.png

c:\program files (x86)\explorer\Styles\SymbolImages\Placemark\Populated1.png

c:\program files (x86)\explorer\Styles\SymbolImages\Placemark\Populated2.png

c:\program files (x86)\explorer\Styles\SymbolImages\Placemark\Populated3.png

c:\program files (x86)\explorer\Styles\SymbolImages\Placemark\Populated4.png

c:\program files (x86)\explorer\Styles\SymbolImages\Placemark\Populated5.png

c:\program files (x86)\explorer\Styles\SymbolImages\Placemark\Populated6.png

c:\program files (x86)\explorer\Styles\SymbolImages\Placemark\Populated7.png

c:\program files (x86)\explorer\Styles\SymbolImages\Placemark\Star.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\AmusementPark.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\Bar.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\Camera.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\CameraWeb.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\CellPhone.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\Coffee.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\Dam.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\DepartmentStore.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\Dining.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\DrinkingWater.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\FastFood.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\FitnessCenter.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\Forest.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\Globe.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\Information.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\InformationQuestion.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\LandLine.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\Light.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\LiveShow.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\Mine.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\MovieTheater.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\Museum.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\News.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\Note.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\OilWell.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\Pizza.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\Pub.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\Question.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\RealEstate.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\Reservoir.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\Restroom.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\Shopping.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\Shower.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\Stadium.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\TowerShort.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\TowerTall.png

c:\program files (x86)\explorer\Styles\SymbolImages\Points of Interest\Zoo.png

c:\program files (x86)\explorer\Styles\SymbolImages\Public Safety\Burglary.png

c:\program files (x86)\explorer\Styles\SymbolImages\Public Safety\FireFighter.png

c:\program files (x86)\explorer\Styles\SymbolImages\Public Safety\FireStation.png

c:\program files (x86)\explorer\Styles\SymbolImages\Public Safety\FireTruck.png

c:\program files (x86)\explorer\Styles\SymbolImages\Public Safety\Homicide.png

c:\program files (x86)\explorer\Styles\SymbolImages\Public Safety\Police.png

c:\program files (x86)\explorer\Styles\SymbolImages\Public Safety\PoliceCar.png

c:\program files (x86)\explorer\Styles\SymbolImages\Public Safety\PoliceOfficer.png

c:\program files (x86)\explorer\Styles\SymbolImages\Public Safety\PoliceStation.png

c:\program files (x86)\explorer\Styles\SymbolImages\Public Safety\Theft.png

c:\program files (x86)\explorer\Styles\SymbolImages\Pushpin\BlackPushpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Pushpin\BluePushpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Pushpin\BrownPushpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Pushpin\GrayPushpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Pushpin\GreenPushpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Pushpin\LightBluePushpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Pushpin\OrangePushpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Pushpin\PinkPushpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Pushpin\PurplePushpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Pushpin\RedPushpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Pushpin\SpringGreenPushpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Pushpin\WhitePushpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Pushpin\YellowPushpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Recreation\Beach.png

c:\program files (x86)\explorer\Styles\SymbolImages\Recreation\BoatLaunch.png

c:\program files (x86)\explorer\Styles\SymbolImages\Recreation\Bowling.png

c:\program files (x86)\explorer\Styles\SymbolImages\Recreation\Camping.png

c:\program files (x86)\explorer\Styles\SymbolImages\Recreation\Deer.png

c:\program files (x86)\explorer\Styles\SymbolImages\Recreation\Fishing.png

c:\program files (x86)\explorer\Styles\SymbolImages\Recreation\Geocache.png

c:\program files (x86)\explorer\Styles\SymbolImages\Recreation\GeocacheFound.png

c:\program files (x86)\explorer\Styles\SymbolImages\Recreation\Gliding.png

c:\program files (x86)\explorer\Styles\SymbolImages\Recreation\Golf.png

c:\program files (x86)\explorer\Styles\SymbolImages\Recreation\Hiking.png

c:\program files (x86)\explorer\Styles\SymbolImages\Recreation\Mountain.png

c:\program files (x86)\explorer\Styles\SymbolImages\Recreation\Park.png

c:\program files (x86)\explorer\Styles\SymbolImages\Recreation\RestArea.png

c:\program files (x86)\explorer\Styles\SymbolImages\Recreation\RVPark.png

c:\program files (x86)\explorer\Styles\SymbolImages\Recreation\SkyDiving.png

c:\program files (x86)\explorer\Styles\SymbolImages\Recreation\Sports.png

c:\program files (x86)\explorer\Styles\SymbolImages\Recreation\Swimming.png

c:\program files (x86)\explorer\Styles\SymbolImages\Recreation\TrackBack.png

c:\program files (x86)\explorer\Styles\SymbolImages\Recreation\WaterSkiing.png

c:\program files (x86)\explorer\Styles\SymbolImages\Sphere\BlueSphere.png

c:\program files (x86)\explorer\Styles\SymbolImages\Sphere\GreenSphere.png

c:\program files (x86)\explorer\Styles\SymbolImages\Sphere\OrangeSphere.png

c:\program files (x86)\explorer\Styles\SymbolImages\Sphere\PurpleSphere.png

c:\program files (x86)\explorer\Styles\SymbolImages\Sphere\RedSphere.png

c:\program files (x86)\explorer\Styles\SymbolImages\Sphere\YellowSphere.png

c:\program files (x86)\explorer\Styles\SymbolImages\Square\BlackWaypoint.png

c:\program files (x86)\explorer\Styles\SymbolImages\Square\BlueWaypoint.png

c:\program files (x86)\explorer\Styles\SymbolImages\Square\WhiteWaypoint.png

c:\program files (x86)\explorer\Styles\SymbolImages\Stickpin\BlackStickpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Stickpin\BlueStickpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Stickpin\BrownStickpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Stickpin\GrayStickpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Stickpin\GreenStickpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Stickpin\LightBlueStickpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Stickpin\OrangeStickpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Stickpin\PinkStickpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Stickpin\PurpleStickpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Stickpin\RedStickpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Stickpin\SpringGreenStickpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Stickpin\WhiteStickpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Stickpin\YellowStickpin.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transparent\Transparent.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\Airplane.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\AirStrip.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\Breakdown.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\Bus.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\CarGreenBack.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\CarGreenFront.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\CarRedBack.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\CarRedFront.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\CarRental.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\CarRepair.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\CarYellowBack.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\CarYellowFront.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\ConvenienceStore.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\Crossing.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\Fuel.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\HelicopterGreen.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\HelicopterRed.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\HelicopterYellow.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\Landingpad.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\Lodging.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\MileMarker.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\MountainPass.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\Overpass.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\Parking.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\PrivateField.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\RoadClosure.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\RoadWork.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\Sailing.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\Scales.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\Seaplane.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\Tank.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\Toll.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\TrafficAccident.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\Tunnel.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\Ultralight.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\WarningRed.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\WarningYellow.png

c:\program files (x86)\explorer\Styles\SymbolImages\Transportation\YellowSemiTractor.png

c:\program files (x86)\explorer\Styles\SymbolImages\Weather\Cloudy.png

c:\program files (x86)\explorer\Styles\SymbolImages\Weather\HeatAdvisory.png

c:\program files (x86)\explorer\Styles\SymbolImages\Weather\Lightning.png

c:\program files (x86)\explorer\Styles\SymbolImages\Weather\PartlySunny.png

c:\program files (x86)\explorer\Styles\SymbolImages\Weather\Rain.png

c:\program files (x86)\explorer\Styles\SymbolImages\Weather\Snow.png

c:\program files (x86)\explorer\Styles\SymbolImages\Weather\Sunny.png

c:\program files (x86)\explorer\Styles\Template.ncfg

c:\program files (x86)\explorer\TilingSchemes\ArcGIS_Online_Bing_Maps_Google_Maps.xml

c:\program files (x86)\explorer\TilingSchemes\GoogleMapsVersions.xml

c:\program files (x86)\explorer\TilingSchemes\Yahoo.xml

c:\users\katydid\AppData\Local\Microsoft\Windows\Temporary Internet Files\{37EC055D-BFE4-465C-967A-E6FF05FB5297}.xps

c:\users\katydid\AppData\Local\Microsoft\Windows\Temporary Internet Files\{4C03123C-ACAD-420D-90EA-3CCECFFC45DA}.xps

c:\users\katydid\AppData\Local\Microsoft\Windows\Temporary Internet Files\{500889FB-A7CF-46DE-8AB9-DD7A9E0DD840}.xps

c:\users\katydid\AppData\Local\Microsoft\Windows\Temporary Internet Files\{73758E7E-0DA6-4AC6-9F92-57C1E5E05AF2}.xps

c:\users\katydid\AppData\Local\Microsoft\Windows\Temporary Internet Files\{9CBA13A2-96B2-4168-A536-15AA8406D349}.xps

c:\users\katydid\AppData\Local\Microsoft\Windows\Temporary Internet Files\{A8AB0EFB-5CBB-40E4-8F8A-3973CEC21158}.xps

c:\users\katydid\AppData\Local\Microsoft\Windows\Temporary Internet Files\{B3E0F59B-4071-4D3F-9B3B-57303AF86680}.xps

c:\users\katydid\AppData\Local\Microsoft\Windows\Temporary Internet Files\{B4BE6F4C-C302-4509-9B5B-57BD178F7BA7}.xps

c:\users\katydid\AppData\Local\Microsoft\Windows\Temporary Internet Files\{B99D3070-EDFC-41F4-9E96-7D4508174321}.xps

c:\users\katydid\AppData\Local\Microsoft\Windows\Temporary Internet Files\{BA7457C4-431F-4CAC-AE9A-335E0DF7286A}.xps

c:\users\katydid\AppData\Local\Microsoft\Windows\Temporary Internet Files\{BFCF4F9C-D591-4CD0-B6B5-5A6B41C91B37}.xps

c:\users\katydid\AppData\Local\Microsoft\Windows\Temporary Internet Files\{D450BC22-AB70-49BC-9A44-F5DD7BBACEF3}.xps

c:\users\katydid\AppData\Local\Microsoft\Windows\Temporary Internet Files\{D89830F3-2DBD-4959-9B08-168781C95911}.xps

c:\users\katydid\AppData\Local\Microsoft\Windows\Temporary Internet Files\{DD7B1D4D-429A-4CBF-AB8C-8A6A58BA105B}.xps

c:\users\katydid\AppData\Local\Microsoft\Windows\Temporary Internet Files\{DF190E63-C47F-4643-B85D-D5130535329C}.xps

c:\users\katydid\AppData\Local\Microsoft\Windows\Temporary Internet Files\{E524405F-6FA3-4209-A4AB-F2D128CD6CAD}.xps

c:\users\katydid\AppData\Local\Microsoft\Windows\Temporary Internet Files\{EC0179B4-7990-4069-8548-41E89CF6CDC9}.xps

c:\users\katydid\AppData\Local\Microsoft\Windows\Temporary Internet Files\{ED5CEA4F-CC30-473E-90AF-EA5E09D44CDC}.xps

c:\users\katydid\AppData\Local\Microsoft\Windows\Temporary Internet Files\{F4E549EF-3766-4183-9B2B-586E678108A1}.xps

c:\users\katydid\AppData\Local\Microsoft\Windows\Temporary Internet Files\{FB75F6F0-9B56-4C0F-94A8-70B3882488FC}.xps

c:\users\katydid\AppData\Local\Microsoft\Windows\Temporary Internet Files\{FF88447B-3735-4EFF-9B2F-93AFF9DED120}.xps

c:\windows\SysWow64\sqlite3.dll

.

((((((((((((((((((((((((( Files Created from 2010-11-24 to 2010-12-24 )))))))))))))))))))))))))))))))

.

2010-12-24 15:49 . 2010-12-24 15:49 -------- d-----w- c:\users\Default\AppData\Local\temp

2010-12-24 12:28 . 2010-11-10 05:35 8199504 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4EA48155-A9DE-4CE1-9DDE-512FADB7BE01}\mpengine.dll

2010-12-22 14:23 . 2010-12-22 14:23 -------- d-----w- c:\users\katydid\AppData\Local\Windows Live Writer

2010-12-22 14:23 . 2010-12-22 14:23 -------- d-----w- c:\users\katydid\AppData\Roaming\Windows Live Writer

2010-12-22 14:10 . 2010-12-22 14:10 -------- d-----w- c:\windows\en

2010-12-22 14:08 . 2010-12-22 14:08 -------- d-----w- c:\program files\Windows Live

2010-12-22 14:07 . 2010-12-22 14:07 -------- d-----w- c:\program files (x86)\MSN Toolbar

2010-12-22 14:07 . 2010-12-22 14:08 -------- d-----w- c:\program files (x86)\Bing Bar Installer

2010-12-22 14:07 . 2009-09-04 22:44 69464 ----a-w- c:\windows\SysWow64\XAPOFX1_3.dll

2010-12-22 14:07 . 2009-09-04 22:44 515416 ----a-w- c:\windows\SysWow64\XAudio2_5.dll

2010-12-22 14:07 . 2009-09-04 22:29 453456 ----a-w- c:\windows\SysWow64\d3dx10_42.dll

2010-12-22 14:06 . 2010-12-22 14:06 469256 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\7c0b7b9e1cba1e10d\InstallManager_WLE_WLE.exe

2010-12-22 14:06 . 2010-12-22 14:06 94040 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\790bf6f81cba1e10b\DSETUP.dll

2010-12-22 14:06 . 2010-12-22 14:06 525656 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\790bf6f81cba1e10b\DXSETUP.exe

2010-12-22 14:06 . 2010-12-22 14:06 1691480 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\790bf6f81cba1e10b\dsetup32.dll

2010-12-22 14:06 . 2010-12-22 14:06 94040 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\77ca00fa1cba1e10a\DSETUP.dll

2010-12-22 14:06 . 2010-12-22 14:06 525656 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\77ca00fa1cba1e10a\DXSETUP.exe

2010-12-22 14:06 . 2010-12-22 14:06 1691480 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\77ca00fa1cba1e10a\dsetup32.dll

2010-12-22 14:06 . 2010-12-22 14:24 -------- d-----w- c:\users\katydid\AppData\Local\Windows Live

2010-12-22 14:05 . 2010-05-23 10:15 1619456 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL

2010-12-22 14:05 . 2010-05-23 10:11 196608 ----a-w- c:\windows\SysWow64\mfreadwrite.dll

2010-12-22 14:05 . 2010-05-23 10:11 3181568 ----a-w- c:\windows\SysWow64\mf.dll

2010-12-21 23:55 . 2010-12-22 12:32 -------- d-----w- c:\users\katydid\.storybook

2010-12-21 23:55 . 2010-12-21 23:55 -------- d-----w- c:\program files (x86)\Storybook

2010-12-20 02:05 . 2010-12-24 15:51 -------- d-----w- c:\program files (x86)\Common Files\Blizzard Entertainment

2010-12-10 15:52 . 2010-12-10 15:52 -------- d-----w- c:\program files\HawthsTools

2010-12-06 14:49 . 2010-12-06 14:49 -------- d-----w- c:\program files (x86)\Repast 3

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-12-20 23:09 . 2010-08-20 12:45 38224 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys

2010-12-10 15:29 . 2010-08-14 19:33 539968 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Google Update"="c:\users\katydid\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-10-06 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-01-15 284696]

"PDVDDXSrv"="c:\program files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2010-01-07 140520]

"DellBtrEvent"="d:\program files (x86)\Dell\Reader 2.1\DellBtrEvent.exe" [2010-05-04 147456]

"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2010-03-12 462993]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]

"00PCTFW"="c:\program files (x86)\PC Tools Firewall Plus\FirewallGUI.exe" [2010-01-12 3168216]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

c:\users\katydid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE [2010-3-29 227712]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Dell ControlPoint System Manager.lnk - c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe [2009-12-10 1416480]

Digital Line Detect.lnk - c:\program files (x86)\Digital Line Detect\DLG.exe [2010-7-22 50688]

TdmNotify.lnk - c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmNotify.exe [2009-11-24 185192]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"mixer4"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-27 136176]

R3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]

R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]

R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [2009-06-19 20992]

R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [2009-01-29 9216]

R3 motport;Motorola USB Diagnostic Port;c:\windows\system32\DRIVERS\motport.sys [2009-10-27 30208]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]

R3 rimspci;rimspci;c:\windows\system32\DRIVERS\rimspe64.sys [2010-03-21 61952]

R3 rixdpcie;rixdpcie;c:\windows\system32\DRIVERS\rixdpe64.sys [2010-03-21 55808]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-08-14 1255736]

S0 NCFilter;Novell UNC Filter - Filter;c:\windows\system32\DRIVERS\NCFilter.sys [2009-12-27 113176]

S0 NCRecognizer;Novell UNC Filter - Recognizer;c:\windows\system32\DRIVERS\NCRecognizer.sys [2009-12-27 119320]

S0 NCUncFilter;Novell UNC Filter - UNC Filter;c:\windows\system32\DRIVERS\NCUncFilter.sys [2009-12-27 26136]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2009-07-09 55280]

S0 stdflt;Disk Filter Driver for Accelerometer;c:\windows\system32\DRIVERS\stdfltn.sys [2010-01-18 21040]

S1 aswSP;aswSP; [x]

S1 DVMIO;DVMIO;d:\program files (x86)\Dell\Reader 2.1\dvmio_x64.sys [2010-05-04 20624]

S1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi64.sys [2010-01-07 306648]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]

S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_e085d3cd5b474ba6\AESTSr64.exe [2010-04-05 89600]

S2 aswFsBlk;aswFsBlk; [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 61008]

S2 buttonsvc64;Dell ControlPoint Button Service;c:\program files\Dell\Dell ControlPoint\DCPButtonSvc.exe [2009-11-20 373024]

S2 Credential Vault Host Control Service;Credential Vault Host Control Service;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe [2009-12-17 1039776]

S2 Credential Vault Host Storage;Credential Vault Host Storage;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe [2009-12-17 31136]

S2 dcpsysmgrsvc;Dell ControlPoint System Manager;c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe [2009-12-10 515872]

S2 DvmMDES;DeviceVM Meta Data Export Service;d:\program files (x86)\Dell\Reader 2.1\DVMExportService.exe [2010-05-04 327680]

S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe [2009-07-14 27136]

S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-01-15 13336]

S2 InstallFilterService;FF Install Filter Service;c:\program files (x86)\STMicroelectronics\AccelerometerP11\InstallFilterService.exe [2010-01-10 60928]

S2 MotoConnect Service;MotoConnect Service;c:\program files (x86)\Motorola\MotoConnectService\MotoConnectService.exe [2010-06-24 91456]

S2 NCFSD;Novell Client File System Redirector;c:\program files\Novell\Client\XTier\Drivers\ncfsd.sys [2009-12-27 96792]

S2 NCIOCTL;Novell Xplat IoCtl Driver;c:\program files\Novell\Client\XTier\Drivers\ncioctl.sys [2009-12-27 83480]

S2 risdpcie;risdpcie;c:\windows\system32\DRIVERS\risdpe64.sys [2010-03-21 81920]

S2 XTSvcMgr;Novell XTier Service Manager;c:\program files\Novell\Client\XTier\Services\XTSvcMgr.exe [2009-12-27 21016]

S3 Acceler;Accelerometer Service;c:\windows\system32\DRIVERS\Accelern.sys [2010-01-18 26160]

S3 CAXHWAZL;CAXHWAZL;c:\windows\system32\DRIVERS\CAXHWAZL.sys [2009-02-13 292864]

S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2009-09-16 172960]

S3 cvusbdrv;Dell ControlVault;c:\windows\system32\Drivers\cvusbdrv.sys [2009-10-30 38440]

S3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys [2009-12-10 294064]

S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 151936]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2010-01-28 86120]

S3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter64.sys [2010-01-12 95504]

S3 pctNDIS;PC Tools Driver;c:\windows\system32\DRIVERS\pctNdis64.sys [2010-01-07 81584]

S3 pctplfw;pctplfw;c:\windows\System32\drivers\pctplfw64.sys [2010-01-13 164496]

--- Other Services/Drivers In Memory ---

*Deregistered* - nciom

*Deregistered* - ncp

*Deregistered* - ncpl

*Deregistered* - ndm

*Deregistered* - ndmndap

*Deregistered* - ndslpp

*Deregistered* - niam

*Deregistered* - nipctl

*Deregistered* - nscm

*Deregistered* - nsns

*Deregistered* - nsvccost

*Deregistered* - xtxplat

.

Contents of the 'Scheduled Tasks' folder

2010-12-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-27 01:21]

2010-12-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-27 01:21]

2010-12-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-481820188-3860043195-3257424291-1001Core.job

- c:\users\katydid\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-06 10:59]

2010-12-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-481820188-3860043195-3257424291-1001UA.job

- c:\users\katydid\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-06 10:59]

.

--------- x86-64 -----------

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnabledUnlockedFDEIconOverlay]

@="{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}"

[HKEY_CLASSES_ROOT\CLSID\{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}]

2009-11-24 21:02 60784 ----a-w- c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UninitializedFdeIconOverlay]

@="{CF08DA3E-C97D-4891-A66B-E39B28DD270F}"

[HKEY_CLASSES_ROOT\CLSID\{CF08DA3E-C97D-4891-A66B-E39B28DD270F}]

2009-11-24 21:02 60784 ----a-w- c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"combofix"="c:\combofix\CF22760.cfxxe" [X]

"Apoint"="c:\program files\DellTPad\Apoint.exe" [2010-05-13 391024]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2010-04-05 487424]

"nwiz"="nwiz.exe" [2010-04-15 1712744]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-04-17 16414824]

"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2010-04-17 95336]

"Broadcom Wireless Manager UI"="c:\program files\Dell\DW WLAN Card\WLTRAY.exe" [2009-11-30 5107712]

"DellControlPoint"="c:\program files\Dell\Dell ControlPoint\Dell.ControlPoint.exe" [2009-11-02 657920]

"USCService"="c:\program files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe" [2010-01-14 34232]

"NWTRAY"="NWTRAY.EXE" [2009-12-27 37400]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uDefault_Search_URL = hxxp://www.google.com/ie

mLocal Page = c:\windows\SysWOW64\blank.htm

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~2\MIF5BA~1\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~2\MIF5BA~1\Office14\ONBttnIE.dll/105

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL

FF - ProfilePath - c:\users\katydid\AppData\Roaming\Mozilla\Firefox\Profiles\zzza7di1.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.bangordailynews.com/

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

FF - Ext: Skype extension for Firefox: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

FF - Ext: Zotero: zotero@chnm.gmu.edu - %profile%\extensions\zotero@chnm.gmu.edu

FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}

FF - user.js: yahoo.homepage.dontask - true

.

- - - - ORPHANS REMOVED - - - -

Toolbar-Locked - (no file)

Wow6432Node-HKCU-Run-updateMgr - c:\program files (x86)\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe

Toolbar-Locked - (no file)

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx"

"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx, 1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx"

"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx, 1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Alwil Software\Avast5\AvastSvc.exe

c:\program files (x86)\PC Tools Firewall Plus\FWService.exe

c:\program files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\program files (x86)\Motorola\MotoConnectService\MotoConnect.exe

.

**************************************************************************

.

Completion time: 2010-12-24 10:58:59 - machine was rebooted

ComboFix-quarantined-files.txt 2010-12-24 15:58

Pre-Run: 200,903,340,032 bytes free

Post-Run: 201,112,100,864 bytes free

- - End Of File - - 3DF993B766D0F887FB897619A918C9EA

Please do not attach the scan results from Combofx. Use copy/paste.
DO NOT use any TOOLS such as Combofix, or HijackThis fixes without supervision.
Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.
Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")
Stay with this topic until I give you the all clean post.
You might want to print these instructions out.
I suggest you do this:
XP Users
Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.
Vista Users
To enable the viewing of hidden and protected system files in Windows Vista please follow these steps:
Close all programs so that you are at your desktop.
Click on the Start button. This is the small round button with the Windows flag in the lower left corner.
Click on the Control Panel menu option.
When the control panel opens you can either be in Classic View or Control Panel Home view:
If you are in the Classic View do the following:
Double-click on the Folder Options icon.
Click on the View tab.
If you are in the Control Panel Home view do the following:
Click on the Appearance and Personalization link.
Click on Show Hidden Files or Folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.
Please do not delete anything unless instructed to.
Next:
Please download ATF Cleaner by Atribune.
Download - ATF Cleaner

LDTate · December 24, 2010

Good job

The following will implement some cleanup procedures as well as reset System Restore points:

For XP:

Click START run
Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.

For Vista / Windows 7

Click START Search
Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.

If you used DeFogger

To re-enable your Emulation drivers, double click DeFogger to run the tool.

The application window will appear
Click the Re-enable button to re-enable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.

Here's my usual all clean post

To be on the safe side, I would also change all my passwords.

This infection appears to have been cleaned, but as the malware could be configured to run any program a remote attacker requires, it's impossible to be 100% sure that any machine is clean.

Log looks good :lol:

Make your Internet Explorer more secure - This can be done by following these simple instructions:
1. From within Internet Explorer click on the Tools menu and then click on Options.
2. Click once on the Security tab
3. Click once on the Internet icon so it becomes highlighted.
4. Click once on the Custom Level button.
5. Change the Download signed ActiveX controls to Prompt
6. Change the Download unsigned ActiveX controls to Disable
7. Change the Initialize and script ActiveX controls not marked as safe to Disable
8. Change the Installation of desktop items to Prompt
9. Change the Launching programs and files in an IFRAME to Prompt
10. Change the Navigate sub-frames across different domains to Prompt
11. When all these settings have been made, click on the OK button.
12. If it prompts you as to whether or not you want to save the settings, press the Yes button.
13. Next press the Apply button and then the OK to exit the Internet Properties page.
[*]Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
[*]Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.
[*] WOT , Web of Trust, As 'Googling' is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
Green to go
Yellow for caution
Red to stop
WOT has an addon available for both Firefox and IE.
[*]Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
This will ensure your computer has always the latest security updates available installed on your computer.
If there are new updates to install, install them immediately, reboot your computer, and revisit the site
until there are no more critical updates.

Only run one Anti-Virus and Firewall program.

I would suggest you read:

PC Safety and Security--What Do I Need?.

How to Prevent Malware:

michelazul · December 24, 2010

Thank you!

Good job
The following will implement some cleanup procedures as well as reset System Restore points:
For XP:
Click START run
Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
For Vista / Windows 7
Click START Search
Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
If you used DeFogger
To re-enable your Emulation drivers, double click DeFogger to run the tool.
The application window will appear
Click the Re-enable button to re-enable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.
Your Emulation drivers are now re-enabled.
Here's my usual all clean post
To be on the safe side, I would also change all my passwords.
This infection appears to have been cleaned, but as the malware could be configured to run any program a remote attacker requires, it's impossible to be 100% sure that any machine is clean.
Log looks good
Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.
[*]Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
[*]Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.
[*] WOT , Web of Trust, As 'Googling' is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
Green to go
Yellow for caution
Red to stop
WOT has an addon available for both Firefox and IE.
[*]Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
This will ensure your computer has always the latest security updates available installed on your computer.
If there are new updates to install, install them immediately, reboot your computer, and revisit the site
until there are no more critical updates.
Only run one Anti-Virus and Firewall program.
I would suggest you read:
PC Safety and Security--What Do I Need?.
How to Prevent Malware:

LDTate · December 24, 2010

You're more than welcome.

Glad we were able to help

Peace be with you

LDTate · December 26, 2010

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.

Sign In

worried about keystroke logger malware

Recommended Posts

michelazul

Link to post

Share on other sites

LDTate

Link to post

Share on other sites

michelazul

Link to post

Share on other sites

LDTate

Link to post

Share on other sites

michelazul

Link to post

Share on other sites

LDTate

Link to post

Share on other sites

LDTate

Link to post

Share on other sites

Recently Browsing 0 members

Browse

Activity

Personal

Business

Business Modules

Partners

Learn

Start here

Type of malware/attacks

How does it get on my computer?

Scams and grifts

Support

Important Information