wrap up malaria

7/26/2019 Wrap Up Malaria

1/403

/2/2011 2:31 PMModified: 8/2/2011 2:31 PMCompany: AtherosKey: AtherosSvcImagePath: C:\Program Files\Bluetooth Suite\adminservice.exeC:\Program Files\Bluetooth Suite\adminservice.exe82592 bytesCreated: 8/2/2011 1:54 PMModified: 8/2/2011 1:54 PMCompany: Atheros CommnucationsKey: athrImagePath: system32\DRIVERS\athr.sysC:\Windows\system32\DRIVERS\athr.sys2171904 bytesCreated: 9/30/2011 11:47 AMModified: 4/21/2011 8:14 PMCompany: Atheros Communications, Inc.Key: avkmgrImagePath: system32\DRIVERS\avkmgr.sysC:\Windows\system32\DRIVERS\avkmgr.sys36000 bytes

Created: 4/14/2012 9:32 PMModified: 9/16/2011 4:09 PMCompany: Avira GmbHKey: BTATH_A2DPImagePath: system32\drivers\btath_a2dp.sysC:\Windows\system32\drivers\btath_a2dp.sys290976 bytesCreated: 8/2/2011 2:01 PMModified: 8/2/2011 2:01 PMCompany: AtherosKey: btath_avdt

ImagePath: system32\drivers\btath_avdt.sysC:\Windows\system32\drivers\btath_avdt.sys97440 bytesCreated: 8/2/2011 2:02 PMModified: 8/2/2011 2:02 PMCompany: AtherosKey: BTATH_BUSImagePath: system32\DRIVERS\btath_bus.sysC:\Windows\system32\DRIVERS\btath_bus.sys25248 bytesCreated: 8/2/2011 2:02 PMModified: 8/2/2011 2:02 PM

Company: AtherosKey: BTATH_HCRPImagePath: system32\DRIVERS\btath_hcrp.sysC:\Windows\system32\DRIVERS\btath_hcrp.sys147616 bytesCreated: 8/2/2011 2:02 PMModified: 8/2/2011 2:02 PMCompany: Atheros


2/403

Key: BTATH_LWFLTImagePath: system32\DRIVERS\btath_lwflt.sysC:\Windows\system32\DRIVERS\btath_lwflt.sys60064 bytesCreated: 8/2/2011 2:03 PMModified: 8/2/2011 2:03 PMCompany: AtherosKey: BTATH_RCPImagePath: system32\DRIVERS\btath_rcp.sysC:\Windows\system32\DRIVERS\btath_rcp.sys263968 bytesCreated: 8/2/2011 2:03 PMModified: 8/2/2011 2:03 PMCompany: AtherosKey: BtFilterImagePath: system32\DRIVERS\btfilter.sysC:\ndows\system32\DRIVERS\btfilter.sys436896 bytesCreated: 8/2/2011 2:04 PMModified: 8/2/2011 2:04 PMCompany: Atheros

Key: BthEnumImagePath: \SystemRoot\system32\drivers\BthEnum.sysC:\Windows\system32\drivers\BthEnum.sys34816 bytesCreated: 7/14/2009 6:51 AMModified: 7/14/2009 6:51 AMCompany: Microsoft CorporationKey: BTHPORTImagePath: \SystemRoot\System32\Drivers\BTHport.sysC:\Windows\System32\Drivers\BTHport.sys393728 bytesCreated: 10/3/2011 10:34 AM

Modified: 4/28/2011 10:15 AMCompany: Microsoft CorporationKey: BTHUSBImagePath: \SystemRoot\System32\Drivers\BTHUSB.sysC:\Windows\System32\Drivers\BTHUSB.sys60416 bytesCreated: 10/3/2011 10:34 AMModified: 4/28/2011 10:15 AMCompany: Microsoft CorporationKey: clr_optimization_v4.0.30319_32ImagePath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe130384 bytesCreated: 3/18/2010 1:16 PMModified: 3/18/2010 1:16 PMCompany: Microsoft CorporationKey: clwvdImagePath: system32\DRIVERS\clwvd.sysC:\Windows\system32\DRIVERS\clwvd.sys27632 bytes


3/403

Created: 7/28/2010 9:13 AMModified: 7/28/2010 9:13 AMCompany: CyberLink CorporationKey: CompositeBusImagePath: \SystemRoot\system32\drivers\CompositeBus.sysC:\Windows\system32\drivers\CompositeBus.sys31232 bytesCreated: 10/3/2011 10:49 AMModified: 11/20/2010 4:50 PMCompany: Microsoft CorporationKey: HdAudAddServiceImagePath: \SystemRoot\system32\drivers\HdAudio.sysC:\Windows\system32\drivers\HdAudio.sys304128 bytesCreated: 10/3/2011 10:49 AMModified: 11/20/2010 5:00 PMCompany: Microsoft CorporationKey: HP Support Assistant ServiceImagePath: "C:\Program Files\HewlettPackard\HP Support Framework\hpsa_service.exe"C:\Program Files\HewlettPackard\HP Support Framework\hpsa_service.exe

85560 bytesCreated: 6/21/2011 3:57 PMModified: 6/21/2011 3:57 PMCompany: HewlettPackard CompanyKey: HPDrvMntSvc.exeImagePath: "C:\Program Files\HewlettPackard\Shared\HPDrvMntSvc.exe"C:\Program Files\HewlettPackard\Shared\HPDrvMntSvc.exe227384 bytesCreated: 7/5/2011 5:02 PMModified: 7/5/2011 5:02 PMCompany: HewlettPackard Compy

Key: hpqwmiexImagePath: "C:\Program Files\HewlettPackard\Shared\hpqWmiEx.exe"C:\Program Files\HewlettPackard\Shared\hpqWmiEx.exe988216 bytesCreated: 7/5/2011 5:00 PMModified: 7/5/2011 5:00 PMCompany: HewlettPackard CompanyKey: HPWMISVCImagePath: C:\Program Files\HewlettPackard\HP Quick Launch\HPWMISVC.exeC:\Program Files\HewlettPackard\HP Quick Launch\HPWMISVC.exe26680 bytesCreated: 6/14/2011 2:29 PM

Modified: 6/14/2011 2:29 PMCompany: HewlettPackard Development Company, L.P.Key: iaStorVImagePath: \SystemRoot\system32\drivers\iaStorV.sysC:\Windows\system32\drivers\iaStorV.sys332160 bytesCreated: 10/3/2011 10:34 AMModified: 3/11/2011 12:38 PMCompany: Intel Corporation


4/403

Key: IconMan_RImagePath: "C:\Program Files\Realtek\Realtek PCIE Card Reader\RIconMan.exe"C:\Program Files\Realtek\Realtek PCIE Card Reader\RIconMan.exe1755136 bytesCreated: 9/30/2011 11:04 AMModified: 3/7/2011 10:45 PMCompany: Realsil Microelectronics Inc.Key: igfxImagePath: system32\DRIVERS\igdkmd32.sysC:\Windows\system32\DRIVERS\igdkmd32.sys10855424 bytesCreated: 8/31/2011 12:48 PMModified: 8/31/2011 12:48 PMCompany: Intel CorporationKey: IntcDAudImagePath: system32\DRIVERS\IntcDAud.sysC:\Windows\system32\DRIVERS\IntcDAud.sys269824 bytesCreated: 10/15/2010 1:27 AMModified: 10/15/2010 1:27 AMCompany: Intel(R) Corporation

Key: kbdclassImagePath: \SystemRoot\system32\drivers\kbdclass.sysC:\Windows\system32\drivers\kbdclass.sys42576 bytesCreated: 7/14/2009 6:11 AMModified: 7/14/2009 8:20 AMCompany: Microsoft CorporationKey: kbdhidImagePath: \SystemRoot\system32\drivers\kbdhid.sysC:\Windows\system32\drivers\kbdhid.sys28160 bytes

Created: 10/3/2011 10:49 AMModified: 11/20/2010 4:50 PMCompany: Microsoft CorporationKey: LMSImagePath: C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exeC:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe325912 bytesCreated: 9/30/2011 11:04 AMModified: 8/8/2011 5:39 PMCompany: Intel Corporation

Key: MEIImagePath: system32\DRIVERS\HECI.sysC:\Windows\system32\DRIVERS\HECI.sys41088 bytesCreated: 9/30/2011 11:04 AMModified: 10/19/2010 4:33 PMCompany: Intel CorporationKey: Microsoft SharePoint Workspace Audit ServiceImagePath: "C:\Program Files\Microsoft Office\Office14\GROOVE.EXE" /auditservice


5/403

C:\Program Files\Microsoft Office\Office14\GROOVE.EXE31125880 bytesCreated: 6/12/2011 11:15 AMModified: 6/12/2011 11:15 AMCompany: Microsoft CorporationKey: MpFilterImagePath: system32\DRIVERS\MpFilter.sysC:\Windows\system32\DRIVERS\MpFilter.sys165648 bytesCreated: 4/18/2011 1:18 PMModified: 4/18/2011 1:18 PMCompany: Microsoft CorporationKey: MpKsl5b540e51ImagePath: \??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{9A4BBB1D5E5D4CB996D04E2ADF9DBDEB}\MpKsl5b540e51.sysc:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{9A4BBB1D5E5D4CB996D04E2ADF9DBDEB}\MpKsl5b540e51.sys [file not found to scan]Key: MpNWMonImagePath: system32\DRIVERS\MpNWMon.sysC:\Windows\system32\DRIVERS\MpNWMon.sys43392 bytes

Created: 4/18/2011 1:18 PMModified: 4/18/2011 1:18 PMCompany: Microsoft CorporationKey: msahciImagePath: system32\drivers\msahci.sysC:\Windows\system32\drivers\msahci.sys28032 bytesCreed: 10/3/2011 10:49 AMModified: 11/20/2010 7:30 PMCompany: Microsoft CorporationKey: MsMpSvc

ImagePath: "c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe"c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe11736 bytesCreated: 4/27/2011 3:39 PMModified: 4/27/2011 3:39 PMCompany: Microsoft CorporationKey: mssmbiosImagePath: \SystemRoot\system32\drivers\mssmbios.sysC:\Windows\system32\drivers\mssmbios.sys28240 bytesCreated: 7/14/2009 6:19 AMModified: 7/14/2009 8:20 AM

Company: Microsoft CorporationKey: Nero BackItUp Scheduler 4.0ImagePath: C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exeC:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe935208 bytesCreated: 9/23/2009 1:38 PMModified: 9/23/2009 1:38 PMCompany: Nero AG


6/403

Key: NisDrvImagePath: system32\DRIVERS\NisDrvWFP.sysC:\Windows\system32\DRIVERS\NisDrvWFP.sys65024 bytesCreated: 4/27/2011 3:25 PMModified: 4/27/2011 3:25 PMCompany: Microsoft CorporationKey: NisSrvImagePath: "c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe"c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe208944 bytesCreated: 4/27/2011 3:39 PMModified: 4/27/2011 3:39 PMCompany: Microsoft CorporationKey: osppsvcImagePath: "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE4640000 bytesCreated: 1/9/2010 9:37 PMModified: 1/9/2010 9:37 PM

Company: Microsoft CorporationKey: RSPCIESTORImagePath: system32\DRIVERS\RtsPStor.sysC:\Windows\system32\DRIVERS\RtsPStor.sys253544 bytesCreated: 9/30/2011 11:04 AMModified: 5/4/2011 10:44 PMCompany: Realtek Semiconductor Corp.Key: RTL8167ImagePath: system32\DRIVERS\Rt86win7.sysC:\Windows\system32\DRIVERS\Rt86win7.sys

414824 bytesCreated: 8/23/2011 9:57 PMModified: 8/23/2011 9:57 PMCompany: RealtekKey: SerenumImagePath: \SystemRoot\system32\DRIVERS\serenum.sysC:\Windows\system32\DRIVERS\serenum.sys17920 bytesCreated: 7/14/2009 6:45 AMModified: 7/14/2009 6:45 AMCompany: Microsoft Corporation

Key: SerialImagePath: \SystemRoot\system32\DRIVERS\serial.sysC:\Windows\system32\DRIVERS\serial.sys83456 bytesCreated: 7/14/2009 6:45 AMModified: 7/14/2009 6:45 AMCompany: Microsoft CorporationKey: SHDSERVImagePath: C:\Program Files\Shield\shdserv.exe


7/403

C:\Program Files\Shield\shdserv.exe221184 bytesCreated: 11/3/2011 1:31 PMModified: 11/4/2010 10:28 AMCompany:Key: ShieldClientServiceImagePath: C:\Program Files\Shield\shieldclnt.exeC:\Program Files\Shield\shieldclnt.exe45056 bytesCreated: 11/3/2011 1:31 PMModified: 11/4/2010 10:24 AMCompany: [no info]Key: SkypeUpdateImagePath: "C:\Program Files\Skype\Updater\Updater.exe"C:\Program Files\Skype\Updater\Updater.exeR 158856 bytesCreated: 2/29/2012 8:50 AMModified: 2/29/2012 8:50 AMCompany: Skype TechnologiesKey: swenumImagePath: \SystemRoot\system32\drivers\swenum.sys

C:\Windows\system32\drivers\swenum.sys12240 bytesCreated: 7/14/2009 6:45 AMModified: 7/14/2009 8:19 AMCompany: Microsoft CorporationKey: SynTPImagePath: system32\DRIVERS\SynTP.sysC:\Windows\system32\DRIVERS\SynTP.sys1350704 bytesCreated: 6/9/2011 6:19 PMModified: 6/9/2011 6:19 PMCompany: Synaptics Incorporated

Key: TermDDImagePath: \SystemRoot\system32\drivers\termdd.sysC:\Windows\system32\drivers\termdd.sys53120 bytesCreated: 10/3/2011 10:49 AMModified: 11/20/2010 7:30 PMCompany: Microsoft CorporationKey: TsUsbFltImagePath: System32\drivers\tsusbflt.sysC:\Windows\System32\drivers\tsusbflt.sys52224 bytes

Created: 10/3/2011 10:50 AMModified: 11/20/2010 5:24 PMCompany: Microsoft CorporationKey: UNSImagePath: "C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe"C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe2656536 bytesCreated: 9/30/2011 11:04 AM


8/403

Modified: 8/8/2011 5:39 PMCpany: Intel CorporationKey: usbvideoImagePath: \SystemRoot\System32\Drivers\usbvideo.sysC:\Windows\System32\Drivers\usbvideo.sys146432 bytesCreated: 10/3/2011 10:49 AMModified: 11/20/2010 5:00 PMCompany: Microsoft CorporationKey: vmbusImagePath: system32\drivers\vmbus.sysC:\Windows\system32\drivers\vmbus.sys175360 bytesCreated: 10/3/2011 10:50 AMModified: 11/20/2010 7:30 PMCompany: Microsoft CorporationKey: vwifibusImagePath: system32\DRIVERS\vwifibus.sysC:\Windows\system32\DRIVERS\vwifibus.sys19968 bytesCreated: 7/14/2009 6:52 AM

Modified: 7/14/2009 6:52 AMCompany: Microsoft CorporationKey: vwififltImagePath: system32\DRIVERS\vwififlt.sysC:\Windows\system32\DRIVERS\vwififlt.sys48128 bytesCreated: 7/14/2009 6:52 AMModified: 7/14/2009 6:52 AMCompany: Microsoft CorporationKey: vwifimpImagePath: system32\DRIVERS\vwifimp.sys

C:\Windows\system32\DRIVERS\vwifimp.sys14336 bytesCreated: 7/14/2009 6:52 AMModified: 7/14/2009 6:52 AMCompany: Microsoft CorporationKey: WatAdminSvcImagePath: %SystemRoot%\system32\Wat\WatAdminSvc.exeC:\Windows\system32\Wat\WatAdminSvc.exe1343400 bytesCreated: 9/30/2011 1:32 PMModified: 9/30/2011 12:01 PMCompany: Microsoft Corporation

************************************************************10:46:56 PM: Scanning VXD ENTRIES

************************************************************10:46:56 PM: Scanning WINLOGON\NOTIFY DLLS

************************************************************10:46:56 PM: Scanning CONTEXTMENUHANDLERS


9/403

Key: AtherosCLSID: {B89524210E55400B94A6FA858FC0A39F}Path: C:\Program Files\Bluetooth Suite\BtvAppExt.dllC:\Program Files\Bluetooth Suite\BtvAppExt.dll145568 bytesCreated: 8/2/2011 1:58 PMModified: 8/2/2011 1:58 PMCompany: Atheros CommnucationsKey: Cover DesignerCLSID: {73FCA4629BD54065A73FA8E5F6904EF7}Path: C:\Program Files\Nero\Nero 9\Nero CoverDesigner\CoverEdExtension.dllC:\Program Files\Nero\Nero 9\Nero CoverDesigner\CoverEdExtension.dll2250024 bytesCreated: 9/24/2009 5:07 PMModified: 9/24/2009 5:07 PMCompany: Nero AGKey: EazshellCLSID: {CB0877AB7E94407381946F992D27EFAA}Path: C:\Program Files\Shield\shieldshell.dllC:\Program Files\Shield\shieldshell.dll36864 bytesCreated: 11/3/2011 1:31 PM

Modified: 11/4/2010 10:27 AMCompany:Key: EPPCLSID: {09A4786011B04DA5AFA526D86198A780}Path: c:\PROGRA~1\MI8079~1\shellext.dllc:\PROGRA~1\MI8079~1\shellext.dll301128 bytesCreated: 6/15/2011 3:16 PMModified: 6/15/2011 3:16 PMCompany: Microsoft CorporationKey: Shell Extension for Malware scanning

CLSID: {45AC268802534ED897DEB5370FA7D48A}Path: C:\Program Files\Avira\AntiVir Desktop\shlext.dllC:\Program Files\Avira\AntiVir Desktop\shlext.dll150480 bytesCreated: 4/14/2012 9:32 PMModified: 1/31/2012 8:57 AMCompany: Avira Operations GmbH & Co. KGKey: XXX Groove GFS Context Menu Handler XXXCLSID: {6C46733682814E608204430CED96822D}Path: C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLLC:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL4221328 bytes

Created: 6/12/2011 11:15 AMModified: 6/12/2011 11:15 AMCompany: icrosoft Corporation

************************************************************10:46:57 PM: Scanning FOLDER\COLUMNHANDLERS No Folder\ColumnHandler entries found to scan

************************************************************


10/403

10:46:58 PM: Scanning BROWSER HELPER OBJECTS Key: {7285316130C54D22B7F90BBC1D38A37E}BHO: C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLLC:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL file already scannedKey: {8D10F6C40E014BD4860111AC1FDF8126}BHO: C:\Program Files\Bluetooth Suite\IEPlugIn.dllC:\Program Files\Bluetooth Suite\IEPlugIn.dll51872 bytesCreated: 8/2/2011 2:06 PMModified: 8/2/2011 2:06 PMCompany: Atheros CommnucationsKey: {B4F3A8350E214959BA2242B3008E02FF}BHO: C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLLC:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL561552 bytesCreated: 12/21/2010 1:05 AMModified: 12/21/2010 1:05 AMCompany: Microsoft Corporation

************************************************************10:46:58 PM: Scanning SHELLSERVICEOBJECTS

************************************************************10:46:58 PM: Scanning SHAREDTASKSCHEDULER ENTRIES No SharedTaskScheduler entries found to scan

************************************************************10:46:58 PM: Scanning IMAGEFILE DEBUGGERS No "Debugger" entries found.

************************************************************10:46:58 PM: Scanning APPINIT_DLLS The AppInit_DLLs value is blank or does not exist

************************************************************10:46:59 PM: Scanning SECURITY PROVIDER DLLS

************************************************************10:46:59 PM: Scanning COMMON STARTUP GROUP [C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup]The Common Startup Group attempts to load the following file(s) at boot time:C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.iniHS 174 bytesCreated: 7/14/2009 11:41 AMModified: 7/14/2009 11:41 AMCompany: [no info]

************************************************************10:46:59 PM: Scanning USER STARTUP GROUPS Checking Startup Group for: ADMIN[C:\Users\ADMIN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup]C:\Users\ADMIN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.iniHS 174 bytesCreated: 9/30/2011 9:18 AMModified: 10/3/2011 11:32 AM


11/403

Company: [no info]Checking Startup Group for: USER[C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup]C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.iniHS 174 bytesCreated: 10/6/2011 3:46 PMModified: 3/20/2012 12:37 PMCompany: [no info]

************************************************************10:47:00 PM: Scanning SCHEDULED TASKS Taskname: {11AB47D9BB174D00B4222641E30D181C}File: c:\program files\mozilla firefox\firefox.exec:\program files\mozilla firefox\firefox.exe924600 bytesCreated: 9/30/2011 11:19 AMModified: 4/8/2012 8:50 PMCompany: Mozilla Corporationarameters: http://www.skype.com/go/downloadg?source=lightinstaller&ver=5.8.0.158.259&LastError=12002

Schedule: At task creation/modificationNext Run Time:Status: ReadyCreator: SkypeSetupLightComments:Taskname: {65A7DF39B5AB474DA8CCFE71AD4F90DA}File: c:\program files\mozilla firefox\firefox.exec:\program files\mozilla firefox\firefox.exe924600 bytesCreated: 9/30/2011 11:19 AMModified: 4/8/2012 8:50 PMCompany: Mozilla Corporation

Parameters: http://www.skype.com/go/downloading?source=lightinstaller&ver=5.8.0.158.259&LastError=12002Schedule: At task creation/modificationNext Run Time:Status: ReadyCreator: SkypeSetupLightComments:Taskname: {C90587A9733C48DFBC48E12CCA883122}File: c:\program files\mozilla firefox\firefox.exec:\program files\mozilla firefox\firefox.exe924600 bytesCreated: 9/30/2011 11:19 AM

Modified: 4/8/2012 8:50 PMCompany: Mozilla CorporationParameters: http://ui.skype.com/ui/0/5.8.0.158.259/en/abandoninstall?page=tsMainSchedule: At task creation/modificationNext Run Time:Status: ReadyCreator: SkypeSetupComments:


12/403

Taskname: {E5F53081305B4CDF84A0F1B730B6C3E6}File: c:\program files\mozilla firefox\firefox.exec:\program files\mozilla firefox\firefox.exe924600 bytesCreated: 9/30/2011 11:19 AMModified: 4/8/2012 8:50 PMCompany: Mozilla CorporationParameters: http://www.skype.com/go/downloading?source=lightinstaller&ver=5.8.0.158.259&LastError=12002Schedule: At task creation/modificationNext Run Time:Status: ReadyCreator: SkypeSetupLightComments:Taskname: MirageAgentFile: C:\Program Files\CyberLink\YouCam\YCMMirage.exeC:\Program Files\CyberLink\YouCam\YCMMirage.exe136488 bytesCreated: 7/6/2011 8:13 PMModified: 7/6/2011 8:13 PMCompany: CyberLinkSchedule: At logonNext Run Time:

Status: RunningCreator: CyberLinkComments:

************************************************************10:47:01 PM: Scanning SHELLICONOVERLAYIDENTIFIERS Key: Groove Explorer Icon Overlay 1 (GFS Unread Stub)CLSID: {99FD978CD2874F50827FB2C658EDA8E7}File: C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLLKey: Groove Explorer Icon Overlay 2 (GFS Stub)CLSID: {AB5C56007E6E4B0691979ECEF74D31CC}

File: C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLLKey: Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)CLSID: {920E6DB199074370B3A0BAFC03D81399}File: C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLLKey: Groove Explorer Icon Overlay 3 (GFS Folder)CLSID: {16F3DD561AF54347846D7C10C4192619}File: C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLLKey: Groove Explorer Icon Overlay 4 (GFS Unread Mark)CLSID: {2916C86E86A643FE811243ABE6BF8DCC}File: C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL

Key: SharingPrivateCLSID: {08244EE692F047f29FC9929BAA2E7235}File: %SystemRoot%\system32\ntshrui.dllC:\Windows\system32\ntshrui.dll442880 bytesCreated: 3/19/2012 8:34 PMModified: 1/4/2012 3:58 PMCompany: Microsoft Corporation


13/403

************************************************************10:47:02 PM: Scanning DEVICE DRIVER ENTRIES Value: msacm.l3fhgFile: mp3fhg.acmC:\Windows\system32\mp3fhg.acm232448 bytesCreated: 9/30/2011 10:30 AMModified: 10/19/2006 1:05 AMCompany: Fraunhofer Institut Integrierte Schaltungen IISValue: VIDC.YV12File: yv12vfw.dllC:\Windows\syem32\yv12vfw.dll237568 bytesCreated: 9/30/2011 10:30 AMModified: 11/4/2010 1:08 AMCompany: www.helixcommunity.orgValue: msacm.ac3acmFile: ac3acm.acmC:\Windows\system32\ac3acm.acm151552 bytesCreated: 9/30/2011 10:30 AM

Modified: 3/20/2011 2:00 AMCompany: fccHandlerValue: VIDC.FFDSFile: ff_vfw.dllC:\Windows\system32\ff_vfw.dll80896 bytesCreated: 9/30/2011 10:30 AMModified: 3/29/2011 3:00 PMCompany: [no info]

************************************************************

10:47:03 PM: ADDITIONAL CHECKS Winlogon registry rootkit checks completedHeuristic checks for hidden files/drivers completedLayered Service Provider entries checks completedWindows Explorer Policies checks completedDesktop Wallpaper: C:\Users\USER\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpgC:\Users\USER\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg729698 bytes

Created: 10/6/2011 3:46 PMModified: 4/14/2012 10:30 PMCompany: [no info]Web Desktop Wallper entry is blankChecks for rogue DNS NameServers completedA Proxy Serr is enabled for Internet ExplorerProxy Server: [10.10.1.12:8080]


14/403

Additional checks completed

************************************************************10:47:04 PM: Scanning RUNNING PROCESSES

C:\Windows\System32\smss.exe69632 bytesCreated: 7/14/2009 6:11 AMModified: 7/14/2009 8:14 AMCompany: Microsoft CorporationC:\Windows\system32\csrss.exe6144 bytesCreated: 7/14/2009 6:11 AMModified: 7/14/2009 8:14 AMCompany: Microsoft CorporationC:\Windows\system32\wininit.exe96256 bytesCreated: 7/14/2009 6:36 AMModified: 7/14/2009 8:14 AMCompany: Microsoft Corporation

C:\Windows\system32\services.exe259072 bytesCreated: 7/14/2009 6:11 AMModified: 7/14/2009 8:14 AMCompany: Microsoft CorporationC:\Windows\system32\lsass.exe22528 bytesCreated: 3/19/2012 8:35 PMModified: 11/17/2011 12:29 PMCompany: Microsoft CorporationC:\Windows\system32\lsm.exe

267776 bytesCreated: 10/3/2011 10:50 AMModified: 11/20/2010 7:17 PMCompany: Microsoft CorporationC:\Windows\system32\svchost.exe20992 bytesCreated: 7/14/2009 6:19 AMModified: 7/14/2009 8:14 AMCompany: Microsoft CorporationC:\Windows\system32\WLANExt.exe77312 bytes

Created: 7/14/29 6:51 AMModified: 7/14/2009 8:14 AMCompany: icrosoft CorporationC:\Windows\system32\conhost.exe271360 bytesCreated: 9/30/2011 11:57 AMModified: 6/24/2011 11:22 AMCompany: Microsoft Corporation


15/403

C:\Windows\System32\spoolsv.exe317440 bytesCreated: 10/3/2011 10:50 AMModified: 11/20/2010 7:17 PMCompany: Microsoft CorporationC:\Program Files\Bonjour\mDNSResponder.exe349472 bytesCreated: 4/6/2011 4:20 PMModified: 4/6/2011 4:20 PMCompany: Apple Inc.C:\Program Files\Common Files\LightScribe\LSSrvc.exe73728 bytesCreated: 8/20/2009 1:34 PMModified: 8/20/2009 1:34 PMCompany: HewlettPackard CompanyC:\Windows\system32\SearchIndexer.exe427520 bytesCreated: 9/30/2011 11:57 AMModified: 5/4/2011 11:28 AMCompany: Microsoft Corporation

C:\Windows\system32\wbem\wmiprvse.exe257536 bytesCreated: 10/3/2011 10:50 AMModified: 11/20/2010 7:17 PMCompany: Microsoft CorporationC:\Program Files\Windows Media Player\wmpnetwk.exe1121792 bytesCreated: 10/3/2011 10:50 AMModified: 11/20/2010 7:17 PMCompany: Microsoft CorporationC:\Program Files\Avira\AntiVir Desktop\avshadow.exe

80336 bytesCreated: 4/14/2012 9:32 PMModified: 1/31/2012 8:57 AMCompany: Avira Operations GmbH & Co. KGC:\Windows\system32\winlogon.exe286720 bytesCreated: 10/3/2011 10:50 AMModified: 11/20/2010 7:17 PMCompany: Microsoft CorporationC:\Windows\system32\Dwm.exe92672 bytes

Created: 7/14/2009 6:24 AMModified: 7/14/2009 8:14 AMCompany: Microsoft CorporationC:\Windows\system32\taskhost.exe49152 bytesCreated: 10/3/2011 10:49 AMModified: 11/20/2010 7:17 PMCompany: Microsoft Corporation


16/403

C:\Windows\system32\taskeng.exe192000 bytesCreated: 10/3/2011 10:50 AMModified: 11/20/2010 7:17 PMCompany: Microsoft CorporationC:\Program Files\Mozilla Firefox\plugincontainer.exe16824 bytesCreated: 9/30/2011 11:19 AMModified: 4/8/2012 8:50 PMCompany: Mozilla CorporationC:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE149352 bytesCreated: 1/9/2010 9:18 PMModified: 1/9/2010 9:18 PMCompany: Microsoft CorporationC:\Windows\system32\SearchProtocolHost.exe164352 bytesCreated: 9/30/2011 11:57 AMModified: 5/4/2011 11:28 AMCompany: Microsoft Corporation

C:\Windows\system32\SearchFilterHost.exe86528 bytesCreated: 9/30/2011 11:57 AMModified: 5/4/2011 11:28 AMCompany: Microsoft CorporationC:\Program Files\Trojan Remover\Rmvtrjan.exeFileSize: 4738296[This is a Trojan Remover component]

************************************************************

10:47:08 PM: Checking HOSTS fileNo malicious entries were found in the HOSTS file

************************************************************ INTERNET EXPLORER HOME/START/SEARCH SETTINGS HKLM\Software\Microsoft\Internet Explorer\Main\"Start Page":http://go.microsoft.com/fwlink/?LinkId=69157HKLM\Software\Microsoft\Internet Explorer\Main\"Local ge":C:\Windows\System32\blank.htmHKLM\Software\Microsoft\Internet Explorer\Main\"Search Page":http://go.microsoft.com/fwlink/?LinkId=54896HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Page_URL":http://go.microsoft.com/fwlink/?LinkId=69157

HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":http://.microsoft.com/fwlink/?LinkId=54896HKCU\Software\Microsoft\Internet Explorer\Main\"Start Page":http://go.microsoft.com/fwlink/?LinkId=69157HKCU\Software\Microsoft\Internet Explorer\Main\"Local Page":C:\Windows\system32\blank.htmHKCU\Software\Microsoft\Internet Explorer\Main\"Search Page":http://go.microsoft.com/fwlink/?LinkId=54896

************************************************************


17/403

=== NO CHANGES HAVE BEEN MADE TO YOUR SYSTEM FILES ===Scan completed at: 10:47:08 PM 14 Apr 2012Total Scan time: 00:00:34************************************************************

MZP @ ! L!This program must be run under Win32$7PELlC0

@@0/.text0& .datap@,@.idata6@@.rsrcF@@'P"USVW}]


18/403

uuh@AjjBCtKtWujfV% Gfftft#0hhPAjeVb$jV


19/403

uuh@AjjBtKt E`QAPjeV$ fftGftdfdum QAbJP{+


20/403

Ct5`QAjeV,$ 7h5`QAjeV#jV\# jVM# 33_^[]UP PHuESVW}u


21/403

]uhAAjjAt


22/403

N(HA HA=dYAt5dYAjhSf#=hYAt5hYAjhrjiSB#jgS"EPV"jURSj"jV0#j5jgV"IhjjjjVW"V!jjj1S"tjPj0V "h@jh5V"Ph= jeS!ERu"Ep]AB=@Au[%AA#G~=X@AuR Al]A=T@A3ju= =D@At3f>3e>X@At,=HAu#HujjhS jjhS=HAt }fPjS{ f HAjS8 %=HAt HAUjgS&=HAu!jjhVh@AjhVV33PPug


23/403

PRSHAjS MHA3f


24/403

]uh'AAjj;t


25/403

N=hYAt5hYAjhrjfSJjeS hjh5V4jPjhCVH@AzP@AtP Ap]A(P@AjS


26/403

PHu$d@AL$$-$$3


27/403

$$ C|34D$(PuC|


28/403

b$-_@@@k@@%@j@@@q @ @#@ @#@|$$$Pht$$$$$$$$$$$$6


29/403

Rb$QtC$P$0ROt7tjj$Q7$,$$3


30/403

;~$$:|$=L@AuAAL@A|$t $$ t3L@A@D$


31/403

5L@AT$


32/403

>L@At L@AL@AX|$[O|$D$$Rt$.|$#$-3$$.u&3$%\u3$$\t$$t&3$%:u$$$-L$QjjhAAhYu3D$D$P$-RL$QjhAAt$$1tt023HA3HA3HAHAHA3HA|$$$3|$U$Qhz$

3S5@@A$PhAA$Rs$QtC$Pjet$


33/403

$$=\@A$$$,u93*%@u$%$$


34/403

C$u$u&$$ $$$$0$$$Yj$$R$,Qt$


35/403

tjE@At$ HAu|$h=X@AuX@AD@AI|$u'$$t$$Pt$P@A @A|$$$|$$$ 3PttHt


36/403

D$D$D$D$$$$0$3$"ue$$0$B=At$ A"$"$$$@:t$$@$$$$$$ :t $$ $$08$$Q;tuuCB;u}tEt#hRVYEG^[]SVW dUA$t$t!3 t


37/403

%AAdUA


38/403

AA3FCD$|$tT$@FDL$@N


39/403

hX(


40/403

=E@AuoS4@@AOuThBA


41/403

D$3v$f$$$R


42/403

SVWP E;u 3{t73}tA~H~3T t@Aj3\t/u%@


43/403

3TjjhBAh uDD$L$Q$PT$RjL$Qt$b u$


44/403

4$6


45/403

[S@A@A|3@A@AHAhSP5Ajj AT%[St3T\t


46/403


47/403

RTTjdD$Pjh: 3$dSV0@A8u0@AVh@AL$QR


48/403

jSh @AD$


49/403

Pjh4^[S@Bvu3[;v d[kd3[SVWUQt?u33%"uP3W"uu;uG3,ttG"FO$t3G"L:$u(3,u

EPh@GAjjhPGAVURQPWEPR}


50/403

tju


51/403


52/403

uURQ,K3tRMQP$URhpGAMQ|;hRjujjjQYZ^[SVH&=8@Au;=


53/403

R3]SVWjg5HA=@Au:l]AjVzjjhVAh@AjhV/@AhhhV


54/403

PuRHA]StSfPjV


55/403

SePj>


56/403

N=HA[UQSVWE5TQA}=XQA=HAt ,=HAt Sh0@5HAh@A5A


57/403


58/403

NUE30PjeS hh RjQ7jhpjfSPP


59/403

Qj@Pjhj2Rj@Qjhv


60/403

PRzPh@APRPQjjStVPuFp,PXQAUXQARQPV@RMQ j2


61/403

Pj@Rjhj2Qj@Pjhj


62/403


63/403

t)jjhqjfStPVS 33_^[]USVWu}


64/403


65/403

8t8EPu


66/403

RVQh@AtS[]Pj$Uuuu


67/403


68/403


69/403

Ph@5HAh@A5ASVWP PHu$p 3739$q$q3


70/403

/u43TstSu$Tt 3 uX@A\@A@u}uhhdQAjhdQAhAAjAjdSLdp]Aj3HA3p]Al]A=HAu=HAuH@A3XEEE0=D@AtVPA3=H@A5dYAkhYAtP\=Au=HAtA HA5A3^[]SHAHAt }PjS


71/403


72/403


73/403


74/403


75/403


76/403


77/403


78/403


79/403

u]G3MURwE33CUSMK


80/403


81/403

FU


82/403


83/403

U @]U3]U @]U @]U3]U @]U @]U @]U @]


84/403


85/403

U @]U @]U3]U @]U3]


86/403


87/403


88/403


89/403


90/403


91/403


92/403


93/403


94/403


95/403


96/403


97/403

CtSRQ3C[VptRQ33C^SVW3$3T$H+='wKjjjjD$Pnt$jjjT$RL$QD$P|+D$PR |WL$QPD$PR$_^[SVWUP$


98/403


99/403

RQ,$=D$4$ulmUj@D$


100/403


101/403


102/403


103/403

BA|$u l|$tlt]USjVjjVD$jjURjSjhuD$P|$FFT$_L$Qjt$|G


104/403

T$YGL$QP]_^[SVW@ $


105/403


106/403

>u@|B:u3SVWU+ @


107/403


108/403


109/403


110/403


111/403


112/403


113/403


114/403


115/403

dCO;yD$RP$3D$|$@}


116/403

F$RP$3Fu$


117/403


118/403


119/403


120/403


121/403

rt


122/403


123/403


124/403


125/403


126/403


127/403


128/403

t;u3^[USVWMEEPUEMEPVfURV&M+MA+MME+E@


129/403


130/403

$3$PVSiPEZ^[U0tt&ASEAQM]SVWTt3Z\$3T$L$$L$


131/403

t$D$A3D$3T$L$QKu3WSdSD$PR(_^[USVWUE}


132/403


133/403


134/403


135/403


136/403

[SVW;u3


137/403


138/403


139/403

u3Q


140/403


141/403

3


142/403

HEAtEAu3S_^[USVW0t3/S+u3PF


143/403


144/403


145/403


146/403


147/403


148/403


149/403

I@


150/403


151/403


152/403


153/403


154/403


155/403

ft?tE"u:lPRuHHtu3


156/403


157/403


158/403


159/403


160/403


161/403


162/403


163/403

gT


164/403


165/403


166/403


167/403


168/403


169/403


170/403

3:u_=At A*F;uZ]_^[SVWUt;tc;wV9%/u


171/403


172/403


173/403


174/403

D$CT$SL$KCHC EAS @;Cr{vtC fD$T$RL$Q$+D$C [SVffDfKfL$fC


175/403


176/403

PbC$;$vD$VT$R [8u33YZzD$33RPD$3$T$YZ;u0H;Ju(H;Ju H


177/403

;J


178/403

uH;JuH;Ju@;Bt3SVwRPn;T$u;$[SVup


179/403


180/403


181/403


182/403


183/403


184/403


185/403


186/403

$L$T$|$


187/403

u$|$=At AT$D$@F|$uL$$9


188/403


189/403


190/403


191/403


192/403


193/403


194/403

z


195/403

o


196/403

dK0


197/403


198/403

Hp


199/403


200/403


201/403


202/403

>3eR3Pgqeu$>o F;Yeu3PD$?XD$+pEfef;eD$ veL$eL$eD$


203/403


204/403


205/403


206/403

u$Wtt{t;ev~3 kt3PD$0Xu4hU ui ANjj


207/403

D$DD$,Pt|$


208/403


209/403


210/403


211/403


212/403


213/403

F,33RPF3$T$


214/403

f~"s~"T$HD$,-qD


215/403


216/403

Jq(FAF0Uw0


217/403


218/403

D$,vpD


219/403


220/403

3


221/403


222/403


223/403


224/403


225/403

\L$+L$


226/403

|$|$


227/403

tT$D$,oT$D$L$VW$t _^t$3$|$3;|$}T$D$,nO3+L$


228/403


229/403


230/403


231/403

eeFL$D$,T$


232/403

offfef;>ts~zu+FAF0ue AGF0PhPUR


233/403


234/403

mae AF3PD$0VXzee;eu;ewJFh$FA h|PURFe


235/403

A1F3PD$0XD$%=>w >u3 >


236/403

>>>/3/t\u\=At AyF;uBff/tf\uf\f8u_^[SVWP


237/403


238/403

T$L$


239/403


240/403


241/403

$$PjBt+Bx0u3$Rj\t3Z^[USVWs0M


242/403


243/403


244/403

3B;w]_^[RJUSVWMUEE8}33ieAUi}uifAt2FSEEofEIoo}tUg3@uEV0^0Dy?E,/Ca33


245/403

@|B|i4FAeAUg}i4FAfA


246/403

t3ME_^[]USVWEp>U}zuK>}tt}zuGu3 Et


247/403


248/403


249/403

Up>tu*[ee+KKRP3Vtn}{u .G


250/403

E


251/403

EUV UV$


252/403


253/403


254/403

P


255/403


256/403

EM}UEaE []SVWU $3D$D$


257/403

D$a3339$3,$\


258/403

|=


259/403

0D$3ThAT$


260/403

0BD$3ThAT$


261/403

0BD$3ThAT$


262/403

0BD$jAD$


263/403

0D$|$t1;T$3\|


264/403

0@|B;T$|3\|


265/403

0@|BD$y;|D$y3ThA0T


266/403

3T hA0T3ThA0T3ThA0TB;T$}3\|


267/403

0@|B;T$|3:%3


268/403

@|BA;T$}|uF3;T$}~i,]_^[SVW$33$3zA>A2zRA>A22TA|@|_^[SVWPT$$ $T$


269/403


270/403

D$\$@3C\$


271/403

CD$\$@3C\$


272/403

CD$\$@


273/403

3C


274/403

\$


275/403

C


276/403

3L$>zAD$B


277/403

@>~AD$ B@>AD$$B@>AD$(D$\$ 3\$$3\$(3\$AD$,B>zAD$03


278/403

@>AD$8B@>AD$~AD$H3


279/403

@>AD$PD$D\$H3\$L3\$P3\$@A


280/403

D$TB


281/403

>zAD$XB@>~AD$\B@>AD$`3B>AD$dD$X\$\3\$`3\$d3\$TD$


282/403

3p


283/403

s


284/403

r


285/403

v3>A|$hz>zA>A>~A|$lz


286/403

3t$h3t$l3ZrA>A|$pz>zA>A>~A|$t3t$p3t$t3rZzvA>


287/403

>zA>A>~A|$|z3t$x3t$|3rZ


288/403

vA


289/403

>A$z>zA>A>~A$3$3$3L$|$O$$$$$$$3


290/403

3C


291/403

$C


292/403

3iAB


293/403

@iAAB@iAAB@iAABiAA3BiAAB


294/403

@iAAB@iAABiAAB@iAA 3BiAAB


295/403

@iAAB


296/403

iAA


297/403

B@iAAB@iAARiAA$$$$$$$3$$P$3QP$$J$3HJ$


298/403

$3B


299/403

A


300/403

_^[SVW34@t333u3 jAt 33B|3t3


301/403

L3


302/403

AvA


303/403

@rA


304/403

?nA


305/403

>jAtL3


306/403

@vA


307/403

?rA


308/403

>nA


309/403

AjA332tB332+3iAt3ttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttAttttttttttttAAtAttttttt?AtttttttttttttttttttAttttAtttttttttttt>tttAttttttt@t?ttAtttttttttttttttttttAtt@AtttttttttAttttttttt>AAttt>AtttttttttthNAttjjjtttt/Pttttt$$44ttt


310/403

tttttttttt$tttt$3utD$xttttAAAA$


311/403

ttt


312/403

ttt


313/403

tD$At|HutA+ttt|btt$


314/403


315/403


316/403


317/403


318/403


319/403


320/403


321/403


322/403


323/403


324/403


325/403

[[[[


326/403

ttttttttLtttAtt


327/403

[


328/403

fff$


329/403

tt$WLWtyt$


330/403

5[WWtytjyt$'SSSSStttttt$^[ZHutthttttt$ftttttttttf;t$ttttt$tttttttt@AtHutttttt|[


331/403


332/403


333/403


334/403

ttttttttttttttttttYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY>Y$


335/403


336/403


337/403


338/403


339/403


340/403


341/403


342/403


343/403


344/403


345/403


346/403

Y$$$$$AYYYYYYYYYY3Y$


347/403

YYYYYYYYYYYY>Y$YYYYYYYYYYYYYYYYYYY?t$$ PYYR$ YYYYYYYYYYYY$0000'YYYYYYYYYYFAKYYYYYYYYYYtYYYYYYYYYYYYYYYYYYYYYYYYYYAKAYYYYYYYYYYY


348/403

YYQYTYYY?tYYP| Y 3YYYYYYY


349/403

Y|34YYYYYYYYYYYYYY


350/403

|YYYYY


351/403

YYYYYYYYYYAYYYYYYYYY|YY,YYYYYYYYYYYY


352/403

YYYYYYYYYYYYYYYYYYYyYYYYtYYYYYYYYYYYt


353/403

YY


354/403

YYYYYYYYYY>Y$YYYYTYYYYYYYYYxYYYYYYYY4YYYY3YYYYYYYTYYYYYYYYYYTYYYYYYYYYYYYYYYYYYY


355/403

ltYYYYYYY


356/403

YYlY


357/403

YYYYYYYYTYYY@*|YYYYYYYYYYYt'YYYYh>Y$YYYYYYYYYYYY0YYt'YYYYYY


358/403

Y|


359/403


360/403

YY4


361/403

YYYYt4tt|YT


362/403

TYYY@(5YY4


363/403

YYYYYYYYYtYYY#t


364/403

YYYYYYYYYYYYYY


365/403

YYYYYx3


366/403

YY4TtYY


367/403

$


368/403


369/403


370/403


371/403

YYY4t


372/403

@


373/403


374/403

YYY$


375/403


376/403

YYY


377/403


378/403

t4YYYttT


379/403


380/403

YTY@P5$YY


381/403

Y@ [@@YY|YY@


382/403

YYYlYPYSVWUVYyY?;vT


383/403

YYY


384/403


385/403


386/403

YYYYY:YYYYYBLLLL,YYYYYTYY;Y


387/403


388/403


389/403

YY


390/403


391/403


392/403

Y$Y====YYYYYYYY$Y


393/403


394/403


395/403

34K$KYC3KYYKC3J$JYYY4YYYYYf3YYYT[YVYY!


396/403

LLLLYYYYtSLY^[SYDhL$YYYYYYY


397/403

Y{YYY_JYFJYFJ3Y3N0{


398/403

t{


399/403

YYYuY


400/403

Y%


401/403

0sN


402/403

0t o@CV


403/403

CnI]_^[SVWU$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$N$$$$$$$$$$$$$$$($$$$$$$$$EEEEEEEEEEEEEE$$$$$$$$$$$$$ $ $$$$$$$$

wrap up malaria

Documents