Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

malware removal help [Closed]

Started by sarahs , Jun 09 2009 05:22 AM

This topic is locked

#1
sarahs

Posted 09 June 2009 - 05:22 AM

Member

Member
28 posts

Hi, im following up to this thread
http://www.geekstogo...lp-t241799.html

ive run allsorts but it wont allow me to open malwarebytes so i was unable to run this, also it wont let me do a windows update, i have tried everything else.

Here is my OLT

OTL logfile created on: 08/06/2009 18:55:04 - Run 1
OTL by OldTimer - Version 2.1.1.0 Folder = C:\Documents and Settings\xp\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

510.41 Mb Total Physical Memory | 123.97 Mb Available Physical Memory | 24.29% Memory free
1.22 Gb Paging File | 0.85 Gb Available in Paging File | 69.70% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 298.08 Gb Total Space | 281.14 Gb Free Space | 94.32% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: SARAH-UXDV5WVLU
Current User Name: xp
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Standard
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - [2009/02/25 14:27:41 | 00,602,112 | ---- | M] (ATI Technologies Inc.) -- C:\windows\system32\Ati2evxx.exe
PRC - [2009/02/25 14:27:41 | 00,602,112 | ---- | M] (ATI Technologies Inc.) -- C:\windows\system32\Ati2evxx.exe
PRC - [2009/04/01 15:46:23 | 00,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2008/04/13 17:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\windows\Explorer.EXE
PRC - [2009/03/02 13:10:30 | 00,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2006/10/23 05:50:35 | 00,046,640 | R--- | M] (AOL LLC) -- C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
PRC - [2009/05/22 00:26:14 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2003/08/27 10:29:46 | 00,065,536 | ---- | M] (America Online, Inc.) -- C:\windows\wanmpsvc.exe
PRC - [2009/04/17 09:57:30 | 00,466,689 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avscan.exe
PRC - [2009/04/17 09:57:30 | 00,466,689 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avscan.exe
PRC - [2009/05/21 21:44:56 | 00,274,224 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\uTorrent\uTorrent.exe
PRC - [2009/04/23 23:00:56 | 00,307,704 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/06/08 18:54:41 | 00,501,760 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\xp\Desktop\OTL.exe

========== Win32 Services (SafeList) ==========

SRV - [2009/04/01 15:46:23 | 00,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService [Auto | Running])
SRV - [2009/03/02 13:10:30 | 00,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService [Auto | Running])
SRV - [2006/10/23 05:50:35 | 00,046,640 | R--- | M] (AOL LLC) -- C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe -- (AOL ACS [Auto | Running])
SRV - [2009/02/25 14:27:41 | 00,602,112 | ---- | M] (ATI Technologies Inc.) -- C:\windows\system32\Ati2evxx.exe -- (Ati HotKey Poller [Auto | Running])
SRV - [2009/02/25 15:15:00 | 00,593,920 | ---- | M] () -- C:\WINDOWS\system32\ati2sgag.exe -- (ATI Smart [Disabled | Stopped])
SRV - [2008/04/13 17:12:02 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\windows\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2009/05/22 00:26:14 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService [Auto | Running])
SRV - [2009/06/01 21:32:53 | 01,005,904 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service [Disabled | Stopped])
SRV - [2007/06/29 19:16:56 | 00,800,040 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe -- (NBService [Disabled | Stopped])
SRV - [2007/06/27 19:04:00 | 00,279,848 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService [Disabled | Stopped])
SRV - [2007/01/19 12:54:14 | 00,097,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\MSN Messenger\usnsvc.exe -- (usnjsvc [On_Demand | Stopped])
SRV - [2003/08/27 10:29:46 | 00,065,536 | ---- | M] (America Online, Inc.) -- C:\windows\wanmpsvc.exe -- (WANMiniportService [Auto | Running])
SRV - [2006/10/18 20:05:24 | 00,913,408 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])

========== Driver Services (SafeList) ==========

DRV - [2009/05/21 21:33:06 | 00,008,552 | ---- | M] (Windows ® 2000 DDK provider) -- C:\windows\System32\drivers\asctrm.sys -- (ASCTRM [Auto | Running])
DRV - [2009/02/25 15:58:57 | 03,565,568 | ---- | M] (ATI Technologies Inc.) -- C:\windows\system32\DRIVERS\ati2mtag.sys -- (ati2mtag [On_Demand | Running])
DRV - [2009/02/13 12:35:05 | 00,011,608 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio [System | Running])
DRV - [2009/03/24 16:08:22 | 00,055,640 | ---- | M] (Avira GmbH) -- C:\windows\system32\DRIVERS\avgntflt.sys -- (avgntflt [Auto | Running])
DRV - [2009/03/30 10:33:07 | 00,096,104 | ---- | M] (Avira GmbH) -- C:\windows\system32\DRIVERS\avipbb.sys -- (avipbb [System | Running])
DRV - [2005/10/26 10:01:02 | 00,142,720 | ---- | M] (Broadcom Corporation) -- C:\windows\System32\DRIVERS\b57xp32.sys -- (b57w2k [On_Demand | Running])
DRV - [2008/04/13 09:36:05 | 00,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) -- C:\windows\system32\DRIVERS\HDAudBus.sys -- (HDAudBus [On_Demand | Running])
DRV - [2007/04/26 09:23:08 | 00,267,520 | ---- | M] (Conexant Systems, Inc.) -- C:\windows\system32\DRIVERS\HSFHWBS2.sys -- (HSFHWBS2 [On_Demand | Running])
DRV - [2007/04/26 09:23:44 | 00,988,032 | ---- | M] (Conexant Systems, Inc.) -- C:\windows\system32\DRIVERS\HSF_DPV.sys -- (HSF_DPV [On_Demand | Running])
DRV - [2005/09/23 18:56:28 | 03,966,976 | ---- | M] (Realtek Semiconductor Corp.) -- C:\windows\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService [On_Demand | Running])
DRV - [2005/08/04 05:51:58 | 00,026,112 | ---- | M] (Integrated Technology Express, Inc.) -- C:\windows\system32\DRIVERS\iteraid.sys -- (iteraid [Boot | Running])
DRV - [2006/06/19 06:26:58 | 00,012,672 | ---- | M] (Conexant) -- C:\windows\system32\DRIVERS\mdmxsdk.sys -- (mdmxsdk [Auto | Running])
DRV - [2001/08/17 13:57:38 | 00,016,128 | ---- | M] (Microsoft Corporation) -- C:\windows\system32\drivers\MODEMCSA.sys -- (MODEMCSA [On_Demand | Running])
DRV - [2003/03/31 05:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\windows\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2008/04/13 09:39:15 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\windows\System32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped])
DRV - [2009/02/13 12:50:02 | 00,028,376 | ---- | M] (Avira GmbH) -- C:\windows\system32\DRIVERS\ssmdrv.sys -- (ssmdrv [System | Running])
DRV - [2007/05/02 11:11:16 | 00,083,592 | ---- | M] (MCCI Corporation) -- C:\windows\system32\DRIVERS\ss_bus.sys -- (ss_bus [On_Demand | Stopped])
DRV - [2007/05/02 11:11:18 | 00,015,112 | ---- | M] (MCCI Corporation) -- C:\windows\system32\DRIVERS\ss_mdfl.sys -- (ss_mdfl [On_Demand | Stopped])
DRV - [2007/05/02 11:11:18 | 00,109,704 | ---- | M] (MCCI Corporation) -- C:\windows\system32\DRIVERS\ss_mdm.sys -- (ss_mdm [On_Demand | Stopped])
DRV - [2009/06/02 17:01:24 | 00,005,632 | ---- | M] () -- C:\windows\System32\drivers\StarOpen.sys -- (StarOpen [System | Running])
DRV - [2003/01/10 16:13:04 | 00,033,588 | ---- | M] (America Online, Inc.) -- C:\windows\system32\DRIVERS\wanatw4.sys -- (wanatw [On_Demand | Running])
DRV - [2007/04/26 09:23:04 | 00,731,136 | ---- | M] (Conexant Systems, Inc.) -- C:\windows\system32\DRIVERS\HSF_CNXT.sys -- (winachsf [On_Demand | Running])

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn...st/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn...st/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://virginmedia.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Ask"
FF - prefs.js..browser.search.order.1: "Ask"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.co.uk/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: [email protected]:1.03.01
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.10
FF - prefs.js..keyword.URL: "http://toolbar.ask.c...7&gct=&gc=1&q="

FF - HKLM\software\mozilla\Firefox\extensions\\[email protected]: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009/05/22 00:26:15 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009/05/27 02:10:12 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009/05/29 12:16:55 | 00,000,000 | ---D | M]

[2009/05/21 22:33:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\xp\Application Data\mozilla\Extensions
[2009/05/21 21:09:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\xp\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/05/21 22:33:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\xp\Application Data\mozilla\Extensions\[email protected]
[2009/06/07 06:32:30 | 00,000,000 | ---D | M] -- C:\Documents and Settings\xp\Application Data\mozilla\Firefox\Profiles\hoxyw94x.default\extensions
[2009/05/22 17:55:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\xp\Application Data\mozilla\Firefox\Profiles\hoxyw94x.default\extensions\[email protected]
[2009/05/21 21:46:44 | 00,000,681 | ---- | M] () -- C:\Documents and Settings\xp\Application Data\Mozilla\FireFox\Profiles\hoxyw94x.default\searchplugins\ask.xml
[2009/06/08 06:45:02 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2009/05/21 21:08:38 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/05/21 22:25:29 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
[2009/05/22 00:26:23 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2009/04/23 23:00:58 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/04/23 23:00:58 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2008/01/04 08:36:50 | 00,001,538 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2006/07/05 11:47:38 | 00,002,193 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2008/01/04 08:36:50 | 00,000,947 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2008/03/08 02:35:22 | 00,001,534 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2008/09/22 12:14:04 | 00,000,759 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2008/04/15 21:08:20 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2008/03/28 11:11:14 | 00,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2008/01/04 08:36:50 | 00,000,831 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: (734 bytes) - C:\windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - Reg Error: Key error. File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKCU\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.m...ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.6,85.255.112.68
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Interfaces\{85A5196B-FF0E-4C2A-A0B3-E2D6EFAC2BD6}\\NameServer = 85.255.112.6,85.255.112.68
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\windows\system32\Ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/05 23:26:09 | 00,000,370 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]
O33 - MountPoints2\{45284ee1-43d2-11de-9632-806d6172696f}\Shell - "" = Autorun
O33 - MountPoints2\{45284ee1-43d2-11de-9632-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{45284ee1-43d2-11de-9632-806d6172696f}\Shell\AutoRun\command - "" = C:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RECYCLER\S-2-9-50-100029363-100003527-100026996-4265.com c:\
O33 - MountPoints2\{45284ee1-43d2-11de-9632-806d6172696f}\Shell\Open\command - "" = RECYCLER\S-2-9-50-100029363-100003527-100026996-4265.com c:\
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\windows\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - * [2009/06/08 18:49:35 | 00,000,000 | ---D | M]
O34 - HKLM BootExecute: (lsdelete) - C:\windows\System32\lsdelete.exe ()

========== Files/Folders - Created Within 30 Days ==========

[2 C:\windows\System32\*.tmp files]
[4 C:\windows\*.tmp files]
[2009/06/08 18:56:32 | 03,371,384 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\xp\Desktop\mbam-setup.exe
[2009/06/08 18:54:40 | 00,501,760 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\xp\Desktop\OTL.exe
[2009/06/08 18:52:45 | 00,000,000 | ---D | C] -- C:\windows\ERDNT
[2009/06/08 18:52:19 | 00,000,611 | ---- | C] () -- C:\Documents and Settings\xp\Desktop\NTREGOPT.lnk
[2009/06/08 18:52:19 | 00,000,592 | ---- | C] () -- C:\Documents and Settings\xp\Desktop\ERUNT.lnk
[2009/06/08 18:52:19 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2009/06/08 18:51:53 | 00,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\xp\Desktop\erunt_setup.exe
[2009/06/05 19:17:43 | 00,032,128 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\usbccgp.sys
[2009/06/05 13:11:57 | 00,000,370 | RHS- | C] () -- C:\autorun.inf
[2009/06/05 13:11:49 | 00,000,266 | -H-- | C] () -- C:\windows\tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job
[2009/06/05 13:11:46 | 00,000,000 | ---D | C] -- C:\Program Files\FreeHDplay
[2009/06/03 13:46:20 | 00,636,025 | R--- | C] () -- C:\Documents and Settings\xp\Desktop\Bejeweled.zip
[2009/06/02 22:37:33 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\Application Data\Malwarebytes
[2009/06/02 22:37:30 | 00,019,096 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys
[2009/06/02 22:37:30 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/06/02 22:37:29 | 00,040,160 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbamswissarmy.sys
[2009/06/02 22:37:28 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/06/02 22:37:27 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/06/02 17:56:45 | 00,000,000 | ---D | C] -- C:\windows\Minidump
[2009/06/02 17:10:10 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\My Documents\My Art
[2009/06/02 17:10:09 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\Application Data\Samsung
[2009/06/02 16:54:37 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\LauncherAccess.dt
[2009/06/02 16:53:27 | 00,174,592 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\framedyn.dll
[2009/06/02 16:53:08 | 00,109,704 | ---- | C] (MCCI Corporation) -- C:\windows\System32\drivers\ss_mdm.sys
[2009/06/02 16:53:08 | 00,083,592 | ---- | C] (MCCI Corporation) -- C:\windows\System32\drivers\ss_bus.sys
[2009/06/02 16:53:08 | 00,015,112 | ---- | C] (MCCI Corporation) -- C:\windows\System32\drivers\ss_mdfl.sys
[2009/06/02 16:53:08 | 00,012,424 | ---- | C] (MCCI Corporation) -- C:\windows\System32\drivers\ss_whnt.sys
[2009/06/02 16:53:08 | 00,012,424 | ---- | C] (MCCI Corporation) -- C:\windows\System32\drivers\ss_wh.sys
[2009/06/02 16:53:08 | 00,012,424 | ---- | C] (MCCI Corporation) -- C:\windows\System32\drivers\ss_cmnt.sys
[2009/06/02 16:53:08 | 00,012,424 | ---- | C] (MCCI Corporation) -- C:\windows\System32\drivers\ss_cm.sys
[2009/06/02 16:53:08 | 00,000,000 | ---D | C] -- C:\windows\System32\Samsung_USB_Drivers
[2009/06/02 16:52:56 | 00,000,766 | ---- | C] () -- C:\windows\System32\Uninstall.ico
[2009/06/02 16:52:47 | 00,005,632 | ---- | C] () -- C:\windows\System32\drivers\StarOpen.sys
[2009/06/02 16:52:36 | 00,000,673 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Samsung PC Studio 3.lnk
[2009/06/02 16:52:35 | 00,000,000 | ---D | C] -- C:\Program Files\Samsung
[2009/05/28 21:45:12 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\Application Data\Systweak
[2009/05/28 21:44:39 | 00,000,684 | ---- | C] () -- C:\Documents and Settings\xp\Desktop\Advanced System Optimizer.lnk
[2009/05/28 21:44:34 | 00,000,000 | ---D | C] -- C:\Program Files\Advanced System Optimizer
[2009/05/28 21:30:54 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2009/05/28 21:17:49 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe AIR
[2009/05/28 21:17:25 | 00,001,729 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2009/05/28 21:17:09 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Adobe
[2009/05/28 21:16:17 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2009/05/28 21:16:17 | 00,000,000 | ---D | C] -- C:\Program Files\Adobe
[2009/05/28 21:11:54 | 00,000,000 | ---D | C] -- C:\Program Files\NOS
[2009/05/28 21:11:54 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NOS
[2009/05/26 23:30:56 | 00,000,761 | ---- | C] () -- C:\Documents and Settings\xp\Desktop\IsoBuster.lnk
[2009/05/26 23:30:54 | 00,000,000 | ---D | C] -- C:\Program Files\Smart Projects
[2009/05/26 23:26:14 | 00,000,967 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Medieval CUE Splitter.lnk
[2009/05/26 23:26:13 | 00,000,000 | ---D | C] -- C:\Program Files\Medieval Software
[2009/05/26 23:23:31 | 00,001,732 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\WinZip.lnk
[2009/05/26 23:23:22 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2009/05/26 23:23:18 | 00,000,000 | ---D | C] -- C:\Program Files\WinZip
[2009/05/26 23:22:30 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\Application Data\WinRAR
[2009/05/26 23:22:07 | 00,000,692 | ---- | C] () -- C:\Documents and Settings\xp\Desktop\WinRAR.lnk
[2009/05/26 23:21:54 | 00,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2009/05/26 22:14:56 | 00,000,000 | ---D | C] -- C:\windows\Sun
[2009/05/26 18:38:07 | 00,202,776 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wuweb.dll
[2009/05/26 18:38:07 | 00,202,776 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wuweb.dll
[2009/05/26 14:26:01 | 00,000,000 | ---- | C] () -- C:\boot.ini
[2009/05/25 21:37:15 | 00,015,688 | ---- | C] () -- C:\windows\System32\lsdelete.exe
[2009/05/25 21:29:52 | 00,000,472 | ---- | C] () -- C:\windows\tasks\Ad-Aware Update (Weekly).job
[2009/05/25 21:28:35 | 00,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
[2009/05/25 21:28:34 | 00,000,867 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2009/05/25 21:28:27 | 00,000,000 | ---D | C] -- C:\Program Files\Lavasoft
[2009/05/25 21:28:27 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Lavasoft
[2009/05/23 19:00:18 | 00,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0
[2009/05/23 17:43:20 | 00,054,156 | -H-- | C] () -- C:\windows\QTFont.qfn
[2009/05/23 17:43:20 | 00,001,409 | ---- | C] () -- C:\windows\QTFont.for
[2009/05/23 17:42:37 | 00,000,000 | ---D | C] -- C:\Program Files\SoundSpectrum
[2009/05/23 17:35:08 | 00,487,424 | ---- | C] () -- C:\windows\potfield.scr
[2009/05/23 17:31:19 | 00,000,025 | ---- | C] () -- C:\windows\Cannabinatic.INI
[2009/05/23 17:31:02 | 00,000,000 | ---D | C] -- C:\windows\Cannab
[2009/05/23 03:00:34 | 00,000,069 | ---- | C] () -- C:\windows\NeroDigital.ini
[2009/05/23 02:51:21 | 00,002,361 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Nero StartSmart.lnk
[2009/05/23 02:51:21 | 00,002,261 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Nero Home.lnk
[2009/05/23 02:50:57 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\Application Data\Ahead
[2009/05/23 02:50:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Ahead
[2009/05/23 02:49:23 | 00,000,000 | ---D | C] -- C:\Program Files\Nero
[2009/05/23 02:49:23 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Ahead
[2009/05/23 02:49:23 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Nero
[2009/05/23 02:48:56 | 02,388,176 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_30.dll
[2009/05/23 02:48:55 | 02,323,664 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx9_28.dll
[2009/05/22 15:51:31 | 00,000,000 | ---D | C] -- C:\Program Files\AOL
[2009/05/22 12:55:49 | 00,221,184 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wmpns.dll
[2009/05/22 01:38:07 | 00,268,648 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mucltui.dll
[2009/05/22 01:38:07 | 00,208,744 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\muweb.dll
[2009/05/22 01:38:07 | 00,027,496 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mucltui.dll.mui
[2009/05/22 01:21:01 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
[2009/05/21 23:44:40 | 00,000,000 | ---D | C] -- C:\windows\System32\Adobe
[2009/05/21 23:03:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\My Documents\My Chat Logs
[2009/05/21 22:41:29 | 00,001,586 | ---- | C] () -- C:\Documents and Settings\xp\Desktop\LimeWire PRO 5.1.2.lnk
[2009/05/21 22:33:34 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\My Documents\LimeWire
[2009/05/21 22:33:06 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\Application Data\LimeWire
[2009/05/21 22:32:41 | 00,000,000 | ---D | C] -- C:\Program Files\LimeWire
[2009/05/21 22:27:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\Desktop\Incomplete
[2009/05/21 22:26:51 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\Desktop\limewire and frostwire downloads
[2009/05/21 22:26:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\My Documents\FrostWire
[2009/05/21 22:26:35 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\Application Data\FrostWire
[2009/05/21 22:26:26 | 00,000,850 | ---- | C] () -- C:\Documents and Settings\xp\Desktop\FrostWire 4.18.0.lnk
[2009/05/21 22:25:02 | 00,000,000 | ---D | C] -- C:\Program Files\Java
[2009/05/21 22:25:01 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2009/05/21 22:24:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\Application Data\Sun
[2009/05/21 22:23:29 | 00,000,000 | ---D | C] -- C:\Program Files\FrostWire
[2009/05/21 22:09:02 | 00,000,580 | ---- | C] () -- C:\Documents and Settings\xp\My Documents\My Sharing Folders.lnk
[2009/05/21 22:08:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\My Documents\My Received Files
[2009/05/21 22:08:05 | 00,000,000 | ---D | C] -- C:\windows\System32\DRVSTORE
[2009/05/21 22:08:02 | 00,001,736 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Windows Live Messenger.lnk
[2009/05/21 22:07:59 | 00,000,000 | ---D | C] -- C:\Program Files\MSN Messenger
[2009/05/21 22:02:08 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\My Documents\Downloads
[2009/05/21 21:46:19 | 00,001,734 | ---- | C] () -- C:\Documents and Settings\xp\Desktop\HijackThis.lnk
[2009/05/21 21:46:19 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2009/05/21 21:44:56 | 00,000,630 | ---- | C] () -- C:\Documents and Settings\xp\Desktop\µTorrent.lnk
[2009/05/21 21:44:56 | 00,000,000 | ---D | C] -- C:\Program Files\uTorrent
[2009/05/21 21:44:34 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\Application Data\uTorrent
[2009/05/21 21:35:01 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\Application Data\AOL
[2009/05/21 21:34:49 | 00,000,715 | ---- | C] () -- C:\windows\aolback.exe.lnk
[2009/05/21 21:33:58 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\aolback
[2009/05/21 21:33:55 | 00,000,594 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\AOL 9.0.lnk
[2009/05/21 21:33:55 | 00,000,000 | ---D | C] -- C:\Program Files\AOL Companion
[2009/05/21 21:33:47 | 00,010,752 | ---- | C] (Almeida & Andrade Ltda) -- C:\windows\System32\aamd532.dll
[2009/05/21 21:33:46 | 01,066,176 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\MSCOMCTL.OCX
[2009/05/21 21:33:46 | 00,368,912 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\vbar332.dll
[2009/05/21 21:33:46 | 00,140,288 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\COMDLG32.OCX
[2009/05/21 21:33:46 | 00,102,400 | ---- | C] (4Developers LLC) -- C:\windows\System32\SimpleRegistry.dll
[2009/05/21 21:33:43 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\Application Data\You've Got Pictures Screensaver
[2009/05/21 21:33:42 | 00,000,000 | ---D | C] -- C:\windows\occache
[2009/05/21 21:33:42 | 00,000,000 | ---D | C] -- C:\Program Files\Learn2.com
[2009/05/21 21:33:41 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/05/21 21:33:40 | 00,000,000 | ---D | C] -- C:\Program Files\Viewpoint
[2009/05/21 21:33:36 | 01,499,136 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\shdocvw.bak
[2009/05/21 21:33:24 | 00,086,016 | ---- | C] (MindVision) -- C:\windows\unvise32qt.exe
[2009/05/21 21:33:19 | 00,000,724 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2009/05/21 21:33:18 | 00,000,000 | ---D | C] -- C:\windows\System32\QuickTime
[2009/05/21 21:33:18 | 00,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2009/05/21 21:33:18 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\QuickTime
[2009/05/21 21:33:12 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Nullsoft
[2009/05/21 21:33:06 | 00,000,000 | ---D | C] -- C:\My Music
[2009/05/21 21:33:03 | 00,157,696 | ---- | C] (RealNetworks) -- C:\windows\System32\rmoc3260.dll
[2009/05/21 21:33:01 | 00,278,528 | ---- | C] (Real Networks, Inc) -- C:\windows\System32\pncrt.dll
[2009/05/21 21:33:01 | 00,000,000 | ---D | C] -- C:\Program Files\Real
[2009/05/21 21:33:00 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Real
[2009/05/21 21:32:39 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\AOL Downloads
[2009/05/21 21:32:37 | 00,153,088 | ---- | C] (America Online) -- C:\windows\System32\jgdwmie.dll
[2009/05/21 21:32:36 | 01,060,864 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mfc71.dll
[2009/05/21 21:32:36 | 01,044,480 | ---- | C] (eHelp Corporation.) -- C:\windows\System32\roboex32.dll
[2009/05/21 21:32:36 | 00,054,784 | ---- | C] (Blue Sky Software Corporation.) -- C:\windows\System32\Inetwh32.dll
[2009/05/21 21:32:36 | 00,029,184 | ---- | C] (Blue Sky Software) -- C:\windows\System32\popup.ocx
[2009/05/21 21:32:08 | 00,499,712 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msvcp71.dll
[2009/05/21 21:32:08 | 00,348,160 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msvcr71.dll
[2009/05/21 21:32:04 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\aolshare
[2009/05/21 21:32:01 | 00,000,000 | ---D | C] -- C:\Program Files\AOL 9.0
[2009/05/21 21:32:01 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AOL
[2009/05/21 21:31:30 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\AOL
[2009/05/21 21:27:10 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\Application Data\Macromedia
[2009/05/21 21:27:09 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\Application Data\Adobe
[2009/05/21 21:26:40 | 00,000,788 | ---- | C] () -- C:\Documents and Settings\xp\Desktop\Windows Media Player.lnk
[2009/05/21 21:26:00 | 00,016,760 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\spmsg.dll
[2009/05/21 21:25:35 | 00,000,000 | ---D | C] -- C:\Program Files\Windows Media Connect 2
[2009/05/21 21:24:15 | 00,000,000 | -H-- | C] () -- C:\windows\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2009/05/21 21:24:12 | 00,000,000 | ---D | C] -- C:\windows\System32\LogFiles
[2009/05/21 21:24:12 | 00,000,000 | ---D | C] -- C:\windows\System32\drivers\UMDF
[2009/05/21 21:23:34 | 00,001,707 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Avira AntiVir Control Center.lnk
[2009/05/21 21:23:25 | 00,096,104 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avipbb.sys
[2009/05/21 21:23:25 | 00,055,640 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avgntflt.sys
[2009/05/21 21:23:25 | 00,045,416 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avgntdd.sys
[2009/05/21 21:23:25 | 00,028,376 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\ssmdrv.sys
[2009/05/21 21:23:25 | 00,022,360 | ---- | C] (Avira GmbH) -- C:\windows\System32\drivers\avgntmgr.sys
[2009/05/21 21:23:22 | 00,000,000 | ---D | C] -- C:\Program Files\Avira
[2009/05/21 21:23:22 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Avira
[2009/05/21 21:22:47 | 00,000,250 | -H-- | C] () -- C:\windows\tasks\A92DB6AF91922ED7.job
[2009/05/21 21:22:37 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Joy coal mpeg heck
[2009/05/21 21:22:22 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\Application Data\AXISBAT
[2009/05/21 21:22:11 | 00,000,000 | ---D | C] -- C:\Program Files\Circle Developemnt
[2009/05/21 21:22:10 | 00,000,000 | ---D | C] -- C:\Program Files\Messenger Plus! Live
[2009/05/21 21:20:09 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\microsoft
[2009/05/21 21:20:03 | 00,000,000 | ---D | C] -- C:\Program Files\Windows Live SkyDrive
[2009/05/21 21:19:43 | 00,000,000 | ---D | C] -- C:\Program Files\Windows Live
[2009/05/21 21:15:47 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Windows Live
[2009/05/21 21:15:11 | 05,167,952 | ---- | C] (Patchou) -- C:\Documents and Settings\xp\Desktop\MsgPlusLive-481.exe
[2009/05/21 21:09:45 | 00,000,335 | ---- | C] () -- C:\windows\nsreg.dat
[2009/05/21 21:09:43 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\Application Data\Mozilla
[2009/05/21 21:08:39 | 00,001,602 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2009/05/21 21:08:37 | 00,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2009/05/21 21:02:38 | 00,000,767 | ---- | C] () -- C:\Documents and Settings\xp\Desktop\Internet Explorer.lnk
[2009/05/21 21:02:10 | 00,000,000 | ---D | C] -- C:\windows\ie8updates
[2009/05/21 21:01:55 | 00,102,400 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\iecompat.dll
[2009/05/21 21:01:42 | 00,000,000 | ---D | C] -- C:\windows\WBEM
[2009/05/21 21:00:56 | 00,000,000 | -H-D | C] -- C:\windows\ie8
[2009/05/21 20:59:37 | 00,000,000 | -HSD | C] -- C:\RECYCLER
[2009/05/21 20:58:03 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\Application Data\MSN6
[2009/05/21 20:58:03 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\MSN6
[2009/05/21 20:57:39 | 00,000,790 | ---- | C] () -- C:\Documents and Settings\xp\Desktop\Windows Movie Maker.lnk
[2009/05/21 20:57:28 | 00,000,000 | R--D | C] -- C:\Documents and Settings\xp\My Documents\My Videos
[2009/05/21 20:57:28 | 00,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Videos
[2009/05/21 20:44:28 | 00,000,000 | ---D | C] -- C:\windows\pss
[2009/05/18 20:27:53 | 00,940,794 | ---- | C] () -- C:\windows\System32\LoopyMusic.wav
[2009/05/18 20:27:53 | 00,146,650 | ---- | C] () -- C:\windows\System32\BuzzingBee.wav
[2009/05/18 20:27:50 | 00,000,000 | ---D | C] -- C:\windows\System32\Lang
[2009/05/18 20:27:29 | 00,000,000 | ---- | C] () -- C:\windows\ativpsrm.bin
[2009/05/18 20:26:08 | 00,593,920 | ---- | C] () -- C:\windows\System32\ati2sgag.exe
[2009/05/18 20:25:58 | 00,000,000 | -H-D | C] -- C:\Program Files\InstallShield Installation Information
[2009/05/18 20:25:51 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\InstallShield
[2009/05/18 20:10:59 | 00,006,272 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\splitter.sys
[2009/05/18 20:10:59 | 00,006,272 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\splitter.sys
[2009/05/18 20:10:57 | 00,083,072 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\wdmaud.sys
[2009/05/18 20:10:57 | 00,083,072 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wdmaud.sys
[2009/05/18 20:10:56 | 00,052,864 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\DMusic.sys
[2009/05/18 20:10:56 | 00,052,864 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\dmusic.sys
[2009/05/18 20:10:54 | 00,056,576 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\swmidi.sys
[2009/05/18 20:10:54 | 00,056,576 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\swmidi.sys
[2009/05/18 20:10:53 | 00,142,592 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\aec.sys
[2009/05/18 20:10:53 | 00,142,592 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\aec.sys
[2009/05/18 20:10:52 | 00,172,416 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\kmixer.sys
[2009/05/18 20:10:52 | 00,172,416 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kmixer.sys
[2009/05/18 20:10:51 | 00,002,944 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\drmkaud.sys
[2009/05/18 20:10:51 | 00,002,944 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\drmkaud.sys
[2009/05/18 20:10:49 | 00,060,800 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\sysaudio.sys
[2009/05/18 20:10:49 | 00,060,800 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\sysaudio.sys
[2009/05/18 19:46:20 | 00,000,000 | ---D | C] -- C:\windows\System32\RTCOM
[2009/05/18 19:46:17 | 00,146,048 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\portcls.sys
[2009/05/18 19:46:17 | 00,146,048 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\portcls.sys
[2009/05/18 19:46:16 | 00,060,160 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\drmk.sys
[2009/05/18 19:46:16 | 00,060,160 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\drmk.sys
[2009/05/18 19:37:54 | 00,000,000 | ---D | C] -- C:\windows\Prefetch
[2009/05/18 19:31:14 | 00,000,000 | ---D | C] -- C:\windows\System32\scripting
[2009/05/18 19:31:14 | 00,000,000 | ---D | C] -- C:\windows\System32\en-us
[2009/05/18 19:31:13 | 00,000,000 | ---D | C] -- C:\windows\System32\en
[2009/05/18 19:31:13 | 00,000,000 | ---D | C] -- C:\windows\l2schemas
[2009/05/18 19:28:13 | 00,000,000 | ---D | C] -- C:\windows\network diagnostic
[2009/05/18 19:22:48 | 00,258,048 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmvds32.ax
[2009/05/18 19:22:48 | 00,121,856 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xmllite.dll
[2009/05/18 19:22:48 | 00,004,096 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmvdmoe2.dll
[2009/05/18 19:22:48 | 00,004,096 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmvdmod.dll
[2009/05/18 19:22:47 | 08,231,936 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmploc.dll
[2009/05/18 19:22:47 | 02,458,112 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\WMVCore.dll
[2009/05/18 19:22:47 | 01,329,152 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\WMSPDMOE.dll
[2009/05/18 19:22:47 | 00,603,648 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\WMSPDMOD.dll
[2009/05/18 19:22:47 | 00,303,616 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmstream.dll
[2009/05/18 19:22:47 | 00,278,559 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmv8ds32.ax
[2009/05/18 19:22:47 | 00,221,184 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmpns.dll
[2009/05/18 19:22:47 | 00,115,200 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmsdmoe.dll
[2009/05/18 19:22:47 | 00,099,840 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmpshell.dll
[2009/05/18 19:22:47 | 00,064,000 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmplayer.exe
[2009/05/18 19:22:47 | 00,020,480 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmpui.dll
[2009/05/18 19:22:47 | 00,010,457 | ---- | C] () -- C:\windows\System32\dllcache\wmptour.hta
[2009/05/18 19:22:47 | 00,004,096 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmsdmoe2.dll
[2009/05/18 19:22:47 | 00,004,096 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmsdmod.dll
[2009/05/18 19:22:47 | 00,001,771 | ---- | C] () -- C:\windows\System32\dllcache\wmptour.css
[2009/05/18 19:22:47 | 00,000,855 | ---- | C] () -- C:\windows\System32\dllcache\wmpocm.inf
[2009/05/18 19:22:47 | 00,000,420 | ---- | C] () -- C:\windows\System32\dllcache\wmploc.js
[2009/05/18 19:22:46 | 10,838,016 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmp.dll
[2009/05/18 19:22:46 | 00,938,496 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\WMNetmgr.dll
[2009/05/18 19:22:46 | 00,613,334 | ---- | C] () -- C:\windows\System32\dllcache\wmplayer.chm
[2009/05/18 19:22:46 | 00,354,468 | ---- | C] () -- C:\windows\System32\dllcache\wmpaud1.wav
[2009/05/18 19:22:46 | 00,343,204 | ---- | C] () -- C:\windows\System32\dllcache\wmpaud7.wav
[2009/05/18 19:22:46 | 00,343,204 | ---- | C] () -- C:\windows\System32\dllcache\wmpaud6.wav
[2009/05/18 19:22:46 | 00,314,880 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmpdxm.dll
[2009/05/18 19:22:46 | 00,276,992 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wmphoto.dll
[2009/05/18 19:22:46 | 00,242,688 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmpasf.dll
[2009/05/18 19:22:46 | 00,227,328 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmerror.dll
[2009/05/18 19:22:46 | 00,172,196 | ---- | C] () -- C:\windows\System32\dllcache\wmpaud9.wav
[2009/05/18 19:22:46 | 00,172,196 | ---- | C] () -- C:\windows\System32\dllcache\wmpaud8.wav
[2009/05/18 19:22:46 | 00,172,196 | ---- | C] () -- C:\windows\System32\dllcache\wmpaud3.wav
[2009/05/18 19:22:46 | 00,157,184 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmidx.dll
[2009/05/18 19:22:46 | 00,096,256 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmpband.dll
[2009/05/18 19:22:46 | 00,086,196 | ---- | C] () -- C:\windows\System32\dllcache\wmpaud5.wav
[2009/05/18 19:22:46 | 00,086,180 | ---- | C] () -- C:\windows\System32\dllcache\wmpaud4.wav
[2009/05/18 19:22:46 | 00,086,180 | ---- | C] () -- C:\windows\System32\dllcache\wmpaud2.wav
[2009/05/18 19:22:46 | 00,069,612 | ---- | C] () -- C:\windows\System32\dllcache\wmplayer.adm
[2009/05/18 19:22:46 | 00,037,376 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmdmps.dll
[2009/05/18 19:22:46 | 00,033,792 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmdmlog.dll
[2009/05/18 19:22:46 | 00,029,070 | ---- | C] () -- C:\windows\System32\dllcache\wmp.inf
[2009/05/18 19:22:46 | 00,023,195 | ---- | C] () -- C:\windows\System32\dllcache\wmplay.chm
[2009/05/18 19:22:46 | 00,020,480 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmpcore.dll
[2009/05/18 19:22:46 | 00,020,480 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmpcd.dll
[2009/05/18 19:22:46 | 00,020,480 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmp.ocx
[2009/05/18 19:22:46 | 00,017,272 | ---- | C] () -- C:\windows\System32\dllcache\wmdm.inf
[2009/05/18 19:22:46 | 00,006,769 | ---- | C] () -- C:\windows\System32\dllcache\wmfsdk.inf
[2009/05/18 19:22:45 | 01,117,696 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\WMADMOE.dll
[2009/05/18 19:22:45 | 00,757,248 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\WMADMOD.dll
[2009/05/18 19:22:45 | 00,222,720 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmasf.dll
[2009/05/18 19:22:45 | 00,069,120 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wlanapi.dll
[2009/05/18 19:22:45 | 00,008,677 | ---- | C] () -- C:\windows\System32\dllcache\wm7.gif
[2009/05/18 19:22:45 | 00,007,892 | ---- | C] () -- C:\windows\System32\dllcache\wm9.gif
[2009/05/18 19:22:45 | 00,007,636 | ---- | C] () -- C:\windows\System32\dllcache\wm2.gif
[2009/05/18 19:22:45 | 00,007,369 | ---- | C] () -- C:\windows\System32\dllcache\wm4.gif
[2009/05/18 19:22:45 | 00,006,241 | ---- | C] () -- C:\windows\System32\dllcache\wm3.gif
[2009/05/18 19:22:45 | 00,006,060 | ---- | C] () -- C:\windows\System32\dllcache\wm6.gif
[2009/05/18 19:22:45 | 00,005,789 | ---- | C] () -- C:\windows\System32\dllcache\wm1.gif
[2009/05/18 19:22:45 | 00,004,193 | ---- | C] () -- C:\windows\System32\dllcache\wm8.gif
[2009/05/18 19:22:45 | 00,002,477 | ---- | C] () -- C:\windows\System32\dllcache\wm5.gif
[2009/05/18 19:22:44 | 00,712,704 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\windowscodecs.dll
[2009/05/18 19:22:44 | 00,346,112 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\windowscodecsext.dll
[2009/05/18 19:22:44 | 00,300,969 | ---- | C] () -- C:\windows\System32\dllcache\viz.wmv
[2009/05/18 19:22:44 | 00,017,489 | ---- | C] () -- C:\windows\System32\dllcache\videobg.gif
[2009/05/18 19:22:44 | 00,005,290 | ---- | C] () -- C:\windows\System32\dllcache\vidsamp.gif
[2009/05/18 19:22:42 | 00,317,440 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\unregmp2.exe
[2009/05/18 19:22:42 | 00,062,976 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\tzchange.exe
[2009/05/18 19:22:41 | 00,053,248 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\tsgqec.dll
[2009/05/18 19:22:41 | 00,050,688 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\tspkg.dll
[2009/05/18 19:22:41 | 00,023,829 | ---- | C] () -- C:\windows\System32\dllcache\tourbg.gif
[2009/05/18 19:22:41 | 00,003,187 | ---- | C] () -- C:\windows\System32\dllcache\tour.js
[2009/05/18 19:22:41 | 00,002,469 | ---- | C] () -- C:\windows\System32\dllcache\tplay.gif
[2009/05/18 19:22:41 | 00,002,450 | ---- | C] () -- C:\windows\System32\dllcache\tpause.gif
[2009/05/18 19:22:41 | 00,002,375 | ---- | C] () -- C:\windows\System32\dllcache\tplayh.gif
[2009/05/18 19:22:41 | 00,002,371 | ---- | C] () -- C:\windows\System32\dllcache\tpauseh.gif
[2009/05/18 19:22:41 | 00,001,398 | ---- | C] () -- C:\windows\System32\dllcache\taon.gif
[2009/05/18 19:22:41 | 00,001,380 | ---- | C] () -- C:\windows\System32\dllcache\taonh.gif
[2009/05/18 19:22:41 | 00,001,380 | ---- | C] () -- C:\windows\System32\dllcache\taoff.gif
[2009/05/18 19:22:41 | 00,001,367 | ---- | C] () -- C:\windows\System32\dllcache\taoffh.gif
[2009/05/18 19:22:39 | 00,086,016 | ---- | C] (Sipro Lab Telecom Inc.) -- C:\windows\System32\dllcache\sl_anet.acm
[2009/05/18 19:22:39 | 00,001,148 | ---- | C] () -- C:\windows\System32\dllcache\snd.htm
[2009/05/18 19:22:38 | 00,152,064 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\shmedia.dll
[2009/05/18 19:22:38 | 00,000,908 | ---- | C] () -- C:\windows\System32\dllcache\skins.inf
[2009/05/18 19:22:37 | 01,669,120 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\setup_wm.exe
[2009/05/18 19:22:37 | 00,032,768 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\setupn.exe
[2009/05/18 19:22:37 | 00,010,240 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\sffp_mmc.sys
[2009/05/18 19:22:36 | 00,572,557 | ---- | C] () -- C:\windows\System32\dllcache\rtuner.wmv
[2009/05/18 19:22:35 | 00,290,304 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\rhttpaa.dll
[2009/05/18 19:22:35 | 00,076,800 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\qutil.dll
[2009/05/18 19:22:35 | 00,066,725 | ---- | C] () -- C:\windows\System32\dllcache\revert.wmz
[2009/05/18 19:22:35 | 00,061,952 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\rasqec.dll
[2009/05/18 19:22:34 | 00,412,160 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\photometadatahandler.dll
[2009/05/18 19:22:34 | 00,291,328 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\qagentrt.dll
[2009/05/18 19:22:34 | 00,150,528 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\qagent.dll
[2009/05/18 19:22:34 | 00,077,307 | ---- | C] () -- C:\windows\System32\dllcache\plyr_err.chm
[2009/05/18 19:22:34 | 00,062,464 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\qcliprov.dll
[2009/05/18 19:22:34 | 00,001,477 | ---- | C] () -- C:\windows\System32\dllcache\plylst6.wpl
[2009/05/18 19:22:34 | 00,001,477 | ---- | C] () -- C:\windows\System32\dllcache\plylst5.wpl
[2009/05/18 19:22:34 | 00,001,474 | ---- | C] () -- C:\windows\System32\dllcache\plylst3.wpl
[2009/05/18 19:22:34 | 00,001,451 | ---- | C] () -- C:\windows\System32\dllcache\plylst12.wpl
[2009/05/18 19:22:34 | 00,001,448 | ---- | C] () -- C:\windows\System32\dllcache\plylst4.wpl
[2009/05/18 19:22:34 | 00,001,250 | ---- | C] () -- C:\windows\System32\dllcache\plylst1.wpl
[2009/05/18 19:22:34 | 00,001,049 | ---- | C] () -- C:\windows\System32\dllcache\plylst2.wpl
[2009/05/18 19:22:34 | 00,001,046 | ---- | C] () -- C:\windows\System32\dllcache\plylst7.wpl
[2009/05/18 19:22:34 | 00,001,036 | ---- | C] () -- C:\windows\System32\dllcache\plylst8.wpl
[2009/05/18 19:22:34 | 00,000,789 | ---- | C] () -- C:\windows\System32\dllcache\plylst11.wpl
[2009/05/18 19:22:34 | 00,000,787 | ---- | C] () -- C:\windows\System32\dllcache\plylst10.wpl
[2009/05/18 19:22:34 | 00,000,784 | ---- | C] () -- C:\windows\System32\dllcache\plylst9.wpl
[2009/05/18 19:22:34 | 00,000,783 | ---- | C] () -- C:\windows\System32\dllcache\plylst13.wpl
[2009/05/18 19:22:34 | 00,000,775 | ---- | C] () -- C:\windows\System32\dllcache\plylst14.wpl
[2009/05/18 19:22:34 | 00,000,733 | ---- | C] () -- C:\windows\System32\dllcache\plylst15.wpl
[2009/05/18 19:22:32 | 00,144,384 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\onex.dll
[2009/05/18 19:22:31 | 00,375,519 | ---- | C] () -- C:\windows\System32\dllcache\nuskin.wmv
[2009/05/18 19:22:30 | 00,364,544 | ---- | C] (Microsoft Corporation (written by Digital Renaissance Inc.)) -- C:\windows\System32\dllcache\npdsplay.dll
[2009/05/18 19:22:30 | 00,226,816 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\npdrmv2.dll
[2009/05/18 19:22:30 | 00,022,060 | ---- | C] () -- C:\windows\System32\dllcache\npds.zip
[2009/05/18 19:22:30 | 00,010,240 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\npwmsdrm.dll
[2009/05/18 19:22:30 | 00,000,403 | ---- | C] () -- C:\windows\System32\dllcache\npdrmv2.zip
[2009/05/18 19:22:29 | 00,193,024 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\napmontr.dll
[2009/05/18 19:22:29 | 00,176,640 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\napstat.exe
[2009/05/18 19:22:29 | 00,030,208 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\napipsec.dll
[2009/05/18 19:22:28 | 01,307,648 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msxml6.dll
[2009/05/18 19:22:28 | 01,307,648 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\msxml6.dll
[2009/05/18 19:22:28 | 00,414,720 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\msscp.dll
[2009/05/18 19:22:28 | 00,321,536 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\mswmdm.dll
[2009/05/18 19:22:28 | 00,175,616 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\mspmsp.dll
[2009/05/18 19:22:28 | 00,155,136 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mssha.dll
[2009/05/18 19:22:28 | 00,079,872 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msxml6r.dll
[2009/05/18 19:22:28 | 00,079,872 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\msxml6r.dll
[2009/05/18 19:22:28 | 00,076,800 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msshavmsg.dll
[2009/05/18 19:22:28 | 00,069,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\msscds32.ax
[2009/05/18 19:22:28 | 00,027,136 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\mspmsnsv.dll
[2009/05/18 19:22:27 | 00,179,712 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\msnetobj.dll
[2009/05/18 19:22:25 | 00,844,314 | ---- | C] () -- C:\windows\System32\dllcache\msdxm.ocx
[2009/05/18 19:22:25 | 00,004,126 | ---- | C] () -- C:\windows\System32\dllcache\msdxmlc.dll
[2009/05/18 19:22:24 | 00,294,912 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\msaud32.acm
[2009/05/18 19:22:24 | 00,262,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\mpg4ds32.ax
[2009/05/18 19:22:24 | 00,243,712 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\mpvis.dll
[2009/05/18 19:22:24 | 00,221,184 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\msadds32.ax
[2009/05/18 19:22:24 | 00,123,392 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\mplay32.exe
[2009/05/18 19:22:24 | 00,097,117 | ---- | C] () -- C:\windows\System32\dllcache\mplayer2.hlp
[2009/05/18 19:22:24 | 00,018,286 | ---- | C] () -- C:\windows\System32\dllcache\mplayer2.inf
[2009/05/18 19:22:24 | 00,004,639 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\mplayer2.exe
[2009/05/18 19:22:24 | 00,004,096 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\MPG4DMOD.dll
[2009/05/18 19:22:24 | 00,004,096 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\MP4SDMOD.dll
[2009/05/18 19:22:24 | 00,004,096 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\MP43DMOD.dll
[2009/05/18 19:22:24 | 00,002,778 | ---- | C] () -- C:\windows\System32\dllcache\mplogoh.gif
[2009/05/18 19:22:24 | 00,002,545 | ---- | C] () -- C:\windows\System32\dllcache\mplogo.gif
[2009/05/18 19:22:24 | 00,001,885 | ---- | C] () -- C:\windows\System32\dllcache\mplayer2.cnt
[2009/05/18 19:22:23 | 00,786,432 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\migrate.exe
[2009/05/18 19:22:23 | 00,397,312 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mmcex.dll
[2009/05/18 19:22:23 | 00,184,320 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\microsoft.managementconsole.dll
[2009/05/18 19:22:23 | 00,106,496 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mmcfxcommon.dll
[2009/05/18 19:22:23 | 00,033,792 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mmcperf.exe
[2009/05/18 19:22:22 | 00,457,607 | ---- | C] () -- C:\windows\System32\dllcache\mdlib.wmv
[2009/05/18 19:22:21 | 00,100,864 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\logagent.exe
[2009/05/18 19:22:21 | 00,011,264 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\LAPRXY.dll
[2009/05/18 19:22:19 | 00,290,816 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\windows\System32\dllcache\l3codeca.acm
[2009/05/18 19:22:19 | 00,061,440 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\kmsvc.dll
[2009/05/18 19:22:19 | 00,037,376 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\l2gpstore.dll
[2009/05/18 19:22:19 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\kbdpash.dll
[2009/05/18 19:22:19 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\kbdnepr.dll
[2009/05/18 19:22:19 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\kbdiultn.dll
[2009/05/18 19:22:19 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\kbdbhc.dll
[2009/05/18 19:22:17 | 00,001,261 | ---- | C] () -- C:\windows\System32\pid.inf
[2009/05/18 19:22:14 | 00,498,742 | ---- | C] () -- C:\windows\System32\dllcache\dxmasf.dll
[2009/05/18 19:22:14 | 00,184,832 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\eapp3hst.dll
[2009/05/18 19:22:14 | 00,180,224 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\eapphost.dll
[2009/05/18 19:22:14 | 00,126,976 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\eappcfg.dll
[2009/05/18 19:22:14 | 00,094,208 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\eappgnui.dll
[2009/05/18 19:22:14 | 00,059,392 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\eapqec.dll
[2009/05/18 19:22:14 | 00,040,960 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\eappprxy.dll
[2009/05/18 19:22:14 | 00,033,792 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\eapsvc.dll
[2009/05/18 19:22:14 | 00,030,720 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\eapolqec.dll
[2009/05/18 19:22:14 | 00,005,971 | ---- | C] () -- C:\windows\System32\dllcache\events.js
[2009/05/18 19:22:13 | 00,991,744 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\drmv2clt.dll
[2009/05/18 19:22:13 | 00,650,752 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dot3ui.dll
[2009/05/18 19:22:13 | 00,299,520 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\drmclien.dll
[2009/05/18 19:22:13 | 00,132,096 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dot3svc.dll
[2009/05/18 19:22:13 | 00,087,040 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\drmstor.dll
[2009/05/18 19:22:13 | 00,057,856 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dot3cfg.dll
[2009/05/18 19:22:13 | 00,056,320 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dot3msm.dll
[2009/05/18 19:22:13 | 00,039,936 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dot3gpclnt.dll
[2009/05/18 19:22:13 | 00,026,112 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dot3api.dll
[2009/05/18 19:22:13 | 00,009,216 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dot3dlg.dll
[2009/05/18 19:22:12 | 00,294,912 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\dlimport.exe
[2009/05/18 19:22:12 | 00,048,640 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dhcpqec.dll
[2009/05/18 19:22:12 | 00,039,936 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dimsroam.dll
[2009/05/18 19:22:12 | 00,033,792 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\custsat.dll
[2009/05/18 19:22:12 | 00,019,456 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dimsntfy.dll
[2009/05/18 19:22:11 | 00,381,425 | ---- | C] () -- C:\windows\System32\dllcache\copycd.wmv
[2009/05/18 19:22:11 | 00,229,376 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\cewmdm.dll
[2009/05/18 19:22:11 | 00,184,959 | ---- | C] () -- C:\windows\System32\dllcache\compact.wmz
[2009/05/18 19:22:11 | 00,012,800 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\credssp.dll
[2009/05/18 19:22:11 | 00,009,585 | ---- | C] () -- C:\windows\System32\dllcache\controls.css
[2009/05/18 19:22:11 | 00,008,298 | ---- | C] () -- C:\windows\System32\dllcache\contents.htm
[2009/05/18 19:22:11 | 00,006,878 | ---- | C] () -- C:\windows\System32\dllcache\controls.js
[2009/05/18 19:22:11 | 00,000,773 | ---- | C] () -- C:\windows\System32\dllcache\cnth.gif
[2009/05/18 19:22:11 | 00,000,773 | ---- | C] () -- C:\windows\System32\dllcache\cnt.gif
[2009/05/18 19:22:11 | 00,000,772 | ---- | C] () -- C:\windows\System32\dllcache\cntd.gif
[2009/05/18 19:22:11 | 00,000,760 | ---- | C] () -- C:\windows\System32\dllcache\cloapph.gif
[2009/05/18 19:22:11 | 00,000,717 | ---- | C] () -- C:\windows\System32\dllcache\cloapp.gif
[2009/05/18 19:22:10 | 00,542,720 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\blackbox.dll
[2009/05/18 19:22:10 | 00,233,472 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\azroles.dll
[2009/05/18 19:22:10 | 00,007,168 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\bitsprx4.dll
[2009/05/18 19:22:10 | 00,000,999 | ---- | C] () -- C:\windows\System32\dllcache\bktrh.gif
[2009/05/18 19:22:08 | 00,007,168 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\asferror.dll
[2009/05/18 19:22:07 | 00,136,192 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\aaclient.dll
[2009/05/18 19:16:20 | 00,007,552 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\mskssrv.sys
[2009/05/18 19:16:19 | 00,004,992 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\mspqm.sys
[2009/05/18 19:16:18 | 00,005,376 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\mspclock.sys
[2009/05/18 19:16:16 | 00,129,536 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ksproxy.ax
[2009/05/18 19:16:16 | 00,129,536 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\ksproxy.ax
[2009/05/18 19:16:16 | 00,016,128 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\MODEMCSA.sys
[2009/05/18 19:16:16 | 00,016,128 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\modemcsa.sys
[2009/05/18 19:16:16 | 00,004,096 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ksuser.dll
[2009/05/18 19:16:16 | 00,004,096 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\ksuser.dll
[2009/05/18 19:16:09 | 00,000,000 | ---D | C] -- C:\Program Files\CONEXANT
[2009/05/18 19:14:58 | 00,203,136 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\rmcast.sys
[2009/05/18 19:11:53 | 00,455,296 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\mrxsmb.sys
[2009/05/18 19:09:12 | 01,203,922 | ---- | C] () -- C:\windows\System32\dllcache\sysmain.sdb
[2009/05/18 19:09:12 | 00,215,552 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wordpad.exe
[2009/05/18 19:09:12 | 00,002,560 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xpsp4res.dll
[2009/05/18 19:08:52 | 00,272,128 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\bthport.sys
[2009/05/18 19:08:04 | 00,729,088 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\lsasrv.dll
[2009/05/18 19:08:04 | 00,714,752 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\ntdll.dll
[2009/05/18 19:08:04 | 00,617,472 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\advapi32.dll
[2009/05/18 19:08:04 | 00,473,600 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\fastprox.dll
[2009/05/18 19:08:04 | 00,453,120 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmiprvsd.dll
[2009/05/18 19:08:04 | 00,401,408 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\rpcss.dll
[2009/05/18 19:08:04 | 00,284,160 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\pdh.dll
[2009/05/18 19:08:04 | 00,227,840 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmiprvse.exe
[2009/05/18 19:08:04 | 00,110,592 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\services.exe
[2009/05/18 19:08:03 | 02,189,056 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\ntoskrnl.exe
[2009/05/18 19:08:03 | 02,145,280 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\ntkrnlmp.exe
[2009/05/18 19:08:02 | 02,023,936 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\ntkrpamp.exe
[2009/05/18 19:03:13 | 00,333,952 | ---- | C] () -- C:\windows\System32\dllcache\srv.sys
[2009/05/18 19:03:06 | 00,331,776 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\msadce.dll
[2009/05/18 19:02:50 | 00,691,712 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\inetcomm.dll
[2009/05/18 19:02:37 | 00,247,326 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\strmdll.dll
[2009/05/18 19:02:30 | 00,337,408 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\netapi32.dll
[2009/05/18 18:51:12 | 24,699,336 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\MRT.exe
[2009/05/18 18:46:03 | 00,316,640 | ---- | C] () -- C:\windows\WMSysPr9.prx
[2009/05/18 18:45:31 | 00,000,000 | ---D | C] -- C:\windows\provisioning
[2009/05/18 18:45:31 | 00,000,000 | ---D | C] -- C:\windows\peernet
[2009/05/18 18:44:26 | 00,000,000 | ---D | C] -- C:\windows\ServicePackFiles
[2009/05/18 18:42:58 | 00,000,000 | ---D | C] -- C:\windows\System32\ReinstallBackups
[2009/05/18 18:41:43 | 00,000,000 | -H-D | C] -- C:\windows\$NtServicePackUninstall$
[2009/05/18 18:41:41 | 00,000,000 | ---D | C] -- C:\windows\EHome
[2009/05/18 18:39:42 | 00,067,866 | ---- | C] () -- C:\windows\System32\drivers\netwlan5.img
[2009/05/18 18:39:42 | 00,011,264 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\spnpinst.exe
[2009/05/18 18:39:42 | 00,007,208 | ---- | C] () -- C:\windows\System32\secupd.sig
[2009/05/18 18:39:42 | 00,004,569 | ---- | C] () -- C:\windows\System32\secupd.dat
[2009/05/18 18:23:10 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2009/05/18 18:20:42 | 00,000,000 | --SD | C] -- C:\windows\System32\Microsoft
[2009/05/18 18:20:36 | 00,000,000 | ---D | C] -- C:\windows\System32\PreInstall
[2009/05/18 18:14:46 | 00,000,000 | ---D | C] -- C:\Program Files\Broadcom
[2009/05/18 18:14:27 | 00,000,000 | ---D | C] -- C:\SWSetup
[2009/05/18 18:00:01 | 00,000,000 | -HSD | C] -- C:\windows\Installer
[2009/05/18 17:59:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\Application Data\Identities
[2009/05/18 17:59:56 | 00,000,073 | -HS- | C] () -- C:\Documents and Settings\xp\My Documents\desktop.ini
[2009/05/18 17:59:56 | 00,000,000 | R--D | C] -- C:\Documents and Settings\xp\My Documents\My Pictures
[2009/05/18 17:59:56 | 00,000,000 | R--D | C] -- C:\Documents and Settings\xp\My Documents\My Music
[2009/05/18 17:59:49 | 00,000,084 | -HS- | C] () -- C:\Documents and Settings\xp\Start Menu\Programs\Startup\desktop.ini
[2009/05/18 17:59:49 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\xp\Local Settings\desktop.ini
[2009/05/18 17:59:49 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\xp\Application Data\desktop.ini
[2009/05/18 17:59:49 | 00,000,000 | --SD | C] -- C:\Documents and Settings\xp\Application Data\Microsoft
[2009/05/18 17:59:49 | 00,000,000 | -HSD | C] -- C:\Documents and Settings\xp\Local Settings\Temporary Internet Files
[2009/05/18 17:59:49 | 00,000,000 | -HSD | C] -- C:\Documents and Settings\xp\Local Settings\History
[2009/05/18 17:59:49 | 00,000,000 | -H-D | C] -- C:\Documents and Settings\xp\Local Settings\Application Data
[2009/05/18 17:59:49 | 00,000,000 | ---D | C] -- C:\Documents and Settings\xp\Local Settings\Temp
[2009/05/18 17:58:48 | 00,000,000 | -HSD | C] -- C:\System Volume Information
[2009/05/18 17:57:32 | 00,008,192 | ---- | C] () -- C:\windows\REGLOCS.OLD
[2009/05/18 17:56:42 | 00,002,048 | --S- | C] () -- C:\windows\bootstat.dat
[2009/05/18 17:56:36 | 00,156,672 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\winzm.ime
[2009/05/18 17:56:36 | 00,156,672 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\winsp.ime
[2009/05/18 17:56:36 | 00,156,672 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\winpy.ime
[2009/05/18 17:56:35 | 00,079,360 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\winar30.ime
[2009/05/18 17:56:35 | 00,072,704 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wingb.ime
[2009/05/18 17:56:35 | 00,065,536 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\winime.ime
[2009/05/18 17:56:35 | 00,041,600 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\weitekp9.dll
[2009/05/18 17:56:35 | 00,031,232 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\weitekp9.sys
[2009/05/18 17:56:34 | 00,086,073 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\voicesub.dll
[2009/05/18 17:56:34 | 00,048,256 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\w32.dll
[2009/05/18 17:56:33 | 00,426,041 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\voicepad.dll
[2009/05/18 17:56:33 | 00,076,288 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\uniime.dll
[2009/05/18 17:56:33 | 00,065,024 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\unicdime.ime
[2009/05/18 17:56:32 | 00,455,168 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\tintsetp.exe
[2009/05/18 17:56:32 | 00,044,032 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\tintlphr.exe
[2009/05/18 17:56:32 | 00,014,336 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\tsprof.exe
[2009/05/18 17:56:32 | 00,010,240 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\tmigrate.dll
[2009/05/18 17:56:31 | 00,571,392 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\tintlgnt.ime
[2009/05/18 17:56:31 | 00,185,344 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\thawbrkr.dll
[2009/05/18 17:56:31 | 00,019,464 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\tdspx.sys
[2009/05/18 17:56:30 | 00,101,376 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\srusbusd.dll
[2009/05/18 17:56:30 | 00,021,896 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\tdipx.sys
[2009/05/18 17:56:30 | 00,013,192 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\tdasync.sys
[2009/05/18 17:56:29 | 00,143,422 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\softkey.dll
[2009/05/18 17:56:28 | 00,010,240 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\snmpstup.dll
[2009/05/18 17:56:28 | 00,007,168 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\EXCH_snprfdll.dll
[2009/05/18 17:56:27 | 00,015,872 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\smierrsm.dll
[2009/05/18 17:56:27 | 00,012,288 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\EXCH_smtpctrs.dll
[2009/05/18 17:56:27 | 00,009,728 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\EXCH_smtpapi.dll
[2009/05/18 17:56:27 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\smimsgif.dll
[2009/05/18 17:56:27 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\smierrsy.dll
[2009/05/18 17:56:26 | 00,038,912 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\sm9aw.dll
[2009/05/18 17:56:26 | 00,031,744 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\smb6w.dll
[2009/05/18 17:56:26 | 00,031,744 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\sma3w.dll
[2009/05/18 17:56:26 | 00,029,184 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\sm8cw.dll
[2009/05/18 17:56:26 | 00,026,624 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\sm93w.dll
[2009/05/18 17:56:26 | 00,026,624 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\sm92w.dll
[2009/05/18 17:56:26 | 00,026,112 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\sm90w.dll
[2009/05/18 17:56:26 | 00,026,112 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\sm8dw.dll
[2009/05/18 17:56:26 | 00,026,112 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\sm8aw.dll
[2009/05/18 17:56:26 | 00,026,112 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\sm89w.dll
[2009/05/18 17:56:25 | 00,030,208 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\sm87w.dll
[2009/05/18 17:56:25 | 00,030,208 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\sm81w.dll
[2009/05/18 17:56:25 | 00,025,088 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\sm59w.dll
[2009/05/18 17:56:25 | 00,018,944 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\simptcp.dll
[2009/05/18 17:56:24 | 00,205,824 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\EXCH_seo.dll
[2009/05/18 17:56:24 | 00,026,112 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\EXCH_seos.dll
[2009/05/18 17:56:23 | 00,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\windows\System32\dllcache\rwia330.dll
[2009/05/18 17:56:23 | 00,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\windows\System32\dllcache\rwia001.dll
[2009/05/18 17:56:23 | 00,057,856 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\EXCH_scripto.dll
[2009/05/18 17:56:23 | 00,009,216 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\EXCH_rwnh.dll
[2009/05/18 17:56:22 | 00,026,112 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\romanime.ime
[2009/05/18 17:56:21 | 00,023,040 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\EXCH_regtrace.exe
[2009/05/18 17:56:21 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\quser.exe
[2009/05/18 17:56:21 | 00,014,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\register.exe
[2009/05/18 17:56:20 | 00,131,584 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\pmxviceo.dll
[2009/05/18 17:56:20 | 00,077,824 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\quick.ime
[2009/05/18 17:56:20 | 00,009,728 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\query.exe
[2009/05/18 17:56:19 | 00,482,304 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\pintlgnt.ime
[2009/05/18 17:56:19 | 00,070,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\pintlphr.exe
[2009/05/18 17:56:19 | 00,067,584 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\pmigrate.dll
[2009/05/18 17:56:19 | 00,011,264 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\pmxmcro.dll
[2009/05/18 17:56:19 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\pmxgl.dll
[2009/05/18 17:56:18 | 00,175,104 | ---- | C] () -- C:\windows\System32\dllcache\pintlcsa.dll
[2009/05/18 17:56:18 | 00,079,360 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\phon.ime
[2009/05/18 17:56:18 | 00,053,760 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\pintlcsd.dll
[2009/05/18 17:56:18 | 00,036,927 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\padrs411.dll
[2009/05/18 17:56:18 | 00,015,872 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\padrs404.dll
[2009/05/18 17:56:18 | 00,015,360 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\padrs804.dll
[2009/05/18 17:56:18 | 00,014,336 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\padrs412.dll
[2009/05/18 17:56:16 | 00,038,912 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\EXCH_ntfsdrv.dll
[2009/05/18 17:56:15 | 00,229,439 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\multibox.dll
[2009/05/18 17:56:11 | 01,875,968 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\msir3jp.lex
[2009/05/18 17:56:11 | 00,098,304 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\msir3jp.dll
[2009/05/18 17:56:08 | 00,092,416 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\mga.sys
[2009/05/18 17:56:08 | 00,092,032 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\mga.dll
[2009/05/18 17:56:08 | 00,065,536 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\EXCH_mailmsg.dll
[2009/05/18 17:56:06 | 01,158,818 | ---- | C] () -- C:\windows\System32\dllcache\korwbrkr.lex
[2009/05/18 17:56:06 | 00,070,656 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\korwbrkr.dll
[2009/05/18 17:56:06 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdth3.dll
[2009/05/18 17:56:06 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdvntc.dll
[2009/05/18 17:56:06 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdusa.dll
[2009/05/18 17:56:06 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdurdu.dll
[2009/05/18 17:56:05 | 00,009,216 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdnecat.dll
[2009/05/18 17:56:05 | 00,007,680 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdnecnt.dll
[2009/05/18 17:56:05 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdth2.dll
[2009/05/18 17:56:05 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdth1.dll
[2009/05/18 17:56:05 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdth0.dll
[2009/05/18 17:56:05 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdsyr2.dll
[2009/05/18 17:56:05 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdsyr1.dll
[2009/05/18 17:56:04 | 00,007,168 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdnec95.dll
[2009/05/18 17:56:04 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdinpun.dll
[2009/05/18 17:56:04 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdintel.dll
[2009/05/18 17:56:04 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdintam.dll
[2009/05/18 17:56:04 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdinmar.dll
[2009/05/18 17:56:03 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdinkan.dll
[2009/05/18 17:56:03 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdinhin.dll
[2009/05/18 17:56:03 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdinguj.dll
[2009/05/18 17:56:03 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdindev.dll
[2009/05/18 17:56:03 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdheb.dll
[2009/05/18 17:56:03 | 00,005,120 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdgeo.dll
[2009/05/18 17:56:02 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdfa.dll
[2009/05/18 17:56:02 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbddiv2.dll
[2009/05/18 17:56:02 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbddiv1.dll
[2009/05/18 17:56:02 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbda3.dll
[2009/05/18 17:56:02 | 00,005,120 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdarmw.dll
[2009/05/18 17:56:02 | 00,005,120 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdarme.dll
[2009/05/18 17:56:01 | 00,018,432 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\jupiw.dll
[2009/05/18 17:56:01 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbd101a.dll
[2009/05/18 17:56:01 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbda2.dll
[2009/05/18 17:56:01 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbda1.dll
[2009/05/18 17:56:00 | 00,315,455 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\imskf.dll
[2009/05/18 17:55:59 | 00,471,102 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\imskdic.dll
[2009/05/18 17:55:59 | 00,274,489 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\imjputyc.dll
[2009/05/18 17:55:59 | 00,262,200 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\imjputy.exe
[2009/05/18 17:55:59 | 00,233,527 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\imjprw.exe
[2009/05/18 17:55:59 | 00,208,952 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\imjpmig.exe
[2009/05/18 17:55:59 | 00,102,456 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\imlang.dll
[2009/05/18 17:55:59 | 00,059,904 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\imkrinst.exe
[2009/05/18 17:55:59 | 00,059,392 | ---- | C] () -- C:\windows\System32\dllcache\imscinst.exe
[2009/05/18 17:55:59 | 00,045,109 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\imjpuex.exe
[2009/05/18 17:55:58 | 00,716,856 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\imjpcus.dll
[2009/05/18 17:55:58 | 00,368,696 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\imjpcic.dll
[2009/05/18 17:55:58 | 00,307,257 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\imjpdct.exe
[2009/05/18 17:55:58 | 00,196,665 | ---- | C] () -- C:\windows\System32\dllcache\imjpinst.exe
[2009/05/18 17:55:58 | 00,155,705 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\imjpdsvr.exe
[2009/05/18 17:55:58 | 00,081,976 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\imjpdct.dll
[2009/05/18 17:55:58 | 00,057,398 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\imjpdadm.exe
[2009/05/18 17:55:57 | 00,811,064 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\imjp81k.dll
[2009/05/18 17:55:57 | 00,340,023 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\imjp81.ime
[2009/05/18 17:55:57 | 00,311,359 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\imepadsv.exe
[2009/05/18 17:55:57 | 00,106,496 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\imekrcic.dll
[2009/05/18 17:55:57 | 00,102,463 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\imepadsm.dll
[2009/05/18 17:55:57 | 00,086,016 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\imekrmbx.dll
[2009/05/18 17:55:57 | 00,044,032 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\imekrmig.exe
[2009/05/18 17:55:56 | 00,134,339 | ---- | C] () -- C:\windows\System32\dllcache\imekr.lex
[2009/05/18 17:55:56 | 00,094,720 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\imekr61.ime
[2009/05/18 17:55:53 | 10,129,408 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\hwxkor.dll
[2009/05/18 17:55:49 | 13,463,552 | ---- | C] () -- C:\windows\System32\dllcache\hwxjpn.dll
[2009/05/18 17:55:44 | 10,096,640 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\hwxcht.dll
[2009/05/18 17:55:43 | 00,108,827 | ---- | C] () -- C:\windows\System32\dllcache\hanja.lex
[2009/05/18 17:55:43 | 00,036,864 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\hanjadic.dll
[2009/05/18 17:55:42 | 00,031,744 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\fxsroute.dll
[2009/05/18 17:55:42 | 00,011,264 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\fxssend.exe
[2009/05/18 17:55:41 | 00,132,608 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\fxsclntr.dll
[2009/05/18 17:55:41 | 00,111,104 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\fxscfgwz.dll
[2009/05/18 17:55:40 | 00,014,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\flattemp.exe
[2009/05/18 17:55:40 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\ftlx041e.dll
[2009/05/18 17:55:39 | 00,057,856 | ---- | C] (SEIKO EPSON CORP.) -- C:\windows\System32\dllcache\esuimgd.dll
[2009/05/18 17:55:39 | 00,045,056 | ---- | C] (SEIKO EPSON CORP.) -- C:\windows\System32\dllcache\esunid.dll
[2009/05/18 17:55:39 | 00,043,520 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\EXCH_fcachdll.dll
[2009/05/18 17:55:39 | 00,031,744 | ---- | C] (SEIKO EPSON CORP.) -- C:\windows\System32\dllcache\esucmd.dll
[2009/05/18 17:55:39 | 00,025,856 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\et4000.sys
[2009/05/18 17:55:38 | 00,514,587 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\edb500.dll
[2009/05/18 17:55:36 | 00,078,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\dayi.ime
[2009/05/18 17:55:35 | 00,057,399 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\cplexe.exe
[2009/05/18 17:55:35 | 00,018,944 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\cprofile.exe
[2009/05/18 17:55:34 | 00,480,256 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\cintsetp.exe
[2009/05/18 17:55:34 | 00,198,656 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\cintime.dll
[2009/05/18 17:55:34 | 00,173,568 | ---- | C] () -- C:\windows\System32\dllcache\chtskf.dll
[2009/05/18 17:55:34 | 00,021,504 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\cintlgnt.ime
[2009/05/18 17:55:33 | 00,838,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\chtbrkr.dll
[2009/05/18 17:55:33 | 00,097,792 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\chtmbx.dll
[2009/05/18 17:55:33 | 00,056,320 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\chtskdic.dll
[2009/05/18 17:55:31 | 01,677,824 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\chsbrkr.dll
[2009/05/18 17:55:31 | 00,078,336 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\chajei.ime
[2009/05/18 17:55:31 | 00,015,872 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\chgport.exe
[2009/05/18 17:55:31 | 00,014,336 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\chgusr.exe
[2009/05/18 17:55:31 | 00,013,312 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\chglogon.exe
[2009/05/18 17:55:31 | 00,009,728 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\change.exe
[2009/05/18 17:55:30 | 00,054,528 | ---- | C] (Philips Semiconductors GmbH) -- C:\windows\System32\dllcache\cap7146.sys
[2009/05/18 17:55:30 | 00,010,752 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\c_iscii.dll
[2009/05/18 17:55:30 | 00,006,656 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\c_is2022.dll
[2009/05/18 17:55:29 | 00,312,832 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\EXCH_aqueue.dll
[2009/05/18 17:55:28 | 00,045,056 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\EXCH_aqadmin.dll
[2009/05/18 17:55:27 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\EXCH_adsiisex.dll
[2009/05/18 17:55:25 | 02,134,528 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\EXCH_smtpsnap.dll
[2009/05/18 17:55:25 | 00,175,104 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\EXCH_smtpadm.dll
[2009/05/18 17:55:17 | 00,000,000 | ---D | C] -- C:\windows\System32\xircom
[2009/05/18 17:55:17 | 00,000,000 | ---D | C] -- C:\Program Files\xerox
[2009/05/18 17:55:17 | 00,000,000 | ---D | C] -- C:\Program Files\microsoft frontpage
[2009/05/18 17:55:09 | 00,002,577 | ---- | C] () -- C:\windows\System32\CONFIG.NT
[2009/05/18 17:55:09 | 00,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2009/05/18 17:55:09 | 00,000,000 | RHS- | C] () -- C:\IO.SYS
[2009/05/18 17:55:08 | 00,025,065 | ---- | C] () -- C:\windows\System32\wmpscheme.xml
[2009/05/18 17:55:07 | 00,023,392 | ---- | C] () -- C:\windows\System32\nscompat.tlb
[2009/05/18 17:55:07 | 00,016,832 | ---- | C] () -- C:\windows\System32\amcompat.tlb
[2009/05/18 17:55:06 | 00,299,552 | ---- | C] () -- C:\windows\WMSysPrx.prx
[2009/05/18 17:55:04 | 00,112,128 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mapi32.dll
[2009/05/18 17:55:04 | 00,000,006 | -H-- | C] () -- C:\windows\tasks\SA.DAT
[2009/05/18 17:54:33 | 00,000,488 | RH-- | C] () -- C:\windows\System32\WindowsLogon.manifest
[2009/05/18 17:54:33 | 00,000,488 | RH-- | C] () -- C:\windows\System32\logonui.exe.manifest
[2009/05/18 17:54:33 | 00,000,000 | --SD | C] -- C:\windows\Downloaded Program Files
[2009/05/18 17:54:33 | 00,000,000 | R--D | C] -- C:\windows\Offline Web Pages
[2009/05/18 17:54:29 | 00,000,749 | RH-- | C] () -- C:\windows\WindowsShell.Manifest
[2009/05/18 17:54:29 | 00,000,749 | RH-- | C] () -- C:\windows\System32\wuaucpl.cpl.manifest
[2009/05/18 17:54:29 | 00,000,749 | RH-- | C] () -- C:\windows\System32\sapi.cpl.manifest
[2009/05/18 17:54:29 | 00,000,749 | RH-- | C] () -- C:\windows\System32\nwc.cpl.manifest
[2009/05/18 17:54:29 | 00,000,749 | RH-- | C] () -- C:\windows\System32\ncpa.cpl.manifest
[2009/05/18 17:54:29 | 00,000,749 | RH-- | C] () -- C:\windows\System32\cdplayer.exe.manifest
[2009/05/18 17:54:20 | 04,399,505 | ---- | C] () -- C:\windows\System32\dllcache\nls302en.lex
[2009/05/18 17:54:09 | 00,000,000 | ---D | C] -- C:\windows\System32\DirectX
[2009/05/18 17:53:34 | 00,045,568 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\safrslv.dll
[2009/05/18 17:53:34 | 00,043,520 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\safrcdlg.dll
[2009/05/18 17:53:34 | 00,043,520 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\racpldlg.dll
[2009/05/18 17:53:34 | 00,035,328 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\notiflag.exe
[2009/05/18 17:53:34 | 00,029,696 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\safrdm.dll
[2009/05/18 17:53:34 | 00,021,504 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\brpinfo.dll
[2009/05/18 17:53:34 | 00,011,264 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\atrace.dll
[2009/05/18 17:53:34 | 00,011,264 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\atrace.dll
[2009/05/18 17:53:33 | 00,099,840 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\helphost.exe
[2009/05/18 17:53:33 | 00,006,656 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\hcappres.dll
[2009/05/18 17:53:31 | 00,048,680 | -HS- | C] () -- C:\windows\winnt256.bmp
[2009/05/18 17:53:31 | 00,048,680 | -HS- | C] () -- C:\windows\winnt.bmp
[2009/05/18 17:53:23 | 00,047,104 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\srdiag.exe
[2009/05/18 17:53:23 | 00,000,984 | ---- | C] () -- C:\windows\System32\dllcache\srframe.mmf
[2009/05/18 17:53:22 | 00,118,784 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msg723.acm
[2009/05/18 17:53:22 | 00,032,768 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mnmsrvc.exe
[2009/05/18 17:53:22 | 00,012,288 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\nmevtmsg.dll
[2009/05/18 17:53:22 | 00,012,288 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\nmevtmsg.dll
[2009/05/18 17:53:21 | 00,039,936 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\msinfo32.exe
[2009/05/18 17:53:21 | 00,012,288 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wb32.exe
[2009/05/18 17:53:21 | 00,012,288 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\cb32.exe
[2009/05/18 17:53:20 | 00,064,512 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\acctres.dll
[2009/05/18 17:53:20 | 00,064,512 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\acctres.dll
[2009/05/18 17:53:20 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Services
[2009/05/18 17:53:19 | 00,048,128 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\inetres.dll
[2009/05/18 17:53:14 | 00,073,728 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\icwdial.dll
[2009/05/18 17:53:14 | 00,065,536 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\icwphbk.dll
[2009/05/18 17:53:14 | 00,000,065 | RH-- | C] () -- C:\windows\tasks\desktop.ini
[2009/05/18 17:53:14 | 00,000,000 | --SD | C] -- C:\windows\Tasks
[2009/05/18 17:53:13 | 00,274,432 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\inetcfg.dll
[2009/05/18 17:53:13 | 00,081,920 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\isign32.dll
[2009/05/18 17:53:13 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\icfgnt5.dll
[2009/05/18 17:53:13 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\icfgnt5.dll
[2009/05/18 17:53:12 | 00,061,440 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\icwres.dll
[2009/05/18 17:53:12 | 00,040,960 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\trialoc.dll
[2009/05/18 17:53:11 | 00,073,728 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\icwtutor.exe
[2009/05/18 17:53:11 | 00,023,552 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\mssoapr.dll
[2009/05/18 17:53:11 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\isignup.exe
[2009/05/18 17:53:10 | 00,235,520 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\mssoap1.dll
[2009/05/18 17:53:10 | 00,025,088 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wisc10.dll
[2009/05/18 17:53:10 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\MSSoap
[2009/05/18 17:53:08 | 00,093,184 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\ieinfo5.ocx
[2009/05/18 17:53:04 | 00,000,000 | ---D | C] -- C:\windows\System32\Macromed
[2009/05/18 17:53:04 | 00,000,000 | ---D | C] -- C:\windows\srchasst
[2009/05/18 17:53:03 | 00,520,192 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmpvis.dll
[2009/05/18 17:53:02 | 00,409,088 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\qmgr.dll
[2009/05/18 17:53:02 | 00,319,542 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmmres.dll
[2009/05/18 17:53:02 | 00,163,897 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmmutil.dll
[2009/05/18 17:53:02 | 00,110,648 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmmfilt.dll
[2009/05/18 17:53:01 | 00,000,000 | ---D | C] -- C:\Program Files\Movie Maker
[2009/05/18 17:52:57 | 00,239,104 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\srrstr.dll
[2009/05/18 17:52:57 | 00,171,008 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\srsvc.dll
[2009/05/18 17:52:57 | 00,067,584 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\srclient.dll
[2009/05/18 17:52:57 | 00,000,000 | ---D | C] -- C:\windows\System32\Restore
[2009/05/18 17:52:57 | 00,000,000 | ---D | C] -- C:\windows\PCHealth
[2009/05/18 17:52:56 | 00,188,416 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msh261.drv
[2009/05/18 17:52:56 | 00,081,920 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ils.dll
[2009/05/18 17:52:56 | 00,073,472 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\sr.sys
[2009/05/18 17:52:56 | 00,034,560 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mnmdd.dll
[2009/05/18 17:52:55 | 00,069,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msconf.dll
[2009/05/18 17:52:55 | 00,028,672 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\nmmkcert.dll
[2009/05/18 17:52:53 | 00,105,984 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msoert2.dll
[2009/05/18 17:52:53 | 00,000,000 | ---D | C] -- C:\Program Files\NetMeeting
[2009/05/18 17:52:52 | 00,691,712 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\inetcomm.dll
[2009/05/18 17:52:52 | 00,252,928 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msoeacct.dll
[2009/05/18 17:52:51 | 00,192,512 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\schedsvc.dll
[2009/05/18 17:52:51 | 00,000,000 | ---D | C] -- C:\Program Files\Outlook Express
[2009/05/18 17:52:50 | 00,274,944 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mstask.dll
[2009/05/18 17:52:50 | 00,012,288 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mstinit.exe
[2009/05/18 17:52:46 | 00,000,000 | ---D | C] -- C:\Program Files\Internet Explorer
[2009/05/18 17:52:46 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\System
[2009/05/18 17:52:45 | 00,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Pictures
[2009/05/18 17:52:45 | 00,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Music
[2009/05/18 17:52:44 | 00,021,640 | ---- | C] () -- C:\windows\System32\emptyregdb.dat
[2009/05/18 17:52:42 | 00,000,000 | ---D | C] -- C:\windows\Registration
[2009/05/18 17:52:29 | 00,000,000 | ---D | C] -- C:\Program Files\Online Services
[2009/05/18 17:52:28 | 00,000,000 | ---D | C] -- C:\Program Files\Windows Media Player
[2009/05/18 17:52:24 | 00,000,000 | ---D | C] -- C:\Program Files\Messenger
[2009/05/18 17:52:22 | 00,042,577 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\bckgzm.exe
[2009/05/18 17:52:21 | 01,817,687 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\bckgres.dll
[2009/05/18 17:52:21 | 00,780,885 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\chkrres.dll
[2009/05/18 17:52:21 | 00,753,236 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\rvseres.dll
[2009/05/18 17:52:21 | 00,082,501 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\bckg.dll
[2009/05/18 17:52:21 | 00,048,706 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\rvse.dll
[2009/05/18 17:52:21 | 00,042,575 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\chkrzm.exe
[2009/05/18 17:52:21 | 00,042,574 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\rvsezm.exe
[2009/05/18 17:52:21 | 00,042,573 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\shvlzm.exe
[2009/05/18 17:52:21 | 00,040,515 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\chkr.dll
[2009/05/18 17:52:20 | 02,178,131 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\shvlres.dll
[2009/05/18 17:52:20 | 01,175,635 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\hrtzres.dll
[2009/05/18 17:52:20 | 00,066,113 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\shvl.dll
[2009/05/18 17:52:20 | 00,057,409 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\hrtz.dll
[2009/05/18 17:52:20 | 00,042,573 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\hrtzzm.exe
[2009/05/18 17:52:20 | 00,041,029 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\zcorem.dll
[2009/05/18 17:52:20 | 00,032,339 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\uniansi.dll
[2009/05/18 17:52:20 | 00,013,894 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\zonelibm.dll
[2009/05/18 17:52:20 | 00,004,677 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\zeeverm.dll
[2009/05/18 17:52:19 | 01,039,955 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\cmnresm.dll
[2009/05/18 17:52:19 | 00,217,160 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\cmnclim.dll
[2009/05/18 17:52:19 | 00,113,222 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\zoneclim.dll
[2009/05/18 17:52:19 | 00,029,760 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\znetm.dll
[2009/05/18 17:52:18 | 00,036,937 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\zclientm.exe
[2009/05/18 17:52:18 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\write.exe
[2009/05/18 17:52:18 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\write.exe
[2009/05/18 17:52:18 | 00,000,000 | ---D | C] -- C:\Program Files\MSN Gaming Zone
[2009/05/18 17:52:07 | 00,184,320 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\accwiz.exe
[2009/05/18 17:52:07 | 00,138,752 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\sndvol32.exe
[2009/05/18 17:52:07 | 00,138,752 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\sndvol32.exe
[2009/05/18 17:52:07 | 00,131,584 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\sndrec32.exe
[2009/05/18 17:52:07 | 00,068,608 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\access.cpl
[2009/05/18 17:52:06 | 00,227,840 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\avtapi.dll
[2009/05/18 17:52:06 | 00,227,840 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\avtapi.dll
[2009/05/18 17:52:06 | 00,073,216 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\avwav.dll
[2009/05/18 17:52:06 | 00,073,216 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\avwav.dll
[2009/05/18 17:52:06 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\avmeter.dll
[2009/05/18 17:52:06 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\avmeter.dll
[2009/05/18 17:52:05 | 00,035,328 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\winchat.exe
[2009/05/18 17:52:05 | 00,035,328 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\winchat.exe
[2009/05/18 17:51:59 | 00,065,832 | ---- | C] () -- C:\windows\Santa Fe Stucco.bmp
[2009/05/18 17:51:59 | 00,026,680 | ---- | C] () -- C:\windows\River Sumida.bmp
[2009/05/18 17:51:59 | 00,009,522 | ---- | C] () -- C:\windows\Zapotec.bmp
[2009/05/18 17:51:58 | 00,065,954 | ---- | C] () -- C:\windows\Prairie Wind.bmp
[2009/05/18 17:51:58 | 00,026,582 | ---- | C] () -- C:\windows\Greenstone.bmp
[2009/05/18 17:51:58 | 00,017,362 | ---- | C] () -- C:\windows\Rhododendron.bmp
[2009/05/18 17:51:58 | 00,017,336 | ---- | C] () -- C:\windows\Gone Fishing.bmp
[2009/05/18 17:51:58 | 00,017,062 | ---- | C] () -- C:\windows\Coffee Bean.bmp
[2009/05/18 17:51:58 | 00,016,730 | ---- | C] () -- C:\windows\FeatherTexture.bmp
[2009/05/18 17:51:57 | 00,093,702 | ---- | C] () -- C:\windows\System32\subrange.uce
[2009/05/18 17:51:57 | 00,065,978 | ---- | C] () -- C:\windows\Soap Bubbles.bmp
[2009/05/18 17:51:57 | 00,060,458 | ---- | C] () -- C:\windows\System32\ideograf.uce
[2009/05/18 17:51:57 | 00,016,740 | ---- | C] () -- C:\windows\System32\shiftjis.uce
[2009/05/18 17:51:57 | 00,012,876 | ---- | C] () -- C:\windows\System32\korean.uce
[2009/05/18 17:51:57 | 00,008,484 | ---- | C] () -- C:\windows\System32\kanji_2.uce
[2009/05/18 17:51:57 | 00,006,948 | ---- | C] () -- C:\windows\System32\kanji_1.uce
[2009/05/18 17:51:57 | 00,001,272 | ---- | C] () -- C:\windows\Blue Lace 16.bmp
[2009/05/18 17:51:56 | 00,605,696 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\getuname.dll
[2009/05/18 17:51:56 | 00,605,696 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\getuname.dll
[2009/05/18 17:51:56 | 00,114,688 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\calc.exe
[2009/05/18 17:51:56 | 00,114,688 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\calc.exe
[2009/05/18 17:51:56 | 00,080,384 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\charmap.exe
[2009/05/18 17:51:56 | 00,080,384 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\charmap.exe
[2009/05/18 17:51:56 | 00,024,006 | ---- | C] () -- C:\windows\System32\gb2312.uce
[2009/05/18 17:51:56 | 00,022,984 | ---- | C] () -- C:\windows\System32\bopomofo.uce
[2009/05/18 17:51:55 | 00,126,976 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mshearts.exe
[2009/05/18 17:51:55 | 00,126,976 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\mshearts.exe
[2009/05/18 17:51:55 | 00,119,808 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\winmine.exe
[2009/05/18 17:51:55 | 00,119,808 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\winmine.exe
[2009/05/18 17:51:55 | 00,056,832 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\sol.exe
[2009/05/18 17:51:55 | 00,056,832 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\sol.exe
[2009/05/18 17:51:54 | 00,067,072 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\rdshost.exe
[2009/05/18 17:51:54 | 00,055,296 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\freecell.exe
[2009/05/18 17:51:54 | 00,055,296 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\freecell.exe
[2009/05/18 17:51:54 | 00,021,896 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\tdtcp.sys
[2009/05/18 17:51:54 | 00,016,896 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\tsshutdn.exe
[2009/05/18 17:51:54 | 00,016,896 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\tsshutdn.exe
[2009/05/18 17:51:54 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\tskill.exe
[2009/05/18 17:51:54 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\tskill.exe
[2009/05/18 17:51:54 | 00,012,040 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\tdpipe.sys
[2009/05/18 17:51:54 | 00,009,728 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\reset.exe
[2009/05/18 17:51:54 | 00,009,728 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\reset.exe
[2009/05/18 17:51:54 | 00,003,286 | ---- | C] () -- C:\windows\System32\tslabels.h
[2009/05/18 17:51:54 | 00,001,161 | ---- | C] () -- C:\windows\System32\usrlogon.cmd
[2009/05/18 17:51:53 | 00,033,792 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\regini.exe
[2009/05/18 17:51:53 | 00,033,792 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\regini.exe
[2009/05/18 17:51:53 | 00,022,016 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\qwinsta.exe
[2009/05/18 17:51:53 | 00,022,016 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\qwinsta.exe
[2009/05/18 17:51:53 | 00,020,992 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msg.exe
[2009/05/18 17:51:53 | 00,020,992 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\msg.exe
[2009/05/18 17:51:53 | 00,019,968 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\qprocess.exe
[2009/05/18 17:51:53 | 00,016,896 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\qappsrv.exe
[2009/05/18 17:51:53 | 00,016,896 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\qappsrv.exe
[2009/05/18 17:51:53 | 00,015,872 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\rwinsta.exe
[2009/05/18 17:51:53 | 00,015,872 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\rwinsta.exe
[2009/05/18 17:51:53 | 00,015,360 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\logoff.exe
[2009/05/18 17:51:53 | 00,015,360 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\logoff.exe
[2009/05/18 17:51:53 | 00,014,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\tsdiscon.exe
[2009/05/18 17:51:53 | 00,014,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\tscon.exe
[2009/05/18 17:51:53 | 00,014,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\shadow.exe
[2009/05/18 17:51:53 | 00,014,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\tsdiscon.exe
[2009/05/18 17:51:53 | 00,014,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\tscon.exe
[2009/05/18 17:51:53 | 00,014,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\shadow.exe
[2009/05/18 17:51:53 | 00,004,096 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\rdpcfgex.dll
[2009/05/18 17:51:53 | 00,004,096 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\rdpcfgex.dll
[2009/05/18 17:51:52 | 00,956,928 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msdtctm.dll
[2009/05/18 17:51:52 | 00,161,792 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msdtcuiu.dll
[2009/05/18 17:51:52 | 00,091,648 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mtxoci.dll
[2009/05/18 17:51:52 | 00,015,872 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\cdmodem.dll
[2009/05/18 17:51:52 | 00,015,872 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\cdmodem.dll
[2009/05/18 17:51:52 | 00,011,776 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xolehlp.dll
[2009/05/18 17:51:51 | 00,058,880 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msdtclog.dll
[2009/05/18 17:51:51 | 00,019,456 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\mtsadmin.tlb
[2009/05/18 17:51:51 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msdtc.exe
[2009/05/18 17:51:51 | 00,000,768 | ---- | C] () -- C:\windows\System32\msdtcprf.h
[2009/05/18 17:51:50 | 00,060,416 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\colbact.dll
[2009/05/18 17:51:50 | 00,034,304 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mtxlegih.dll
[2009/05/18 17:51:50 | 00,030,720 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mtxdm.dll
[2009/05/18 17:51:50 | 00,028,160 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\comaddin.dll
[2009/05/18 17:51:50 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dcomcnfg.exe
[2009/05/18 17:51:50 | 00,004,096 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mtxex.dll
[2009/05/18 17:51:49 | 00,539,648 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\comuid.dll
[2009/05/18 17:51:49 | 00,226,304 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\catsrv.dll
[2009/05/18 17:51:49 | 00,110,592 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\clbcatex.dll
[2009/05/18 17:51:49 | 00,097,792 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\comrepl.dll
[2009/05/18 17:51:49 | 00,085,504 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\catsrvps.dll
[2009/05/18 17:51:49 | 00,059,392 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\stclient.dll
[2009/05/18 17:51:48 | 00,498,688 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\clbcatq.dll
[2009/05/18 17:51:48 | 00,167,424 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\comsnap.dll
[2009/05/18 17:51:48 | 00,045,568 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmi2xml.dll
[2009/05/18 17:51:44 | 00,075,264 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmipicmp.dll
[2009/05/18 17:51:44 | 00,061,440 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmimsg.dll
[2009/05/18 17:51:44 | 00,052,224 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wmitimep.dll
[2009/05/18 17:51:43 | 00,116,224 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\updprov.dll
[2009/05/18 17:51:43 | 00,059,904 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wbemdisp.tlb
[2009/05/18 17:51:43 | 00,031,232 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wbemads.tlb
[2009/05/18 17:51:43 | 00,016,896 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\unsecapp.exe
[2009/05/18 17:51:43 | 00,016,384 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\winmgmtr.dll
[2009/05/18 17:51:43 | 00,013,312 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\winmgmt.exe
[2009/05/18 17:51:43 | 00,012,288 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wbemads.dll
[2009/05/18 17:51:42 | 00,273,920 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\msiprov.dll
[2009/05/18 17:51:42 | 00,061,952 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\tmplprov.dll
[2009/05/18 17:51:42 | 00,059,904 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\trnsprov.dll
[2009/05/18 17:51:42 | 00,040,960 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\smtpcons.dll
[2009/05/18 17:51:41 | 00,120,320 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\dsprov.dll
[2009/05/18 17:51:41 | 00,063,488 | ---- | C] () -- C:\windows\System32\wmimgmt.msc
[2009/05/18 17:51:41 | 00,056,320 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\servdeps.dll
[2009/05/18 17:51:41 | 00,053,248 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\fwdprov.dll
[2009/05/18 17:51:41 | 00,017,408 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mmfutil.dll
[2009/05/18 17:51:40 | 00,185,344 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\cmprops.dll
[2009/05/18 17:51:34 | 00,123,392 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mplay32.exe
[2009/05/18 17:51:34 | 00,000,000 | ---D | C] -- C:\Program Files\Windows NT
[2009/05/18 17:51:34 | 00,000,000 | ---D | C] -- C:\Program Files\MSN
[2009/05/18 17:51:33 | 00,538,624 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\spider.exe
[2009/05/18 17:51:33 | 00,343,040 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mspaint.exe
[2009/05/18 17:51:33 | 00,102,912 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\clipbrd.exe
[2009/05/18 17:51:32 | 01,809,944 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wuaueng.dll
[2009/05/18 17:51:32 | 01,809,944 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wuaueng.dll
[2009/05/18 17:51:32 | 00,139,656 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\rdpwd.sys
[2009/05/18 17:51:32 | 00,093,696 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\tscfgwmi.dll
[2009/05/18 17:51:32 | 00,051,224 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wuauclt.exe
[2009/05/18 17:51:32 | 00,051,224 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wuauclt.exe
[2009/05/18 17:51:32 | 00,006,656 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wuauserv.dll
[2009/05/18 17:51:31 | 02,061,824 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mstscax.dll
[2009/05/18 17:51:31 | 00,677,888 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mstsc.exe
[2009/05/18 17:51:31 | 00,147,968 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\rdchost.dll
[2009/05/18 17:51:31 | 00,141,312 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\sessmgr.exe
[2009/05/18 17:51:31 | 00,060,416 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\remotepg.dll
[2009/05/18 17:51:31 | 00,044,544 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\tscupgrd.exe
[2009/05/18 17:51:31 | 00,013,824 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\rdsaddin.exe
[2009/05/18 17:51:30 | 00,295,424 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\termsrv.dll
[2009/05/18 17:51:30 | 00,087,176 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\rdpwsx.dll
[2009/05/18 17:51:30 | 00,062,976 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\rdpclip.exe
[2009/05/18 17:51:30 | 00,038,912 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\cfgbkend.dll
[2009/05/18 17:51:30 | 00,019,968 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\rdpsnd.dll
[2009/05/18 17:51:30 | 00,011,264 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\icaapi.dll
[2009/05/18 17:51:30 | 00,000,000 | ---D | C] -- C:\windows\System32\MsDtc
[2009/05/18 17:51:29 | 00,625,664 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\catsrvut.dll
[2009/05/18 17:51:29 | 00,428,032 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msdtcprx.dll
[2009/05/18 17:51:29 | 00,000,000 | ---D | C] -- C:\windows\System32\Com
[2009/05/18 17:51:28 | 01,267,200 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\comsvcs.dll
[2009/05/18 17:51:25 | 00,058,880 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\licwmi.dll
[2009/05/18 17:51:21 | 00,196,224 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\rdpdr.sys
[2009/05/18 17:51:21 | 00,040,840 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\termdd.sys
[2009/05/18 10:46:02 | 00,003,072 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\audstub.sys
[2009/05/18 10:45:29 | 00,057,600 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\redbook.sys
[2009/05/18 10:45:13 | 00,074,240 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\usbui.dll
[2009/05/18 10:44:47 | 00,001,891 | ---- | C] () -- C:\windows\imsins.BAK
[2009/05/18 10:44:44 | 00,077,824 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\spcommon.dll
[2009/05/18 10:44:44 | 00,061,440 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\spcplui.dll
[2009/05/18 10:44:43 | 01,685,606 | ---- | C] () -- C:\windows\System32\dllcache\sam.spd
[2009/05/18 10:44:43 | 00,774,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\spttseng.dll
[2009/05/18 10:44:43 | 00,605,050 | ---- | C] () -- C:\windows\System32\dllcache\r1033tts.lxa
[2009/05/18 10:44:43 | 00,000,888 | ---- | C] () -- C:\windows\System32\dllcache\sam.sdf
[2009/05/18 10:44:42 | 00,643,717 | ---- | C] () -- C:\windows\System32\dllcache\ltts1033.lxa
[2009/05/18 10:44:42 | 00,036,864 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\sapisvr.exe
[2009/05/18 10:44:42 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\SpeechEngines
[2009/05/18 10:44:41 | 00,066,082 | ---- | C] () -- C:\windows\System32\c_28603.nls
[2009/05/18 10:44:41 | 00,000,000 | R--D | C] -- C:\Program Files
[2009/05/18 10:44:41 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Microsoft Shared
[2009/05/18 10:44:41 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files
[2009/05/18 10:44:39 | 00,066,594 | ---- | C] () -- C:\windows\System32\c_857.nls
[2009/05/18 10:44:39 | 00,066,082 | ---- | C] () -- C:\windows\System32\c_28599.nls
[2009/05/18 10:44:39 | 00,066,082 | ---- | C] () -- C:\windows\System32\c_10081.nls
[2009/05/18 10:44:39 | 00,006,144 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdtuq.dll
[2009/05/18 10:44:39 | 00,006,144 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdtuf.dll
[2009/05/18 10:44:39 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdtuq.dll
[2009/05/18 10:44:39 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdtuf.dll
[2009/05/18 10:44:39 | 00,005,632 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdazel.dll
[2009/05/18 10:44:39 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdazel.dll
[2009/05/18 10:44:37 | 00,005,632 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdtat.dll
[2009/05/18 10:44:37 | 00,005,632 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdmon.dll
[2009/05/18 10:44:37 | 00,005,632 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdkyr.dll
[2009/05/18 10:44:37 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdtat.dll
[2009/05/18 10:44:37 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdmon.dll
[2009/05/18 10:44:37 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdkyr.dll
[2009/05/18 10:44:36 | 00,066,082 | ---- | C] () -- C:\windows\System32\C_28595.NLS
[2009/05/18 10:44:36 | 00,066,082 | ---- | C] () -- C:\windows\System32\c_10017.nls
[2009/05/18 10:44:36 | 00,066,082 | ---- | C] () -- C:\windows\System32\c_10007.nls
[2009/05/18 10:44:36 | 00,005,632 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdycc.dll
[2009/05/18 10:44:36 | 00,005,632 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbduzb.dll
[2009/05/18 10:44:36 | 00,005,632 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdur.dll
[2009/05/18 10:44:36 | 00,005,632 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdru1.dll
[2009/05/18 10:44:36 | 00,005,632 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdru.dll
[2009/05/18 10:44:36 | 00,005,632 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdkaz.dll
[2009/05/18 10:44:36 | 00,005,632 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdbu.dll
[2009/05/18 10:44:36 | 00,005,632 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdblr.dll
[2009/05/18 10:44:36 | 00,005,632 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdaze.dll
[2009/05/18 10:44:36 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdycc.dll
[2009/05/18 10:44:36 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbduzb.dll
[2009/05/18 10:44:36 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdur.dll
[2009/05/18 10:44:36 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdru1.dll
[2009/05/18 10:44:36 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdru.dll
[2009/05/18 10:44:36 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdkaz.dll
[2009/05/18 10:44:36 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdbu.dll
[2009/05/18 10:44:36 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdblr.dll
[2009/05/18 10:44:36 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdaze.dll
[2009/05/18 10:44:34 | 00,008,192 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdhept.dll
[2009/05/18 10:44:34 | 00,008,192 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdhept.dll
[2009/05/18 10:44:34 | 00,006,656 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdhela3.dll
[2009/05/18 10:44:34 | 00,006,656 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdhela3.dll
[2009/05/18 10:44:34 | 00,006,144 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdhela2.dll
[2009/05/18 10:44:34 | 00,006,144 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdgkl.dll
[2009/05/18 10:44:34 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdhela2.dll
[2009/05/18 10:44:34 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdgkl.dll
[2009/05/18 10:44:34 | 00,005,632 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdhe319.dll
[2009/05/18 10:44:34 | 00,005,632 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdhe220.dll
[2009/05/18 10:44:34 | 00,005,632 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdhe.dll
[2009/05/18 10:44:34 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdhe319.dll
[2009/05/18 10:44:34 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdhe220.dll
[2009/05/18 10:44:34 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdhe.dll
[2009/05/18 10:44:33 | 00,066,594 | ---- | C] () -- C:\windows\System32\c_869.nls
[2009/05/18 10:44:33 | 00,066,594 | ---- | C] () -- C:\windows\System32\c_737.nls
[2009/05/18 10:44:33 | 00,066,082 | ---- | C] () -- C:\windows\System32\c_875.nls
[2009/05/18 10:44:33 | 00,066,082 | ---- | C] () -- C:\windows\System32\C_28597.NLS
[2009/05/18 10:44:33 | 00,066,082 | ---- | C] () -- C:\windows\System32\c_10006.nls
[2009/05/18 10:44:32 | 00,066,594 | ---- | C] () -- C:\windows\System32\c_866.nls
[2009/05/18 10:44:32 | 00,066,594 | ---- | C] () -- C:\windows\System32\c_855.nls
[2009/05/18 10:44:32 | 00,066,082 | ---- | C] () -- C:\windows\System32\C_28594.NLS
[2009/05/18 10:44:32 | 00,006,144 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdlv1.dll
[2009/05/18 10:44:32 | 00,006,144 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdlv.dll
[2009/05/18 10:44:32 | 00,006,144 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdest.dll
[2009/05/18 10:44:32 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdlv1.dll
[2009/05/18 10:44:32 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdlv.dll
[2009/05/18 10:44:32 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdest.dll
[2009/05/18 10:44:32 | 00,005,632 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdlt1.dll
[2009/05/18 10:44:32 | 00,005,632 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdlt.dll
[2009/05/18 10:44:32 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdlt1.dll
[2009/05/18 10:44:32 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdlt.dll
[2009/05/18 10:44:29 | 00,066,594 | ---- | C] () -- C:\windows\System32\c_852.nls
[2009/05/18 10:44:29 | 00,066,082 | ---- | C] () -- C:\windows\System32\c_10082.nls
[2009/05/18 10:44:29 | 00,066,082 | ---- | C] () -- C:\windows\System32\c_10029.nls
[2009/05/18 10:44:29 | 00,066,082 | ---- | C] () -- C:\windows\System32\c_10010.nls
[2009/05/18 10:44:29 | 00,007,168 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdcz.dll
[2009/05/18 10:44:29 | 00,007,168 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdcz.dll
[2009/05/18 10:44:29 | 00,006,656 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdycl.dll
[2009/05/18 10:44:29 | 00,006,656 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdsl1.dll
[2009/05/18 10:44:29 | 00,006,656 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdsl.dll
[2009/05/18 10:44:29 | 00,006,656 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdpl.dll
[2009/05/18 10:44:29 | 00,006,656 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdhu.dll
[2009/05/18 10:44:29 | 00,006,656 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdcz2.dll
[2009/05/18 10:44:29 | 00,006,656 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdcz1.dll
[2009/05/18 10:44:29 | 00,006,656 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdcr.dll
[2009/05/18 10:44:29 | 00,006,656 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\KBDAL.DLL
[2009/05/18 10:44:29 | 00,006,656 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdycl.dll
[2009/05/18 10:44:29 | 00,006,656 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdsl1.dll
[2009/05/18 10:44:29 | 00,006,656 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdsl.dll
[2009/05/18 10:44:29 | 00,006,656 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdpl.dll
[2009/05/18 10:44:29 | 00,006,656 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdhu.dll
[2009/05/18 10:44:29 | 00,006,656 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdcz2.dll
[2009/05/18 10:44:29 | 00,006,656 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdcz1.dll
[2009/05/18 10:44:29 | 00,006,656 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdcr.dll
[2009/05/18 10:44:29 | 00,006,656 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdal.dll
[2009/05/18 10:44:29 | 00,005,632 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdro.dll
[2009/05/18 10:44:29 | 00,005,632 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdpl1.dll
[2009/05/18 10:44:29 | 00,005,632 | R--- | C] (Microsoft Corporation) -- C:\windows\System32\kbdhu1.dll
[2009/05/18 10:44:29 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdro.dll
[2009/05/18 10:44:29 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdpl1.dll
[2009/05/18 10:44:29 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\kbdhu1.dll
[2009/05/18 10:44:27 | 00,066,082 | ---- | C] () -- C:\windows\System32\c_20127.nls
[2009/05/18 10:44:27 | 00,013,312 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\irclass.dll
[2009/05/18 10:44:27 | 00,013,312 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\irclass.dll
[2009/05/18 10:44:27 | 00,011,264 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\irenum.sys
[2009/05/18 10:44:26 | 00,024,661 | ---- | C] (Perle Systems Ltd.) -- C:\windows\System32\spxcoins.dll
[2009/05/18 10:44:26 | 00,024,661 | ---- | C] (Perle Systems Ltd.) -- C:\windows\System32\dllcache\spxcoins.dll
[2009/05/18 10:44:26 | 00,019,200 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\tapi.dll
[2009/05/18 10:44:26 | 00,019,200 | ---- | C] (Microsoft Corporation) -- C:\windows\System\TAPI.DLL
[2009/05/18 10:44:26 | 00,013,600 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\wfwnet.drv
[2009/05/18 10:44:26 | 00,013,600 | ---- | C] (Microsoft Corporation) -- C:\windows\System\WFWNET.DRV
[2009/05/18 10:44:26 | 00,009,008 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\ver.dll
[2009/05/18 10:44:26 | 00,009,008 | ---- | C] (Microsoft Corporation) -- C:\windows\System\VER.DLL
[2009/05/18 10:44:26 | 00,004,048 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\timer.drv
[2009/05/18 10:44:26 | 00,004,048 | ---- | C] (Microsoft Corporation) -- C:\windows\System\TIMER.DRV
[2009/05/18 10:44:26 | 00,003,360 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\system.drv
[2009/05/18 10:44:26 | 00,003,360 | ---- | C] (Microsoft Corporation) -- C:\windows\System\SYSTEM.DRV
[2009/05/18 10:44:26 | 00,002,176 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\vga.drv
[2009/05/18 10:44:26 | 00,002,176 | ---- | C] (Microsoft Corporation) -- C:\windows\System\VGA.DRV
[2009/05/18 10:44:26 | 00,001,744 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\sound.drv
[2009/05/18 10:44:26 | 00,001,744 | ---- | C] (Microsoft Corporation) -- C:\windows\System\SOUND.DRV
[2009/05/18 10:44:25 | 00,126,912 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\msvideo.dll
[2009/05/18 10:44:25 | 00,126,912 | ---- | C] (Microsoft Corporation) -- C:\windows\System\MSVIDEO.DLL
[2009/05/18 10:44:25 | 00,082,944 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\olecli.dll
[2009/05/18 10:44:25 | 00,082,944 | ---- | C] (Microsoft Corporation) -- C:\windows\System\OLECLI.DLL
[2009/05/18 10:44:25 | 00,073,376 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\mciavi.drv
[2009/05/18 10:44:25 | 00,073,376 | ---- | C] (Microsoft Corporation) -- C:\windows\System\MCIAVI.DRV
[2009/05/18 10:44:25 | 00,068,768 | ---- | C] (Microsoft Corporation) -- C:\windows\System\mmsystem.dll
[2009/05/18 10:44:25 | 00,028,160 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\mciwave.drv
[2009/05/18 10:44:25 | 00,028,160 | ---- | C] (Microsoft Corporation) -- C:\windows\System\MCIWAVE.DRV
[2009/05/18 10:44:25 | 00,025,264 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\mciseq.drv
[2009/05/18 10:44:25 | 00,025,264 | ---- | C] (Microsoft Corporation) -- C:\windows\System\MCISEQ.DRV
[2009/05/18 10:44:25 | 00,024,064 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\olesvr.dll
[2009/05/18 10:44:25 | 00,024,064 | ---- | C] (Microsoft Corporation) -- C:\windows\System\OLESVR.DLL
[2009/05/18 10:44:25 | 00,005,120 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\shell.dll
[2009/05/18 10:44:25 | 00,005,120 | ---- | C] (Microsoft Corporation) -- C:\windows\System\SHELL.DLL
[2009/05/18 10:44:25 | 00,002,032 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\mouse.drv
[2009/05/18 10:44:25 | 00,002,032 | ---- | C] (Microsoft Corporation) -- C:\windows\System\MOUSE.DRV
[2009/05/18 10:44:25 | 00,001,152 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\mmtask.tsk
[2009/05/18 10:44:25 | 00,001,152 | ---- | C] (Microsoft Corporation) -- C:\windows\System\MMTASK.TSK
[2009/05/18 10:44:24 | 00,109,456 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\avifile.dll
[2009/05/18 10:44:24 | 00,109,456 | ---- | C] (Microsoft Corporation) -- C:\windows\System\AVIFILE.DLL
[2009/05/18 10:44:24 | 00,069,584 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\avicap.dll
[2009/05/18 10:44:24 | 00,069,584 | ---- | C] (Microsoft Corporation) -- C:\windows\System\AVICAP.DLL
[2009/05/18 10:44:24 | 00,069,120 | ---- | C] (Microsoft Corporation) -- C:\windows\notepad.exe
[2009/05/18 10:44:24 | 00,032,816 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\commdlg.dll
[2009/05/18 10:44:24 | 00,032,816 | ---- | C] (Microsoft Corporation) -- C:\windows\System\COMMDLG.DLL
[2009/05/18 10:44:24 | 00,015,360 | ---- | C] (Microsoft Corporation) -- C:\windows\TASKMAN.EXE
[2009/05/18 10:44:24 | 00,015,360 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\taskman.exe
[2009/05/18 10:44:24 | 00,009,936 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\lzexpand.dll
[2009/05/18 10:44:24 | 00,009,936 | ---- | C] (Microsoft Corporation) -- C:\windows\System\LZEXPAND.DLL
[2009/05/18 10:44:24 | 00,002,000 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\keyboard.drv
[2009/05/18 10:44:24 | 00,002,000 | ---- | C] (Microsoft Corporation) -- C:\windows\System\KEYBOARD.DRV
[2009/05/18 10:44:23 | 00,146,432 | ---- | C] (Microsoft Corporation) -- C:\windows\System\winspool.drv
[2009/05/18 10:44:23 | 00,074,752 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\storprop.dll
[2009/05/18 10:44:23 | 00,008,704 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\batt.dll
[2009/05/18 10:44:23 | 00,001,688 | ---- | C] () -- C:\windows\System32\AUTOEXEC.NT
[2009/05/18 10:44:20 | 00,000,138 | -HS- | C] () -- C:\Documents and Settings\All Users\Documents\desktop.ini
[2009/05/18 10:44:20 | 00,000,084 | -HS- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
[2009/05/18 10:44:20 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini
[2009/05/18 10:43:51 | 00,797,189 | ---- | C] () -- C:\windows\System32\dllcache\NT5IIS.CAT
[2009/05/18 10:43:51 | 00,399,645 | ---- | C] () -- C:\windows\System32\dllcache\MAPIMIG.CAT
[2009/05/18 10:43:51 | 00,037,484 | ---- | C] () -- C:\windows\System32\dllcache\MW770.CAT
[2009/05/18 10:43:51 | 00,013,472 | ---- | C] () -- C:\windows\System32\dllcache\HPCRDP.CAT
[2009/05/18 10:43:51 | 00,008,574 | ---- | C] () -- C:\windows\System32\dllcache\IASNT4.CAT
[2009/05/18 10:43:51 | 00,007,382 | ---- | C] () -- C:\windows\System32\dllcache\OEMBIOS.CAT
[2009/05/18 10:43:43 | 00,000,000 | ---D | C] -- C:\windows\System32\CatRoot2
[2009/05/18 10:43:43 | 00,000,000 | ---D | C] -- C:\windows\System32\CatRoot
[2009/05/18 10:43:38 | 00,000,000 | --SD | C] -- C:\Documents and Settings\All Users\Application Data\Microsoft
[2009/05/18 10:43:21 | 00,000,000 | ---D | C] -- C:\Documents and Settings
[2009/05/18 10:43:20 | 00,095,072 | ---- | C] () -- C:\windows\System32\FNTCACHE.DAT
[2009/05/18 10:42:16 | 00,000,261 | ---- | C] () -- C:\windows\System32\$winnt$.inf
[2009/05/18 10:38:12 | 00,000,000 | R-SD | C] -- C:\windows\Fonts
[2009/05/18 10:38:12 | 00,000,000 | RHSD | C] -- C:\windows\System32\dllcache
[2009/05/18 10:38:12 | 00,000,000 | R--D | C] -- C:\windows\Web
[2009/05/18 10:38:12 | 00,000,000 | -H-D | C] -- C:\windows\inf
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\WinSxS
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\twain_32
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\Temp
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\wins
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\wbem
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\usmt
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\spool
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\ShellExt
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\Setup
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\ras
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\oobe
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\npp
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\mui
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\inetsrv
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\IME
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\icsxml
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\ias
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\export
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\drivers\etc
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\drivers\disdn
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\drivers
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\dhcp
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\config
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\3com_dmi
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\3076
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\2052
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\1054
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\1042
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\1041
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\1037
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\1033
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\1031
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\1028
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\System32\1025
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\system32
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\system
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\security
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\Resources
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\repair
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\mui
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\msapps
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\msagent
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\Media
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\java
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\ime
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\Help
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\Driver Cache
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\Debug
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\Cursors
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\Connection Wizard
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\Config
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\AppPatch
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\windows\addins
[2009/05/18 10:38:12 | 00,000,000 | ---D | C] -- C:\WINDOWS
[2009/05/18 10:20:41 | 00,026,144 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\spupdsvc.exe
[2009/05/18 10:20:40 | 00,000,000 | -H-D | C] -- C:\windows\$hf_mig$
[2009/05/18 10:20:32 | 00,000,000 | -H-D | C] -- C:\windows\$MSI31Uninstall_KB893803v2$
[2009/05/18 10:20:25 | 00,000,000 | ---D | C] -- C:\windows\System32\bits
[2009/05/18 10:19:59 | 00,438,784 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xpob2res.dll
[2009/05/18 10:19:59 | 00,354,304 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\winhttp.dll
[2009/05/18 10:19:59 | 00,018,944 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\qmgrprxy.dll
[2009/05/18 10:19:59 | 00,008,192 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\bitsprx2.dll
[2009/05/18 10:19:59 | 00,007,168 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\bitsprx3.dll
[2009/05/18 10:18:15 | 00,323,608 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wucltui.dll
[2009/05/18 10:18:15 | 00,043,544 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wups2.dll
[2009/05/18 10:18:15 | 00,034,328 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wups.dll
[2009/05/18 10:18:15 | 00,031,768 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wucltui.dll.mui
[2009/05/18 10:18:14 | 00,561,688 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wuapi.dll
[2009/05/18 10:18:14 | 00,213,528 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wuaucpl.cpl
[2009/05/18 10:18:14 | 00,023,576 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wuaucpl.cpl.mui
[2009/05/18 10:18:14 | 00,023,576 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wuapi.dll.mui
[2009/05/18 10:18:14 | 00,018,456 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\wuaueng.dll.mui
[2009/05/18 10:17:49 | 00,000,000 | ---D | C] -- C:\windows\SoftwareDistribution
[2009/05/18 10:17:16 | 00,013,646 | ---- | C] () -- C:\windows\System32\wpa.bak
[2003/03/31 05:00:00 | 00,000,610 | ---- | C] () -- C:\windows\win.ini
[2003/03/31 05:00:00 | 00,000,227 | ---- | C] () -- C:\windows\system.ini

========== Files - Modified Within 30 Days ==========

[2 C:\windows\System32\*.tmp files]
[4 C:\windows\*.tmp files]
[2009/06/08 18:57:10 | 03,371,384 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\xp\Desktop\mbam-setup.exe
[2009/06/08 18:54:41 | 00,501,760 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\xp\Desktop\OTL.exe
[2009/06/08 18:52:19 | 00,000,611 | ---- | M] () -- C:\Documents and Settings\xp\Desktop\NTREGOPT.lnk
[2009/06/08 18:52:19 | 00,000,592 | ---- | M] () -- C:\Documents and Settings\xp\Desktop\ERUNT.lnk
[2009/06/08 18:51:57 | 00,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\xp\Desktop\erunt_setup.exe
[2009/06/08 18:45:47 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\LauncherAccess.dt
[2009/06/08 18:40:36 | 00,013,646 | ---- | M] () -- C:\windows\System32\wpa.dbl
[2009/06/08 18:08:35 | 00,000,266 | -H-- | M] () -- C:\windows\tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job
[2009/06/08 18:08:33 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\xp\Local Settings\desktop.ini
[2009/06/08 18:08:31 | 00,000,006 | -H-- | M] () -- C:\windows\tasks\SA.DAT
[2009/06/08 18:08:27 | 00,002,048 | --S- | M] () -- C:\windows\bootstat.dat
[2009/06/08 18:00:00 | 00,000,250 | -H-- | M] () -- C:\windows\tasks\A92DB6AF91922ED7.job
[2009/06/08 17:55:51 | 00,000,069 | ---- | M] () -- C:\windows\NeroDigital.ini
[2009/06/08 17:45:17 | 00,001,734 | ---- | M] () -- C:\Documents and Settings\xp\Desktop\HijackThis.lnk
[2009/06/08 15:28:04 | 00,001,891 | ---- | M] () -- C:\windows\imsins.BAK
[2009/06/08 15:05:15 | 00,000,580 | ---- | M] () -- C:\Documents and Settings\xp\My Documents\My Sharing Folders.lnk
[2009/06/07 08:09:04 | 00,000,610 | ---- | M] () -- C:\windows\win.ini
[2009/06/05 23:26:09 | 00,000,370 | RHS- | M] () -- C:\autorun.inf
[2009/06/03 17:25:43 | 00,054,156 | -H-- | M] () -- C:\windows\QTFont.qfn
[2009/06/03 13:46:20 | 00,636,025 | R--- | M] () -- C:\Documents and Settings\xp\Desktop\Bejeweled.zip
[2009/06/02 22:37:30 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/06/02 17:01:24 | 00,005,632 | ---- | M] () -- C:\windows\System32\drivers\StarOpen.sys
[2009/06/02 16:52:36 | 00,000,673 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Samsung PC Studio 3.lnk
[2009/06/01 21:33:17 | 00,000,472 | ---- | M] () -- C:\windows\tasks\Ad-Aware Update (Weekly).job
[2009/05/28 21:44:39 | 00,000,684 | ---- | M] () -- C:\Documents and Settings\xp\Desktop\Advanced System Optimizer.lnk
[2009/05/28 21:17:25 | 00,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2009/05/26 23:30:56 | 00,000,761 | ---- | M] () -- C:\Documents and Settings\xp\Desktop\IsoBuster.lnk
[2009/05/26 23:26:14 | 00,000,967 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Medieval CUE Splitter.lnk
[2009/05/26 23:23:31 | 00,001,732 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\WinZip.lnk
[2009/05/26 23:22:07 | 00,000,692 | ---- | M] () -- C:\Documents and Settings\xp\Desktop\WinRAR.lnk
[2009/05/26 14:26:01 | 00,000,000 | ---- | M] () -- C:\boot.ini
[2009/05/26 13:20:08 | 00,040,160 | ---- | M] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbamswissarmy.sys
[2009/05/26 13:19:56 | 00,019,096 | ---- | M] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys
[2009/05/25 21:31:23 | 00,015,688 | ---- | M] () -- C:\windows\System32\lsdelete.exe
[2009/05/25 21:28:34 | 00,000,867 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2009/05/23 17:43:20 | 00,001,409 | ---- | M] () -- C:\windows\QTFont.for
[2009/05/23 17:35:10 | 00,487,424 | ---- | M] () -- C:\windows\potfield.scr
[2009/05/23 17:31:19 | 00,000,025 | ---- | M] () -- C:\windows\Cannabinatic.INI
[2009/05/23 02:51:21 | 00,002,361 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Nero StartSmart.lnk
[2009/05/23 02:51:21 | 00,002,261 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Nero Home.lnk
[2009/05/21 22:41:29 | 00,001,586 | ---- | M] () -- C:\Documents and Settings\xp\Desktop\LimeWire PRO 5.1.2.lnk
[2009/05/21 22:26:26 | 00,000,850 | ---- | M] () -- C:\Documents and Settings\xp\Desktop\FrostWire 4.18.0.lnk
[2009/05/21 22:08:02 | 00,001,736 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Windows Live Messenger.lnk
[2009/05/21 21:50:11 | 00,095,072 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2009/05/21 21:44:56 | 00,000,630 | ---- | M] () -- C:\Documents and Settings\xp\Desktop\µTorrent.lnk
[2009/05/21 21:34:49 | 00,000,715 | ---- | M] () -- C:\windows\aolback.exe.lnk
[2009/05/21 21:33:55 | 00,000,594 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AOL 9.0.lnk
[2009/05/21 21:33:19 | 00,000,724 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2009/05/21 21:33:08 | 00,157,696 | ---- | M] (RealNetworks) -- C:\windows\System32\rmoc3260.dll
[2009/05/21 21:33:01 | 00,278,528 | ---- | M] (Real Networks, Inc) -- C:\windows\System32\pncrt.dll
[2009/05/21 21:31:28 | 00,000,335 | ---- | M] () -- C:\windows\nsreg.dat
[2009/05/21 21:26:08 | 00,000,788 | ---- | M] () -- C:\Documents and Settings\xp\Desktop\Windows Media Player.lnk
[2009/05/21 21:25:51 | 00,023,392 | ---- | M] () -- C:\windows\System32\nscompat.tlb
[2009/05/21 21:25:51 | 00,016,832 | ---- | M] () -- C:\windows\System32\amcompat.tlb
[2009/05/21 21:24:15 | 00,000,000 | -H-- | M] () -- C:\windows\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2009/05/21 21:23:34 | 00,001,707 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Avira AntiVir Control Center.lnk
[2009/05/21 21:15:37 | 05,167,952 | ---- | M] (Patchou) -- C:\Documents and Settings\xp\Desktop\MsgPlusLive-481.exe
[2009/05/21 21:08:39 | 00,001,602 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2009/05/21 21:06:13 | 00,000,073 | -HS- | M] () -- C:\Documents and Settings\xp\My Documents\desktop.ini
[2009/05/21 20:44:40 | 00,000,227 | ---- | M] () -- C:\windows\system.ini
[2009/05/20 23:35:15 | 00,356,120 | ---- | M] () -- C:\windows\System32\PerfStringBackup.INI
[2009/05/20 23:35:15 | 00,311,604 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2009/05/20 23:35:15 | 00,039,992 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2009/05/18 20:27:53 | 00,940,794 | ---- | M] () -- C:\windows\System32\LoopyMusic.wav
[2009/05/18 20:27:53 | 00,146,650 | ---- | M] () -- C:\windows\System32\BuzzingBee.wav
[2009/05/18 20:27:29 | 00,000,000 | ---- | M] () -- C:\windows\ativpsrm.bin
[2009/05/18 19:38:27 | 00,316,640 | ---- | M] () -- C:\windows\WMSysPr9.prx
[2009/05/18 19:38:11 | 00,000,767 | ---- | M] () -- C:\Documents and Settings\xp\Desktop\Internet Explorer.lnk
[2009/05/18 19:28:02 | 00,250,048 | RHS- | M] () -- C:\ntldr
[2009/05/18 18:43:12 | 00,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2009/05/18 18:15:20 | 00,000,138 | -HS- | M] () -- C:\Documents and Settings\All Users\Documents\desktop.ini
[2009/05/18 18:00:00 | 00,025,065 | ---- | M] () -- C:\windows\System32\wmpscheme.xml
[2009/05/18 17:57:32 | 00,008,192 | ---- | M] () -- C:\windows\REGLOCS.OLD
[2009/05/18 17:56:42 | 00,000,261 | ---- | M] () -- C:\windows\System32\$winnt$.inf
[2009/05/18 17:55:10 | 00,000,084 | -HS- | M] () -- C:\Documents and Settings\xp\Start Menu\Programs\Startup\desktop.ini
[2009/05/18 17:55:10 | 00,000,084 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
[2009/05/18 17:55:09 | 00,002,577 | ---- | M] () -- C:\windows\System32\CONFIG.NT
[2009/05/18 17:55:09 | 00,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2009/05/18 17:55:09 | 00,000,000 | RHS- | M] () -- C:\IO.SYS
[2009/05/18 17:55:09 | 00,000,000 | ---- | M] () -- C:\windows\control.ini
[2009/05/18 17:55:06 | 00,299,552 | ---- | M] () -- C:\windows\WMSysPrx.prx
[2009/05/18 17:55:04 | 00,004,161 | ---- | M] () -- C:\windows\ODBCINST.INI
[2009/05/18 17:54:33 | 00,000,488 | RH-- | M] () -- C:\windows\System32\WindowsLogon.manifest
[2009/05/18 17:54:33 | 00,000,488 | RH-- | M] () -- C:\windows\System32\logonui.exe.manifest
[2009/05/18 17:54:29 | 00,000,749 | RH-- | M] () -- C:\windows\WindowsShell.Manifest
[2009/05/18 17:54:29 | 00,000,749 | RH-- | M] () -- C:\windows\System32\wuaucpl.cpl.manifest
[2009/05/18 17:54:29 | 00,000,749 | RH-- | M] () -- C:\windows\System32\sapi.cpl.manifest
[2009/05/18 17:54:29 | 00,000,749 | RH-- | M] () -- C:\windows\System32\nwc.cpl.manifest
[2009/05/18 17:54:29 | 00,000,749 | RH-- | M] () -- C:\windows\System32\ncpa.cpl.manifest
[2009/05/18 17:54:29 | 00,000,749 | RH-- | M] () -- C:\windows\System32\cdplayer.exe.manifest
[2009/05/18 17:54:27 | 00,000,790 | ---- | M] () -- C:\Documents and Settings\xp\Desktop\Windows Movie Maker.lnk
[2009/05/18 17:52:44 | 00,021,640 | ---- | M] () -- C:\windows\System32\emptyregdb.dat
[2009/05/18 17:52:43 | 00,000,037 | ---- | M] () -- C:\windows\vbaddin.ini
[2009/05/18 17:52:43 | 00,000,036 | ---- | M] () -- C:\windows\vb.ini
[2009/05/18 10:44:20 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\xp\Application Data\desktop.ini
[2009/05/18 10:44:20 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini
[2009/05/18 10:17:14 | 00,013,646 | ---- | M] () -- C:\windows\System32\wpa.bak
< End of report >

It wont let me run the rooter detector , it says 'exeption processing message c00000a3 parameters 75b6bf7c 4 75 b6bf7c 75b6bf7c , then gives me the options cancel - try again - continue but whichever one i click it just does this

any help be greatly appreciated

#2
Rorschach112

Posted 09 June 2009 - 05:41 AM

Ralphie

Retired Staff
47,710 posts

have you posted at any other forums ?

#3
sarahs

Posted 09 June 2009 - 06:00 AM

Member

Topic Starter
Member
28 posts

no, just this one

#4
Rorschach112

Posted 09 June 2009 - 06:51 AM

Ralphie

Retired Staff
47,710 posts

hi

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you don't know how to disable them then just continue on.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.

#5
sarahs

Posted 09 June 2009 - 07:21 AM

Member

Topic Starter
Member
28 posts

Hi, i think that might have done the trick, im now able to get on my c drive and open malwarebytes, i have that running now.

here is my log file

ComboFix 09-06-08.03 - xp 06/09/2009 6:11.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.185 [GMT -7:00]
Running from: c:\documents and settings\xp\Desktop\ComboFixer.exe
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
c:\windows\system32\drivers\gxvxcvuoxjhyfrkcvvirxdqjnoedcyuodxjda.sys
c:\windows\system32\gxvxcevqjgxnctjlkiemlrtgmtoyiclwrtjiy.dll
c:\windows\system32\gxvxcnbakhdidhxdckcbxdxesyigncstqsppp.dll
c:\windows\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_GXVXCSERV.SYS

((((((((((((((((((((((((( Files Created from 2009-05-09 to 2009-06-09 )))))))))))))))))))))))))))))))
.

2009-06-09 13:00 . 2009-05-26 20:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-09 13:00 . 2009-05-26 20:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-09 12:07 . 2009-06-09 12:07 446538 ----a-w- c:\documents and settings\Guest\Application Data\Mozilla\Firefox\Profiles\irki0u7e.default\extensions\{d0c29249-27c7-4192-aec8-6c84436aeb80}\components\TSBoxFF.dll
2009-06-09 11:44 . 2006-05-31 22:38 10752 ----a-w- c:\windows\system32\md5.dll
2009-06-09 11:44 . 2004-05-11 17:56 423784 ----a-w- c:\windows\system32\XceedBkp.dll
2009-06-09 11:44 . 2003-11-19 21:59 512688 ----a-w- c:\windows\system32\XceedCry.dll
2009-06-09 11:44 . 2000-07-15 13:00 101888 ----a-w- c:\windows\system32\VB6STKIT.DLL
2009-06-09 11:44 . 2000-07-15 07:00 118784 ----a-w- c:\windows\system32\msstdfmt.dll
2009-06-09 11:37 . 2009-06-09 13:10 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-09 11:37 . 2008-08-25 19:36 81288 ----a-w- c:\windows\system32\drivers\iksyssec.sys
2009-06-09 11:37 . 2008-08-25 19:36 66952 ----a-w- c:\windows\system32\drivers\iksysflt.sys
2009-06-09 11:37 . 2008-08-25 19:36 40840 ----a-w- c:\windows\system32\drivers\ikfilesec.sys
2009-06-09 11:37 . 2008-06-02 23:19 29576 ----a-w- c:\windows\system32\drivers\kcom.sys
2009-06-09 11:37 . 2009-06-09 11:37 -------- d-----w- c:\program files\Spyware Doctor
2009-06-09 11:37 . 2009-06-09 11:37 -------- d-----w- c:\documents and settings\xp\Application Data\PC Tools
2009-06-09 11:13 . 2009-06-09 11:18 -------- d-----w- C:\Rooter$
2009-06-09 01:52 . 2009-06-09 01:52 -------- d-----w- c:\program files\ERUNT
2009-06-06 02:17 . 2008-04-13 18:45 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-06-05 20:11 . 2009-06-05 20:11 -------- d-----w- c:\program files\FreeHDplay
2009-06-03 05:37 . 2009-06-03 05:37 -------- d-----w- c:\documents and settings\xp\Application Data\Malwarebytes
2009-06-03 05:37 . 2009-06-03 05:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-03 05:37 . 2009-06-09 13:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-03 00:10 . 2009-06-03 00:10 -------- d-----w- c:\documents and settings\xp\Application Data\Samsung
2009-06-02 23:53 . 2006-05-04 05:53 174592 ----a-w- c:\windows\system32\framedyn.dll
2009-06-02 23:53 . 2009-06-02 23:53 -------- d-----w- c:\windows\system32\Samsung_USB_Drivers
2009-06-02 23:53 . 2007-05-02 18:11 15112 ----a-w- c:\windows\system32\drivers\ss_mdfl.sys
2009-06-02 23:53 . 2007-05-02 18:11 12424 ----a-w- c:\windows\system32\drivers\ss_whnt.sys
2009-06-02 23:53 . 2007-05-02 18:11 12424 ----a-w- c:\windows\system32\drivers\ss_wh.sys
2009-06-02 23:53 . 2007-05-02 18:11 109704 ----a-w- c:\windows\system32\drivers\ss_mdm.sys
2009-06-02 23:53 . 2007-05-02 18:11 83592 ----a-w- c:\windows\system32\drivers\ss_bus.sys
2009-06-02 23:53 . 2007-05-02 18:11 12424 ----a-w- c:\windows\system32\drivers\ss_cmnt.sys
2009-06-02 23:53 . 2007-05-02 18:11 12424 ----a-w- c:\windows\system32\drivers\ss_cm.sys
2009-06-02 23:52 . 2009-06-03 00:01 5632 ----a-w- c:\windows\system32\drivers\StarOpen.sys
2009-06-02 23:52 . 2009-06-02 23:52 -------- d-----w- c:\program files\Samsung
2009-06-02 04:33 . 2009-06-02 04:33 314200 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2009-06-02 04:33 . 2009-06-02 04:33 25440 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\savapibridge.dll
2009-06-02 04:33 . 2009-06-02 04:33 169312 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2009-06-02 04:33 . 2009-06-02 04:33 15688 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
2009-06-02 04:33 . 2009-06-02 04:33 348496 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2009-06-02 04:33 . 2009-06-02 04:33 294240 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2009-06-02 04:33 . 2009-06-02 04:33 83808 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll
2009-06-02 04:33 . 2009-06-02 04:33 1630048 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2009-06-02 04:33 . 2009-06-02 04:33 40288 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2009-06-02 04:33 . 2009-06-02 04:33 212848 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2009-06-02 04:32 . 2009-06-02 04:32 640360 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2009-06-02 04:32 . 2009-06-02 04:32 559464 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2009-06-02 04:32 . 2009-06-02 04:32 540536 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2009-06-02 04:32 . 2009-06-02 04:32 2352456 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2009-06-02 04:32 . 2009-06-02 04:32 627536 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWWSC.exe
2009-06-02 04:32 . 2009-06-02 04:32 518488 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2009-06-02 04:32 . 2009-06-02 04:32 1005904 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2009-05-29 04:45 . 2009-05-29 04:45 -------- d-----w- c:\documents and settings\xp\Application Data\Systweak
2009-05-29 04:44 . 2009-06-09 01:04 -------- d-----w- c:\program files\Advanced System Optimizer
2009-05-29 04:42 . 2006-10-12 16:29 83504 ----a-w- c:\documents and settings\All Users\Application Data\AOL\UserProfiles\All Users\SUDS\TEMP\ProgUpd.dll
2009-05-29 04:30 . 2009-05-29 04:30 -------- d-----w- c:\documents and settings\xp\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-05-29 04:30 . 2009-05-29 04:17 38200 ----a-w- c:\documents and settings\xp\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-05-29 04:17 . 2009-05-29 04:17 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-05-29 04:16 . 2009-05-29 04:17 -------- d-----w- c:\program files\Common Files\Adobe
2009-05-29 04:12 . 2009-05-29 04:30 -------- d-----w- c:\documents and settings\xp\Local Settings\Application Data\Adobe
2009-05-29 04:11 . 2009-05-29 19:16 -------- d-----w- c:\program files\NOS
2009-05-29 04:11 . 2009-05-29 19:16 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-05-28 08:28 . 2009-05-28 08:28 -------- d-sh--w- c:\documents and settings\Guest\PrivacIE
2009-05-27 08:02 . 2009-05-27 08:02 13688 ----a-w- c:\documents and settings\Guest\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-27 07:59 . 2009-05-28 08:28 -------- d-----w- c:\documents and settings\Guest
2009-05-27 06:30 . 2009-05-27 06:30 -------- d-----w- c:\program files\Smart Projects
2009-05-27 06:26 . 2009-05-27 06:26 -------- d-----w- c:\program files\Medieval Software
2009-05-27 06:23 . 2009-05-27 06:23 -------- d-----w- c:\documents and settings\xp\Local Settings\Application Data\WinZip
2009-05-27 06:23 . 2009-05-27 06:23 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip
2009-05-27 05:14 . 2009-05-27 05:14 -------- d-----w- c:\windows\Sun
2009-05-27 01:38 . 2008-10-16 21:13 202776 -c--a-w- c:\windows\system32\dllcache\wuweb.dll
2009-05-27 01:38 . 2008-10-16 21:13 202776 ----a-w- c:\windows\system32\wuweb.dll
2009-05-26 04:37 . 2009-05-26 04:31 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-05-26 04:31 . 2009-05-26 04:31 64160 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Drivers\32\lbd.sys
2009-05-26 04:28 . 2009-05-26 04:28 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-05-26 04:28 . 2009-03-12 08:17 2902048 -c--a-w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}\Ad-AwareAE.exe
2009-05-26 04:28 . 2009-05-26 04:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-05-26 04:28 . 2009-05-26 04:28 -------- d-----w- c:\program files\Lavasoft
2009-05-24 02:00 . 2009-05-24 02:00 -------- d-----w- c:\program files\MSXML 4.0
2009-05-24 00:43 . 2009-06-04 06:20 -------- d-----w- c:\documents and settings\xp\G-Force
2009-05-24 00:42 . 2009-05-24 00:42 -------- d-----w- c:\program files\SoundSpectrum
2009-05-24 00:35 . 2009-05-24 00:35 487424 ----a-w- c:\windows\potfield.scr
2009-05-24 00:31 . 2009-05-24 00:32 -------- d-----w- c:\windows\Cannab
2009-05-23 10:01 . 2009-05-23 10:09 -------- d-----w- c:\documents and settings\xp\Local Settings\Application Data\Ahead
2009-05-23 09:50 . 2009-05-25 21:13 -------- d-----w- c:\documents and settings\xp\Application Data\Ahead
2009-05-23 09:50 . 2009-05-23 09:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Ahead
2009-05-23 09:49 . 2009-05-23 09:50 -------- d-----w- c:\program files\Common Files\Ahead
2009-05-23 09:49 . 2009-05-23 09:49 -------- d-----w- c:\program files\Nero
2009-05-23 09:49 . 2009-05-23 09:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2009-05-22 22:52 . 2009-05-22 22:52 -------- d-----w- c:\documents and settings\xp\Local Settings\Application Data\AOL
2009-05-22 22:52 . 2003-08-27 17:29 65536 ----a-w- c:\windows\wanmpsvc.exe
2009-05-22 19:55 . 2008-04-14 00:12 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-05-22 08:38 . 2008-10-16 21:06 268648 ----a-w- c:\windows\system32\mucltui.dll
2009-05-22 08:38 . 2008-10-16 21:06 208744 ----a-w- c:\windows\system32\muweb.dll
2009-05-22 08:21 . 2009-05-22 08:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-05-22 07:26 . 2009-05-22 07:26 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-22 07:25 . 2009-05-22 07:25 152576 ----a-w- c:\documents and settings\xp\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-22 06:44 . 2009-05-22 07:21 -------- d-----w- c:\windows\system32\Adobe
2009-05-22 05:51 . 2009-05-22 05:51 0 ----a-w- c:\documents and settings\xp\Application Data\FrostWire\.NetworkShare\Incomplete\T-4506256-LimeWireWin4.16.6.exe
2009-05-22 05:26 . 2009-06-09 00:45 -------- d-----w- c:\documents and settings\xp\Application Data\FrostWire
2009-05-22 05:25 . 2009-05-22 07:26 -------- d-----w- c:\program files\Java
2009-05-22 05:25 . 2009-05-22 05:25 -------- d-----w- c:\program files\Common Files\Java
2009-05-22 05:23 . 2009-05-22 05:26 -------- d-----w- c:\program files\FrostWire
2009-05-22 05:08 . 2009-06-06 01:53 -------- d-----w- c:\documents and settings\xp\Contacts
2009-05-22 05:08 . 2009-05-26 04:32 -------- dc----w- c:\windows\system32\DRVSTORE
2009-05-22 05:07 . 2009-05-22 05:52 -------- d-----w- c:\program files\MSN Messenger
2009-05-22 04:46 . 2009-05-22 04:46 -------- d-----w- c:\program files\Trend Micro
2009-05-22 04:44 . 2009-05-22 04:44 -------- d-----w- c:\program files\uTorrent
2009-05-22 04:44 . 2009-06-09 01:58 -------- d-----w- c:\documents and settings\xp\Application Data\uTorrent
2009-05-22 04:35 . 2009-05-22 04:35 -------- d-----w- c:\documents and settings\xp\Application Data\AOL
2009-05-22 04:32 . 2005-05-12 19:36 153088 ----a-w- c:\windows\system32\jgdwmie.dll
2009-05-22 04:32 . 2005-05-12 19:36 54784 ----a-w- c:\windows\system32\Inetwh32.dll
2009-05-22 04:32 . 2005-05-12 19:36 1044480 ----a-w- c:\windows\system32\roboex32.dll
2009-05-22 04:32 . 2005-05-12 19:36 1060864 ----a-w- c:\windows\system32\mfc71.dll
2009-05-22 04:32 . 2005-05-12 19:36 14538 ----a-w- c:\documents and settings\All Users\Application Data\AOL\C_AOL 9.0\ctem.sys
2009-05-22 04:32 . 2003-01-10 23:13 33588 ----a-w- c:\windows\system32\drivers\wanatw4.sys
2009-05-22 04:32 . 2003-09-16 17:07 499712 ------w- c:\windows\system32\msvcp71.dll
2009-05-22 04:32 . 2003-09-09 21:06 348160 ------w- c:\windows\system32\msvcr71.dll
2009-05-22 04:32 . 2009-05-22 04:38 -------- d-----w- c:\program files\Common Files\aolshare
2009-05-22 04:32 . 2009-05-27 18:49 -------- d-----w- c:\program files\AOL 9.0
2009-05-22 04:32 . 2009-05-22 22:52 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL
2009-05-22 04:31 . 2009-05-26 21:42 -------- d-----w- c:\program files\Common Files\AOL
2009-05-22 04:26 . 2008-04-14 00:12 26624 ----a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2009-05-22 04:25 . 2009-05-22 04:25 -------- d-----w- c:\program files\Windows Media Connect 2
2009-05-22 04:22 . 2009-05-26 04:35 -------- d-----w- c:\documents and settings\xp\Application Data\AXISBAT
2009-05-22 04:22 . 2009-05-22 05:09 -------- d-----w- c:\program files\Circle Developemnt

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-09 13:10 . 2009-06-09 11:43 49268 ----a-w- c:\documents and settings\All Users\Application Data\AppRanger\system\WebDOMFilter.dll
2009-06-09 13:04 . 2009-06-09 11:43 -------- d-----w- c:\documents and settings\All Users\Application Data\AppRanger
2009-06-09 11:44 . 2009-06-09 11:44 -------- d-----w- c:\program files\MalwareSweeper.com
2009-06-09 11:44 . 2009-06-09 11:43 -------- d-----w- c:\program files\AppRanger
2009-06-09 11:43 . 2009-06-09 11:43 446538 ----a-w- c:\documents and settings\xp\Application Data\Mozilla\Firefox\Profiles\hoxyw94x.default\extensions\{d0c29249-27c7-4192-aec8-6c84436aeb80}\components\TSBoxFF.dll
2009-05-22 05:42 . 2009-05-22 05:33 -------- d-----w- c:\documents and settings\xp\Application Data\LimeWire
2009-05-22 04:36 . 2009-05-22 04:33 -------- d-----w- c:\program files\AOL Companion
2009-05-22 04:34 . 2009-05-22 04:33 -------- d-----w- c:\program files\Common Files\aolback
2009-05-22 04:33 . 2009-05-22 04:33 -------- d-----w- c:\documents and settings\xp\Application Data\You've Got Pictures Screensaver
2009-05-22 04:33 . 2009-05-22 04:33 -------- d-----w- c:\program files\Learn2.com
2009-05-22 04:33 . 2009-05-22 04:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-05-22 04:33 . 2009-05-22 04:33 -------- d-----w- c:\program files\Viewpoint
2009-05-22 04:33 . 2009-05-22 04:33 -------- d-----w- c:\program files\QuickTime
2009-05-22 04:33 . 2009-05-22 04:33 -------- d-----w- c:\documents and settings\All Users\Application Data\QuickTime
2009-05-22 04:33 . 2009-05-22 04:33 -------- d-----w- c:\program files\Common Files\Nullsoft
2009-05-22 04:33 . 2009-05-22 04:33 8552 ----a-w- c:\windows\system32\drivers\asctrm.sys
2009-05-22 04:33 . 2009-05-22 04:33 -------- d-----w- c:\program files\Common Files\Real
2009-05-22 04:33 . 2009-05-22 04:33 -------- d-----w- c:\program files\Real
2009-05-22 04:25 . 2009-05-22 04:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Joy coal mpeg heck
2009-05-22 04:23 . 2009-05-22 04:23 -------- d-----w- c:\program files\Avira
2009-05-22 04:23 . 2009-05-22 04:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-05-19 02:32 . 2009-05-19 00:54 76487 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2009-05-19 00:55 . 2009-05-19 00:55 -------- d-----w- c:\program files\microsoft frontpage
2009-05-19 00:52 . 2009-05-19 00:52 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-03-30 17:33 . 2009-05-22 04:23 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-03-24 23:08 . 2009-05-22 04:23 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-03-21 14:06 . 2009-06-09 11:43 989696 ----a-w- c:\documents and settings\All Users\Application Data\AppRanger\system\k1.dll
2009-03-20 20:18 . 2009-03-20 20:18 207872 ----a-w- c:\windows\system32\drivers\apprngr.sys
.

------- Sigcheck -------

[-] 2004-08-04 07:56 14336 8F078AE4ED187AAABC0A305146DE6716 c:\windows\$NtServicePackUninstall$\svchost.exe
[-] 2008-04-14 00:12 14336 27C6D03BCDB8CFEB96B716F3D8BE3E18 c:\windows\ServicePackFiles\i386\svchost.exe
[-] 2008-04-14 00:12 14336 27C6D03BCDB8CFEB96B716F3D8BE3E18 c:\windows\system32\svchost.exe

[-] 2005-03-02 18:19 577024 1800F293BCCC8EDE8A70E12B88D80036 c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2005-03-02 18:09 577024 DE2DB164BBB35DB061AF0997E4499054 c:\windows\$NtServicePackUninstall$\user32.dll
[-] 2004-08-04 07:56 577024 C72661F8552ACE7C5C85E16A3CF505C4 c:\windows\$NtUninstallKB890859$\user32.dll
[-] 2008-04-14 00:12 578560 B26B135FF1B9F60C9388B4A7D16F600B c:\windows\ServicePackFiles\i386\user32.dll
[-] 2008-04-14 00:12 578560 B26B135FF1B9F60C9388B4A7D16F600B c:\windows\system32\user32.dll

[-] 2004-08-04 07:56 82944 2ED0B7F12A60F90092081C50FA0EC2B2 c:\windows\$NtServicePackUninstall$\ws2_32.dll
[-] 2008-04-14 00:12 82432 2CCC474EB85CEAA3E1FA1726580A3E5A c:\windows\ServicePackFiles\i386\ws2_32.dll
[-] 2008-04-14 00:12 82432 2CCC474EB85CEAA3E1FA1726580A3E5A c:\windows\system32\ws2_32.dll

[-] 2006-04-20 12:18 360576 B2220C618B42A2212A59D91EBD6FC4B4 c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
[-] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[-] 2006-04-20 11:51 359808 1DBF125862891817F374F407626967F4 c:\windows\$NtServicePackUninstall$\tcpip.sys
[-] 2004-08-04 06:14 359040 9F4B36614A0FC234525BA224957DE55C c:\windows\$NtUninstallKB917953$\tcpip.sys
[-] 2008-04-13 19:20 361344 93EA8D04EC73A85DB02EB8805988F733 c:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2008-04-13 19:20 361344 93EA8D04EC73A85DB02EB8805988F733 c:\windows\ServicePackFiles\i386\tcpip.sys
[-] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 11:51 361600 9AEFA14BD6B182D61E3119FA5F436D3D c:\windows\system32\drivers\tcpip.sys

[-] 2004-08-04 07:56 502272 01C3346C241652F43AED8E2149881BFE c:\windows\$NtServicePackUninstall$\winlogon.exe
[-] 2008-04-14 00:12 507904 ED0EF0A136DEC83DF69F04118870003E c:\windows\ServicePackFiles\i386\winlogon.exe
[-] 2008-04-14 00:12 507904 ED0EF0A136DEC83DF69F04118870003E c:\windows\system32\winlogon.exe

[-] 2004-08-04 06:14 182912 558635D3AF1C7546D26067D5D9B6959E c:\windows\$NtServicePackUninstall$\ndis.sys
[-] 2008-04-13 19:20 182656 1DF7F42665C94B825322FAE71721130D c:\windows\ServicePackFiles\i386\ndis.sys
[-] 2008-04-13 19:20 182656 1DF7F42665C94B825322FAE71721130D c:\windows\system32\drivers\ndis.sys

[-] 2004-08-04 06:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\windows\$NtServicePackUninstall$\ip6fw.sys
[-] 2008-04-13 18:53 36608 3BB22519A194418D5FEC05D800A19AD0 c:\windows\ServicePackFiles\i386\ip6fw.sys
[-] 2008-04-13 18:53 36608 3BB22519A194418D5FEC05D800A19AD0 c:\windows\system32\drivers\ip6fw.sys

[-] 2005-03-02 00:36 2056832 D8ABA3EAB509627E707A3B14F00FBB6B c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
[-] 2009-02-06 10:30 2066176 607352B9CB3D708C67F6039097801B5A c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe
[-] 2005-03-02 00:34 2015232 3CD941E472DDF3534E53038535719771 c:\windows\$NtServicePackUninstall$\ntkrnlpa.exe
[-] 2004-08-04 05:59 2015232 FB142B7007CA2EEA76966C6C5CC12150 c:\windows\$NtUninstallKB890859$\ntkrnlpa.exe
[-] 2008-04-13 18:31 2023936 7F653A89F6E89E3AE0D49830EECE35D4 c:\windows\$NtUninstallKB956572$\ntkrnlpa.exe
[-] 2009-02-08 02:02 2066048 5BA7F2141BC6DB06100D0E5A732C617A c:\windows\Driver Cache\i386\ntkrnlpa.exe
[-] 2008-04-13 18:31 2065792 109F8E3E3C82E337BB71B6BC9B895D61 c:\windows\ServicePackFiles\i386\ntkrnlpa.exe
[-] 2002-08-29 08:04 1947904 0E8EFB15746878A9B256E75267337233 c:\windows\SoftwareDistribution\Download\080070f6461c8001578e5e4cd4bb024b\backup\sp1qfe\ntkrnlpa.exe
[-] 2009-02-06 10:32 2023936 65D4220799E6FC2CB079070A6393CC0E c:\windows\system32\ntkrnlpa.exe
[-] 2009-02-08 02:02 2066048 5BA7F2141BC6DB06100D0E5A732C617A c:\windows\system32\dllcache\ntkrnlpa.exe

[-] 2005-03-02 01:04 2179456 28187802B7C368C0D3AEF7D4C382AABB c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
[-] 2009-02-08 02:35 2189184 EFE8EACE83EAAD5849A7A548FB75B584 c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
[-] 2005-03-02 00:57 2135552 48B3E89AF7074CEE0314A3E0C7FAFFDB c:\windows\$NtServicePackUninstall$\ntoskrnl.exe
[-] 2004-08-04 06:18 2148352 626309040459C3915997EF98EC1C8D40 c:\windows\$NtUninstallKB890859$\ntoskrnl.exe
[-] 2008-04-13 19:24 2145280 40F8880122A030A7E9E1FEDEA833B33D c:\windows\$NtUninstallKB956572$\ntoskrnl.exe
[-] 2009-02-06 11:08 2189056 7A95B10A73737EBF24139AAA63F5212B c:\windows\Driver Cache\i386\ntoskrnl.exe
[-] 2008-04-13 19:27 2188928 0C89243C7C3EE199B96FCC16990E0679 c:\windows\ServicePackFiles\i386\ntoskrnl.exe
[-] 2002-08-29 09:03 2042240 B9080D97DBD631AADF9128F7316958D2 c:\windows\SoftwareDistribution\Download\080070f6461c8001578e5e4cd4bb024b\backup\sp1qfe\ntoskrnl.exe
[-] 2009-02-06 11:06 2145280 0CBA44D0938D57F334C0862424148B70 c:\windows\system32\ntoskrnl.exe
[-] 2009-02-06 11:08 2189056 7A95B10A73737EBF24139AAA63F5212B c:\windows\system32\dllcache\ntoskrnl.exe

[-] 2008-04-14 00:12 1033728 12896823FB95BFB3DC9B46BCAEDC9923 c:\windows\explorer.exe
[-] 2004-08-04 07:56 1032192 A0732187050030AE399B241436565E64 c:\windows\$NtServicePackUninstall$\explorer.exe
[-] 2008-04-14 00:12 1033728 12896823FB95BFB3DC9B46BCAEDC9923 c:\windows\ServicePackFiles\i386\explorer.exe

[-] 2009-02-06 11:06 110592 020CEAAEDC8EB655B6506B8C70D53BB6 c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe
[-] 2004-08-04 07:56 108032 C6CE6EEC82F187615D1002BB3BB50ED4 c:\windows\$NtServicePackUninstall$\services.exe
[-] 2008-04-14 00:12 108544 0E776ED5F7CC9F94299E70461B7B8185 c:\windows\$NtUninstallKB956572$\services.exe
[-] 2008-04-14 00:12 108544 0E776ED5F7CC9F94299E70461B7B8185 c:\windows\ServicePackFiles\i386\services.exe
[-] 2009-02-06 11:11 110592 65DF52F5B8B6E9BBD183505225C37315 c:\windows\system32\services.exe
[-] 2009-02-06 11:11 110592 65DF52F5B8B6E9BBD183505225C37315 c:\windows\system32\dllcache\services.exe

[-] 2004-08-04 07:56 13312 84885F9B82F4D55C6146EBF6065D75D2 c:\windows\$NtServicePackUninstall$\lsass.exe
[-] 2008-04-14 00:12 13312 BF2466B3E18E970D8A976FB95FC1CA85 c:\windows\ServicePackFiles\i386\lsass.exe
[-] 2008-04-14 00:12 13312 BF2466B3E18E970D8A976FB95FC1CA85 c:\windows\system32\lsass.exe

[-] 2004-08-04 07:56 15360 24232996A38C0B0CF151C2140AE29FC8 c:\windows\$NtServicePackUninstall$\ctfmon.exe
[-] 2008-04-14 00:12 15360 5F1D5F88303D4A4DBC8E5F97BA967CC3 c:\windows\ServicePackFiles\i386\ctfmon.exe
[-] 2008-04-14 00:12 15360 5F1D5F88303D4A4DBC8E5F97BA967CC3 c:\windows\system32\ctfmon.exe

[-] 2005-06-11 00:17 57856 AD3D9D191AEA7B5445FE1D82FFBB4788 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[-] 2005-06-10 23:53 57856 DA81EC57ACD4CDC3D4C51CF3D409AF9F c:\windows\$NtServicePackUninstall$\spoolsv.exe
[-] 2004-08-04 07:56 57856 7435B108B935E42EA92CA94F59C8E717 c:\windows\$NtUninstallKB896423$\spoolsv.exe
[-] 2008-04-14 00:12 57856 D8E14A61ACC1D4A6CD0D38AEBAC7FA3B c:\windows\ServicePackFiles\i386\spoolsv.exe
[-] 2008-04-14 00:12 57856 D8E14A61ACC1D4A6CD0D38AEBAC7FA3B c:\windows\system32\spoolsv.exe

[-] 2004-08-04 07:56 24576 39B1FFB03C2296323832ACBAE50D2AFF c:\windows\$NtServicePackUninstall$\userinit.exe
[-] 2008-04-14 00:12 26112 A93AEE1928A9D7CE3E16D24EC7380F89 c:\windows\ServicePackFiles\i386\userinit.exe
[-] 2008-04-14 00:12 26112 A93AEE1928A9D7CE3E16D24EC7380F89 c:\windows\system32\userinit.exe

[-] 2004-08-04 07:56 295424 B60C877D16D9C880B952FDA04ADF16E6 c:\windows\$NtServicePackUninstall$\termsrv.dll
[-] 2008-04-14 00:12 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\ServicePackFiles\i386\termsrv.dll
[-] 2008-04-14 00:12 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\system32\termsrv.dll

[-] 2006-07-05 10:57 985088 0FDD84928A5DDE2510761B7EC76CCEC9 c:\windows\$hf_mig$\KB917422\SP2QFE\kernel32.dll
[-] 2009-03-21 13:59 991744 DA11D9D6ECBDF0F93436A4B7C13F7BEC c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll
[-] 2006-07-05 10:55 984064 D8DB5397DE07577C1CB50BA6D23B3AD4 c:\windows\$NtServicePackUninstall$\kernel32.dll
[-] 2004-08-04 07:56 983552 888190E31455FAD793312F8D087146EB c:\windows\$NtUninstallKB917422$\kernel32.dll
[-] 2008-04-14 00:11 989696 C24B983D211C34DA8FCC1AC38477971D c:\windows\$NtUninstallKB959426$\kernel32.dll
[-] 2008-04-14 00:11 989696 C24B983D211C34DA8FCC1AC38477971D c:\windows\ServicePackFiles\i386\kernel32.dll
[-] 2009-03-21 14:06 989696 B921FB870C9AC0D509B2CCABBBBE95F3 c:\windows\system32\kernel32.dll
[-] 2009-03-21 14:06 989696 B921FB870C9AC0D509B2CCABBBBE95F3 c:\windows\system32\dllcache\kernel32.dll

[-] 2004-08-04 07:56 17408 1B5F6923ABB450692E9FE0672C897AED c:\windows\$NtServicePackUninstall$\powrprof.dll
[-] 2008-04-14 00:12 17408 50A166237A0FA771261275A405646CC0 c:\windows\ServicePackFiles\i386\powrprof.dll
[-] 2008-04-14 00:12 17408 50A166237A0FA771261275A405646CC0 c:\windows\system32\powrprof.dll

[-] 2004-08-04 07:56 110080 87CA7CE6469577F059297B9D6556D66D c:\windows\$NtServicePackUninstall$\imm32.dll
[-] 2008-04-14 00:11 110080 0DA85218E92526972A821587E6A8BF8F c:\windows\ServicePackFiles\i386\imm32.dll
[-] 2008-04-14 00:11 110080 0DA85218E92526972A821587E6A8BF8F c:\windows\system32\imm32.dll

[-] 2004-08-04 07:56 1580544 30A609E00BD1D4FFC49D6B5A432BE7F2 c:\windows\$NtServicePackUninstall$\sfcfiles.dll
[-] 2008-04-14 00:12 1614848 9DD07AF82244867CA36681EA2D29CE79 c:\windows\ServicePackFiles\i386\sfcfiles.dll
[-] 2008-04-14 00:12 1614848 9DD07AF82244867CA36681EA2D29CE79 c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"Malware Sweeper"="c:\program files\MalwareSweeper.com\MalwareSweeper\MalSwep.exe" [2007-11-11 696320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2008-08-25 1168264]
"SWTray"="c:\program files\AppRanger\SWTray.exe" [2009-03-20 667719]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\AOL 9.0\\waol.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Common Files\\AOL\\1243032708\\ee\\aolsoftware.exe"=
"c:\\Program Files\\FrostWire\\FrostWire.exe"=

R0 iteraid;ITERAID_Service_Install;c:\windows\system32\drivers\iteraid.sys [8/4/2005 05:51 26112]
R1 apprngr;AppRanger Scan Driver;c:\windows\system32\drivers\apprngr.sys [3/20/2009 13:18 207872]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [5/21/2009 21:23 108289]
R2 apprngr_svc;AppRanger Service;c:\program files\AppRanger\SWSvc.exe [3/20/2009 13:16 1040458]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [6/9/2009 04:37 356920]
S0 osrersa;osrersa;c:\windows\system32\drivers\ijpq.sys --> c:\windows\system32\drivers\ijpq.sys [?]
S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 12:06 1005904]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-06-02 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 04:32]
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-procexp90.Sys

.
------- Supplementary Scan -------
.
uStart Page = hxxp://virginmedia.com/
FF - ProfilePath - c:\documents and settings\xp\Application Data\Mozilla\Firefox\Profiles\hoxyw94x.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13917&gct=&gc=1&q=

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-09 06:14
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(668)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-06-09 6:16
ComboFix-quarantined-files.txt 2009-06-09 13:16

Pre-Run: 302,938,058,752 bytes free
Post-Run: 302,941,474,816 bytes free

348 --- E O F --- 2009-05-24 02:00

#6
sarahs

Posted 09 June 2009 - 09:10 AM

Member

Topic Starter
Member
28 posts

Ive run everything and removed allsorts , everything seems to be fine now. Thanx you very very much for your help , you guys are brilliant!

#7
Rorschach112

Posted 09 June 2009 - 09:37 AM

Ralphie

Retired Staff
47,710 posts

hi

Please download OTM

Save it to your desktop.
Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).

Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Services
osrersa
:Reg

:Files
c:\documents and settings\Guest\Application Data\Mozilla\Firefox\Profiles\irki0u7e.default\extensions\{d0c29249-27c7-4192-aec8-6c84436aeb80}\components\TSBoxFF.dll
c:\windows\system32\drivers\ijpq.sys
:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTM

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Download TFC to your desktop

Open the file and close any other windows.
It will close all programs itself when run, make sure to let it run uninterrupted.
Click the Start button to begin the process. The program should not take long to finish its job
Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

Please download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

#8
Rorschach112

Posted 13 June 2009 - 11:30 AM

Ralphie

Retired Staff
47,710 posts

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.