Virus sur l'ordinateur

Bonjour,
J'ai téléchargé un point .Exe sur mon PC que j'ai d abord fait analyser par avast avant de le lancer.
je l'ai executé mais il a apparemment installé un vers ou un virus sur mon ordinateur.
depuis il m'est impossible de me connecter sur le site de comment ca marche et j'ai souvent un renvoi vers un site apellé porntube .......

de plus j ai fait une analyse complete anti virus par avast, il m'a trouvé quelques virus dont il a detruit les fichiers.

j ai également fait une analyse anti trojan a l'aide de spybot-sd, il a trouvé quelques trojan que j'ai supprimé.

j'ai fait une analyse avec hijackthis mais je ne sais pas comment transferer le fichier sans risquer de corrompre cet ordinateur portable ....

je vais quand meme vous mettre le point txt créé par hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:19:32, on 12/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

--
End of file - 3879 bytes
Configuration: Windows XP
Firefox 3.0.1

10 réponses

  1. Contributeur sécurité
    On va utiliser Combofix pour finir la désinfection. Attention, ce logiciel est très puissant, une mauvaise utilisation peut faire des dégâts...

    Fais exactement ce qui suit :

    Télécharge ComboFix (de sUBs) sur ton Bureau (et pas ailleurs !) :
    Fais un clic droit sur ce lien et choisis "enregistrer la cible sous ... " : dans la fenêtre qui s'ouvre tape C-Fix, choisis le bureau comme destination et valide : http://download.bleepingcomputer.com/sUBs/ComboFix.exe

    --------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
    !! déconnecte toi, ferme toutes tes applications en cours et DESACTIVE TOUTES TES DEFENCES (anti-virus, antispyware, pare-feu) le temps de la manipulation : en effet , activés, ils pourraient gêner fortement la procédure de recherche et de nettoyage de l'outil ( voir planter le PC )...Tu les réactiveras donc après !!
    Dans ton cas, il s'agit d'Avast et ton pare-feu Kerio

    ---> Surtout, si tu rencontres des difficultés à ce niveau là, dis le moi avant de poursuivre...

    Tuto ici : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
    ---------------------------------------------------------------------------------------------------------------------------------

    Ensuite :
    double-clique sur C-Fix.exe (= combofix.exe ) .

    Appuie sur une touche pour démarrer le scan .

    Attention : n'utilise pas ta souris ni ton clavier pendant que le programme tourne. Cela pourrait figer l'ordi ---> si un message d'erreur windows apparait à un moment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer

    Le rapport sera crée dans: C:\Combofix.txt , poste le ici stp

    1
    1. Contributeur sécurité
      Ok, peux-tu poster un nouveau rapport hijackthis stp ?
      1
      1. Contributeur sécurité
        Bonjour anakin661,

        Voila ce qui arrive quand on fait trop confiance à son antivirus (surtout Avast qui est médiocre...)

        Ton rapport hijackthis est très court, l'infection a probablement masqué des lignes...

        Télécharge et installe Malwarebyte's Anti-Malware : http://www.malwarebytes.org/mbam/program/mbam-setup.exe
        - A la fin de l'installation, veille à ce que l'option « mettre a jour Malwarebyte's Anti-Malware » soit cochée
        - Lance Malwarebyte's Anti-Malware, laisse les Mises à jour se télécharger et referme le programme

        Redémarre en "Mode sans échec" : redémarre ton ordinateur et tapote sur la touche F8 jusqu'à l'affichage du menu des options avancées de Windows, et sélectionne "Mode sans échec". Choisis ta session habituelle

        Lance Malwarebyte's Anti-Malware
        - Puis va dans l'onglet "Recherche", coche "Exécuter un examen complet" puis "Rechercher"
        - Sélectionne tes disques durs" puis clique sur "Lancer l’examen"
        - A la fin du scan, clique sur Afficher les résultats puis sur Enregistrer le rapport
        - Suppression des éléments détectés --> clique sur Supprimer la sélection
        - S'il t'es demandé de redémarrer, clique sur Yes

        Poste le rapport de scan après la suppression ici

        -1
        1. Voila aprés un scan trés long, j'ai eu ceci comme rapport, Y a t il encore quelque chose que je doive faire ?

          ---------------------------------------------------------------------------------------------------------------------------------------------------

          Malwarebytes' Anti-Malware 1.28
          Version de la base de données: 1141
          Windows 5.1.2600 Service Pack 2

          12/09/2008 16:09:52
          mbam-log-2008-09-12 (16-09-52).txt

          Type de recherche: Examen complet (C:\|F:\|G:\|)
          Eléments examinés: 219270
          Temps écoulé: 1 hour(s), 2 minute(s), 7 second(s)

          Processus mémoire infecté(s): 0
          Module(s) mémoire infecté(s): 0
          Clé(s) du Registre infectée(s): 6
          Valeur(s) du Registre infectée(s): 0
          Elément(s) de données du Registre infecté(s): 2
          Dossier(s) infecté(s): 1
          Fichier(s) infecté(s): 21

          Processus mémoire infecté(s):
          (Aucun élément nuisible détecté)

          Module(s) mémoire infecté(s):
          (Aucun élément nuisible détecté)

          Clé(s) du Registre infectée(s):
          HKEY_CLASSES_ROOT\xml.xml (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\TypeLib\{9233c3c0-1472-4091-a505-5580a23bb4ac} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\CLSID\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          HKEY_CLASSES_ROOT\xml.xml.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.

          Valeur(s) du Registre infectée(s):
          (Aucun élément nuisible détecté)

          Elément(s) de données du Registre infecté(s):
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Malware.Trace) -> Data: c:\windows\system32\ -> Quarantined and deleted successfully.
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Malware.Trace) -> Data: system32\ -> Quarantined and deleted successfully.

          Dossier(s) infecté(s):
          C:\Program Files\Helper (Adware.BHO) -> Quarantined and deleted successfully.

          Fichier(s) infecté(s):
          C:\WINDOWS\system32\msxml71.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          C:\Documents and Settings\Renaud\Local Settings\Temp\D6.tmp (Rogue.Installer) -> Quarantined and deleted successfully.
          C:\WINDOWS\system32\ (Malware.Trace) -> Quarantined and deleted successfully.
          C:\WINDOWS\system32\casino1.ico (Malware.Trace) -> Quarantined and deleted successfully.
          C:\WINDOWS\system32\casino2.ico (Malware.Trace) -> Quarantined and deleted successfully.
          C:\WINDOWS\system32\casino3.ico (Malware.Trace) -> Quarantined and deleted successfully.
          C:\Program Files\SAV\sav0.dat (Rogue.SystemAntivirus) -> Quarantined and deleted successfully.
          C:\Program Files\SAV\sav1.dat (Rogue.SystemAntivirus) -> Quarantined and deleted successfully.
          C:\Program Files\SAV\sav.ooo (Rogue.SystemAntivirus) -> Quarantined and deleted successfully.
          C:\WINDOWS\system32\tdssadw.dll (Trojan.Agent) -> Delete on reboot.
          C:\WINDOWS\system32\tdssl.dll (Trojan.Agent) -> Delete on reboot.
          C:\WINDOWS\system32\tdssmain.dll (Trojan.Agent) -> Delete on reboot.
          C:\WINDOWS\system32\tdssinit.dll (Trojan.Agent) -> Delete on reboot.
          C:\WINDOWS\system32\tdsslog.dll (Trojan.Agent) -> Delete on reboot.
          C:\WINDOWS\system32\tdssservers.dat (Trojan.Agent) -> Delete on reboot.
          C:\WINDOWS\system32\drivers\tdssserv.sys (Trojan.Agent) -> Delete on reboot.
          C:\WINDOWS\gwgzcy.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          C:\WINDOWS\gvwjxr.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          C:\WINDOWS\gntkqu.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          C:\WINDOWS\gmucjk.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          C:\WINDOWS\mywallpaper.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
          -1
          1. Contributeur sécurité
            Peux-tu poster un nouveau rapport hijacthis stp ?
            -1
            1. voila
              ======================================

              Logfile of Trend Micro HijackThis v2.0.2
              Scan saved at 16:17:04, on 12/09/2008
              Platform: Windows XP SP2 (WinNT 5.01.2600)
              MSIE: Internet Explorer v7.00 (7.00.6000.16705)
              Boot mode: Normal

              Running processes:
              C:\WINDOWS\System32\smss.exe
              C:\WINDOWS\system32\winlogon.exe
              C:\WINDOWS\system32\services.exe
              C:\WINDOWS\system32\lsass.exe
              C:\WINDOWS\system32\svchost.exe
              C:\WINDOWS\System32\svchost.exe
              C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
              C:\Program Files\Alwil Software\Avast4\ashServ.exe
              C:\WINDOWS\system32\spoolsv.exe
              C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
              C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
              C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
              C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
              C:\WINDOWS\system32\nvsvc32.exe
              C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
              C:\WINDOWS\system32\svchost.exe
              C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
              C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
              C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
              C:\WINDOWS\system32\wuauclt.exe
              C:\WINDOWS\Explorer.EXE
              C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
              C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
              C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
              C:\WINDOWS\system32\ctfmon.exe
              C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
              C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
              C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

              O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
              O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
              O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
              O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
              O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
              O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
              O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
              O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
              O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
              O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
              O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
              O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
              O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
              O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
              O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
              O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
              O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
              O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
              O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
              O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
              -1
              1. Voila le log de combo

                ========================================================

                ComboFix 08-09-10.04 - Renaud 2008-09-12 17:31:08.4 - NTFSx86
                Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1084 [GMT 2:00]
                Endroit: C:\Documents and Settings\Renaud\Bureau\ComboFix.exe
                .

                (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                .
                .
                ---- Previous Run -------
                .
                C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
                C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
                C:\Documents and Settings\celine\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
                C:\WINDOWS\system32\tdsspopup.dll
                C:\WINDOWS\system32\tdsspopup1.url
                C:\WINDOWS\system32\tdsspopup2.url
                C:\WINDOWS\system32\tdsspopup3.url

                .
                ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
                .

                -------\Legacy_TDSSSERV
                -------\Service_TDSSserv

                ((((((((((((((((((((((((((((( Fichiers créés 2008-08-12 to 2008-09-12 ))))))))))))))))))))))))))))))))))))
                .

                2008-09-12 16:38 . 2008-07-16 09:57 269,736 -ra------ C:\WINDOWS\system32\drivers\SbFw.sys
                2008-09-12 16:38 . 2008-06-21 04:54 65,576 --a------ C:\WINDOWS\system32\drivers\SbFwIm.sys
                2008-09-12 14:50 . 2008-09-12 14:50 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
                2008-09-12 14:50 . 2008-09-12 14:50 <REP> d-------- C:\Documents and Settings\Renaud\Application Data\Malwarebytes
                2008-09-12 14:50 . 2008-09-12 14:50 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
                2008-09-12 14:50 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
                2008-09-12 14:50 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
                2008-09-11 19:42 . 2008-09-11 19:42 <REP> d-------- C:\Program Files\Electronic Arts
                2008-09-11 18:12 . 2008-09-12 16:09 <REP> d-------- C:\Program Files\SAV
                2008-09-06 09:08 . 2008-09-06 09:08 <REP> d-------- C:\Documents and Settings\celine\Application Data\Nero
                2008-09-06 03:12 . 2008-09-10 11:08 <REP> d-------- C:\Documents and Settings\Nouveau dossier\[u]0/u9Septembre2008
                2008-09-05 17:26 . 2008-09-05 17:26 <REP> d-------- C:\Program Files\Real Alternative
                2008-09-05 11:38 . 2008-09-05 11:39 <REP> d-------- C:\Program Files\OpenOffice.org 2.4
                2008-09-05 01:02 . 2008-09-05 01:02 <REP> d-------- C:\Games
                2008-08-29 15:22 . 2008-09-05 18:19 69 --a------ C:\WINDOWS\NeroDigital.ini
                2008-08-29 14:43 . 2008-08-29 14:44 60 --a------ C:\WINDOWS\RESULT.QTW
                2008-08-29 14:07 . 2008-08-29 14:07 <REP> d-------- C:\Program Files\FileZilla FTP Client
                2008-08-29 14:07 . 2008-09-04 20:05 <REP> d-------- C:\Documents and Settings\Renaud\Application Data\FileZilla
                2008-08-29 11:27 . 2008-08-29 11:27 <REP> d-------- C:\Program Files\DriverMagic
                2008-08-29 11:27 . 2008-08-29 11:29 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SymplisIT
                2008-08-29 10:20 . 2008-08-29 10:20 <REP> d-------- C:\Program Files\Nero
                2008-08-29 10:20 . 2008-08-29 10:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero
                2008-08-26 10:51 . 2008-08-31 22:03 <REP> d-------- C:\Documents and Settings\Renaud\Application Data\Azureus
                2008-08-26 10:51 . 2008-08-26 10:51 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Azureus
                2008-08-26 10:50 . 2008-08-26 10:51 <REP> d-------- C:\Program Files\Vuze
                2008-08-26 10:49 . 2008-08-26 10:49 <REP> d-------- C:\Documents and Settings\Renaud\Temp
                2008-08-22 02:11 . 2008-08-22 02:11 <REP> d-------- C:\Documents and Settings\Renaud\Application Data\Sony Online Entertainment
                2008-08-22 01:24 . 2008-08-22 01:24 <REP> d-------- C:\Program Files\VideoLAN
                2008-08-21 12:00 . 2008-08-21 12:00 305,664 --a------ C:\Documents and Settings\Nouveau dossier\Xtremsplit.exe
                2008-08-21 02:55 . 2008-08-21 02:55 <REP> d-------- C:\Documents and Settings\Renaud\Application Data\MPEG Streamclip
                2008-08-12 16:54 . 2008-08-12 16:57 3,326,400 --a------ C:\s2fo.2
                2008-08-12 16:54 . 2008-08-12 16:57 3,326,400 --a------ C:\s2fo.1
                2008-08-12 16:54 . 2008-08-12 16:57 3,326,400 --a------ C:\s2fo

                .
                (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                .
                2008-09-12 15:27 --------- d-----w C:\Documents and Settings\Renaud\Application Data\OpenOffice.org2
                2008-09-12 15:03 --------- d-----w C:\Program Files\Spybot - Search & Destroy
                2008-09-12 15:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
                2008-09-12 14:29 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
                2008-09-12 12:53 658 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
                2008-09-11 17:38 --------- d-----w C:\Documents and Settings\Renaud\Application Data\uTorrent
                2008-09-10 13:55 --------- d-----w C:\Program Files\Mozilla Thunderbird
                2008-09-09 18:28 --------- d-----w C:\Program Files\StarWarsGalaxies
                2008-09-05 09:38 --------- d-----w C:\Program Files\OpenOffice.org 2.3
                2008-09-05 09:36 --------- d-----w C:\Program Files\Java
                2008-08-29 08:20 --------- d-----w C:\Program Files\Fichiers communs\Nero
                2008-08-24 18:25 --------- d-----w C:\Program Files\Sony
                2008-08-21 23:41 --------- d-----w C:\Documents and Settings\Renaud\Application Data\vlc
                2008-07-21 14:04 --------- d-----w C:\Documents and Settings\celine\Application Data\Winamp
                2008-07-21 13:58 --------- d-----w C:\Documents and Settings\celine\Application Data\Media Player Classic
                2008-07-21 13:58 --------- d-----w C:\Documents and Settings\celine\Application Data\CyberLink
                2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
                2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
                2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
                2008-06-23 16:28 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
                2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
                2008-04-24 18:54 596 ----a-w C:\Program Files\mpc1.reg
                2008-04-24 18:54 3,476 ----a-w C:\Program Files\mpc7.reg
                2008-04-24 18:54 3,026 ----a-w C:\Program Files\mpc3.reg
                2008-04-24 18:54 18,156 ----a-w C:\Program Files\mpc6.reg
                2008-04-24 18:54 16,150 ----a-w C:\Program Files\mpc5.reg
                2008-04-24 18:54 1,658 ----a-w C:\Program Files\ffdssetts.reg
                2008-04-24 18:54 1,646 ----a-w C:\Program Files\mpc4.reg
                2008-04-24 18:54 1,292 ----a-w C:\Program Files\ffdsasetts.reg
                2008-04-24 18:52 4,688 ----a-w C:\Program Files\satsukidecodersettings.ini
                2008-01-22 18:40 16 ---ha-w C:\Program Files\mxfilerelatedcache.mxc2
                2008-01-25 16:53 594,944 ----a-w C:\Program Files\mozilla firefox\plugins\MannequinPlayer2.dll
                .

                ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
                .
                .
                *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                REGEDIT4

                [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                "LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2004-06-01 196608]
                "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                "EPSON Stylus Photo RX420 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE" [2004-04-09 98304]
                "NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
                "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]

                C:\Documents and Settings\Renaud\Menu D‚marrer\Programmes\D‚marrage\
                OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]

                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                "msacm.enc"= ITIG726.acm

                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                "EnableFirewall"= 0 (0x0)

                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                "%windir%\\system32\\sessmgr.exe"=
                "C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
                "C:\\Program Files\\uTorrent\\uTorrent.exe"=
                "C:\\Program Files\\Messenger\\msmsgs.exe"=
                "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
                "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
                "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
                "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
                "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"=
                "C:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe"=
                "C:\\Program Files\\Freeplayer\\vlc\\vlc.exe"=
                "C:\\Program Files\\StarWarsGalaxies\\SwgClient_r.exe"=

                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

                R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
                R1 SbFw;SbFw;C:\WINDOWS\system32\drivers\SbFw.sys [2008-07-16 269736]
                R1 sbhips;Sunbelt HIPS Driver;C:\WINDOWS\system32\drivers\sbhips.sys [2008-06-21 66600]
                R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
                R2 fssfltr;FssFltr;C:\WINDOWS\system32\DRIVERS\fssfltr.sys [2007-10-17 43816]
                R2 fsssvc;Windows Live OneCare Contrôle parental;C:\Program Files\Windows Live\Contrôle parental\fsssvc.exe [2007-12-17 523816]
                R2 SbPF.Launcher;SbPF.Launcher;C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [2008-07-30 95528]
                R2 SPF4;Sunbelt Personal Firewall 4;C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [2008-07-30 1361192]
                R3 PhilCam8116_XP;Logitech QuickCam Pro 3000(PID_08B1);C:\WINDOWS\system32\DRIVERS\CamDrL20.sys [2004-05-21 245760]
                R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;C:\WINDOWS\system32\DRIVERS\sbfwim.sys [2008-06-21 65576]
                S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 1527900]

                *Newly Created Service* - ASWUPDSV
                *Newly Created Service* - AVAST!_MAIL_SCANNER
                *Newly Created Service* - AVAST!_WEB_SCANNER
                .
                Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
                .
                .
                ------- Supplementary Scan -------
                .
                FireFox -: Profile - C:\Documents and Settings\Renaud\Application Data\Mozilla\Firefox\Profiles\m0z3v94x.default\
                FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://famille.maydat.free.fr/
                FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npredoute.dll
                .

                **************************************************************************

                catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                Rootkit scan 2008-09-12 17:36:57
                Windows 5.1.2600 Service Pack 2 NTFS

                Balayage processus cachés ...

                Balayage caché autostart entries ...

                Balayage des fichiers cachés ...

                Scan terminé avec succès
                Les fichiers cachés: 0

                **************************************************************************
                .
                Temps d'accomplissement: 2008-09-12 17:39:41
                ComboFix-quarantined-files.txt 2008-09-12 15:39:34

                Pre-Run: 434,722,799,616 octets libres
                Post-Run: 434,712,281,088 octets libres

                165 --- E O F --- 2008-09-10 01:01:27
                -1
                1. Quelqu'un pourrait'il finir de repondre a mon sujet pls ?
                  -1
                  1. Contributeur sécurité
                    Un peu de patience...

                    Toujours avec toutes les protections désactivées, fais ceci :

                    Ouvre le bloc-notes (Menu démarrer --> programmes --> accessoires --> bloc-notes)
                    Copie/colle dans le bloc-notes ce qui entre les lignes ci dessous (sans les lignes) :

                    ----------------------------------------------------------
                    File::
                    C:\WINDOWS\RESULT.QTW
                    C:\s2fo.2
                    C:\s2fo.1
                    C:\s2fo

                    Folder::
                    C:\Program Files\SAV
                    C:\s2fo.2
                    C:\s2fo.1
                    C:\s2fo

                    ------------------------------------------------------------------

                    - Enregistre ce fichier sur ton bureau (et pas ailleurs !) sous le nom CFScript.txt
                    - Quitte le Bloc Notes

                    · Fais un glisser/déposer de ce fichier CFScript sur le fichier C-Fix.exe (combofix) comme sur ce lien :
                    http://img.photobucket.com/albums/v666/sUBs/CFScript.gif

                    * Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort), tape 1 puis valide.
                    * Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
                    Ne touche à rien tant que le scan n'est pas terminé.
                    * Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
                    * Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
                    -1
                    1. ComboFix 08-09-16.05 - Renaud 2008-09-17 23:37:32.5 - NTFSx86
                      Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.1081 [GMT 2:00]
                      Lancé depuis: C:\Documents and Settings\Renaud\Bureau\ComboFix.exe
                      Command switches used :: C:\Documents and Settings\Renaud\Bureau\CFScript.txt
                      * Un nouveau point de restauration a été créé
                      .

                      (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                      .

                      C:\Program Files\SAV
                      C:\s2fo
                      C:\s2fo.1
                      C:\s2fo.1\
                      C:\s2fo.2
                      C:\s2fo.2\
                      C:\s2fo\
                      C:\WINDOWS\RESULT.QTW

                      .
                      ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
                      .

                      -------\Legacy_TDSSSERV
                      -------\Service_TDSSserv

                      ((((((((((((((((((((((((((((( Fichiers cr‚‚s du 2008-08-17 au 2008-09-17 ))))))))))))))))))))))))))))))))))))
                      .

                      2008-09-15 21:47 . 2008-09-15 21:47 <REP> d-------- C:\WINDOWS\system32\fr
                      2008-09-15 21:47 . 2008-09-15 21:47 <REP> d-------- C:\WINDOWS\system32\bits
                      2008-09-15 21:47 . 2008-09-15 21:47 <REP> d-------- C:\WINDOWS\l2schemas
                      2008-09-15 21:23 . 2008-09-15 21:52 <REP> d-------- C:\WINDOWS\ServicePackFiles
                      2008-09-12 20:05 . 2008-09-12 20:05 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SimCity Societies
                      2008-09-12 20:04 . 2008-07-12 08:18 3,851,784 --a------ C:\WINDOWS\system32\D3DX9_39.dll
                      2008-09-12 20:03 . 2008-09-12 20:03 <REP> d-------- C:\WINDOWS\Logs
                      2008-09-12 20:02 . 2008-09-12 20:02 <REP> d-------- C:\Program Files\directX
                      2008-09-12 18:36 . 2008-09-12 18:36 <REP> d-------- C:\Program Files\Avira
                      2008-09-12 18:36 . 2008-09-12 18:36 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
                      2008-09-12 18:06 . 2008-07-16 09:57 269,736 -ra------ C:\WINDOWS\system32\drivers\SbFw.sys
                      2008-09-12 18:06 . 2008-06-21 04:54 65,576 --a------ C:\WINDOWS\system32\drivers\SbFwIm.sys
                      2008-09-12 14:50 . 2008-09-12 14:50 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
                      2008-09-12 14:50 . 2008-09-12 14:50 <REP> d-------- C:\Documents and Settings\Renaud\Application Data\Malwarebytes
                      2008-09-12 14:50 . 2008-09-12 14:50 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
                      2008-09-12 14:50 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
                      2008-09-12 14:50 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
                      2008-09-11 19:42 . 2008-09-11 19:42 <REP> d-------- C:\Program Files\Electronic Arts
                      2008-09-06 09:08 . 2008-09-06 09:08 <REP> d-------- C:\Documents and Settings\celine\Application Data\Nero
                      2008-09-06 03:12 . 2008-09-17 23:06 <REP> d-------- C:\Documents and Settings\Nouveau dossier\[u]0/u9Septembre2008
                      2008-09-05 17:26 . 2008-09-05 17:26 <REP> d-------- C:\Program Files\Real Alternative
                      2008-09-05 11:38 . 2008-09-05 11:39 <REP> d-------- C:\Program Files\OpenOffice.org 2.4
                      2008-09-05 01:02 . 2008-09-05 01:02 <REP> d-------- C:\Games
                      2008-08-29 15:22 . 2008-09-05 18:19 69 --a------ C:\WINDOWS\NeroDigital.ini
                      2008-08-29 14:07 . 2008-08-29 14:07 <REP> d-------- C:\Program Files\FileZilla FTP Client
                      2008-08-29 14:07 . 2008-09-04 20:05 <REP> d-------- C:\Documents and Settings\Renaud\Application Data\FileZilla
                      2008-08-29 11:27 . 2008-08-29 11:27 <REP> d-------- C:\Program Files\DriverMagic
                      2008-08-29 11:27 . 2008-08-29 11:29 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SymplisIT
                      2008-08-29 10:20 . 2008-08-29 10:20 <REP> d-------- C:\Program Files\Nero
                      2008-08-29 10:20 . 2008-08-29 10:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero
                      2008-08-26 10:51 . 2008-08-31 22:03 <REP> d-------- C:\Documents and Settings\Renaud\Application Data\Azureus
                      2008-08-26 10:51 . 2008-08-26 10:51 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Azureus
                      2008-08-26 10:50 . 2008-08-26 10:51 <REP> d-------- C:\Program Files\Vuze
                      2008-08-26 10:49 . 2008-08-26 10:49 <REP> d-------- C:\Documents and Settings\Renaud\Temp
                      2008-08-22 02:11 . 2008-08-22 02:11 <REP> d-------- C:\Documents and Settings\Renaud\Application Data\Sony Online Entertainment
                      2008-08-22 01:24 . 2008-08-22 01:24 <REP> d-------- C:\Program Files\VideoLAN
                      2008-08-21 12:00 . 2008-08-21 12:00 305,664 --a------ C:\Documents and Settings\Nouveau dossier\Xtremsplit.exe
                      2008-08-21 02:55 . 2008-08-21 02:55 <REP> d-------- C:\Documents and Settings\Renaud\Application Data\MPEG Streamclip

                      .
                      (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                      .
                      2008-09-17 21:30 --------- d-----w C:\Documents and Settings\Renaud\Application Data\OpenOffice.org2
                      2008-09-17 21:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
                      2008-09-17 21:00 --------- d-----w C:\Program Files\Spybot - Search & Destroy
                      2008-09-17 13:39 --------- d-----w C:\Program Files\Mozilla Thunderbird
                      2008-09-12 14:29 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
                      2008-09-12 12:53 658 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
                      2008-09-11 17:38 --------- d-----w C:\Documents and Settings\Renaud\Application Data\uTorrent
                      2008-09-09 18:28 --------- d-----w C:\Program Files\StarWarsGalaxies
                      2008-09-05 09:38 --------- d-----w C:\Program Files\OpenOffice.org 2.3
                      2008-09-05 09:36 --------- d-----w C:\Program Files\Java
                      2008-08-29 08:20 --------- d-----w C:\Program Files\Fichiers communs\Nero
                      2008-08-24 18:25 --------- d-----w C:\Program Files\Sony
                      2008-08-21 23:41 --------- d-----w C:\Documents and Settings\Renaud\Application Data\vlc
                      2008-07-21 14:04 --------- d-----w C:\Documents and Settings\celine\Application Data\Winamp
                      2008-07-21 13:58 --------- d-----w C:\Documents and Settings\celine\Application Data\Media Player Classic
                      2008-07-21 13:58 --------- d-----w C:\Documents and Settings\celine\Application Data\CyberLink
                      2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
                      2008-04-24 18:54 596 ----a-w C:\Program Files\mpc1.reg
                      2008-04-24 18:54 3,476 ----a-w C:\Program Files\mpc7.reg
                      2008-04-24 18:54 3,026 ----a-w C:\Program Files\mpc3.reg
                      2008-04-24 18:54 18,156 ----a-w C:\Program Files\mpc6.reg
                      2008-04-24 18:54 16,150 ----a-w C:\Program Files\mpc5.reg
                      2008-04-24 18:54 1,658 ----a-w C:\Program Files\ffdssetts.reg
                      2008-04-24 18:54 1,646 ----a-w C:\Program Files\mpc4.reg
                      2008-04-24 18:54 1,292 ----a-w C:\Program Files\ffdsasetts.reg
                      2008-04-24 18:52 4,688 ----a-w C:\Program Files\satsukidecodersettings.ini
                      2008-01-22 18:40 16 ---ha-w C:\Program Files\mxfilerelatedcache.mxc2
                      2008-01-25 16:53 594,944 ----a-w C:\Program Files\mozilla firefox\plugins\MannequinPlayer2.dll
                      .

                      ((((((((((((((((((((((((((((( snapshot@2008-09-12_17.38.16.37 )))))))))))))))))))))))))))))))))))))))))
                      .
                      - 2004-08-19 15:09:34 82,944 -c----w C:\WINDOWS\$NtUninstallKB946648$\msgsc.dll
                      + 2004-08-19 15:09:34 82,944 -c----w C:\WINDOWS\$NtUninstallKB946648_0$\msgsc.dll
                      + 2007-11-30 12:39:29 234,872 -c----w C:\WINDOWS\$NtUninstallKB946648_0$\spuninst\spuninst.exe
                      + 2007-11-30 12:39:31 406,392 -c----w C:\WINDOWS\$NtUninstallKB946648_0$\spuninst\updspapi.dll
                      - 2006-07-13 08:48:58 202,240 -c----w C:\WINDOWS\$NtUninstallKB950762$\rmcast.sys
                      + 2006-07-13 08:48:58 202,240 -c----w C:\WINDOWS\$NtUninstallKB950762_0$\rmcast.sys
                      + 2007-11-30 12:39:29 234,872 -c----w C:\WINDOWS\$NtUninstallKB950762_0$\spuninst\spuninst.exe
                      + 2007-11-30 12:39:31 406,392 -c----w C:\WINDOWS\$NtUninstallKB950762_0$\spuninst\updspapi.dll
                      - 2005-07-26 04:39:57 243,200 -c----w C:\WINDOWS\$NtUninstallKB950974$\es.dll
                      + 2005-07-26 04:39:57 243,200 -c----w C:\WINDOWS\$NtUninstallKB950974_0$\es.dll
                      + 2007-11-30 12:39:29 234,872 -c----w C:\WINDOWS\$NtUninstallKB950974_0$\spuninst\spuninst.exe
                      + 2007-11-30 12:39:29 406,392 -c----w C:\WINDOWS\$NtUninstallKB950974_0$\spuninst\updspapi.dll
                      - 2007-08-21 06:17:23 683,520 -c----w C:\WINDOWS\$NtUninstallKB951066$\inetcomm.dll
                      + 2007-08-21 06:17:23 683,520 -c----w C:\WINDOWS\$NtUninstallKB951066_0$\inetcomm.dll
                      + 2007-11-30 12:39:29 234,872 -c----w C:\WINDOWS\$NtUninstallKB951066_0$\spuninst\spuninst.exe
                      + 2007-11-30 12:39:31 406,392 -c----w C:\WINDOWS\$NtUninstallKB951066_0$\spuninst\updspapi.dll
                      - 2008-04-14 15:52:45 272,768 -c----w C:\WINDOWS\$NtUninstallKB951376-v2$\bthport.sys
                      + 2008-04-14 15:52:45 272,768 -c----w C:\WINDOWS\$NtUninstallKB951376-v2_0$\bthport.sys
                      + 2007-11-30 11:19:06 234,872 -c----w C:\WINDOWS\$NtUninstallKB951376-v2_0$\spuninst\spuninst.exe
                      + 2007-11-30 11:19:10 406,392 -c----w C:\WINDOWS\$NtUninstallKB951376-v2_0$\spuninst\updspapi.dll
                      + 2007-11-30 11:19:06 234,872 -c----w C:\WINDOWS\$NtUninstallKB951376_0$\spuninst\spuninst.exe
                      + 2007-11-30 11:19:10 406,392 -c----w C:\WINDOWS\$NtUninstallKB951376_0$\spuninst\updspapi.dll
                      - 2007-10-29 22:43:32 1,293,824 -c----w C:\WINDOWS\$NtUninstallKB951698$\quartz.dll
                      + 2007-10-29 22:43:32 1,293,824 -c----w C:\WINDOWS\$NtUninstallKB951698_0$\quartz.dll
                      + 2007-11-30 11:19:06 234,872 -c----w C:\WINDOWS\$NtUninstallKB951698_0$\spuninst\spuninst.exe
                      + 2007-11-30 12:39:31 406,392 -c----w C:\WINDOWS\$NtUninstallKB951698_0$\spuninst\updspapi.dll
                      - 2004-08-03 22:14:16 138,496 -c----w C:\WINDOWS\$NtUninstallKB951748$\afd.sys
                      - 2008-02-20 05:35:05 148,992 -c----w C:\WINDOWS\$NtUninstallKB951748$\dnsapi.dll
                      - 2004-08-03 23:54:36 247,808 -c----w C:\WINDOWS\$NtUninstallKB951748$\mswsock.dll
                      - 2007-10-30 17:20:55 360,064 -c----w C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys
                      - 2006-08-16 09:37:30 225,664 -c----w C:\WINDOWS\$NtUninstallKB951748$\tcpip6.sys
                      + 2004-08-03 22:14:16 138,496 -c----w C:\WINDOWS\$NtUninstallKB951748_0$\afd.sys
                      + 2008-02-20 05:35:05 148,992 -c----w C:\WINDOWS\$NtUninstallKB951748_0$\dnsapi.dll
                      + 2004-08-03 23:54:36 247,808 -c----w C:\WINDOWS\$NtUninstallKB951748_0$\mswsock.dll
                      + 2007-11-30 12:39:29 234,872 -c----w C:\WINDOWS\$NtUninstallKB951748_0$\spuninst\spuninst.exe
                      + 2007-11-30 12:39:29 406,392 -c----w C:\WINDOWS\$NtUninstallKB951748_0$\spuninst\updspapi.dll
                      + 2007-10-30 17:20:55 360,064 -c----w C:\WINDOWS\$NtUninstallKB951748_0$\tcpip.sys
                      + 2006-08-16 09:37:30 225,664 -c----w C:\WINDOWS\$NtUninstallKB951748_0$\tcpip6.sys
                      - 2004-08-03 23:54:32 331,776 -c----w C:\WINDOWS\$NtUninstallKB952287$\msadce.dll
                      + 2004-08-03 23:54:32 331,776 -c----w C:\WINDOWS\$NtUninstallKB952287_0$\msadce.dll
                      + 2007-11-30 11:19:06 234,872 -c----w C:\WINDOWS\$NtUninstallKB952287_0$\spuninst\spuninst.exe
                      + 2007-11-30 11:19:10 406,392 -c----w C:\WINDOWS\$NtUninstallKB952287_0$\spuninst\updspapi.dll
                      - 2005-06-29 01:49:41 74,240 -c----w C:\WINDOWS\$NtUninstallKB952954$\mscms.dll
                      + 2005-06-29 01:49:41 74,240 -c----w C:\WINDOWS\$NtUninstallKB952954_0$\mscms.dll
                      + 2007-11-30 11:19:06 234,872 -c----w C:\WINDOWS\$NtUninstallKB952954_0$\spuninst\spuninst.exe
                      + 2007-11-30 12:39:31 406,392 -c----w C:\WINDOWS\$NtUninstallKB952954_0$\spuninst\updspapi.dll
                      + 2008-04-14 02:33:18 39,424 ------w C:\WINDOWS\AppPatch\acadproc.dll
                      - 2004-08-03 23:54:22 1,852,416 ----a-w C:\WINDOWS\AppPatch\AcGenral.dll
                      + 2008-04-14 02:33:18 1,852,928 ----a-w C:\WINDOWS\AppPatch\acgenral.dll
                      - 2004-08-03 23:54:22 450,048 ----a-w C:\WINDOWS\AppPatch\AcLayers.dll
                      + 2008-04-14 02:33:18 451,072 ----a-w C:\WINDOWS\AppPatch\aclayers.dll
                      - 2004-08-03 23:54:22 137,728 ----a-w C:\WINDOWS\AppPatch\AcLua.dll
                      + 2008-04-14 02:33:18 141,312 ----a-w C:\WINDOWS\AppPatch\aclua.dll
                      - 2004-08-03 23:54:22 244,736 ----a-w C:\WINDOWS\AppPatch\AcSpecfc.dll
                      + 2008-04-14 02:33:18 245,248 ----a-w C:\WINDOWS\AppPatch\acspecfc.dll
                      - 2004-08-03 23:54:22 116,224 ----a-w C:\WINDOWS\AppPatch\AcXtrnal.dll
                      + 2008-04-14 02:33:18 116,224 ----a-w C:\WINDOWS\AppPatch\acxtrnal.dll
                      + 2008-09-12 18:04:14 53,248 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
                      + 2008-09-12 18:04:15 12,800 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
                      + 2008-09-12 18:04:15 473,600 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
                      + 2008-09-12 18:04:11 2,676,224 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
                      + 2008-09-12 18:04:12 2,846,720 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
                      + 2008-09-12 18:04:12 563,712 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
                      + 2008-09-12 18:04:12 567,296 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
                      + 2008-09-12 18:04:13 576,000 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
                      + 2008-09-12 18:04:13 577,024 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
                      + 2008-09-12 18:04:13 577,536 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
                      + 2008-09-12 18:04:13 577,536 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
                      + 2008-09-12 18:04:14 578,560 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
                      + 2008-09-12 18:04:15 578,560 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
                      + 2008-09-12 18:04:15 145,920 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
                      + 2008-09-12 18:04:15 159,232 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
                      + 2008-09-12 18:04:15 364,544 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
                      + 2008-09-12 18:04:15 178,176 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
                      + 2008-09-12 18:04:14 223,232 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
                      - 2008-09-11 15:31:34 68,608 ----a-w C:\WINDOWS\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
                      + 2008-09-15 22:34:27 68,608 ----a-w C:\WINDOWS\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
                      - 2008-09-11 15:31:38 72,192 ----a-w C:\WINDOWS\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
                      + 2008-09-15 22:34:32 72,192 ----a-w C:\WINDOWS\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
                      - 2008-09-11 15:31:38 4,308,992 ----a-w C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
                      + 2008-09-15 22:34:32 4,308,992 ----a-w C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
                      - 2008-09-11 15:31:39 482,304 ----a-w C:\WINDOWS\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
                      + 2008-09-15 22:34:33 482,304 ----a-w C:\WINDOWS\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
                      - 2008-09-11 15:31:37 2,878,976 ----a-w C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
                      + 2008-09-15 22:34:30 2,902,016 ----a-w C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
                      - 2008-09-11 15:31:32 258,048 ----a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
                      + 2008-09-15 22:34:25 258,048 ----a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
                      - 2008-09-11 15:31:32 114,176 ----a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
                      + 2008-09-15 22:34:25 114,176 ----a-w C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
                      - 2008-09-11 15:31:41 260,096 ----a-w C:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
                      + 2008-09-15 22:34:35 260,096 ----a-w C:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
                      - 2008-09-11 15:31:35 5,025,792 ----a-w C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
                      + 2008-09-15 22:34:28 5,156,864 ----a-w C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
                      - 2008-09-11 15:31:34 10,752 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
                      + 2008-09-15 22:34:27 10,752 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
                      - 2008-09-11 15:31:32 503,808 ----a-w C:\WINDOWS\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
                      + 2008-09-15 22:34:25 507,904 ----a-w C:\WINDOWS\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
                      - 2008-09-11 15:31:33 13,312 ----a-w C:\WINDOWS\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
                      + 2008-09-15 22:34:26 13,312 ----a-w C:\WINDOWS\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
                      - 2008-09-11 15:31:37 8,192 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
                      + 2008-09-15 22:34:31 8,192 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
                      - 2008-09-11 15:31:38 36,864 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
                      + 2008-09-15 22:34:31 36,864 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
                      - 2008-09-11 15:31:38 5,632 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
                      + 2008-09-15 22:34:32 5,632 ----a-w C:\WINDOWS\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
                      - 2008-09-11 15:31:33 413,696 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
                      + 2008-09-15 22:34:26 413,696 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
                      - 2008-09-11 15:31:33 36,864 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
                      + 2008-09-15 22:34:26 36,864 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
                      - 2008-09-11 15:31:34 647,168 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
                      + 2008-09-15 22:34:27 647,168 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
                      - 2008-09-11 15:31:34 73,728 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
                      + 2008-09-15 22:34:27 73,728 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
                      - 2008-09-11 15:31:33 745,472 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
                      + 2008-09-15 22:34:26 749,568 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
                      - 2008-09-11 15:31:41 110,592 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
                      + 2008-09-15 22:34:35 110,592 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
                      - 2008-09-11 15:31:41 372,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
                      + 2008-09-15 22:34:35 372,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
                      - 2008-09-11 15:31:31 28,672 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
                      + 2008-09-15 22:34:25 28,672 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
                      - 2008-09-11 15:31:41 667,648 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
                      + 2008-09-15 22:34:35 667,648 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
                      - 2008-09-11 15:31:42 5,632 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
                      + 2008-09-15 22:34:35 5,632 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
                      - 2008-09-11 15:31:32 12,800 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
                      + 2008-09-15 22:34:25 12,800 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
                      - 2008-09-11 15:31:32 32,768 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
                      + 2008-09-15 22:34:25 32,768 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
                      - 2008-09-11 15:31:32 7,168 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
                      + 2008-09-15 22:34:25 7,168 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
                      - 2008-09-11 15:31:40 110,592 ----a-w C:\WINDOWS\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
                      + 2008-09-15 22:34:33 110,592 ----a-w C:\WINDOWS\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
                      - 2008-09-11 15:31:34 81,920 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
                      + 2008-09-15 22:34:27 81,920 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
                      - 2008-09-11 15:31:40 389,120 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
                      + 2008-09-15 22:34:34 413,696 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
                      - 2008-09-11 15:31:39 716,800 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
                      + 2008-09-15 22:34:33 716,800 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
                      - 2008-09-11 15:31:33 884,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
                      + 2008-09-15 22:34:26 888,832 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
                      - 2008-09-11 15:31:37 5,050,368 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
                      + 2008-09-15 22:34:30 5,001,216 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
                      - 2008-09-11 15:31:35 188,416 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
                      + 2008-09-15 22:34:28 188,416 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
                      - 2008-09-11 15:31:35 397,312 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
                      + 2008-09-15 22:34:28 397,312 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
                      - 2008-09-11 15:31:35 81,920 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
                      + 2008-09-15 22:34:28 81,920 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
                      - 2008-09-11 15:31:40 700,416 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
                      + 2008-09-15 22:34:34 577,536 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
                      - 2008-09-11 15:31:39 368,640 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
                      + 2008-09-15 22:34:33 372,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
                      - 2008-09-11 15:31:40 258,048 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
                      + 2008-09-15 22:34:34 258,048 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
                      - 2008-09-11 15:31:39 299,008 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
                      + 2008-09-15 22:34:33 299,008 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
                      - 2008-09-11 15:31:39 131,072 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
                      + 2008-09-15 22:34:33 131,072 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
                      - 2008-09-11 15:31:34 258,048 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
                      + 2008-09-15 22:34:27 258,048 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
                      - 2008-09-11 15:31:35 114,688 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
                      + 2008-09-15 22:34:28 114,688 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
                      - 2008-09-11 15:31:41 835,584 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
                      + 2008-09-15 22:34:35 835,584 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
                      - 2008-09-11 15:31:36 86,016 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
                      + 2008-09-15 22:34:29 86,016 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
                      - 2008-09-11 15:31:36 823,296 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
                      + 2008-09-15 22:34:29 823,296 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
                      - 2008-09-11 15:31:36 5,316,608 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
                      + 2008-09-15 22:34:29 5,152,768 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
                      - 2008-09-11 15:31:36 2,035,712 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
                      + 2008-09-15 22:34:30 2,027,520 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
                      - 2008-09-11 15:31:40 3,018,752 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
                      + 2008-09-15 22:34:34 2,940,928 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
                      + 2008-09-15 22:41:20 26,624 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Accessibility\[u]0/u34a44742647d86bbaa1c8f15b7cb528\Accessibility.ni.dll
                      + 2008-09-15 22:41:20 888,832 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\bb304cec0361eca66b0fa89d1a59e969\AspNetMMCExt.ni.dll
                      + 2008-09-15 22:41:21 237,568 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\a6eea31abed00f52cc062c424092dafd\CustomMarshalers.ni.dll
                      + 2008-09-15 22:41:21 15,360 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\dfsvc\1dd3efadaa530f2449dc13c568ea5164\dfsvc.ni.exe
                      + 2008-09-15 22:41:22 880,640 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\6930d162678847a01f47fed348873e15\Microsoft.Build.Engine.ni.dll
                      + 2008-09-15 22:41:22 81,920 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\a2f7cb74d513ff512c4bec4c300aaa15\Microsoft.Build.Framework.ni.dll
                      + 2008-09-15 22:41:24 1,687,552 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\917a297b2ea5a0f5fbd388a4259c26ba\Microsoft.Build.Tasks.ni.dll
                      + 2008-09-15 22:41:25 163,840 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\c9adde7899f180b78f199267c84fa3a0\Microsoft.Build.Utilities.ni.dll
                      + 2008-09-15 22:41:26 1,720,320 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\[u]0/u44886a99768c9ee6dfae01b295354c9\Microsoft.VisualBasic.ni.dll
                      + 2008-09-15 22:35:09 11,304,960 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\1fb9d8194c139bc9c29600e687c112b6\mscorlib.ni.dll
                      + 2008-09-15 22:41:27 1,003,520 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\c4ec8ced34ef9ab8954cff5bf5d0fc05\System.Configuration.ni.dll
                      + 2008-09-15 22:35:26 6,676,480 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Data\ab5532e25121f69c1df505c56ed62fab\System.Data.ni.dll
                      + 2008-09-15 22:41:29 1,724,416 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Deployment\600ab411d9ec3bc2df23b85bf663d9f9\System.Deployment.ni.dll
                      + 2008-09-15 22:35:38 10,702,848 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Design\51b0a2ce84b66381e636f67a29179050\System.Design.ni.dll
                      + 2008-09-15 22:41:31 512,000 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\[u]0/ufa46f97e5901f66384d24c91953fca1\System.DirectoryServices.Protocols.ni.dll
                      + 2008-09-15 22:41:30 1,216,512 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\bcb19767b1dd92ea6ead4713747a3f9d\System.DirectoryServices.ni.dll
                      + 2008-09-15 22:35:41 229,376 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\df7ec312ebe9d15ba00294c1e1b3a5c6\System.Drawing.Design.ni.dll
                      + 2008-09-15 22:35:40 1,601,536 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\171abffae7d81afa0a1f913aa092d753\System.Drawing.ni.dll
                      + 2008-09-15 22:41:32 659,456 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\[u]0/ucb936db5338057a6eefd08d17cf1749\System.EnterpriseServices.ni.dll
                      + 2008-09-15 22:41:32 294,912 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\[u]0/ucb936db5338057a6eefd08d17cf1749\System.EnterpriseServices.Wrapper.dll
                      + 2008-09-15 22:41:33 729,088 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Security\531fdb92069c959eb4c7f6fc87a2c943\System.Security.ni.dll
                      + 2008-09-15 22:41:34 684,032 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Transactions\1f04130d373d41e907397eb57ba046bb\System.Transactions.ni.dll
                      + 2008-09-15 22:41:50 2,306,048 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\830d818643869a46b45df035b39913c0\System.Web.Mobile.ni.dll
                      + 2008-09-15 22:41:50 237,568 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\[u]0/u83e36946f184bd0578406e00584e953\System.Web.RegularExpressions.ni.dll
                      + 2008-09-15 22:41:52 1,941,504 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Services\2861d1fbebc0438e1a199f430e2dec4c\System.Web.Services.ni.dll
                      + 2008-09-15 22:41:47 12,185,600 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\d1df715e50f008d994d12ef39606a565\System.Web.ni.dll
                      + 2008-09-15 22:35:53 13,107,200 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\c137809123042cafa5275b677638c165\System.Windows.Forms.ni.dll
                      + 2008-09-15 22:35:59 5,623,808 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\8fbebde964c57f779f777a2c19c75919\System.Xml.ni.dll
                      + 2008-09-15 22:35:19 8,130,560 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\30bad1d3e889c7b60f85b092688c76de\System.ni.dll
                      - 2008-06-14 17:59:52 272,768 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys
                      + 2008-06-14 17:33:37 272,768 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys
                      + 2008-04-14 02:34:10 58,368 ------w C:\WINDOWS\ehome\medctrro.exe
                      - 2007-06-13 13:22:28 1,037,312 ----a-w C:\WINDOWS\explorer.exe
                      + 2008-04-14 02:34:03 1,037,824 ----a-w C:\WINDOWS\explorer.exe
                      - 2004-08-03 23:54:42 34,816 ----a-w C:\WINDOWS\Help\sniffpol.dll
                      + 2008-04-14 02:33:41 34,816 ----a-w C:\WINDOWS\Help\sniffpol.dll
                      - 2004-08-03 23:54:42 33,280 ----a-w C:\WINDOWS\Help\sstub.dll
                      + 2008-04-14 02:33:46 33,280 ----a-w C:\WINDOWS\Help\sstub.dll
                      - 2004-08-03 23:54:44 279,040 ----a-w C:\WINDOWS\Help\tshoot.dll
                      + 2008-04-14 02:33:46 279,040 ----a-w C:\WINDOWS\Help\tshoot.dll
                      - 2005-05-26 23:22:01 10,752 ----a-w C:\WINDOWS\hh.exe
                      + 2008-04-14 02:34:06 10,752 ----a-w C:\WINDOWS\hh.exe
                      - 2004-08-03 23:54:32 220,160 ----a-w C:\WINDOWS\ime\mscandui.dll
                      + 2008-04-14 02:33:30 220,160 ----a-w C:\WINDOWS\ime\mscandui.dll
                      - 2004-08-03 23:54:42 130,048 ----a-w C:\WINDOWS\ime\SOFTKBD.DLL
                      + 2008-04-14 02:33:41 130,048 ----a-w C:\WINDOWS\ime\softkbd.dll
                      - 2004-08-03 23:53:48 62,976 ----a-w C:\WINDOWS\ime\SPGRMR.dll
                      + 2008-04-13 16:43:18 62,976 ----a-w C:\WINDOWS\ime\spgrmr.dll
                      - 2004-08-03 23:54:42 272,384 ----a-w C:\WINDOWS\ime\SPTIP.dll
                      + 2008-04-14 02:33:46 272,384 ----a-w C:\WINDOWS\ime\sptip.dll
                      - 2004-08-03 23:55:02 208,896 ----a-w C:\WINDOWS\inf\unregmp2.exe
                      + 2008-04-14 02:34:26 208,896 ----a-w C:\WINDOWS\inf\unregmp2.exe
                      - 2008-09-12 14:38:38 18,718 ----a-r C:\WINDOWS\Installer\{F61A549E-9C8A-4859-8BFE-2A4A018BBA4A}\ARPPRODUCTICON.exe
                      + 2008-09-12 16:07:06 18,718 ----a-r C:\WINDOWS\Installer\{F61A549E-9C8A-4859-8BFE-2A4A018BBA4A}\ARPPRODUCTICON.exe
                      - 2008-09-12 14:38:38 18,718 ----a-r C:\WINDOWS\Installer\{F61A549E-9C8A-4859-8BFE-2A4A018BBA4A}\NewShortcut1_E659E0EE10E649B7869660F38D0EB174.exe
                      + 2008-09-12 16:07:06 18,718 ----a-r C:\WINDOWS\Installer\{F61A549E-9C8A-4859-8BFE-2A4A018BBA4A}\NewShortcut1_E659E0EE10E649B7869660F38D0EB174.exe
                      - 2008-09-12 14:38:38 57,344 ----a-r C:\WINDOWS\Installer\{F61A549E-9C8A-4859-8BFE-2A4A018BBA4A}\NewShortcut4_C665E66BE8EF49DBB30B81BB5E60462C.exe
                      + 2008-09-12 16:07:06 57,344 ----a-r C:\WINDOWS\Installer\{F61A549E-9C8A-4859-8BFE-2A4A018BBA4A}\NewShortcut4_C665E66BE8EF49DBB30B81BB5E60462C.exe
                      + 2008-01-18 15:13:09 2,247 ------w C:\WINDOWS\Installer\tsclientmsitrans\tscdsbl.bat
                      + 2007-12-12 10:33:51 18,917 ------w C:\WINDOWS\Installer\tsclientmsitrans\tscinst.vbs
                      + 2007-10-30 10:06:46 13,801 ------w C:\WINDOWS\Installer\tsclientmsitrans\tscuinst.vbs
                      + 2008-04-14 02:33:06 25,600 ------w C:\WINDOWS\Installer\tsclientmsitrans\tscupdc.dll
                      + 2005-03-18 14:23:10 53,248 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.AudioVideoPlayback.dll
                      + 2005-03-18 14:23:10 12,800 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Diagnostics.dll
                      + 2005-03-18 14:23:14 473,600 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3D.dll
                      + 2004-09-29 10:38:58 2,676,224 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3DX.dll
                      + 2005-03-18 14:23:10 145,920 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectDraw.dll
                      + 2005-03-18 14:23:10 159,232 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectInput.dll
                      + 2005-03-18 14:23:14 364,544 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectPlay.dll
                      + 2005-03-18 14:23:12 178,176 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectSound.dll
                      + 2005-03-18 14:23:14 223,232 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.dll
                      + 2004-12-01 13:53:06 2,846,720 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2903.0\Microsoft.DirectX.Direct3DX.dll
                      + 2005-02-05 17:32:54 563,712 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2904.0\Microsoft.DirectX.Direct3DX.dll
                      + 2005-03-18 15:23:14 567,296 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2905.0\Microsoft.DirectX.Direct3DX.dll
                      + 2005-05-26 13:15:56 576,000 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2906.0\Microsoft.DirectX.Direct3DX.dll
                      + 2005-07-22 15:21:34 577,024 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2907.0\Microsoft.DirectX.Direct3DX.dll
                      + 2005-09-28 12:11:52 577,536 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2908.0\Microsoft.DirectX.Direct3DX.dll
                      + 2005-12-05 15:20:50 577,536 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2909.0\Microsoft.DirectX.Direct3DX.dll
                      + 2006-02-03 05:40:48 578,560 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2910.0\Microsoft.DirectX.Direct3DX.dll
                      + 2006-03-31 09:27:50 578,560 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2911.0\Microsoft.DirectX.Direct3DX.dll
                      - 2005-09-23 05:28:58 55,488 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
                      + 2007-04-13 01:21:18 58,712 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
                      - 2005-09-23 05:28:32 10,752 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll
                      + 2007-04-13 01:20:52 10,752 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll
                      - 2005-09-23 05:28:32 8,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll
                      + 2007-04-13 01:20:52 8,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll
                      - 2005-09-23 05:28:32 23,552 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll
                      + 2007-04-13 01:20:52 23,552 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll
                      - 2005-09-23 05:28:32 70,656 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll
                      + 2007-04-13 01:20:50 75,264 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll
                      - 2005-09-23 05:28:32 26,824 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
                      + 2007-04-13 01:20:52 32,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe
                      - 2005-09-23 05:28:32 29,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
                      + 2007-04-13 01:20:52 33,632 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
                      - 2005-09-23 05:28:32 29,888 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
                      + 2007-04-13 01:20:52 32,600 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe
                      - 2005-09-23 05:28:32 503,808 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll
                      + 2007-04-13 01:20:52 507,904 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll
                      - 2005-09-23 05:28:56 88,576 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll
                      + 2007-04-13 01:21:16 88,576 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll
                      - 2005-09-23 05:28:38 4,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
                      + 2007-04-13 01:20:58 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
                      - 2005-09-23 05:28:56 9,728 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
                      + 2007-04-13 01:21:16 9,728 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExec.exe
                      - 2005-09-23 05:28:56 224,952 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
                      + 2007-04-13 01:21:16 228,688 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
                      - 2005-09-23 05:28:56 28,672 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
                      + 2007-04-13 01:21:16 28,672 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe
                      - 2005-09-23 05:28:48 413,696 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll
                      + 2007-04-13 01:21:10 413,696 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll
                      - 2005-09-23 05:28:48 647,168 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll
                      + 2007-04-13 01:21:10 647,168 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll
                      - 2005-09-23 05:28:48 745,472 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll
                      + 2007-04-13 01:21:08 749,568 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll
                      - 2005-09-23 05:28:32 87,552 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll
                      + 2007-04-13 01:20:52 87,040 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll
                      - 2005-09-23 05:28:56 800,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
                      + 2007-04-13 01:21:18 802,304 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll
                      - 2005-09-23 05:28:56 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorie.dll
                      + 2007-04-13 01:21:16 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorie.dll
                      - 2005-09-23 05:28:56 326,144 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
                      + 2007-04-13 01:21:16 326,656 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
                      - 2005-09-23 05:28:56 4,308,992 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
                      + 2007-04-13 01:21:16 4,308,992 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
                      - 2005-09-23 05:28:56 102,400 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll
                      + 2007-04-13 01:21:16 102,912 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll
                      - 2005-09-23 05:28:56 226,816 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll
                      + 2007-04-13 01:21:18 227,328 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll
                      - 2005-09-23 05:28:56 66,240 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                      + 2007-04-13 01:21:18 68,952 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                      - 2005-09-23 05:28:50 5,615,616 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
                      + 2007-04-13 01:21:12 5,634,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
                      - 2005-09-23 05:28:56 96,440 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ngen.exe
                      + 2007-04-13 01:21:16 99,152 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\ngen.exe
                      - 2005-09-23 05:28:56 14,848 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\normalization.dll
                      + 2007-04-13 01:21:18 15,360 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\normalization.dll
                      - 2005-09-23 05:28:50 136,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\peverify.dll
                      + 2007-04-13 01:21:12 136,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\peverify.dll
                      - 2005-09-23 05:28:56 377,344 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\SOS.dll
                      + 2007-04-13 01:21:18 382,464 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\SOS.dll
                      - 2005-09-23 05:28:56 110,592 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll
                      + 2007-04-13 01:21:18 110,592 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll
                      - 2005-09-23 05:28:58 389,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll
                      + 2007-04-13 01:21:18 413,696 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll
                      - 2005-09-23 05:28:56 2,878,976 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.dll
                      + 2007-04-13 01:21:16 2,902,016 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.dll
                      - 2005-09-23 05:28:56 482,304 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll
                      + 2007-04-13 01:21:18 482,304 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll
                      - 2005-09-23 05:28:56 716,800 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll
                      + 2007-04-13 01:21:18 716,800 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll
                      - 2005-09-23 05:28:38 884,736 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll
                      + 2007-04-13 01:20:58 888,832 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll
                      - 2005-09-23 05:28:56 5,050,368 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Design.dll
                      + 2007-04-13 01:21:16 5,001,216 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Design.dll
                      - 2005-09-23 05:28:56 188,416 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll
                      + 2007-04-13 01:21:18 188,416 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll
                      - 2005-09-23 05:28:56 3,018,752 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.dll
                      + 2007-04-13 01:21:16 2,940,928 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.dll
                      - 2005-09-23 05:28:56 700,416 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll
                      + 2007-04-13 01:21:16 577,536 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll
                      - 2005-09-23 05:28:56 258,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll
                      + 2007-04-13 01:21:16 258,048 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll
                      - 2005-09-23 05:28:56 47,616 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll
                      + 2007-04-13 01:21:18 47,616 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll
                      - 2005-09-23 05:28:56 114,176 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Wrapper.dll
                      + 2007-04-13 01:21:18 114,176 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Wrapper.dll
                      - 2005-09-23 05:28:56 368,640 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Management.dll
                      + 2007-04-13 01:21:16 372,736 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Management.dll
                      - 2005-09-23 05:28:56 299,008 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll
                      + 2007-04-13 01:21:16 299,008 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll
                      - 2005-09-23 05:28:56 260,096 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll
                      + 2007-04-13 01:21:18 260,096 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll
                      - 2005-09-23 05:28:56 5,025,792 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
                      + 2007-04-13 01:21:16 5,156,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
                      - 2005-09-23 05:28:56 5,316,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll
                      + 2007-04-13 01:21:16 5,152,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll
                      - 2005-09-23 05:28:56 2,035,712 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.XML.dll
                      + 2007-04-13 01:21:16 2,027,520 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.XML.dll
                      - 2005-09-23 05:29:06 1,140,920 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                      + 2007-04-13 01:21:28 1,166,672 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                      - 2005-09-23 05:28:30 1,306,624 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll
                      + 2007-04-13 01:20:50 1,330,688 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll
                      - 2005-09-23 05:28:32 298,496 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\webengine.dll
                      + 2007-04-13 01:20:52 406,016 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\webengine.dll
                      - 2004-08-03 23:54:22 24,064 ----a-w C:\WINDOWS\msagent\agentanm.dll
                      + 2008-04-14 02:33:18 24,064 ----a-w C:\WINDOWS\msagent\agentanm.dll
                      - 2004-08-03 23:54:22 214,016 ----a-w C:\WINDOWS\msagent\agentctl.dll
                      + 2008-04-14 02:33:18 214,016 ----a-w C:\WINDOWS\msagent\agentctl.dll
                      - 2006-10-12 14:04:13 42,496 ----a-w C:\WINDOWS\msagent\agentdp2.dll
                      + 2008-04-14 02:33:18 42,496 ----a-w C:\WINDOWS\msagent\agentdp2.dll
                      - 2007-03-09 13:48:06 57,344 ----a-w C:\WINDOWS\msagent\agentdpv.dll
                      + 2008-04-14 02:33:18 57,344 ----a-w C:\WINDOWS\msagent\agentdpv.dll
                      - 2004-08-03 23:54:22 49,152 ----a-w C:\WINDOWS\msagent\agentmpx.dll
                      + 2008-04-14 02:33:18 49,152 ----a-w C:\WINDOWS\msagent\agentmpx.dll
                      - 2004-08-03 23:54:22 24,064 ----a-w C:\WINDOWS\msagent\agentpsh.dll
                      + 2008-04-14 02:33:18 24,064 ----a-w C:\WINDOWS\msagent\agentpsh.dll
                      - 2004-08-03 23:54:22 44,032 ----a-w C:\WINDOWS\msagent\agentsr.dll
                      + 2008-04-14 02:33:18 44,032 ----a-w C:\WINDOWS\msagent\agentsr.dll
                      - 2006-10-12 11:09:53 256,512 ----a-w C:\WINDOWS\msagent\agentsvr.exe
                      + 2008-04-14 02:33:53 256,512 ----a-w C:\WINDOWS\msagent\agentsvr.exe
                      - 2004-08-03 23:54:22 24,064 ----a-w C:\WINDOWS\msagent\agtintl.dll
                      + 2008-04-14 02:33:19 24,064 ----a-w C:\WINDOWS\msagent\agtintl.dll
                      - 2001-08-28 11:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0405.dll
                      + 2007-04-02 18:25:59 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0405.dll
                      - 2001-08-28 11:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0406.dll
                      + 2007-04-02 18:25:59 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0406.dll
                      - 2001-08-28 11:00:00 21,504 ----a-w C:\WINDOWS\msagent\intl\agt0407.dll
                      + 2007-04-02 18:26:00 21,504 ----a-w C:\WINDOWS\msagent\intl\agt0407.dll
                      - 2001-08-28 11:00:00 22,016 ----a-w C:\WINDOWS\msagent\intl\agt0408.dll
                      + 2007-04-02 18:26:00 22,016 ----a-w C:\WINDOWS\msagent\intl\agt0408.dll
                      - 2001-08-28 11:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0409.dll
                      + 2008-04-13 17:32:28 19,968 ----a-w C:\WINDOWS\msagent\intl\agt0409.dll
                      - 2001-08-28 11:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt040b.dll
                      + 2007-04-02 18:26:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt040b.dll
                      - 2001-08-28 11:00:00 21,504 ----a-w C:\WINDOWS\msagent\intl\agt040c.dll
                      + 2007-04-02 18:26:00 21,504 ----a-w C:\WINDOWS\msagent\intl\agt040c.dll
                      - 2001-08-28 11:00:00 19,968 ----a-w C:\WINDOWS\msagent\intl\agt040e.dll
                      + 2007-04-02 18:26:00 19,968 ----a-w C:\WINDOWS\msagent\intl\agt040e.dll
                      - 2001-08-28 11:00:00 20,992 ----a-w C:\WINDOWS\msagent\intl\agt0410.dll
                      + 2007-04-02 18:26:00 20,992 ----a-w C:\WINDOWS\msagent\intl\agt0410.dll
                      - 2001-08-28 11:00:00 20,992 ----a-w C:\WINDOWS\msagent\intl\agt0413.dll
                      + 2007-04-02 18:26:01 20,992 ----a-w C:\WINDOWS\msagent\intl\agt0413.dll
                      - 2001-08-28 11:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0414.dll
                      + 2007-04-02 18:26:01 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0414.dll
                      - 2001-08-28 11:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0415.dll
                      + 2007-04-02 18:26:01 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0415.dll
                      - 2001-08-28 11:00:00 20,480 ----a-w C:\WINDOWS\msagent\intl\agt0416.dll
                      + 2007-04-02 18:26:01 20,480 ----a-w C:\WINDOWS\msagent\intl\agt0416.dll
                      - 2001-08-28 11:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0419.dll
                      + 2007-04-02 18:26:01 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0419.dll
                      - 2001-08-28 11:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt041d.dll
                      + 2007-04-02 18:26:01 19,456 ----a-w C:\WINDOWS\msagent\intl\agt041d.dll
                      - 2001-08-28 11:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt041f.dll
                      + 2007-04-02 18:26:01 19,456 ----a-w C:\WINDOWS\msagent\intl\agt041f.dll
                      - 2001-08-28 11:00:00 20,992 ----a-w C:\WINDOWS\msagent\intl\agt0816.dll
                      + 2007-04-02 18:26:02 20,992 ----a-w C:\WINDOWS\msagent\intl\agt0816.dll
                      - 2001-08-28 11:00:00 20,480 ----a-w C:\WINDOWS\msagent\intl\agt0c0a.dll
                      + 2007-04-02 18:26:02 20,480 ----a-w C:\WINDOWS\msagent\intl\agt0c0a.dll
                      - 2004-08-03 23:54:34 39,936 ----a-w C:\WINDOWS\msagent\mslwvtts.dll
                      + 2008-04-14 02:33:32 39,936 ----a-w C:\WINDOWS\msagent\mslwvtts.dll
                      + 2008-04-14 02:33:22 33,792 ------w C:\WINDOWS\network diagnostic\custsat.dll
                      + 2008-04-13 18:53:32 558,080 ------w C:\WINDOWS\network diagnostic\xpnetdiag.exe
                      - 2004-08-03 23:55:00 70,656 ----a-w C:\WINDOWS\NOTEPAD.EXE
                      + 2008-04-14 02:34:15 70,656 ----a-w C:\WINDOWS\notepad.exe
                      - 2004-08-03 23:54:52 768,512 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe
                      + 2008-04-14 02:34:06 769,024 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe
                      - 2004-08-03 23:54:52 743,936 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe
                      + 2008-04-14 02:34:06 744,448 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\helpsvc.exe
                      - 2004-08-03 23:54:52 18,944 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HscUpd.exe
                      + 2008-04-14 02:34:06 18,432 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\hscupd.exe
                      - 2004-08-03 23:54:58 160,768 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe
                      + 2008-04-14 02:34:12 172,544 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe
                      - 2004-08-03 23:54:34 381,952 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msinfo.dll
                      + 2008-04-14 02:33:32 382,464 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msinfo.dll
                      - 2004-08-03 23:54:36 102,400 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\pchshell.dll
                      + 2008-04-14 02:33:38 102,912 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\pchshell.dll
                      - 2004-08-03 23:54:36 38,912 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll
                      + 2008-04-14 02:33:38 38,400 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll
                      - 2008-01-08 16:34:53 86,331 ----a-w C:\WINDOWS\pchealth\helpctr\OfflineCache\index.dat
                      + 2008-09-15 20:13:16 86,331 ----a-w C:\WINDOWS\pchealth\helpctr\OfflineCache\index.dat
                      - 2008-01-08 16:34:53 2,430 ----a-w C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
                      + 2008-09-15 20:13:16 2,744 ----a-w C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
                      - 2004-08-03 23:55:02 151,040 ----a-w C:\WINDOWS\pchealth\UploadLB\Binaries\UploadM.exe
                      + 2008-04-14 02:34:26 151,040 ----a-w C:\WINDOWS\pchealth\UploadLB\Binaries\uploadm.exe
                      - 2004-08-03 23:54:42 151,552 ----a-w C:\WINDOWS\PeerNet\sqldb20.dll
                      + 2008-04-14 02:33:46 151,552 ----a-w C:\WINDOWS\PeerNet\sqldb20.dll
                      - 2004-08-03 23:54:42 462,848 ----a-w C:\WINDOWS\PeerNet\sqlqp20.dll
                      + 2008-04-14 02:33:46 462,848 ----a-w C:\WINDOWS\PeerNet\sqlqp20.dll
                      - 2004-08-03 23:54:42 110,592 ----a-w C:\WINDOWS\PeerNet\sqlse20.dll
                      + 2008-04-14 02:33:46 110,592 ----a-w C:\WINDOWS\PeerNet\sqlse20.dll
                      - 2004-08-03 23:55:02 153,088 ----a-w C:\WINDOWS\regedit.exe
                      + 2008-04-14 02:34:19 153,088 ----a-w C:\WINDOWS\regedit.exe
                      + 2008-04-13 18:46:18 53,376 ------w C:\WINDOWS\ServicePackFiles\i386\1394bus.sys
                      + 2008-04-13 18:40:50 12,288 ------w C:\WINDOWS\ServicePackFiles\i386\4mmdat.sys
                      + 2008-04-13 18:46:20 48,128 ------w C:\WINDOWS\ServicePackFiles\i386\61883.sys
                      + 2008-04-14 02:33:18 100,352 ------w C:\WINDOWS\ServicePackFiles\i386\6to4svc.dll
                      + 2008-04-14 02:33:18 136,192 ------w C:\WINDOWS\ServicePackFiles\i386\aaclient.dll
                      + 2004-08-03 20:32:22 231,552 ------w C:\WINDOWS\ServicePackFiles\i386\ac97ali.sys
                      + 2004-08-03 20:32:32 84,480 ------w C:\WINDOWS\ServicePackFiles\i386\ac97via.sys
                      + 2008-04-14 02:33:18 39,424 ------w C:\WINDOWS\ServicePackFiles\i386\acadproc.dll
                      + 2008-04-14 02:33:53 190,464 ------w C:\WINDOWS\ServicePackFiles\i386\accwiz.exe
                      + 2008-04-14 02:33:18 1,852,928 ------w C:\WINDOWS\ServicePackFiles\i386\acgenral.dll
                      + 2008-04-14 02:33:18 451,072 ------w C:\WINDOWS\ServicePackFiles\i386\aclayers.dll
                      + 2008-04-14 02:33:18 141,312 ------w C:\WINDOWS\ServicePackFiles\i386\aclua.dll
                      + 2008-04-14 02:33:18 120,320 ------w C:\WINDOWS\ServicePackFiles\i386\aclui.dll
                      + 2008-04-14 01:52:42 188,672 ------w C:\WINDOWS\ServicePackFiles\i386\acpi.sys
                      + 2008-04-14 02:33:18 245,248 ------w C:\WINDOWS\ServicePackFiles\i386\acspecfc.dll
                      + 2008-04-14 02:33:18 193,536 ------w C:\WINDOWS\ServicePackFiles\i386\activeds.dll
                      + 2008-04-14 02:33:53 4,096 ------w C:\WINDOWS\ServicePackFiles\i386\actmovie.exe
                      + 2008-04-14 02:33:18 98,304 ------w C:\WINDOWS\ServicePackFiles\i386\actxprxy.dll
                      + 2008-04-14 02:33:18 116,224 ------w C:\WINDOWS\ServicePackFiles\i386\acxtrnal.dll
                      + 2008-04-14 02:33:18 29,696 ------w C:\WINDOWS\ServicePackFiles\i386\admexs.dll
                      + 2008-04-14 02:33:18 20,540 ------w C:\WINDOWS\ServicePackFiles\i386\admin.dll
                      + 2008-04-14 02:33:53 16,439 ------w C:\WINDOWS\ServicePackFiles\i386\admin.exe
                      + 2004-08-03 20:32:24 10,880 ------w C:\WINDOWS\ServicePackFiles\i386\admjoy.sys
                      + 2008-04-14 02:33:18 61,440 ------w C:\WINDOWS\ServicePackFiles\i386\admparse.dll
                      + 2008-04-14 02:33:18 43,520 ------w C:\WINDOWS\ServicePackFiles\i386\admwprox.dll
                      + 2008-04-14 02:33:18 290,816 ------w C:\WINDOWS\ServicePackFiles\i386\adsiis51.dll
                      + 2008-04-14 02:33:18 175,616 ------w C:\WINDOWS\ServicePackFiles\i386\adsldp.dll
                      + 2008-04-14 02:33:18 143,360 ------w C:\WINDOWS\ServicePackFiles\i386\adsldpc.dll
                      + 2008-04-14 02:33:18 68,096 ------w C:\WINDOWS\ServicePackFiles\i386\adsmsext.dll
                      + 2008-04-14 02:33:18 263,680 ------w C:\WINDOWS\ServicePackFiles\i386\adsnt.dll
                      + 2008-04-14 02:33:18 123,392 ------w C:\WINDOWS\ServicePackFiles\i386\adsnw.dll
                      + 2007-04-02 13:10:44 85,813 ------w C:\WINDOWS\ServicePackFiles\i386\adsutil.vbs
                      + 2008-04-14 02:33:18 4,255 ------w C:\WINDOWS\ServicePackFiles\i386\adv01nt5.dll
                      + 2008-04-14 02:33:18 3,967 ------w C:\WINDOWS\ServicePackFiles\i386\adv02nt5.dll
                      + 2008-04-14 02:33:18 3,615 ------w C:\WINDOWS\ServicePackFiles\i386\adv05nt5.dll
                      + 2008-04-14 02:33:18 3,647 ------w C:\WINDOWS\ServicePackFiles\i386\adv07nt5.dll
                      + 2008-04-14 02:33:18 3,135 ------w C:\WINDOWS\ServicePackFiles\i386\adv08nt5.dll
                      + 2008-04-14 02:33:18 3,711 ------w C:\WINDOWS\ServicePackFiles\i386\adv09nt5.dll
                      + 2008-04-14 02:33:18 3,775 ------w C:\WINDOWS\ServicePackFiles\i386\adv11nt5.dll
                      + 2008-04-14 02:33:18 685,568 ------w C:\WINDOWS\ServicePackFiles\i386\advapi32.dll
                      + 2008-04-14 02:33:18 101,888 ------w C:\WINDOWS\ServicePackFiles\i386\advpack.dll
                      + 2008-04-13 16:39:23 142,592 ------w C:\WINDOWS\ServicePackFiles\i386\aec.sys
                      + 2008-04-13 19:19:23 138,112 ------w C:\WINDOWS\ServicePackFiles\i386\afd.sys
                      + 2008-04-14 02:33:18 24,064 ------w C:\WINDOWS\ServicePackFiles\i386\agentanm.dll
                      + 2008-04-14 02:33:18 214,016 ------w C:\WINDOWS\ServicePackFiles\i386\agentctl.dll
                      + 2008-04-14 02:33:18 42,496 ------w C:\WINDOWS\ServicePackFiles\i386\agentdp2.dll
                      + 2008-04-14 02:33:18 57,344 ------w C:\WINDOWS\ServicePackFiles\i386\agentdpv.dll
                      + 2008-04-14 02:33:18 49,152 ------w C:\WINDOWS\ServicePackFiles\i386\agentmpx.dll
                      + 2008-04-14 02:33:18 24,064 ------w C:\WINDOWS\ServicePackFiles\i386\agentpsh.dll
                      + 2008-04-14 02:33:18 44,032 ------w C:\WINDOWS\ServicePackFiles\i386\agentsr.dll
                      + 2008-04-14 02:33:53 256,512 ------w C:\WINDOWS\ServicePackFiles\i386\agentsvr.exe
                      + 2008-04-13 18:36:38 42,368 ------w C:\WINDOWS\ServicePackFiles\i386\agp440.sys
                      + 2008-04-13 18:36:39 44,928 ------w C:\WINDOWS\ServicePackFiles\i386\agpcpq.sys
                      + 2007-04-02 18:25:59 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0401.dll
                      + 2007-04-02 18:25:59 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0404.dll
                      + 2007-04-02 18:25:59 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0405.dll
                      + 2007-04-02 18:25:59 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0406.dll
                      + 2007-04-02 18:26:00 21,504 ------w C:\WINDOWS\ServicePackFiles\i386\agt0407.dll
                      + 2007-04-02 18:26:00 22,016 ------w C:\WINDOWS\ServicePackFiles\i386\agt0408.dll
                      + 2008-04-13 17:32:28 19,968 ------w C:\WINDOWS\ServicePackFiles\i386\agt0409.dll
                      + 2007-04-02 18:26:00 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt040b.dll
                      + 2007-04-02 18:26:00 21,504 ------w C:\WINDOWS\ServicePackFiles\i386\agt040c.dll
                      + 2007-04-02 18:26:00 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt040d.dll
                      + 2007-04-02 18:26:00 19,968 ------w C:\WINDOWS\ServicePackFiles\i386\agt040e.dll
                      + 2007-04-02 18:26:00 20,992 ------w C:\WINDOWS\ServicePackFiles\i386\agt0410.dll
                      + 2007-04-02 18:26:00 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0411.dll
                      + 2007-04-02 18:26:00 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0412.dll
                      + 2007-04-02 18:26:01 20,992 ------w C:\WINDOWS\ServicePackFiles\i386\agt0413.dll
                      + 2007-04-02 18:26:01 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0414.dll
                      + 2007-04-02 18:26:01 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0415.dll
                      + 2007-04-02 18:26:01 20,480 ------w C:\WINDOWS\ServicePackFiles\i386\agt0416.dll
                      + 2007-04-02 18:26:01 19,456 ------w C:\WINDOWS\ServicePackFiles\i386\agt0419.dll
                      + 2007-04-02 18:26:01 19,456 ------w C:\WINDOWS\Servi
                      -1