- 2004-08-04 07:56:56 32,866 ——w c:\winnt\slrundll.exe
+ 2008-04-14 00:12:35 32,866 ——w c:\winnt\slrundll.exe
- 2004-08-04 07:56:43 3,166,208 —-a-w c:\winnt\srchasst\msgr3en.dll
+ 2008-04-14 00:11:59 3,166,208 —-a-w c:\winnt\srchasst\msgr3en.dll
- 2004-08-04 07:56:45 58,434 —-a-w c:\winnt\srchasst\srchctls.dll
+ 2008-04-14 00:12:06 58,434 —-a-w c:\winnt\srchasst\srchctls.dll
- 2004-08-04 07:56:45 725,566 —-a-w c:\winnt\srchasst\srchui.dll
+ 2008-04-14 00:12:07 726,078 —-a-w c:\winnt\srchasst\srchui.dll
- 2004-08-04 07:56:57 146,432 —-a-w c:\winnt\system\winspool.drv
+ 2008-04-14 00:12:45 146,432 —-a-w c:\winnt\system\winspool.drv
- 2006-08-16 11:58:05 100,352 —-a-w c:\winnt\system32\6to4svc.dll
+ 2008-04-14 00:11:48 100,352 —-a-w c:\winnt\system32\6to4svc.dll
+ 2008-04-14 00:11:48 136,192 ——w c:\winnt\system32\aaclient.dll
- 2004-08-04 07:56:47 183,808 —-a-w c:\winnt\system32\accwiz.exe
+ 2008-04-14 00:12:11 184,320 —-a-w c:\winnt\system32\accwiz.exe
- 2004-08-04 07:56:41 114,688 —-a-w c:\winnt\system32\aclui.dll
+ 2008-04-14 00:11:48 115,712 —-a-w c:\winnt\system32\aclui.dll
- 2004-08-04 07:56:41 194,048 —-a-w c:\winnt\system32\activeds.dll
+ 2008-04-14 00:11:48 193,536 —-a-w c:\winnt\system32\activeds.dll
- 2004-08-04 07:56:47 4,096 —-a-w c:\winnt\system32\actmovie.exe
+ 2008-04-14 00:12:12 4,096 —-a-w c:\winnt\system32\actmovie.exe
- 2004-08-04 07:56:41 101,888 —-a-w c:\winnt\system32\actxprxy.dll
+ 2008-04-14 00:11:48 98,304 —-a-w c:\winnt\system32\actxprxy.dll
- 2004-08-04 07:56:41 61,440 —-a-w c:\winnt\system32\admparse.dll
+ 2008-04-14 00:11:48 61,440 —-a-w c:\winnt\system32\admparse.dll
- 2004-08-04 07:56:41 175,616 —-a-w c:\winnt\system32\adsldp.dll
+ 2008-04-14 00:11:48 175,616 —-a-w c:\winnt\system32\adsldp.dll
- 2004-08-04 07:56:41 143,360 —-a-w c:\winnt\system32\adsldpc.dll
+ 2008-04-14 00:11:48 143,360 —-a-w c:\winnt\system32\adsldpc.dll
- 2004-08-04 07:56:41 68,096 —-a-w c:\winnt\system32\adsmsext.dll
+ 2008-04-14 00:11:48 68,096 —-a-w c:\winnt\system32\adsmsext.dll
- 2004-08-04 07:56:41 263,680 —-a-w c:\winnt\system32\adsnt.dll
+ 2008-04-14 00:11:48 263,680 —-a-w c:\winnt\system32\adsnt.dll
- 2001-08-23 08:00:00 109,568 —-a-w c:\winnt\system32\adsnw.dll
+ 2008-04-14 00:11:48 123,392 —-a-w c:\winnt\system32\adsnw.dll
- 2004-08-04 07:56:41 616,960 —-a-w c:\winnt\system32\advapi32.dll
+ 2008-04-14 00:11:48 617,472 —-a-w c:\winnt\system32\advapi32.dll
- 2004-08-04 07:56:41 99,840 —-a-w c:\winnt\system32\advpack.dll
+ 2008-04-14 00:11:48 99,840 —-a-w c:\winnt\system32\advpack.dll
- 2004-08-04 07:56:47 98,304 —-a-w c:\winnt\system32\ahui.exe
+ 2008-04-14 00:12:12 98,304 —-a-w c:\winnt\system32\ahui.exe
- 2004-08-04 07:56:47 44,544 —-a-w c:\winnt\system32\alg.exe
+ 2008-04-14 00:12:12 44,544 —-a-w c:\winnt\system32\alg.exe
- 2004-08-04 07:56:41 17,408 —-a-w c:\winnt\system32\alrsvc.dll
+ 2008-04-14 00:11:49 17,408 —-a-w c:\winnt\system32\alrsvc.dll
- 2004-08-04 07:56:41 70,656 —-a-w c:\winnt\system32\amstream.dll
+ 2008-04-14 00:11:49 70,656 —-a-w c:\winnt\system32\amstream.dll
- 2004-08-04 07:56:41 126,976 —-a-w c:\winnt\system32\apphelp.dll
+ 2008-04-14 00:11:49 125,952 —-a-w c:\winnt\system32\apphelp.dll
- 2004-08-04 07:56:41 167,936 —-a-w c:\winnt\system32\appmgmts.dll
+ 2008-04-14 00:11:49 167,936 —-a-w c:\winnt\system32\appmgmts.dll
- 2004-08-04 07:56:41 295,936 —-a-w c:\winnt\system32\appmgr.dll
+ 2008-04-14 00:11:49 295,936 —-a-w c:\winnt\system32\appmgr.dll
- 2004-08-04 07:56:47 30,208 —-a-w c:\winnt\system32\asr_fmt.exe
+ 2008-04-14 00:12:12 30,208 —-a-w c:\winnt\system32\asr_fmt.exe
- 2004-08-04 07:56:47 32,768 —-a-w c:\winnt\system32\asr_pfu.exe
+ 2008-04-14 00:12:12 32,768 —-a-w c:\winnt\system32\asr_pfu.exe
- 2004-08-04 07:56:41 65,024 ——w c:\winnt\system32\asycfilt.dll
+ 2008-04-14 00:11:49 65,024 —-a-w c:\winnt\system32\asycfilt.dll
- 2004-08-04 07:56:47 25,088 —-a-w c:\winnt\system32\at.exe
+ 2008-04-14 00:12:12 25,088 —-a-w c:\winnt\system32\at.exe
- 2004-08-04 07:56:41 229,376 ——w c:\winnt\system32\ati2cqag.dll
+ 2008-04-14 00:11:49 229,376 ——w c:\winnt\system32\ati2cqag.dll
- 2004-08-04 07:56:41 377,984 ——w c:\winnt\system32\ati2dvaa.dll
+ 2008-04-14 00:11:49 377,984 ——w c:\winnt\system32\ati2dvaa.dll
- 2004-08-04 07:56:41 201,728 ——w c:\winnt\system32\ati2dvag.dll
+ 2008-04-14 00:11:49 201,728 ——w c:\winnt\system32\ati2dvag.dll
- 2004-08-04 07:56:41 870,784 ——w c:\winnt\system32\ati3d1ag.dll
+ 2008-04-14 00:11:49 870,784 ——w c:\winnt\system32\ati3d1ag.dll
- 2004-08-04 07:56:41 1,888,992 ——w c:\winnt\system32\ati3duag.dll
+ 2008-04-14 00:11:50 1,888,992 ——w c:\winnt\system32\ati3duag.dll
- 2004-08-04 07:56:41 32,768 ——w c:\winnt\system32\ativtmxx.dll
+ 2008-04-14 00:11:50 32,768 ——w c:\winnt\system32\ativtmxx.dll
- 2004-08-04 07:56:41 516,768 ——w c:\winnt\system32\ativvaxx.dll
+ 2008-04-14 00:11:50 516,768 ——w c:\winnt\system32\ativvaxx.dll
- 2004-08-04 07:56:41 58,880 ——w c:\winnt\system32\atl.dll
+ 2008-04-14 00:11:50 58,880 —-a-w c:\winnt\system32\atl.dll
- 2004-08-04 07:56:47 11,264 —-a-w c:\winnt\system32\atmadm.exe
+ 2008-04-14 00:12:12 11,264 —-a-w c:\winnt\system32\atmadm.exe
- 2004-08-04 07:55:59 285,696 —-a-w c:\winnt\system32\atmfd.dll
+ 2008-04-14 00:09:01 285,696 —-a-w c:\winnt\system32\atmfd.dll
- 2004-08-04 07:56:41 30,208 —-a-w c:\winnt\system32\atmlib.dll
+ 2008-04-14 00:11:50 30,208 —-a-w c:\winnt\system32\atmlib.dll
- 2001-08-23 08:00:00 11,264 —-a-w c:\winnt\system32\attrib.exe
+ 2008-04-14 00:12:12 12,288 —-a-w c:\winnt\system32\attrib.exe
- 2004-08-04 07:56:41 42,496 —-a-w c:\winnt\system32\audiosrv.dll
+ 2008-04-14 00:11:50 42,496 —-a-w c:\winnt\system32\audiosrv.dll
- 2004-08-04 07:56:47 14,336 ——w c:\winnt\system32\auditusr.exe
+ 2008-04-14 00:12:12 14,336 ——w c:\winnt\system32\auditusr.exe
- 2005-03-02 18:09:29 56,832 —-a-w c:\winnt\system32\authz.dll
+ 2008-04-14 00:11:50 62,464 —-a-w c:\winnt\system32\authz.dll
- 2004-08-04 07:56:47 588,800 —-a-w c:\winnt\system32\autochk.exe
+ 2008-04-14 00:12:12 588,800 —-a-w c:\winnt\system32\autochk.exe
- 2004-08-04 07:56:47 602,624 —-a-w c:\winnt\system32\autoconv.exe
+ 2008-04-14 00:12:12 602,624 —-a-w c:\winnt\system32\autoconv.exe
- 2004-08-04 07:56:47 580,608 —-a-w c:\winnt\system32\autofmt.exe
+ 2008-04-14 00:12:13 580,608 —-a-w c:\winnt\system32\autofmt.exe
- 2004-08-04 07:56:47 11,264 —-a-w c:\winnt\system32\autolfn.exe
+ 2008-04-14 00:12:13 11,264 —-a-w c:\winnt\system32\autolfn.exe
- 2004-08-04 07:56:41 84,992 —-a-w c:\winnt\system32\avifil32.dll
+ 2008-04-14 00:11:50 84,992 —-a-w c:\winnt\system32\avifil32.dll
+ 2008-04-14 00:11:50 233,472 ——w c:\winnt\system32\azroles.dll
- 2004-08-04 07:56:41 52,736 —-a-w c:\winnt\system32\basesrv.dll
+ 2008-04-14 00:11:50 52,736 —-a-w c:\winnt\system32\basesrv.dll
- 2004-08-04 07:56:41 28,672 —-a-w c:\winnt\system32\batmeter.dll
+ 2008-04-14 00:11:50 29,184 —-a-w c:\winnt\system32\batmeter.dll
- 2004-08-04 07:56:41 8,704 —-a-w c:\winnt\system32\batt.dll
+ 2008-04-14 00:11:50 8,704 —-a-w c:\winnt\system32\batt.dll
- 2004-08-04 07:56:41 17,408 —-a-w c:\winnt\system32\bidispl.dll
+ 2008-04-14 00:11:50 17,408 —-a-w c:\winnt\system32\bidispl.dll
- 2004-07-01 22:08:18 361,984 ——w c:\winnt\system32\bits\qmgr.dll
+ 2008-04-14 00:12:03 409,088 ——w c:\winnt\system32\bits\qmgr.dll
- 2004-08-04 07:56:41 8,192 ——w c:\winnt\system32\bitsprx2.dll
+ 2008-04-14 00:11:50 8,192 ——w c:\winnt\system32\bitsprx2.dll
- 2004-08-04 07:56:41 7,168 ——w c:\winnt\system32\bitsprx3.dll
+ 2008-04-14 00:11:50 7,168 ——w c:\winnt\system32\bitsprx3.dll
+ 2008-04-14 00:11:50 7,168 ——w c:\winnt\system32\bitsprx4.dll
- 2004-08-04 07:56:47 71,680 ——w c:\winnt\system32\blastcln.exe
+ 2008-04-14 00:12:13 71,680 ——w c:\winnt\system32\blastcln.exe
- 2001-08-23 08:00:00 136,704 —-a-w c:\winnt\system32\bootcfg.exe
+ 2008-04-14 00:12:13 142,848 —-a-w c:\winnt\system32\bootcfg.exe
- 2004-08-04 07:55:59 63,488 —-a-w c:\winnt\system32\browselc.dll
+ 2008-04-13 17:03:24 63,488 —-a-w c:\winnt\system32\browselc.dll
- 2004-08-04 07:56:41 77,312 —-a-w c:\winnt\system32\browser.dll
+ 2008-04-14 00:11:50 77,824 —-a-w c:\winnt\system32\browser.dll
- 2008-10-16 10:37:04 1,023,488 —-a-w c:\winnt\system32\browseui.dll
+ 2008-04-14 00:11:50 1,025,024 —-a-w c:\winnt\system32\browseui.dll
- 2004-08-04 07:56:41 78,336 —-a-w c:\winnt\system32\browsewm.dll
+ 2008-04-14 00:11:50 78,336 —-a-w c:\winnt\system32\browsewm.dll
- 2004-08-04 07:56:41 20,992 ——w c:\winnt\system32\bthci.dll
+ 2008-04-14 00:11:50 20,992 ——w c:\winnt\system32\bthci.dll
- 2004-08-04 07:56:41 30,208 ——w c:\winnt\system32\bthserv.dll
+ 2008-04-14 00:11:50 30,208 —-a-w c:\winnt\system32\bthserv.dll
- 2004-08-04 07:56:41 50,688 ——w c:\winnt\system32\btpanui.dll
+ 2008-04-14 00:11:50 50,688 ——w c:\winnt\system32\btpanui.dll
- 2004-08-04 07:56:41 59,904 —-a-w c:\winnt\system32\cabinet.dll
+ 2008-04-14 00:11:50 60,416 —-a-w c:\winnt\system32\cabinet.dll
- 2004-08-04 07:56:41 84,480 —-a-w c:\winnt\system32\cabview.dll
+ 2008-04-14 00:11:50 84,480 —-a-w c:\winnt\system32\cabview.dll
- 2001-08-23 08:00:00 18,432 —-a-w c:\winnt\system32\cacls.exe
+ 2008-04-14 00:12:13 19,968 —-a-w c:\winnt\system32\cacls.exe
- 2004-08-04 07:56:41 50,688 —-a-w c:\winnt\system32\camocx.dll
+ 2008-04-14 00:11:50 50,688 —-a-w c:\winnt\system32\camocx.dll
- 2001-08-23 08:00:00 142,848 —-a-w c:\winnt\system32\capesnpn.dll
+ 2008-04-14 00:11:50 150,016 —-a-w c:\winnt\system32\capesnpn.dll
- 2005-07-26 04:39:42 225,792 —-a-w c:\winnt\system32\catsrv.dll
+ 2008-04-14 00:11:50 226,304 —-a-w c:\winnt\system32\catsrv.dll
- 2004-08-04 07:56:41 85,504 —-a-w c:\winnt\system32\catsrvps.dll
+ 2008-04-14 00:11:50 85,504 —-a-w c:\winnt\system32\catsrvps.dll
- 2005-07-26 04:39:43 625,152 —-a-w c:\winnt\system32\catsrvut.dll
+ 2008-04-14 00:11:50 625,664 —-a-w c:\winnt\system32\catsrvut.dll
- 2008-10-16 10:37:02 151,040 —-a-w c:\winnt\system32\cdfview.dll
+ 2008-04-14 00:11:50 151,040 —-a-w c:\winnt\system32\cdfview.dll
- 2007-07-30 23:19:20 92,504 —-a-w c:\winnt\system32\cdm.dll
+ 2008-10-16 19:09:44 92,696 —-a-w c:\winnt\system32\cdm.dll
- 2005-09-10 01:53:41 2,067,968 —-a-w c:\winnt\system32\cdosys.dll
+ 2008-04-14 00:11:50 2,091,520 —-a-w c:\winnt\system32\cdosys.dll
- 2004-08-04 07:56:41 194,560 —-a-w c:\winnt\system32\certcli.dll
+ 2008-04-14 00:11:50 194,560 —-a-w c:\winnt\system32\certcli.dll
- 2004-08-04 07:56:41 457,728 —-a-w c:\winnt\system32\certmgr.dll
+ 2008-04-14 00:11:50 457,728 —-a-w c:\winnt\system32\certmgr.dll
- 2004-08-04 07:56:41 38,912 —-a-w c:\winnt\system32\cfgbkend.dll
+ 2008-04-14 00:11:50 38,912 —-a-w c:\winnt\system32\cfgbkend.dll
- 2004-08-04 07:56:00 16,896 —-a-w c:\winnt\system32\cfgmgr32.dll
+ 2008-04-14 00:09:05 16,896 —-a-w c:\winnt\system32\cfgmgr32.dll
- 2001-08-23 08:00:00 109,568 —-a-w c:\winnt\system32\cic.dll
+ 2008-04-14 00:11:50 148,480 —-a-w c:\winnt\system32\cic.dll
- 2006-06-22 05:06:29 69,120 —-a-w c:\winnt\system32\ciodm.dll
+ 2008-04-14 00:11:50 69,120 —-a-w c:\winnt\system32\ciodm.dll
- 2004-08-04 07:56:47 56,320 —-a-w c:\winnt\system32\cipher.exe
+ 2008-04-14 00:12:14 56,832 —-a-w c:\winnt\system32\cipher.exe
- 2004-08-04 07:56:47 5,632 —-a-w c:\winnt\system32\cisvc.exe
+ 2008-04-14 00:12:14 5,632 —-a-w c:\winnt\system32\cisvc.exe
- 2005-07-26 04:39:43 110,080 —-a-w c:\winnt\system32\clbcatex.dll
+ 2008-04-14 00:11:50 110,592 —-a-w c:\winnt\system32\clbcatex.dll
- 2005-07-26 04:39:43 498,688 —-a-w c:\winnt\system32\clbcatq.dll
+ 2008-04-14 00:11:50 498,688 —-a-w c:\winnt\system32\clbcatq.dll
- 2004-08-04 07:56:47 64,000 —-a-w c:\winnt\system32\cleanmgr.exe
+ 2008-04-14 00:12:14 64,000 —-a-w c:\winnt\system32\cleanmgr.exe
- 2004-08-04 07:56:41 77,824 ——w c:\winnt\system32\cliconfg.dll
+ 2008-04-14 00:11:50 77,824 ——w c:\winnt\system32\cliconfg.dll
- 2004-08-04 07:56:47 20,480 ——w c:\winnt\system32\cliconfg.exe
+ 2008-04-14 00:12:14 20,480 ——w c:\winnt\system32\cliconfg.exe
- 2004-08-04 07:56:47 102,912 —-a-w c:\winnt\system32\clipbrd.exe
+ 2008-04-14 00:12:14 102,912 —-a-w c:\winnt\system32\clipbrd.exe
- 2004-08-04 07:56:47 33,280 —-a-w c:\winnt\system32\clipsrv.exe
+ 2008-04-14 00:12:14 33,280 —-a-w c:\winnt\system32\clipsrv.exe
- 2004-08-04 07:56:41 57,856 —-a-w c:\winnt\system32\clusapi.dll
+ 2008-04-14 00:11:50 58,368 —-a-w c:\winnt\system32\clusapi.dll
- 2004-08-04 07:56:41 15,872 —-a-w c:\winnt\system32\cmcfg32.dll
+ 2008-04-14 00:11:50 15,872 —-a-w c:\winnt\system32\cmcfg32.dll
- 2004-08-04 07:56:48 388,608 —-a-w c:\winnt\system32\cmd.exe
+ 2008-04-14 00:12:14 389,120 —-a-w c:\winnt\system32\cmd.exe
- 2004-08-04 07:56:41 343,040 —-a-w c:\winnt\system32\cmdial32.dll
+ 2008-04-14 00:11:50 344,064 —-a-w c:\winnt\system32\cmdial32.dll
- 2004-08-04 07:56:48 47,104 —-a-w c:\winnt\system32\cmdl32.exe
+ 2008-04-14 00:12:14 25,600 —-a-w c:\winnt\system32\cmdl32.exe
- 2004-08-04 07:56:48 39,936 —-a-w c:\winnt\system32\cmmon32.exe
+ 2008-04-14 00:12:15 39,936 —-a-w c:\winnt\system32\cmmon32.exe
- 2004-08-04 07:56:41 185,344 —-a-w c:\winnt\system32\cmprops.dll
+ 2008-04-14 00:11:50 185,344 —-a-w c:\winnt\system32\cmprops.dll
- 2004-08-04 07:56:41 13,824 ——w c:\winnt\system32\cmsetacl.dll
+ 2008-04-14 00:11:50 13,312 ——w c:\winnt\system32\cmsetacl.dll
- 2004-08-04 07:56:48 63,488 —-a-w c:\winnt\system32\cmstp.exe
+ 2008-04-14 00:12:15 63,488 —-a-w c:\winnt\system32\cmstp.exe
- 2004-08-04 07:56:41 39,936 —-a-w c:\winnt\system32\cmutil.dll
+ 2008-04-14 00:11:50 39,424 —-a-w c:\winnt\system32\cmutil.dll
- 2004-08-04 07:56:41 47,104 —-a-w c:\winnt\system32\cnbjmon.dll
+ 2008-04-14 00:11:50 47,104 —-a-w c:\winnt\system32\cnbjmon.dll
- 2005-07-26 04:39:43 60,416 —-a-w c:\winnt\system32\colbact.dll
+ 2008-04-14 00:11:51 60,416 —-a-w c:\winnt\system32\colbact.dll
- 2005-07-26 04:39:44 195,072 —-a-w c:\winnt\system32\Com\comadmin.dll
+ 2008-04-14 00:11:51 195,072 —-a-w c:\winnt\system32\Com\comadmin.dll
- 2004-08-04 07:56:48 9,728 —-a-w c:\winnt\system32\Com\comrepl.exe
+ 2008-04-14 00:12:15 9,728 —-a-w c:\winnt\system32\Com\comrepl.exe
- 2001-08-23 08:00:00 5,120 —-a-w c:\winnt\system32\Com\comrereg.exe
+ 2008-04-14 00:12:15 6,144 —-a-w c:\winnt\system32\Com\comrereg.exe
- 2001-08-23 08:00:00 25,600 —-a-w c:\winnt\system32\comaddin.dll
+ 2008-04-14 00:11:51 28,160 —-a-w c:\winnt\system32\comaddin.dll
- 2006-08-25 15:45:58 617,472 —-a-w c:\winnt\system32\comctl32.dll
+ 2008-04-14 00:11:51 617,472 —-a-w c:\winnt\system32\comctl32.dll
- 2004-08-04 07:56:41 276,992 —-a-w c:\winnt\system32\comdlg32.dll
+ 2008-04-14 00:11:51 276,992 —-a-w c:\winnt\system32\comdlg32.dll
- 2004-08-04 07:56:41 252,928 —-a-w c:\winnt\system32\compatui.dll
+ 2008-04-14 00:11:51 252,928 —-a-w c:\winnt\system32\compatui.dll
- 2004-08-04 07:56:41 229,376 —-a-w c:\winnt\system32\compstui.dll
+ 2008-04-14 00:11:51 229,376 —-a-w c:\winnt\system32\compstui.dll
- 2005-07-26 04:39:44 97,792 —-a-w c:\winnt\system32\comrepl.dll
+ 2008-04-14 00:11:51 97,792 —-a-w c:\winnt\system32\comrepl.dll
- 2004-08-04 07:56:41 792,064 —-a-w c:\winnt\system32\comres.dll
+ 2008-04-14 00:11:51 792,064 —-a-w c:\winnt\system32\comres.dll
- 2004-08-04 05:59:34 9,728 ——w c:\winnt\system32\comsdupd.exe
+ 2008-04-13 18:43:32 9,728 ——w c:\winnt\system32\comsdupd.exe
- 2001-08-23 08:00:00 147,456 —-a-w c:\winnt\system32\comsnap.dll
+ 2008-04-14 00:11:51 167,424 —-a-w c:\winnt\system32\comsnap.dll
- 2005-07-26 04:39:44 1,267,200 —-a-w c:\winnt\system32\comsvcs.dll
+ 2008-04-14 00:11:51 1,267,200 —-a-w c:\winnt\system32\comsvcs.dll
- 2005-07-26 04:39:45 540,160 —-a-w c:\winnt\system32\comuid.dll
+ 2008-04-14 00:11:51 539,648 —-a-w c:\winnt\system32\comuid.dll
- 2005-06-28 12:35:30 16,384 —-a-w c:\winnt\system32\config\systemprofile\Cookies\index.dat
+ 2009-02-20 22:57:15 16,384 —-a-w c:\winnt\system32\config\systemprofile\Cookies\index.dat
- 2005-06-28 12:35:30 32,768 —-a-w c:\winnt\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-02-20 22:57:15 32,768 —-a-w c:\winnt\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-02-20 22:57:12 32,768 —-a-w c:\winnt\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009022020090221\index.dat
- 2005-06-28 12:35:30 49,152 —-a-w c:\winnt\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-02-20 22:57:15 49,152 —-a-w c:\winnt\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2001-08-23 08:00:00 345,600 —-a-w c:\winnt\system32\confmsp.dll
+ 2008-04-14 00:11:51 357,888 —-a-w c:\winnt\system32\confmsp.dll
- 2004-08-04 07:56:48 27,648 —-a-w c:\winnt\system32\conime.exe
+ 2008-04-14 00:12:15 27,648 —-a-w c:\winnt\system32\conime.exe
- 2004-08-04 07:56:41 35,328 —-a-w c:\winnt\system32\corpol.dll
+ 2008-04-14 00:11:51 35,328 —-a-w c:\winnt\system32\corpol.dll
+ 2008-04-14 00:11:51 12,800 ——w c:\winnt\system32\credssp.dll
- 2004-08-04 07:56:41 163,840 —-a-w c:\winnt\system32\credui.dll
+ 2008-04-14 00:11:51 163,840 —-a-w c:\winnt\system32\credui.dll
- 2004-08-04 07:56:41 597,504 —-a-w c:\winnt\system32\crypt32.dll
+ 2008-04-14 00:11:51 599,040 —-a-w c:\winnt\system32\crypt32.dll
- 2004-08-04 07:56:41 74,752 —-a-w c:\winnt\system32\cryptdlg.dll
+ 2008-04-14 00:11:51 74,752 —-a-w c:\winnt\system32\cryptdlg.dll
- 2004-08-04 07:56:41 33,280 —-a-w c:\winnt\system32\cryptdll.dll
+ 2008-04-14 00:11:51 33,280 —-a-w c:\winnt\system32\cryptdll.dll
- 2004-08-04 07:56:41 53,760 —-a-w c:\winnt\system32\cryptext.dll
+ 2008-04-14 00:11:51 53,760 —-a-w c:\winnt\system32\cryptext.dll
- 2004-08-04 07:56:41 63,488 —-a-w c:\winnt\system32\cryptnet.dll
+ 2008-04-14 00:11:51 64,512 —-a-w c:\winnt\system32\cryptnet.dll
- 2004-08-04 07:56:41 60,416 —-a-w c:\winnt\system32\cryptsvc.dll
+ 2008-04-14 00:11:51 62,464 —-a-w c:\winnt\system32\cryptsvc.dll
- 2004-08-04 07:56:41 512,512 —-a-w c:\winnt\system32\cryptui.dll
+ 2008-04-14 00:11:51 512,512 —-a-w c:\winnt\system32\cryptui.dll
- 2004-08-04 07:56:41 101,888 —-a-w c:\winnt\system32\cscdll.dll
+ 2008-04-14 00:11:51 101,888 —-a-w c:\winnt\system32\cscdll.dll
- 2004-08-04 07:56:48 98,304 —-a-w c:\winnt\system32\cscript.exe
+ 2008-05-07 09:07:23 135,168 —-a-w c:\winnt\system32\cscript.exe
- 2004-08-04 07:56:41 326,656 —-a-w c:\winnt\system32\cscui.dll
+ 2008-04-14 00:11:51 326,656 —-a-w c:\winnt\system32\cscui.dll
- 2004-08-04 07:56:41 32,768 —-a-w c:\winnt\system32\csrsrv.dll
+ 2008-04-14 00:11:51 32,256 —-a-w c:\winnt\system32\csrsrv.dll
- 2004-08-04 07:56:48 6,144 —-a-w c:\winnt\system32\csrss.exe
+ 2008-04-14 00:12:15 6,144 —-a-w c:\winnt\system32\csrss.exe
- 2004-08-04 07:56:48 15,360 —-a-w c:\winnt\system32\ctfmon.exe
+ 2008-04-14 00:12:16 15,360 —-a-w c:\winnt\system32\ctfmon.exe
- 2004-08-04 07:56:41 1,179,648 —-a-w c:\winnt\system32\d3d8.dll
+ 2008-04-14 00:11:51 1,179,648 —-a-w c:\winnt\system32\d3d8.dll
- 2004-08-04 07:56:41 8,192 —-a-w c:\winnt\system32\d3d8thk.dll
+ 2008-04-14 00:11:51 8,192 —-a-w c:\winnt\system32\d3d8thk.dll
- 2004-08-04 07:56:41 1,689,088 —-a-w c:\winnt\system32\d3d9.dll
+ 2008-04-14 00:11:51 1,689,088 —-a-w c:\winnt\system32\d3d9.dll
- 2004-08-04 07:56:41 825,344 —-a-w c:\winnt\system32\d3dim700.dll
+ 2008-04-14 00:11:51 824,320 —-a-w c:\winnt\system32\d3dim700.dll
- 2008-10-16 10:37:02 1,054,208 —-a-w c:\winnt\system32\danim.dll
+ 2008-04-14 00:11:51 1,054,208 —-a-w c:\winnt\system32\danim.dll
- 2004-08-04 07:56:42 54,272 —-a-w c:\winnt\system32\dataclen.dll
+ 2008-04-14 00:11:51 54,272 —-a-w c:\winnt\system32\dataclen.dll
- 2001-08-23 08:00:00 152,064 —-a-w c:\winnt\system32\datime.dll
+ 2008-04-14 00:11:51 165,376 —-a-w c:\winnt\system32\datime.dll
- 2004-08-04 07:56:42 24,576 —-a-w c:\winnt\system32\davclnt.dll
+ 2008-04-14 00:11:51 25,088 —-a-w c:\winnt\system32\davclnt.dll
- 2004-08-04 07:56:42 640,000 —-a-w c:\winnt\system32\dbghelp.dll
+ 2008-04-14 00:11:51 640,000 —-a-w c:\winnt\system32\dbghelp.dll
- 2004-08-04 07:56:42 24,576 —-a-w c:\winnt\system32\dbmsrpcn.dll
+ 2008-04-14 00:11:51 24,576 —-a-w c:\winnt\system32\dbmsrpcn.dll
- 2004-08-04 07:56:42 110,592 —-a-w c:\winnt\system32\dbnetlib.dll
+ 2008-04-14 00:11:51 110,592 —-a-w c:\winnt\system32\dbnetlib.dll
- 2004-08-04 07:56:42 28,672 —-a-w c:\winnt\system32\dbnmpntw.dll
+ 2008-04-14 00:11:51 28,672 —-a-w c:\winnt\system32\dbnmpntw.dll
- 2004-08-04 08:07:21 1,788 —-a-w c:\winnt\system32\dcache.bin
+ 2008-04-14 00:25:26 1,804 —-a-w c:\winnt\system32\dcache.bin
- 2004-08-04 07:56:42 8,704 —-a-w c:\winnt\system32\dciman32.dll
+ 2008-04-14 00:11:51 8,704 —-a-w c:\winnt\system32\dciman32.dll
- 2001-08-23 08:00:00 5,120 —-a-w c:\winnt\system32\dcomcnfg.exe
+ 2008-04-14 00:12:16 6,144 —-a-w c:\winnt\system32\dcomcnfg.exe
- 2004-08-04 07:56:48 30,208 —-a-w c:\winnt\system32\ddeshare.exe
+ 2008-04-14 00:12:16 30,208 —-a-w c:\winnt\system32\ddeshare.exe
- 2004-08-04 07:56:42 266,240 —-a-w c:\winnt\system32\ddraw.dll
+ 2008-04-14 00:11:51 279,552 —-a-w c:\winnt\system32\ddraw.dll
- 2004-08-04 07:56:42 27,136 —-a-w c:\winnt\system32\ddrawex.dll
+ 2008-04-14 00:11:51 27,136 —-a-w c:\winnt\system32\ddrawex.dll
- 2004-08-04 07:56:48 25,088 —-a-w c:\winnt\system32\defrag.exe
+ 2008-04-14 00:12:16 25,088 —-a-w c:\winnt\system32\defrag.exe
- 2004-08-04 07:56:42 59,904 —-a-w c:\winnt\system32\devenum.dll
+ 2008-04-14 00:11:51 59,904 —-a-w c:\winnt\system32\devenum.dll
- 2004-08-04 07:56:42 282,624 —-a-w c:\winnt\system32\devmgr.dll
+ 2008-04-14 00:11:51 282,624 —-a-w c:\winnt\system32\devmgr.dll
- 2004-08-04 07:56:48 82,432 —-a-w c:\winnt\system32\dfrgfat.exe
+ 2008-04-14 00:12:16 82,944 —-a-w c:\winnt\system32\dfrgfat.exe
- 2004-08-04 07:56:48 104,960 —-a-w c:\winnt\system32\dfrgntfs.exe
+ 2008-04-14 00:12:16 105,472 —-a-w c:\winnt\system32\dfrgntfs.exe
- 2004-08-04 07:56:42 38,912 —-a-w c:\winnt\system32\dfrgsnap.dll
+ 2008-04-14 00:11:51 39,424 —-a-w c:\winnt\system32\dfrgsnap.dll
- 2004-08-04 07:56:42 123,904 —-a-w c:\winnt\system32\dfrgui.dll
+ 2008-04-14 00:11:51 124,416 —-a-w c:\winnt\system32\dfrgui.dll
- 2005-09-23 11:28:38 83,456 —-a-w c:\winnt\system32\dfshim.dll
+ 2008-07-25 16:16:46 96,760 —-a-w c:\winnt\system32\dfshim.dll
- 2004-08-04 07:56:42 28,672 —-a-w c:\winnt\system32\dfsshlex.dll
+ 2008-04-14 00:11:51 28,672 —-a-w c:\winnt\system32\dfsshlex.dll
- 2004-08-04 07:56:42 111,104 —-a-w c:\winnt\system32\dgnet.dll
+ 2008-04-14 00:11:51 111,104 —-a-w c:\winnt\system32\dgnet.dll
- 2006-05-19 12:59:41 111,616 —-a-w c:\winnt\system32\dhcpcsvc.dll
+ 2008-04-14 00:11:51 126,976 —-a-w c:\winnt\system32\dhcpcsvc.dll
- 2001-08-23 08:00:00 370,176 —-a-w c:\winnt\system32\dhcpmon.dll
+ 2008-04-14 00:11:52 379,904 —-a-w c:\winnt\system32\dhcpmon.dll
+ 2008-04-14 00:11:52 48,640 ——w c:\winnt\system32\dhcpqec.dll
- 2004-08-04 07:56:48 85,504 —-a-w c:\winnt\system32\diantz.exe
+ 2008-04-14 00:12:17 87,040 —-a-w c:\winnt\system32\diantz.exe
- 2004-08-04 07:56:42 68,608 —-a-w c:\winnt\system32\digest.dll
+ 2008-04-14 00:11:52 68,608 —-a-w c:\winnt\system32\digest.dll
+ 2008-04-14 00:11:52 19,456 ——w c:\winnt\system32\dimsntfy.dll
+ 2008-04-14 00:11:52 39,936 ——w c:\winnt\system32\dimsroam.dll
- 2004-08-04 07:56:42 159,232 —-a-w c:\winnt\system32\dinput.dll
+ 2008-04-14 00:11:52 158,720 —-a-w c:\winnt\system32\dinput.dll
- 2004-08-04 07:56:42 181,760 —-a-w c:\winnt\system32\dinput8.dll
+ 2008-04-14 00:11:52 181,760 —-a-w c:\winnt\system32\dinput8.dll
- 2001-08-23 08:00:00 1,501,696 —-a-w c:\winnt\system32\diskcopy.dll
+ 2008-04-14 00:11:52 1,504,256 —-a-w c:\winnt\system32\diskcopy.dll
- 2004-08-04 07:56:48 163,840 —-a-w c:\winnt\system32\diskpart.exe
+ 2008-04-14 00:12:17 163,840 —-a-w c:\winnt\system32\diskpart.exe
- 2001-08-23 08:00:00 45,083 —-a-w c:\winnt\system32\dispex.dll
+ 2008-04-14 00:11:52 32,768 —-a-w c:\winnt\system32\dispex.dll
- 2008-08-14 09:51:43 138,368 -c—-w c:\winnt\system32\dllcache\afd.sys
+ 2008-08-14 10:04:36 138,496 -c—-w c:\winnt\system32\dllcache\afd.sys
- 2008-06-13 13:10:50 272,128 -c—-w c:\winnt\system32\dllcache\bthport.sys
+ 2008-06-13 11:05:51 272,128 -c—-w c:\winnt\system32\dllcache\bthport.sys
- 2007-07-30 23:19:20 92,504 -c–a-w c:\winnt\system32\dllcache\cdm.dll
+ 2008-10-16 19:09:44 92,696 -c–a-w c:\winnt\system32\dllcache\cdm.dll
+ 2008-05-07 09:07:23 135,168 -c—-w c:\winnt\system32\dllcache\cscript.exe
- 2008-06-21 03:11:12 148,992 -c–a-w c:\winnt\system32\dllcache\dnsapi.dll
+ 2008-06-20 17:46:57 147,968 -c—-w c:\winnt\system32\dllcache\dnsapi.dll
- 2004-08-04 07:56:26 96,768 -c—-w c:\winnt\system32\dllcache\dpcdll.dll
+ 2008-04-14 00:10:45 102,912 -c—-w c:\winnt\system32\dllcache\dpcdll.dll
- 2006-08-22 09:05:26 498,742 -c—-w c:\winnt\system32\dllcache\dxmasf.dll
+ 2008-04-14 00:11:52 498,742 -c—-w c:\winnt\system32\dllcache\dxmasf.dll
- 2008-07-07 20:32:22 253,952 -c—-w c:\winnt\system32\dllcache\es.dll
+ 2008-07-07 20:26:58 253,952 -c—-w c:\winnt\system32\dllcache\es.dll
- 2008-10-23 13:01:36 283,648 -c—-w c:\winnt\system32\dllcache\gdi32.dll
+ 2008-10-23 12:36:14 286,720 -c—-w c:\winnt\system32\dllcache\gdi32.dll
- 2008-04-11 18:50:43 683,520 -c—-w c:\winnt\system32\dllcache\inetcomm.dll
+ 2008-04-11 19:04:26 691,712 -c—-w c:\winnt\system32\dllcache\inetcomm.dll
- 2007-12-18 14:40:58 450,560 -c—-w c:\winnt\system32\dllcache\jscript.dll
+ 2008-05-09 10:53:39 512,000 -c—-w c:\winnt\system32\dllcache\jscript.dll
- 2008-10-24 11:10:42 453,632 -c—-w c:\winnt\system32\dllcache\mrxsmb.sys
+ 2008-10-24 11:21:09 455,296 -c—-w c:\winnt\system32\dllcache\mrxsmb.sys
- 2008-06-24 16:23:05 74,240 -c—-w c:\winnt\system32\dllcache\mscms.dll
+ 2008-06-24 16:43:16 74,240 -c—-w c:\winnt\system32\dllcache\mscms.dll
- 2008-12-12 17:33:23 3,060,224 -c—-w c:\winnt\system32\dllcache\mshtml.dll
+ 2008-12-12 17:01:00 3,067,904 -c—-w c:\winnt\system32\dllcache\mshtml.dll
- 2008-06-20 17:41:10 245,248 -c—-w c:\winnt\system32\dllcache\mswsock.dll
+ 2008-06-20 17:46:57 245,248 -c—-w c:\winnt\system32\dllcache\mswsock.dll
- 2008-09-04 16:42:02 1,106,944 -c—-w c:\winnt\system32\dllcache\msxml3.dll
+ 2008-09-04 17:15:04 1,106,944 -c—-w c:\winnt\system32\dllcache\msxml3.dll
+ 2008-04-13 17:27:18 79,872 -c—-w c:\winnt\system32\dllcache\msxml6r.dll
- 2008-10-15 16:57:55 332,800 -c—-w c:\winnt\system32\dllcache\netapi32.dll
+ 2008-10-15 16:34:24 337,408 -c—-w c:\winnt\system32\dllcache\netapi32.dll
- 2008-08-14 09:58:27 2,136,064 -c—-w c:\winnt\system32\dllcache\ntkrnlmp.exe
+ 2008-08-14 10:09:26 2,145,280 -c—-w c:\winnt\system32\dllcache\ntkrnlmp.exe
- 2008-08-14 09:22:13 2,057,728 -c—-w c:\winnt\system32\dllcache\ntkrnlpa.exe
+ 2008-08-14 09:33:16 2,066,048 -c—-w c:\winnt\system32\dllcache\ntkrnlpa.exe
- 2008-08-14 09:22:14 2,015,744 -c—-w c:\winnt\system32\dllcache\ntkrpamp.exe
+ 2008-08-14 09:33:16 2,023,936 -c—-w c:\winnt\system32\dllcache\ntkrpamp.exe
- 2008-08-14 10:00:45 2,180,352 -c—-w c:\winnt\system32\dllcache\ntoskrnl.exe
+ 2008-08-14 10:11:02 2,189,184 -c—-w c:\winnt\system32\dllcache\ntoskrnl.exe
- 2004-08-04 07:56:04 24,064 -c—-w c:\winnt\system32\dllcache\pidgen.dll
+ 2008-04-14 00:09:24 24,064 -c—-w c:\winnt\system32\dllcache\pidgen.dll
- 2008-05-07 05:18:48 1,287,680 -c—-w c:\winnt\system32\dllcache\quartz.dll
+ 2008-05-07 05:12:40 1,288,192 -c—-w c:\winnt\system32\dllcache\quartz.dll
- 2008-05-08 12:28:49 202,752 -c–a-w c:\winnt\system32\dllcache\rmcast.sys
+ 2008-05-08 14:02:52 203,136 -c—-w c:\winnt\system32\dllcache\rmcast.sys
+ 2008-05-09 10:53:39 180,224 -c—-w c:\winnt\system32\dllcache\scrobj.dll
+ 2008-05-09 10:53:40 172,032 -c—-w c:\winnt\system32\dllcache\scrrun.dll
- 2008-10-16 10:37:03 1,494,528 -c—-w c:\winnt\system32\dllcache\shdocvw.dll
+ 2008-10-16 01:00:10 1,499,136 -c—-w c:\winnt\system32\dllcache\shdocvw.dll
- 2008-08-28 10:04:17 333,056 -c—-w c:\winnt\system32\dllcache\srv.sys
+ 2008-12-11 10:57:09 333,952 -c—-w c:\winnt\system32\dllcache\srv.sys
- 2008-10-03 10:15:47 247,326 -c—-w c:\winnt\system32\dllcache\strmdll.dll
+ 2008-10-03 10:02:42 247,326 -c—-w c:\winnt\system32\dllcache\strmdll.dll
- 2008-06-20 10:45:13 360,320 -c–a-w c:\winnt\system32\dllcache\tcpip.sys
+ 2008-06-20 11:51:12 361,600 -c—-w c:\winnt\system32\dllcache\tcpip.sys
- 2008-06-20 19:22:08 225,920 -c–a-w c:\winnt\system32\dllcache\tcpip6.sys
+ 2008-06-20 11:08:27 225,856 -c—-w c:\winnt\system32\dllcache\tcpip6.sys
- 2008-10-16 10:37:04 615,936 -c—-w c:\winnt\system32\dllcache\urlmon.dll
+ 2008-10-16 01:00:11 619,520 -c—-w c:\winnt\system32\dllcache\urlmon.dll
- 2007-12-18 14:40:58 417,792 -c—-w c:\winnt\system32\dllcache\vbscript.dll
+ 2008-05-09 10:53:40 430,080 -c—-w c:\winnt\system32\dllcache\vbscript.dll
- 2006-06-19 20:20:42 702,768 -c—-w c:\winnt\system32\dllcache\WgaLogon.dll
+ 2008-09-06 04:30:42 241,704 -c—-w c:\winnt\system32\dllcache\wgaLogon.dll
- 2006-06-19 20:19:26 304,944 -c—-w c:\winnt\system32\dllcache\WgaTray.exe
+ 2008-09-06 04:29:58 917,032 -c—-w c:\winnt\system32\dllcache\WgaTray.exe
- 2008-09-15 11:57:41 1,846,016 -c—-w c:\winnt\system32\dllcache\win32k.sys
+ 2008-09-15 12:12:56 1,846,400 -c—-w c:\winnt\system32\dllcache\win32k.sys
- 2008-10-16 10:37:03 659,456 -c—-w c:\winnt\system32\dllcache\wininet.dll
+ 2008-10-16 01:00:11 666,112 -c—-w c:\winnt\system32\dllcache\wininet.dll
+ 2008-05-08 11:24:44 155,648 -c—-w c:\winnt\system32\dllcache\wscript.exe
+ 2008-05-09 10:53:40 90,112 -c—-w c:\winnt\system32\dllcache\wshext.dll
- 2007-07-30 23:19:36 549,720 -c–a-w c:\winnt\system32\dllcache\wuapi.dll
+ 2008-10-16 19:12:20 561,688 -c–a-w c:\winnt\system32\dllcache\wuapi.dll
- 2007-07-30 23:19:16 53,080 -c–a-w c:\winnt\system32\dllcache\wuauclt.exe
+ 2008-10-16 19:09:44 51,224 -c–a-w c:\winnt\system32\dllcache\wuauclt.exe
- 2007-07-30 23:19:42 1,712,984 -c–a-w c:\winnt\system32\dllcache\wuaueng.dll
+ 2008-10-16 19:13:40 1,809,944 -c–a-w c:\winnt\system32\dllcache\wuaueng.dll
- 2007-07-30 23:19:32 325,976 -c–a-w c:\winnt\system32\dllcache\wucltui.dll
+ 2008-10-16 19:12:22 323,608 -c–a-w c:\winnt\system32\dllcache\wucltui.dll
- 2007-07-30 23:18:40 33,624 -c–a-w c:\winnt\system32\dllcache\wups.dll
+ 2008-10-16 19:08:58 34,328 -c–a-w c:\winnt\system32\dllcache\wups.dll
- 2004-08-04 07:56:48 5,120 —-a-w c:\winnt\system32\dllhost.exe
+ 2008-04-14 00:12:17 5,120 —-a-w c:\winnt\system32\dllhost.exe
- 2004-08-04 07:56:48 224,768 —-a-w c:\winnt\system32\dmadmin.exe
+ 2008-04-14 00:12:17 224,768 —-a-w c:\winnt\system32\dmadmin.exe
- 2004-08-04 07:56:42 28,672 —-a-w c:\winnt\system32\dmband.dll
+ 2008-04-14 00:11:52 28,672 —-a-w c:\winnt\system32\dmband.dll
- 2004-08-04 07:56:42 61,440 —-a-w c:\winnt\system32\dmcompos.dll
+ 2008-04-14 00:11:52 61,440 —-a-w c:\winnt\system32\dmcompos.dll
- 2001-08-23 08:00:00 273,920 —-a-w c:\winnt\system32\dmdlgs.dll
+ 2008-04-14 00:11:52 285,184 —-a-w c:\winnt\system32\dmdlgs.dll
- 2004-08-04 07:56:42 200,704 —-a-w c:\winnt\system32\dmdskmgr.dll
+ 2008-04-14 00:11:52 200,704 —-a-w c:\winnt\system32\dmdskmgr.dll
- 2004-08-04 07:56:42 181,248 —-a-w c:\winnt\system32\dmime.dll
+ 2008-04-14 00:11:52 181,248 —-a-w c:\winnt\system32\dmime.dll
- 2004-08-04 07:56:42 35,840 —-a-w c:\winnt\system32\dmloader.dll
+ 2008-04-14 00:11:52 35,840 —-a-w c:\winnt\system32\dmloader.dll
- 2004-08-04 07:56:48 15,872 —-a-w c:\winnt\system32\dmremote.exe
+ 2008-04-14 00:12:17 15,872 —-a-w c:\winnt\system32\dmremote.exe
- 2004-08-04 07:56:42 82,432 —-a-w c:\winnt\system32\dmscript.dll
+ 2008-04-14 00:11:52 82,432 —-a-w c:\winnt\system32\dmscript.dll
- 2004-08-04 07:56:42 23,552 —-a-w c:\winnt\system32\dmserver.dll
+ 2008-04-14 00:11:52 23,552 —-a-w c:\winnt\system32\dmserver.dll
- 2004-08-04 07:56:42 105,984 —-a-w c:\winnt\system32\dmstyle.dll
+ 2008-04-14 00:11:52 105,984 —-a-w c:\winnt\system32\dmstyle.dll
- 2004-08-04 07:56:42 103,424 —-a-w c:\winnt\system32\dmsynth.dll
+ 2008-04-14 00:11:52 103,424 —-a-w c:\winnt\system32\dmsynth.dll
- 2004-08-04 07:56:42 104,448 —-a-w c:\winnt\system32\dmusic.dll
+ 2008-04-14 00:11:52 104,448 —-a-w c:\winnt\system32\dmusic.dll
- 2004-08-04 07:56:42 52,224 —-a-w c:\winnt\system32\dmutil.dll
+ 2008-04-14 00:11:52 52,224 —-a-w c:\winnt\system32\dmutil.dll
- 2008-06-21 03:11:12 148,992 —-a-w c:\winnt\system32\dnsapi.dll
+ 2008-06-20 17:46:57 147,968 —-a-w c:\winnt\system32\dnsapi.dll
- 2008-02-20 05:32:43 45,568 —-a-w c:\winnt\system32\dnsrslvr.dll
+ 2008-04-14 00:11:52 45,568 —-a-w c:\winnt\system32\dnsrslvr.dll
- 2004-08-04 07:56:42 48,128 —-a-w c:\winnt\system32\docprop2.dll
+ 2008-04-14 00:11:52 48,128 —-a-w c:\winnt\system32\docprop2.dll
+ 2008-04-14 00:11:52 26,112 ——w c:\winnt\system32\dot3api.dll
+ 2008-04-14 00:11:52 57,856 ——w c:\winnt\system32\dot3cfg.dll
+ 2008-04-14 00:11:52 9,216 ——w c:\winnt\system32\dot3dlg.dll
+ 2008-04-14 00:11:52 39,936 ——w c:\winnt\system32\dot3gpclnt.dll
+ 2008-04-14 00:11:52 56,320 ——w c:\winnt\system32\dot3msm.dll
+ 2008-04-14 00:11:52 132,096 ——w c:\winnt\system32\dot3svc.dll
- 2004-08-04 07:56:26 96,768 —-a-w c:\winnt\system32\dpcdll.dll
+ 2008-04-14 00:10:45 102,912 —-a-w c:\winnt\system32\dpcdll.dll
- 2004-08-04 07:56:48 30,208 —-a-w c:\winnt\system32\dplaysvr.exe
+ 2008-04-14 00:12:17 29,696 —-a-w c:\winnt\system32\dplaysvr.exe
- 2004-08-04 07:56:42 229,888 —-a-w c:\winnt\system32\dplayx.dll
+ 2008-04-14 00:11:52 229,888 —-a-w c:\winnt\system32\dplayx.dll
- 2004-08-04 07:56:42 23,552 —-a-w c:\winnt\system32\dpmodemx.dll
+ 2008-04-14 00:11:52 23,552 —-a-w c:\winnt\system32\dpmodemx.dll
- 2004-08-04 07:56:03 3,584 —-a-w c:\winnt\system32\dpnaddr.dll
+ 2008-04-14 00:09:19 3,072 —-a-w c:\winnt\system32\dpnaddr.dll
- 2004-08-04 07:56:42 375,296 —-a-w c:\winnt\system32\dpnet.dll
+ 2008-04-14 00:11:52 375,296 —-a-w c:\winnt\system32\dpnet.dll
- 2004-08-04 07:56:42 35,328 —-a-w c:\winnt\system32\dpnhpast.dll
+ 2008-04-14 00:11:52 35,328 —-a-w c:\winnt\system32\dpnhpast.dll
- 2004-08-04 07:56:42 60,928 —-a-w c:\winnt\system32\dpnhupnp.dll
+ 2008-04-14 00:11:52 60,928 —-a-w c:\winnt\system32\dpnhupnp.dll
- 2004-08-04 07:56:03 3,584 —-a-w c:\winnt\system32\dpnlobby.dll
+ 2008-04-14 00:09:20 3,072 —-a-w c:\winnt\system32\dpnlobby.dll
- 2004-08-04 07:56:48 18,432 —-a-w c:\winnt\system32\dpnsvr.exe
+ 2008-04-14 00:12:17 17,920 —-a-w c:\winnt\system32\dpnsvr.exe
- 2004-08-04 07:56:42 21,504 —-a-w c:\winnt\system32\dpvacm.dll
+ 2008-04-14 00:11:52 21,504 —-a-w c:\winnt\system32\dpvacm.dll
- 2004-08-04 07:56:42 212,480 —-a-w c:\winnt\system32\dpvoice.dll
+ 2008-04-14 00:11:52 212,480 —-a-w c:\winnt\system32\dpvoice.dll
- 2004-08-04 07:56:48 83,456 —-a-w c:\winnt\system32\dpvsetup.exe
+ 2008-04-14 00:12:18 83,456 —-a-w c:\winnt\system32\dpvsetup.exe
- 2004-08-04 07:56:42 116,736 —-a-w c:\winnt\system32\dpvvox.dll
+ 2008-04-14 00:11:52 116,736 —-a-w c:\winnt\system32\dpvvox.dll
- 2004-08-04 07:56:42 57,344 —-a-w c:\winnt\system32\dpwsockx.dll
+ 2008-04-14 00:11:52 57,344 —-a-w c:\winnt\system32\dpwsockx.dll
- 2001-08-23 08:00:00 58,368 —-a-w c:\winnt\system32\driverquery.exe
+ 2008-04-14 00:12:18 62,976 —-a-w c:\winnt\system32\driverquery.exe
- 2004-08-04 06:07:38 187,776 —-a-w c:\winnt\system32\drivers\acpi.sys
+ 2008-04-13 18:36:35 187,776 —-a-w c:\winnt\system32\drivers\acpi.sys
- 2004-08-04 07:56:41 4,255 ——w c:\winnt\system32\drivers\adv01nt5.dll
+ 2008-04-14 00:11:48 4,255 ——w c:\winnt\system32\drivers\adv01nt5.dll
- 2004-08-04 07:56:41 3,967 ——w c:\winnt\system32\drivers\adv02nt5.dll
+ 2008-04-14 00:11:48 3,967 ——w c:\winnt\system32\drivers\adv02nt5.dll
- 2004-08-04 07:56:41 3,615 ——w c:\winnt\system32\drivers\adv05nt5.dll
+ 2008-04-14 00:11:48 3,615 ——w c:\winnt\system32\drivers\adv05nt5.dll
- 2004-08-04 07:56:41 3,647 ——w c:\winnt\system32\drivers\adv07nt5.dll
+ 2008-04-14 00:11:48 3,647 ——w c:\winnt\system32\drivers\adv07nt5.dll
- 2004-08-04 07:56:41 3,135 ——w c:\winnt\system32\drivers\adv08nt5.dll
+ 2008-04-14 00:11:48 3,135 ——w c:\winnt\system32\drivers\adv08nt5.dll
- 2004-08-04 07:56:41 3,711 ——w c:\winnt\system32\drivers\adv09nt5.dll
+ 2008-04-14 00:11:48 3,711 ——w c:\winnt\system32\drivers\adv09nt5.dll
- 2004-08-04 07:56:41 3,775 ——w c:\winnt\system32\drivers\adv11nt5.dll
+ 2008-04-14 00:11:48 3,775 ——w c:\winnt\system32\drivers\adv11nt5.dll
- 2006-02-15 00:22:26 142,464 —-a-w c:\winnt\system32\drivers\aec.sys
+ 2008-04-13 16:39:23 142,592 —-a-w c:\winnt\system32\drivers\aec.sys
- 2008-08-14 09:51:43 138,368 —-a-w c:\winnt\system32\drivers\afd.sys
+ 2008-08-14 10:04:36 138,496 —-a-w c:\winnt\system32\drivers\afd.sys
- 2004-08-04 06:07:41 42,368 ——w c:\winnt\system32\drivers\agp440.sys
+ 2008-04-13 18:36:38 42,368 ——w c:\winnt\system32\drivers\agp440.sys
- 2004-08-04 06:07:42 44,928 ——w c:\winnt\system32\drivers\agpcpq.sys
+ 2008-04-13 18:36:39 44,928 ——w c:\winnt\system32\drivers\agpcpq.sys
- 2004-08-04 06:07:41 42,752 ——w c:\winnt\system32\drivers\alim1541.sys
+ 2008-04-13 18:36:38 42,752 ——w c:\winnt\system32\drivers\alim1541.sys
- 2004-08-04 06:07:42 43,008 ——w c:\winnt\system32\drivers\amdagp.sys
+ 2008-04-13 18:36:39 43,008 ——w c:\winnt\system32\drivers\amdagp.sys
- 2004-08-04 05:59:19 36,992 —-a-w c:\winnt\system32\drivers\amdk6.sys
+ 2008-04-13 18:31:32 37,376 —-a-w c:\winnt\system32\drivers\amdk6.sys
- 2004-08-04 05:59:20 37,376 —-a-w c:\winnt\system32\drivers\amdk7.sys
+ 2008-04-13 18:31:33 37,760 —-a-w c:\winnt\system32\drivers\amdk7.sys
- 2004-08-04 05:58:29 60,800 —-a-w c:\winnt\system32\drivers\arp1394.sys
+ 2008-04-13 18:51:25 60,800 —-a-w c:\winnt\system32\drivers\arp1394.sys
- 2004-08-04 06:05:03 14,336 —-a-w c:\winnt\system32\drivers\asyncmac.sys
+ 2008-04-13 18:57:27 14,336 —-a-w c:\winnt\system32\drivers\asyncmac.sys
- 2004-08-04 05:59:42 95,360 —-a-w c:\winnt\system32\drivers\atapi.sys
+ 2008-04-13 18:40:30 96,512 —-a-w c:\winnt\system32\drivers\atapi.sys
- 2004-08-04 05:58:30 59,904 —-a-w c:\winnt\system32\drivers\atmarpc.sys
+ 2008-04-13 18:51:25 59,904 —-a-w c:\winnt\system32\drivers\atmarpc.sys
- 2004-08-04 05:58:34 55,936 —-a-w c:\winnt\system32\drivers\atmlane.sys
+ 2008-04-13 18:51:30 55,808 —-a-w c:\winnt\system32\drivers\atmlane.sys
- 2004-08-04 07:56:41 21,183 ——w c:\winnt\system32\drivers\atv01nt5.dll
+ 2008-04-14 00:11:50 21,183 ——w c:\winnt\system32\drivers\atv01nt5.dll
- 2004-08-04 07:56:41 11,359 ——w c:\winnt\system32\drivers\atv02nt5.dll
+ 2008-04-14 00:11:50 11,359 ——w c:\winnt\system32\drivers\atv02nt5.dll
- 2004-08-04 07:56:41 25,471 ——w c:\winnt\system32\drivers\atv04nt5.dll
+ 2008-04-14 00:11:50 25,471 ——w c:\winnt\system32\drivers\atv04nt5.dll
- 2004-08-04 07:56:41 14,143 ——w c:\winnt\system32\drivers\atv06nt5.dll
+ 2008-04-14 00:11:50 14,143 ——w c:\winnt\system32\drivers\atv06nt5.dll
- 2004-08-04 07:56:41 17,279 ——w c:\winnt\system32\drivers\atv10nt5.dll
+ 2008-04-14 00:11:50 17,279 ——w c:\winnt\system32\drivers\atv10nt5.dll
- 2004-08-04 06:10:12 11,776 —-a-w c:\winnt\system32\drivers\bdasup.sys
+ 2008-04-13 18:46:21 11,776 —-a-w c:\winnt\system32\drivers\bdasup.sys
- 2004-08-04 05:59:57 71,552 —-a-w c:\winnt\system32\drivers\bridge.sys
+ 2008-04-13 18:53:23 71,552 —-a-w c:\winnt\system32\drivers\bridge.sys
- 2004-08-04 06:10:38 17,024 ——w c:\winnt\system32\drivers\bthenum.sys
+ 2008-04-13 18:46:33 17,024 ——w c:\winnt\system32\drivers\bthenum.sys
- 2004-08-04 06:10:38 38,016 ——w c:\winnt\system32\drivers\bthmodem.sys
+ 2008-04-13 18:46:33 37,888 ——w c:\winnt\system32\drivers\bthmodem.sys
- 2004-08-04 05:58:38 100,992 ——w c:\winnt\system32\drivers\bthpan.sys
+ 2008-04-13 18:51:34 101,120 ——w c:\winnt\system32\drivers\bthpan.sys
- 2008-06-13 13:10:50 272,128 ——w c:\winnt\system32\drivers\bthport.sys
+ 2008-06-13 11:05:51 272,128 ——w c:\winnt\system32\drivers\bthport.sys
- 2004-08-04 06:10:37 35,456 ——w c:\winnt\system32\drivers\bthprint.sys
+ 2008-04-13 18:46:31 36,480 ——w c:\winnt\system32\drivers\bthprint.sys
- 2004-08-04 06:10:34 18,944 ——w c:\winnt\system32\drivers\bthusb.sys
+ 2008-04-13 18:46:29 18,944 ——w c:\winnt\system32\drivers\bthusb.sys
- 2004-08-04 06:10:16 17,024 —-a-w c:\winnt\system32\drivers\ccdecode.sys
+ 2008-04-13 18:46:23 17,024 —-a-w c:\winnt\system32\drivers\ccdecode.sys
- 2004-08-04 06:14:10 63,744 —-a-w c:\winnt\system32\drivers\cdfs.sys
+ 2008-04-13 19:14:21 63,744 —-a-w c:\winnt\system32\drivers\cdfs.sys
- 2004-08-04 05:59:52 49,536 —-a-w c:\winnt\system32\drivers\cdrom.sys
+ 2008-04-13 18:40:46 62,976 —-a-w c:\winnt\system32\drivers\cdrom.sys
- 2004-08-04 07:56:41 15,423 ——w c:\winnt\system32\drivers\ch7xxnt5.dll
+ 2008-04-14 00:11:50 15,423 ——w c:\winnt\system32\drivers\ch7xxnt5.dll
- 2004-08-04 06:14:26 49,664 —-a-w c:\winnt\system32\drivers\classpnp.sys
+ 2008-04-13 19:16:22 49,536 —-a-w c:\winnt\system32\drivers\classpnp.sys
- 2004-08-04 05:59:20 36,480 —-a-w c:\winnt\system32\drivers\crusoe.sys
+ 2008-04-13 18:31:32 36,736 —-a-w c:\winnt\system32\drivers\crusoe.sys
- 2004-08-04 05:59:54 36,352 —-a-w c:\winnt\system32\drivers\disk.sys
+ 2008-04-13 18:40:47 36,352 —-a-w c:\winnt\system32\drivers\disk.sys
- 2004-08-04 05:59:52 14,208 —-a-w c:\winnt\system32\drivers\diskdump.sys
+ 2008-04-13 18:40:44 14,208 —-a-w c:\winnt\system32\drivers\diskdump.sys
- 2004-08-04 06:07:17 799,744 —-a-w c:\winnt\system32\drivers\dmboot.sys
+ 2008-04-13 18:44:48 799,744 —-a-w c:\winnt\system32\drivers\dmboot.sys
- 2004-08-04 06:07:16 153,344 —-a-w c:\winnt\system32\drivers\dmio.sys
+ 2008-04-13 18:44:46 153,344 —-a-w c:\winnt\system32\drivers\dmio.sys
- 2004-08-04 06:07:38 52,864 —-a-w c:\winnt\system32\drivers\dmusic.sys
+ 2008-04-13 18:45:01 52,864 —-a-w c:\winnt\system32\drivers\dmusic.sys
- 2004-08-04 05:07:58 60,288 —-a-w c:\winnt\system32\drivers\drmk.sys
+ 2008-04-13 18:45:14 60,160 —-a-w c:\winnt\system32\drivers\drmk.sys
- 2004-08-04 06:07:57 2,944 —-a-w c:\winnt\system32\drivers\drmkaud.sys
+ 2008-04-13 18:45:13 2,944 —-a-w c:\winnt\system32\drivers\drmkaud.sys
- 2004-08-04 06:00:54 71,040 —-a-w c:\winnt\system32\drivers\dxg.sys
+ 2008-04-13 18:38:29 71,168 —-a-w c:\winnt\system32\drivers\dxg.sys
- 2004-08-04 06:14:16 143,360 —-a-w c:\winnt\system32\drivers\fastfat.sys
+ 2008-04-13 19:14:29 143,744 —-a-w c:\winnt\system32\drivers\fastfat.sys
- 2004-08-04 05:59:27 27,392 —-a-w c:\winnt\system32\drivers\fdc.sys
+ 2008-04-13 18:40:25 27,392 —-a-w c:\winnt\system32\drivers\fdc.sys
- 2001-08-23 08:00:00 34,944 —-a-w c:\winnt\system32\drivers\fips.sys
+ 2008-04-13 18:33:28 44,544 —-a-w c:\winnt\system32\drivers\fips.sys
- 2004-08-04 05:59:27 20,480 —-a-w c:\winnt\system32\drivers\flpydisk.sys
+ 2008-04-13 18:40:25 20,480 —-a-w c:\winnt\system32\drivers\flpydisk.sys
- 2006-08-21 09:14:58 128,896 ——w c:\winnt\system32\drivers\fltmgr.sys
+ 2008-04-13 18:32:59 129,792 ——w c:\winnt\system32\drivers\fltmgr.sys
- 2004-08-04 06:07:43 46,464 ——w c:\winnt\system32\drivers\gagp30kx.sys
+ 2008-04-13 18:36:40 46,464 ——w c:\winnt\system32\drivers\gagp30kx.sys
+ 2008-04-13 16:36:05 144,384 ——w c:\winnt\system32\drivers\hdaudbus.sys
- 2004-08-04 06:10:36 25,600 ——w c:\winnt\system32\drivers\hidbth.sys
+ 2008-04-13 18:46:30 25,600 ——w c:\winnt\system32\drivers\hidbth.sys
- 2004-08-04 06:08:19 36,224 —-a-w c:\winnt\system32\drivers\hidclass.sys
+ 2008-04-13 18:45:26 36,864 —-a-w c:\winnt\system32\drivers\hidclass.sys
- 2004-08-04 06:08:18 15,104 ——w c:\winnt\system32\drivers\hidir.sys
+ 2008-04-13 18:45:26 19,200 ——w c:\winnt\system32\drivers\hidir.sys
- 2004-08-04 06:08:16 24,960 —-a-w c:\winnt\system32\drivers\hidparse.sys
+ 2008-04-13 18:45:22 24,960 —-a-w c:\winnt\system32\drivers\hidparse.sys
- 2001-08-17 18:02:20 9,600 —-a-w c:\winnt\system32\drivers\hidusb.sys
+ 2008-04-13 18:45:27 10,368 —-a-w c:\winnt\system32\drivers\hidusb.sys
- 2006-03-17 00:33:10 262,784 ——w c:\winnt\system32\drivers\http.sys
+ 2008-04-13 18:53:53 264,832 ——w c:\winnt\system32\drivers\http.sys
- 2004-08-04 05:14:36 52,736 —-a-w c:\winnt\system32\drivers\i8042prt.sys
+ 2008-04-13 19:18:00 52,480 —-a-w c:\winnt\system32\drivers\i8042prt.sys
- 2004-08-04 06:00:15 41,856 —-a-w c:\winnt\system32\drivers\imapi.sys
+ 2008-04-13 18:40:58 42,112 —-a-w c:\winnt\system32\drivers\imapi.sys
- 2004-08-04 05:59:19 36,096 ——w c:\winnt\system32\drivers\intelppm.sys
+ 2008-04-13 18:31:32 36,352 ——w c:\winnt\system32\drivers\intelppm.sys
- 2004-08-04 06:00:06 29,056 ——w c:\winnt\system32\drivers\ip6fw.sys
+ 2008-04-13 18:53:34 36,608 ——w c:\winnt\system32\drivers\ip6fw.sys
- 2004-08-04 06:04:45 20,992 —-a-w c:\winnt\system32\drivers\ipinip.sys
+ 2008-04-13 18:57:07 20,864 —-a-w c:\winnt\system32\drivers\ipinip.sys
- 2004-09-29 22:28:37 134,912 —-a-w c:\winnt\system32\drivers\ipnat.sys
+ 2008-04-13 18:57:15 152,832 —-a-w c:\winnt\system32\drivers\ipnat.sys
- 2004-08-04 06:14:28 74,752 —-a-w c:\winnt\system32\drivers\ipsec.sys
+ 2008-04-13 19:19:42 75,264 —-a-w c:\winnt\system32\drivers\ipsec.sys
- 2004-08-04 06:08:32 40,832 ——w c:\winnt\system32\drivers\irbus.sys
+ 2008-04-13 18:45:34 46,592 ——w c:\winnt\system32\drivers\irbus.sys
- 2004-08-04 06:00:46 11,264 —-a-w c:\winnt\system32\drivers\irenum.sys
+ 2008-04-13 18:54:28 11,264 —-a-w c:\winnt\system32\drivers\irenum.sys
- 2001-08-17 13:58:02 35,840 —-a-w c:\winnt\system32\drivers\isapnp.sys
+ 2008-04-13 18:36:41 37,248 —-a-w c:\winnt\system32\drivers\isapnp.sys
- 2004-08-04 04:58:32 24,576 —-a-w c:\winnt\system32\drivers\kbdclass.sys
+ 2008-04-13 18:39:47 24,576 —-a-w c:\winnt\system32\drivers\kbdclass.sys
- 2004-08-04 04:58:34 14,848 —-a-w c:\winnt\system32\drivers\kbdhid.sys
+ 2008-04-13 18:39:48 14,592 —-a-w c:\winnt\system32\drivers\kbdhid.sys
- 2006-06-14 08:47:45 172,416 —-a-w c:\winnt\system32\drivers\kmixer.sys
+ 2008-04-13 18:45:09 172,416 —-a-w c:\winnt\system32\drivers\kmixer.sys
- 2004-08-04 05:15:22 140,928 —-a-w c:\winnt\system32\drivers\ks.sys
+ 2008-04-13 19:16:36 141,056 —-a-w c:\winnt\system32\drivers\ks.sys
- 2004-08-04 05:59:47 92,032 —-a-w c:\winnt\system32\drivers\ksecdd.sys
+ 2008-04-13 18:31:43 92,288 —-a-w c:\winnt\system32\drivers\ksecdd.sys
- 2004-08-04 06:07:44 63,744 —-a-w c:\winnt\system32\drivers\mf.sys
+ 2008-04-13 18:36:41 63,744 —-a-w c:\winnt\system32\drivers\mf.sys
- 2004-08-04 06:08:05 30,080 —-a-w c:\winnt\system32\drivers\modem.sys
+ 2008-04-13 19:00:19 30,080 —-a-w c:\winnt\system32\drivers\modem.sys
- 2004-08-04 04:58:32 23,040 —-a-w c:\winnt\system32\drivers\mouclass.sys
+ 2008-04-13 18:39:47 23,040 —-a-w c:\winnt\system32\drivers\mouclass.sys
- 2004-08-04 05:58:30 42,240 —-a-w c:\winnt\system32\drivers\mountmgr.sys
+ 2008-04-13 18:39:46 42,368 —-a-w c:\winnt\system32\drivers\mountmgr.sys
- 2004-08-04 06:10:12 15,360 —-a-w c:\winnt\system32\drivers\mpe.sys
+ 2008-04-13 18:46:22 15,232 —-a-w c:\winnt\system32\drivers\mpe.sys
- 2007-07-06 10:05:47 72,960 —-a-w c:\winnt\system32\drivers\mqac.sys
+ 2008-04-13 18:39:44 92,544 —-a-w c:\winnt\system32\drivers\mqac.sys
- 2007-12-18 09:51:35 179,584 —-a-w c:\winnt\system32\drivers\mrxdav.sys
+ 2008-04-13 18:32:44 180,608 —-a-w c:\winnt\system32\drivers\mrxdav.sys
- 2008-10-24 11:10:42 453,632 —-a-w c:\winnt\system32\drivers\mrxsmb.sys
+ 2008-10-24 11:21:09 455,296 —-a-w c:\winnt\system32\drivers\mrxsmb.sys
- 2004-08-04 06:09:58 51,328 —-a-w c:\winnt\system32\drivers\msdv.sys
+ 2008-04-13 18:46:09 51,200 —-a-w c:\winnt\system32\drivers\msdv.sys
- 2004-08-04 06:00:41 19,072 —-a-w c:\winnt\system32\drivers\msfs.sys
+ 2008-04-13 18:32:39 19,072 —-a-w c:\winnt\system32\drivers\msfs.sys
- 2004-08-04 06:04:12 35,072 —-a-w c:\winnt\system32\drivers\msgpc.sys
+ 2008-04-13 18:56:32 35,072 —-a-w c:\winnt\system32\drivers\msgpc.sys
- 2004-08-04 05:58:41 7,552 —-a-w c:\winnt\system32\drivers\mskssrv.sys
+ 2008-04-13 18:39:52 7,552 —-a-w c:\winnt\system32\drivers\mskssrv.sys
- 2004-08-04 05:58:38 5,376 —-a-w c:\winnt\system32\drivers\mspclock.sys
+ 2008-04-13 18:39:50 5,376 —-a-w c:\winnt\system32\drivers\mspclock.sys
- 2004-08-04 05:58:40 4,992 —-a-w c:\winnt\system32\drivers\mspqm.sys
+ 2008-04-13 18:39:51 4,992 —-a-w c:\winnt\system32\drivers\mspqm.sys
- 2004-08-04 06:07:47 15,488 ——w c:\winnt\system32\drivers\mssmbios.sys
+ 2008-04-13 18:36:46 15,488 ——w c:\winnt\system32\drivers\mssmbios.sys
- 2004-08-04 05:58:38 5,504 —-a-w c:\winnt\system32\drivers\mstee.sys
+ 2008-04-13 18:39:50 5,504 —-a-w c:\winnt\system32\drivers\mstee.sys
- 2004-08-04 06:15:20 107,904 —-a-w c:\winnt\system32\drivers\mup.sys
+ 2008-04-13 19:17:05 105,344 —-a-w c:\winnt\system32\drivers\mup.sys
- 2004-08-04 06:04:51 12,672 ——w c:\winnt\system32\drivers\mutohpen.sys
+ 2008-04-13 18:43:55 12,672 ——w c:\winnt\system32\drivers\mutohpen.sys
- 2004-08-04 06:10:28 85,376 —-a-w c:\winnt\system32\drivers\nabtsfec.sys
+ 2008-04-13 18:46:25 85,248 —-a-w c:\winnt\system32\drivers\nabtsfec.sys
- 2004-08-04 06:14:28 182,912 —-a-w c:\winnt\system32\drivers\ndis.sys
+ 2008-04-13 19:20:37 182,656 —-a-w c:\winnt\system32\drivers\ndis.sys
- 2004-08-04 06:10:12 10,880 —-a-w c:\winnt\system32\drivers\ndisip.sys
+ 2008-04-13 18:46:22 10,880 —-a-w c:\winnt\system32\drivers\ndisip.sys
- 2001-08-23 08:00:00 9,600 —-a-w c:\winnt\system32\drivers\ndistapi.sys
+ 2008-04-13 18:57:27 10,112 —-a-w c:\winnt\system32\drivers\ndistapi.sys
- 2004-08-04 06:03:12 12,928 —-a-w c:\winnt\system32\drivers\ndisuio.sys
+ 2008-04-13 18:55:58 14,592 —-a-w c:\winnt\system32\drivers\ndisuio.sys
- 2004-08-04 06:14:31 91,776 —-a-w c:\winnt\system32\drivers\ndiswan.sys
+ 2008-04-13 19:20:42 91,520 —-a-w c:\winnt\system32\drivers\ndiswan.sys
- 2001-08-23 08:00:00 38,016 —-a-w c:\winnt\system32\drivers\ndproxy.sys
+ 2008-04-13 18:57:29 40,576 —-a-w c:\winnt\system32\drivers\ndproxy.sys
- 2004-08-04 06:03:21 34,560 —-a-w c:\winnt\system32\drivers\netbios.sys
+ 2008-04-13 18:56:02 34,688 —-a-w c:\winnt\system32\drivers\netbios.sys
- 2004-08-04 06:14:37 162,816 —-a-w c:\winnt\system32\drivers\netbt.sys
+ 2008-04-13 19:21:00 162,816 —-a-w c:\winnt\system32\drivers\netbt.sys
- 2004-08-04 05:58:29 61,824 —-a-w c:\winnt\system32\drivers\nic1394.sys
+ 2008-04-13 18:51:25 61,824 —-a-w c:\winnt\system32\drivers\nic1394.sys
- 2004-08-04 05:59:50 40,320 —-a-w c:\winnt\system32\drivers\nmnt.sys
+ 2008-04-13 18:53:09 40,320 —-a-w c:\winnt\system32\drivers\nmnt.sys
- 2004-08-04 06:00:43 30,848 —-a-w c:\winnt\system32\drivers\npfs.sys
+ 2008-04-13 18:32:39 30,848 —-a-w c:\winnt\system32\drivers\npfs.sys
- 2007-02-09 11:10:35 574,464 —-a-w c:\winnt\system32\drivers\ntfs.sys
+ 2008-04-13 19:15:53 574,976 —-a-w c:\winnt\system32\drivers\ntfs.sys
- 2004-08-04 06:03:35 88,448 —-a-w c:\winnt\system32\drivers\nwlnkipx.sys
+ 2008-04-13 18:56:06 88,320 —-a-w c:\winnt\system32\drivers\nwlnkipx.sys
- 2006-10-13 10:23:15 163,584 —-a-w c:\winnt\system32\drivers\nwrdr.sys
+ 2008-04-13 18:34:12 163,584 —-a-w c:\winnt\system32\drivers\nwrdr.sys
- 2004-08-04 05:59:19 42,496 —-a-w c:\winnt\system32\drivers\p3.sys
+ 2008-04-13 18:31:31 42,752 —-a-w c:\winnt\system32\drivers\p3.sys
- 2004-08-04 05:59:06 80,128 —-a-w c:\winnt\system32\drivers\parport.sys
+ 2008-04-13 18:40:10 80,128 —-a-w c:\winnt\system32\drivers\parport.sys
- 2001-08-23 08:00:00 18,688 —-a-w c:\winnt\system32\drivers\partmgr.sys
+ 2008-04-13 18:40:49 19,712 —-a-w c:\winnt\system32\drivers\partmgr.sys
- 2004-08-04 06:07:46 68,224 —-a-w c:\winnt\system32\drivers\pci.sys
+ 2008-04-13 18:36:44 68,224 —-a-w c:\winnt\system32\drivers\pci.sys
- 2004-08-04 05:59:41 25,088 —-a-w c:\winnt\system32\drivers\pciidex.sys
+ 2008-04-13 18:40:29 24,960 —-a-w c:\winnt\system32\drivers\pciidex.sys
- 2004-08-04 06:07:46 119,936 —-a-w c:\winnt\system32\drivers\pcmcia.sys
+ 2008-04-13 18:36:43 120,192 —-a-w c:\winnt\system32\drivers\pcmcia.sys
- 2004-08-04 05:15:50 145,792 —-a-w c:\winnt\system32\drivers\portcls.sys
+ 2008-04-13 19:19:41 146,048 —-a-w c:\winnt\system32\drivers\portcls.sys
- 2004-08-04 05:59:17 35,328 —-a-w c:\winnt\system32\drivers\processr.sys
+ 2008-04-13 18:31:30 35,840 —-a-w c:\winnt\system32\drivers\processr.sys
- 2004-08-04 06:04:19 69,120 —-a-w c:\winnt\system32\drivers\psched.sys
+ 2008-04-13 18:56:38 69,120 —-a-w c:\winnt\system32\drivers\psched.sys
- 2004-08-04 06:14:22 51,328 —-a-w c:\winnt\system32\drivers\rasl2tp.sys
+ 2008-04-13 19:19:43 51,328 —-a-w c:\winnt\system32\drivers\rasl2tp.sys
- 2004-08-04 06:05:07 41,472 —-a-w c:\winnt\system32\drivers\raspppoe.sys
+ 2008-04-13 18:57:32 41,472 —-a-w c:\winnt\system32\drivers\raspppoe.sys
- 2004-08-04 06:14:26 48,384 —-a-w c:\winnt\system32\drivers\raspptp.sys
+ 2008-04-13 19:19:48 48,384 —-a-w c:\winnt\system32\drivers\raspptp.sys
- 2006-05-05 09:47:57 174,592 —-a-w c:\winnt\system32\drivers\rdbss.sys
+ 2008-04-13 19:28:39 175,744 —-a-w c:\winnt\system32\drivers\rdbss.sys
- 2004-08-04 06:01:15 196,864 —-a-w c:\winnt\system32\drivers\rdpdr.sys
+ 2008-04-13 18:32:51 196,224 —-a-w c:\winnt\system32\drivers\rdpdr.sys
- 2005-06-10 04:09:46 139,528 —-a-w c:\winnt\system32\drivers\rdpwd.sys
+ 2008-04-14 00:13:22 139,656 —-a-w c:\winnt\system32\drivers\rdpwd.sys
- 2004-08-04 05:59:37 57,472 —-a-w c:\winnt\system32\drivers\redbook.sys
+ 2008-04-13 18:40:27 57,600 —-a-w c:\winnt\system32\drivers\redbook.sys
- 2004-08-04 06:10:39 59,648 ——w c:\winnt\system32\drivers\rfcomm.sys
+ 2008-04-13 18:46:32 59,136 ——w c:\winnt\system32\drivers\rfcomm.sys
- 2008-05-08 12:28:49 202,752 —-a-w c:\winnt\system32\drivers\rmcast.sys
+ 2008-05-08 14:02:52 203,136 —-a-w c:\winnt\system32\drivers\rmcast.sys
- 2004-08-04 06:04:31 30,080 —-a-w c:\winnt\system32\drivers\rndismp.sys
+ 2008-04-13 18:56:49 30,592 —-a-w c:\winnt\system32\drivers\rndismp.sys
- 2004-08-04 06:04:31 30,080 ——w c:\winnt\system32\drivers\rndismpx.sys
+ 2008-04-13 18:56:49 30,592 ——w c:\winnt\system32\drivers\rndismpx.sys
- 2004-08-04 05:59:41 96,256 —-a-w c:\winnt\system32\drivers\scsiport.sys
+ 2008-04-13 18:40:30 96,384 —-a-w c:\winnt\system32\drivers\scsiport.sys
- 2001-08-17 17:53:26 10,880 —-a-w c:\winnt\system32\drivers\scsiscan.sys
+ 2008-04-13 18:45:33 11,520 —-a-w c:\winnt\system32\drivers\scsiscan.sys
- 2004-08-04 06:07:47 67,584 ——w c:\winnt\system32\drivers\sdbus.sys
+ 2008-04-13 18:36:44 79,232 ——w c:\winnt\system32\drivers\sdbus.sys
- 2004-08-04 05:59:07 15,488 —-a-w c:\winnt\system32\drivers\serenum.sys
+ 2008-04-13 18:40:12 15,744 —-a-w c:\winnt\system32\drivers\serenum.sys
- 2004-08-04 06:15:52 64,896 —-a-w c:\winnt\system32\drivers\serial.sys
+ 2008-04-13 19:15:45 64,512 —-a-w c:\winnt\system32\drivers\serial.sys
- 2004-08-04 05:59:54 11,136 ——w c:\winnt\system32\drivers\sffdisk.sys
+ 2008-04-13 18:40:47 11,904 ——w c:\winnt\system32\drivers\sffdisk.sys
+ 2008-04-13 18:40:48 10,240 ——w c:\winnt\system32\drivers\sffp_mmc.sys
- 2004-08-04 05:59:54 10,240 ——w c:\winnt\system32\drivers\sffp_sd.sys
+ 2008-04-13 18:40:47 11,008 ——w c:\winnt\system32\drivers\sffp_sd.sys
- 2004-08-04 05:59:54 11,392 —-a-w c:\winnt\system32\drivers\sfloppy.sys
+ 2008-04-13 18:40:48 11,392 —-a-w c:\winnt\system32\drivers\sfloppy.sys
- 2004-08-04 07:56:45 3,901 ——w c:\winnt\system32\drivers\siint5.dll
+ 2008-04-14 00:12:05 3,901 ——w c:\winnt\system32\drivers\siint5.dll
- 2004-08-04 06:07:42 41,088 ——w c:\winnt\system32\drivers\sisagp.sys
+ 2008-04-13 18:36:39 40,960 ——w c:\winnt\system32\drivers\sisagp.sys
- 2004-08-04 06:10:16 11,136 —-a-w c:\winnt\system32\drivers\slip.sys
+ 2008-04-13 18:46:23 11,136 —-a-w c:\winnt\system32\drivers\slip.sys
- 2004-08-04 06:07:36 6,016 ——w c:\winnt\system32\drivers\smbali.sys
+ 2008-04-13 18:36:34 5,888 ——w c:\winnt\system32\drivers\smbali.sys
- 2004-08-04 06:09:55 25,472 —-a-w c:\winnt\system32\drivers\sonydcam.sys
+ 2008-04-13 18:46:07 25,344 —-a-w c:\winnt\system32\drivers\sonydcam.sys
- 2006-06-14 08:47:46 6,400 —-a-w c:\winnt\system32\drivers\splitter.sys
+ 2008-04-13 18:45:07 6,272 —-a-w c:\winnt\system32\drivers\splitter.sys
- 2004-08-04 06:06:25 73,472 —-a-w c:\winnt\system32\drivers\sr.sys
+ 2008-04-13 18:36:52 73,472 —-a-w c:\winnt\system32\drivers\sr.sys
- 2008-08-28 10:04:17 333,056 —-a-w c:\winnt\system32\drivers\srv.sys
+ 2008-12-11 10:57:09 333,952 —-a-w c:\winnt\system32\drivers\srv.sys
- 2004-08-04 05:08:02 48,640 —-a-w c:\winnt\system32\drivers\stream.sys
+ 2008-04-13 18:45:15 49,408 —-a-w c:\winnt\system32\drivers\stream.sys
- 2004-08-04 06:10:12 15,360 —-a-w c:\winnt\system32\drivers\streamip.sys
+ 2008-04-13 18:46:21 15,232 —-a-w c:\winnt\system32\drivers\streamip.sys
- 2004-08-04 05:58:41 4,352 —-a-w c:\winnt\system32\drivers\swenum.sys
+ 2008-04-13 18:39:53 4,352 —-a-w c:\winnt\system32\drivers\swenum.sys
- 2001-08-17 14:00:52 54,272 —-a-w c:\winnt\system32\drivers\swmidi.sys
+ 2008-04-13 18:45:09 56,576 —-a-w c:\winnt\system32\drivers\swmidi.sys
- 2004-08-04 06:15:55 60,800 —-a-w c:\winnt\system32\drivers\sysaudio.sys
+ 2008-04-13 19:15:55 60,800 —-a-w c:\winnt\system32\drivers\sysaudio.sys
- 2004-08-04 05:59:59 14,976 —-a-w c:\winnt\system32\drivers\tape.sys
+ 2008-04-13 18:40:50 14,976 —-a-w c:\winnt\system32\drivers\tape.sys
- 2008-06-20 10:45:13 360,320 —-a-w c:\winnt\system32\drivers\tcpip.sys
+ 2008-06-20 11:51:12 361,600 —-a-w c:\winnt\system32\drivers\tcpip.sys
- 2008-06-20 19:22:08 225,920 —-a-w c:\winnt\system32\drivers\tcpip6.sys
+ 2008-06-20 11:08:27 225,856 —-a-w c:\winnt\system32\drivers\tcpip6.sys
- 2004-08-04 06:07:48 18,560 —-a-w c:\winnt\system32\drivers\tdi.sys
+ 2008-04-13 19:00:05 19,072 —-a-w c:\winnt\system32\drivers\tdi.sys
- 2004-08-04 08:01:07 12,040 —-a-w c:\winnt\system32\drivers\tdpipe.sys
+ 2008-04-14 00:13:20 12,040 —-a-w c:\winnt\system32\drivers\tdpipe.sys
- 2004-08-04 08:01:07 21,896 —-a-w c:\winnt\system32\drivers\tdtcp.sys
+ 2008-04-14 00:13:21 21,896 —-a-w c:\winnt\system32\drivers\tdtcp.sys
- 2004-08-04 08:01:07 40,840 —-a-w c:\winnt\system32\drivers\termdd.sys
+ 2008-04-14 00:13:20 40,840 —-a-w c:\winnt\system32\drivers\termdd.sys
- 2004-08-04 06:03:17 12,416 —-a-w c:\winnt\system32\drivers\tunmp.sys
+ 2008-04-13 18:56:01 12,288 —-a-w c:\winnt\system32\drivers\tunmp.sys
- 2004-08-04 06:07:43 44,672 ——w c:\winnt\system32\drivers\uagp35.sys
+ 2008-04-13 18:36:40 44,672 ——w c:\winnt\system32\drivers\uagp35.sys
- 2004-08-04 06:00:31 66,176 —-a-w c:\winnt\system32\drivers\udfs.sys
+ 2008-04-13 18:32:36 66,048 —-a-w c:\winnt\system32\drivers\udfs.sys
- 2007-04-23 10:32:54 364,160 —-a-w c:\winnt\system32\drivers\update.sys
+ 2008-04-13 18:39:46 384,768 —-a-w c:\winnt\system32\drivers\update.sys
- 2004-08-04 06:04:32 12,672 —-a-w c:\winnt\system32\drivers\usb8023.sys
+ 2008-04-13 18:56:49 12,800 —-a-w c:\winnt\system32\drivers\usb8023.sys
- 2004-08-04 06:04:33 12,672 ——w c:\winnt\system32\drivers\usb8023x.sys
+ 2008-04-13 18:56:49 12,800 ——w c:\winnt\system32\drivers\usb8023x.sys
- 2001-08-23 08:00:00 23,808 —-a-w c:\winnt\system32\drivers\usbcamd.sys
+ 2008-04-13 18:45:40 25,600 —-a-w c:\winnt\system32\drivers\usbcamd.sys
- 2001-08-23 08:00:00 23,936 —-a-w c:\winnt\system32\drivers\usbcamd2.sys
+ 2008-04-13 18:45:41 25,728 —-a-w c:\winnt\system32\drivers\usbcamd2.sys
- 2004-08-04 06:08:46 31,616 —-a-w c:\winnt\system32\drivers\usbccgp.sys
+ 2008-04-13 18:45:39 32,128 —-a-w c:\winnt\system32\drivers\usbccgp.sys
- 2004-08-04 06:08:37 26,624 —-a-w c:\winnt\system32\drivers\usbehci.sys
+ 2008-04-13 18:45:35 30,208 —-a-w c:\winnt\system32\drivers\usbehci.sys
- 2004-08-04 06:08:42 57,600 —-a-w c:\winnt\system32\drivers\usbhub.sys
+ 2008-04-13 18:45:37 59,520 —-a-w c:\winnt\system32\drivers\usbhub.sys
- 2004-08-04 06:08:57 16,000 —-a-w c:\winnt\system32\drivers\usbintel.sys
+ 2008-04-13 18:45:43 15,872 —-a-w c:\winnt\system32\drivers\usbintel.sys
- 2004-08-04 06:08:42 142,976 —-a-w c:\winnt\system32\drivers\usbport.sys
+ 2008-04-13 18:45:36 143,872 —-a-w c:\winnt\system32\drivers\usbport.sys
- 2004-08-04 06:01:24 25,856 —-a-w c:\winnt\system32\drivers\usbprint.sys
+ 2008-04-13 18:47:37 25,856 —-a-w c:\winnt\system32\drivers\usbprint.sys
- 2004-08-04 05:58:46 15,104 —-a-w c:\winnt\system32\drivers\usbscan.sys
+ 2008-04-13 18:45:34 15,104 —-a-w c:\winnt\system32\drivers\usbscan.sys
- 2004-08-04 06:08:46 26,496 —-a-w c:\winnt\system32\drivers\usbstor.sys
+ 2008-04-13 18:45:38 26,368 —-a-w c:\winnt\system32\drivers\usbstor.sys
- 2004-08-04 06:08:37 20,480 —-a-w c:\winnt\system32\drivers\usbuhci.sys
+ 2008-04-13 18:45:35 20,608 —-a-w c:\winnt\system32\drivers\usbuhci.sys
- 2004-08-04 06:10:10 78,464 ——w c:\winnt\system32\drivers\usbvideo.sys
+ 2008-04-13 18:46:20 121,984 ——w c:\winnt\system32\drivers\usbvideo.sys
- 2004-08-04 07:56:46 11,325 ——w c:\winnt\system32\drivers\vchnt5.dll
+ 2008-04-14 00:12:08 11,325 ——w c:\winnt\system32\drivers\vchnt5.dll
- 2004-08-04 06:07:06 20,992 —-a-w c:\winnt\system32\drivers\vga.sys
+ 2008-04-13 18:44:40 20,992 —-a-w c:\winnt\system32\drivers\vga.sys
- 2004-08-04 06:07:42 42,240 ——w c:\winnt\system32\drivers\viaagp.sys
+ 2008-04-13 18:36:40 42,240 ——w c:\winnt\system32\drivers\viaagp.sys
- 2004-08-04 06:07:05 79,744 —-a-w c:\winnt\system32\drivers\videoprt.sys
+ 2008-04-13 18:44:40 81,664 —-a-w c:\winnt\system32\drivers\videoprt.sys
- 2004-08-04 06:00:16 52,352 —-a-w c:\winnt\system32\drivers\volsnap.sys
+ 2008-04-13 18:41:01 52,352 —-a-w c:\winnt\system32\drivers\volsnap.sys
- 2004-08-04 06:04:52 13,568 ——w c:\winnt\system32\drivers\wacompen.sys
+ 2008-04-13 18:43:55 14,208 ——w c:\winnt\system32\drivers\wacompen.sys
- 2004-08-04 06:04:57 34,560 —-a-w c:\winnt\system32\drivers\wanarp.sys
+ 2008-04-13 18:57:21 34,560 —-a-w c:\winnt\system32\drivers\wanarp.sys
- 2006-06-14 09:00:45 82,944 —-a-w c:\winnt\system32\drivers\wdmaud.sys
+ 2008-04-13 19:17:18 83,072 —-a-w c:\winnt\system32\drivers\wdmaud.sys
- 2004-08-04 06:10:21 19,328 —-a-w c:\winnt\system32\drivers\wstcodec.sys
+ 2008-04-13 18:46:24 19,200 —-a-w c:\winnt\system32\drivers\wstcodec.sys
- 2004-08-04 07:56:42 14,336 —-a-w c:\winnt\system32\drprov.dll
+ 2008-04-14 00:11:52 14,336 —-a-w c:\winnt\system32\drprov.dll
- 2004-08-04 07:56:42 16,384 —-a-w c:\winnt\system32\ds32gt.dll
+ 2008-04-14 00:11:52 16,384 —-a-w c:\winnt\system32\ds32gt.dll
- 2004-08-04 07:56:42 181,760 —-a-w c:\winnt\system32\dsdmo.dll
+ 2008-04-14 00:11:52 181,248 —-a-w c:\winnt\system32\dsdmo.dll
- 2004-08-04 07:56:42 71,680 —-a-w c:\winnt\system32\dsdmoprp.dll
+ 2008-04-14 00:11:52 71,680 —-a-w c:\winnt\system32\dsdmoprp.dll
- 2004-08-04 07:56:42 92,672 —-a-w c:\winnt\system32\dskquota.dll
+ 2008-04-14 00:11:52 92,672 —-a-w c:\winnt\system32\dskquota.dll
- 2001-08-23 08:00:00 144,384 —-a-w c:\winnt\system32\dskquoui.dll
+ 2008-04-14 00:11:52 155,648 —-a-w c:\winnt\system32\dskquoui.dll
- 2004-08-04 07:56:42 367,616 —-a-w c:\winnt\system32\dsound.dll
+ 2008-04-14 00:11:52 367,616 —-a-w c:\winnt\system32\dsound.dll
- 2004-08-04 07:56:42 1,294,336 —-a-w c:\winnt\system32\dsound3d.dll
+ 2008-04-14 00:11:52 1,293,824 —-a-w c:\winnt\system32\dsound3d.dll
- 2004-08-04 07:56:42 142,336 —-a-w c:\winnt\system32\dsprop.dll
+ 2008-04-14 00:11:52 142,848 —-a-w c:\winnt\system32\dsprop.dll
- 2004-08-04 07:56:04 4,096 —-a-w c:\winnt\system32\dsprpres.dll
+ 2008-04-13 17:09:30 4,096 —-a-w c:\winnt\system32\dsprpres.dll
- 2004-08-04 07:56:42 239,104 —-a-w c:\winnt\system32\dsquery.dll
+ 2008-04-14 00:11:52 239,104 —-a-w c:\winnt\system32\dsquery.dll
- 2004-08-04 07:56:42 51,200 —-a-w c:\winnt\system32\dssec.dll
+ 2008-04-14 00:11:52 51,200 —-a-w c:\winnt\system32\dssec.dll
- 2004-08-04 05:31:43 137,216 —-a-w c:\winnt\system32\dssenh.dll
+ 2008-04-13 17:37:57 138,752 —-a-w c:\winnt\system32\dssenh.dll
- 2004-08-04 07:56:42 113,152 —-a-w c:\winnt\system32\dsuiext.dll
+ 2008-04-14 00:11:52 113,152 —-a-w c:\winnt\system32\dsuiext.dll
- 2004-08-04 07:56:42 19,456 —-a-w c:\winnt\system32\dswave.dll
+ 2008-04-14 00:11:52 19,456 —-a-w c:\winnt\system32\dswave.dll
- 2004-08-04 07:56:48 10,752 —-a-w c:\winnt\system32\dumprep.exe
+ 2008-04-14 00:12:18 10,752 —-a-w c:\winnt\system32\dumprep.exe
- 2004-08-04 07:56:42 304,128 —-a-w c:\winnt\system32\duser.dll
+ 2008-04-14 00:11:52 304,128 —-a-w c:\winnt\system32\duser.dll
- 2004-08-04 07:56:48 17,920 —-a-w c:\winnt\system32\dvdupgrd.exe
+ 2008-04-14 00:12:18 17,920 —-a-w c:\winnt\system32\dvdupgrd.exe
- 2004-08-04 07:56:48 180,224 —-a-w c:\winnt\system32\dwwin.exe
+ 2008-04-14 00:12:18 180,224 —-a-w c:\winnt\system32\dwwin.exe
- 2004-08-04 07:56:42 619,008 —-a-w c:\winnt\system32\dx7vb.dll
+ 2008-04-14 00:11:52 619,008 —-a-w c:\winnt\system32\dx7vb.dll
- 2004-08-04 07:56:42 1,227,264 —-a-w c:\winnt\system32\dx8vb.dll
+ 2008-04-14 00:11:52 1,227,264 —-a-w c:\winnt\system32\dx8vb.dll
- 2004-08-04 07:56:48 1,298,432 —-a-w c:\winnt\system32\dxdiag.exe
+ 2008-04-14 00:12:18 1,298,432 —-a-w c:\winnt\system32\dxdiag.exe
- 2004-08-04 07:56:42 2,113,536 —-a-w c:\winnt\system32\dxdiagn.dll
+ 2008-04-14 00:11:52 2,113,536 —-a-w c:\winnt\system32\dxdiagn.dll
- 2006-08-22 09:05:26 498,742 —-a-w c:\winnt\system32\dxmasf.dll
+ 2008-04-14 00:11:52 498,742 —-a-w c:\winnt\system32\dxmasf.dll
- 2008-10-16 10:37:02 357,888 —-a-w c:\winnt\system32\dxtmsft.dll
+ 2008-04-14 00:11:52 357,888 —-a-w c:\winnt\system32\dxtmsft.dll
- 2008-10-16 10:37:02 205,312 —-a-w c:\winnt\system32\dxtrans.dll
+ 2008-04-14 00:11:52 205,312 —-a-w c:\winnt\system32\dxtrans.dll
+ 2008-07-30 02:10:04 73,720 —-a-w c:\winnt\system32\dxva2.dll
+ 2008-04-14 00:11:52 30,720 ——w c:\winnt\system32\eapolqec.dll
+ 2008-04-14 00:11:52 184,832 ——w c:\winnt\system32\eapp3hst.dll
+ 2008-04-14 00:11:52 126,976 ——w c:\winnt\system32\eappcfg.dll
+ 2008-04-14 00:11:52 94,208 ——w c:\winnt\system32\eappgnui.dll
+ 2008-04-14 00:11:52 180,224 ——w c:\winnt\system32\eapphost.dll
+ 2008-04-14 00:11:52 40,960 ——w c:\winnt\system32\eappprxy.dll
+ 2008-04-14 00:11:52 59,392 ——w c:\winnt\system32\eapqec.dll
+ 2008-04-14 00:11:52 33,792 ——w c:\winnt\system32\eapsvc.dll
- 2004-08-04 07:56:42 26,624 —-a-w c:\winnt\system32\efsadu.dll
+ 2008-04-14 00:11:52 26,624 —-a-w c:\winnt\system32\efsadu.dll
- 2004-08-04 07:56:42 183,296 —-a-w c:\winnt\system32\els.dll
+ 2008-04-14 00:11:53 183,296 —-a-w c:\winnt\system32\els.dll
+ 2008-04-14 00:11:57 28,672 ——w c:\winnt\system32\en\microsoft.managementconsole.resources.dll
+ 2008-04-14 00:11:57 40,960 ——w c:\winnt\system32\en\mmcex.resources.dll
+ 2008-04-14 00:11:57 6,656 ——w c:\winnt\system32\en\mmcfxcommon.resources.dll
- 2004-08-04 07:56:42 20,480 —-a-w c:\winnt\system32\encapi.dll
+ 2008-04-14 00:11:53 20,480 —-a-w c:\winnt\system32\encapi.dll
- 2004-08-04 07:56:42 186,368 —-a-w c:\winnt\system32\encdec.dll
+ 2008-04-14 00:11:53 186,880 —-a-w c:\winnt\system32\encdec.dll
- 2004-08-04 07:56:42 23,040 —-a-w c:\winnt\system32\ersvc.dll
+ 2008-04-14 00:11:53 23,040 —-a-w c:\winnt\system32\ersvc.dll
- 2008-07-07 20:32:22 253,952 —-a-w c:\winnt\system32\es.dll
+ 2008-07-07 20:26:58 253,952 —-a-w c:\winnt\system32\es.dll
- 2005-10-20 22:20:03 1,082,368 —-a-w c:\winnt\system32\esent.dll
+ 2008-04-14 00:11:53 1,082,368 —-a-w c:\winnt\system32\esent.dll
- 2004-08-04 07:56:49 193,024 —-a-w c:\winnt\system32\eudcedit.exe
+ 2008-04-14 00:12:19 193,024 —-a-w c:\winnt\system32\eudcedit.exe
- 2004-08-04 07:56:49 50,176 —-a-w c:\winnt\system32\eventcreate.exe
+ 2008-04-14 00:12:19 50,688 —-a-w c:\winnt\system32\eventcreate.exe
- 2004-08-04 07:56:42 55,808 —-a-w c:\winnt\system32\eventlog.dll
+ 2008-04-14 00:11:53 56,320 —-a-w c:\winnt\system32\eventlog.dll
- 2001-08-23 08:00:00 77,824 —-a-w c:\winnt\system32\eventtriggers.exe
+ 2008-04-14 00:12:19 82,944 —-a-w c:\winnt\system32\eventtriggers.exe
+ 2008-07-30 02:10:04 493,048 —-a-w c:\winnt\system32\evr.dll
- 2004-08-04 07:56:42 380,957 —-a-w c:\winnt\system32\expsrv.dll
+ 2008-04-14 00:11:53 380,445 —-a-w c:\winnt\system32\expsrv.dll
- 2008-10-16 10:37:02 55,808 ——w c:\winnt\system32\extmgr.dll
+ 2008-04-14 00:11:53 55,808 ——w c:\winnt\system32\extmgr.dll
- 2004-08-04 07:56:49 45,568 —-a-w c:\winnt\system32\extrac32.exe
+ 2008-04-14 00:12:19 24,064 —-a-w c:\winnt\system32\extrac32.exe
- 2001-08-23 08:00:00 121,856 —-a-w c:\winnt\system32\exts.dll
+ 2008-04-14 00:11:53 125,952 —-a-w c:\winnt\system32\exts.dll
- 2004-08-04 07:56:42 80,384 —-a-w c:\winnt\system32\faultrep.dll
+ 2008-04-14 00:11:53 80,384 —-a-w c:\winnt\system32\faultrep.dll
- 2004-08-04 07:56:49 20,992 ——w c:\winnt\system32\faxpatch.exe
+ 2008-04-14 00:12:20 20,992 ——w c:\winnt\system32\faxpatch.exe
- 2001-08-23 08:00:00 117,760 —-a-w c:\winnt\system32\fde.dll
+ 2008-04-14 00:11:53 124,928 —-a-w c:\winnt\system32\fde.dll
- 2004-08-04 07:56:42 73,728 —-a-w c:\winnt\system32\fdeploy.dll
+ 2008-04-14 00:11:53 73,728 —-a-w c:\winnt\system32\fdeploy.dll
- 2004-08-04 07:56:42 21,504 —-a-w c:\winnt\system32\feclient.dll
+ 2008-04-14 00:11:53 21,504 —-a-w c:\winnt\system32\feclient.dll
- 2004-08-04 07:56:42 337,920 —-a-w c:\winnt\system32\filemgmt.dll
+ 2008-04-14 00:11:53 337,920 —-a-w c:\winnt\system32\filemgmt.dll
- 2004-08-04 07:56:49 27,136 —-a-w c:\winnt\system32\findstr.exe
+ 2008-04-14 00:12:20 27,136 —-a-w c:\winnt\system32\findstr.exe
- 2004-08-04 07:56:42 87,552 —-a-w c:\winnt\system32\fldrclnr.dll
+ 2008-04-14 00:11:53 87,552 —-a-w c:\winnt\system32\fldrclnr.dll
- 2006-08-21 12:21:06 16,896 —-a-w c:\winnt\system32\fltlib.dll
+ 2008-04-14 00:11:53 16,896 —-a-w c:\winnt\system32\fltlib.dll
- 2006-08-21 09:14:58 23,040 —-a-w c:\winnt\system32\fltmc.exe
+ 2008-04-14 00:12:20 23,040 —-a-w c:\winnt\system32\fltmc.exe
- 2005-03-17 19:39:58 1,146,320 —-a-w c:\winnt\system32\FM20.DLL
+ 2007-06-06 15:53:34 1,195,888 —-a-w c:\winnt\system32\FM20.DLL
- 2003-10-23 12:33:30 25,872 —-a-w c:\winnt\system32\FM20ENU.DLL
+ 2007-03-23 00:17:04 35,440 —-a-w c:\winnt\system32\FM20ENU.DLL
- 2009-01-10 01:42:30 213,672 —-a-w c:\winnt\system32\FNTCACHE.DAT
+ 2009-02-21 02:54:43 216,856 —-a-w c:\winnt\system32\FNTCACHE.DAT
- 2004-08-04 07:56:42 382,976 —-a-w c:\winnt\system32\fontext.dll
+ 2008-04-14 00:11:53 382,976 —-a-w c:\winnt\system32\fontext.dll
- 2005-10-17 21:14:45 80,896 —-a-w c:\winnt\system32\fontsub.dll
+ 2008-04-14 00:11:53 80,896 —-a-w c:\winnt\system32\fontsub.dll
- 2004-08-04 07:56:49 20,992 —-a-w c:\winnt\system32\fontview.exe
+ 2008-04-14 00:12:20 20,992 —-a-w c:\winnt\system32\fontview.exe
- 2001-08-23 08:00:00 7,168 —-a-w c:\winnt\system32\forcedos.exe
+ 2008-04-14 00:12:20 7,680 —-a-w c:\winnt\system32\forcedos.exe
- 2001-08-23 08:00:00 25,600 —-a-w c:\winnt\system32\format.com
+ 2008-04-14 00:12:42 29,696 —-a-w c:\winnt\system32\format.com
- 2004-08-04 07:56:06 9,344 —-a-w c:\winnt\system32\framebuf.dll
+ 2008-04-14 00:09:33 9,344 —-a-w c:\winnt\system32\framebuf.dll
- 2004-08-04 07:56:49 193,024 ——w c:\winnt\system32\fsquirt.exe
+ 2008-04-14 00:12:20 193,024 ——w c:\winnt\system32\fsquirt.exe
- 2004-08-04 07:56:49 42,496 —-a-w c:\winnt\system32\ftp.exe
+ 2008-04-14 00:12:20 42,496 —-a-w c:\winnt\system32\ftp.exe
- 2004-08-04 07:56:42 60,416 ——w c:\winnt\system32\fwcfg.dll
+ 2008-04-14 00:11:53 60,416 ——w c:\winnt\system32\fwcfg.dll
- 2004-08-04 07:56:42 452,096 —-a-w c:\winnt\system32\fxsapi.dll
+ 2008-04-14 00:11:53 451,584 —-a-w c:\winnt\system32\fxsapi.dll
- 2004-08-04 07:56:49 143,360 —-a-w c:\winnt\system32\fxsclnt.exe
+ 2008-04-14 00:12:21 142,848 —-a-w c:\winnt\system32\fxsclnt.exe
- 2004-08-04 07:56:42 72,192 —-a-w c:\winnt\system32\fxscom.dll
+ 2008-04-14 00:11:54 72,192 —-a-w c:\winnt\system32\fxscom.dll
- 2004-08-04 07:56:42 285,184 —-a-w c:\winnt\system32\fxscomex.dll
+ 2008-04-14 00:11:54 285,184 —-a-w c:\winnt\system32\fxscomex.dll
- 2004-08-04 07:56:49 229,376 —-a-w c:\winnt\system32\fxscover.exe
+ 2008-04-14 00:12:21 229,376 —-a-w c:\winnt\system32\fxscover.exe
- 2004-08-04 07:56:42 27,136 —-a-w c:\winnt\system32\fxsdrv.dll
+ 2008-04-14 00:11:54 26,624 —-a-w c:\winnt\system32\fxsdrv.dll
- 2004-08-04 07:56:42 55,296 —-a-w c:\winnt\system32\fxsevent.dll
+ 2008-04-14 00:11:54 55,296 —-a-w c:\winnt\system32\fxsevent.dll
- 2004-08-04 07:56:42 23,552 —-a-w c:\winnt\system32\fxsext32.dll
+ 2008-04-14 00:11:54 23,552 —-a-w c:\winnt\system32\fxsext32.dll
- 2004-08-04 07:56:42 23,552 —-a-w c:\winnt\system32\fxsmon.dll
+ 2008-04-14 00:11:54 23,552 —-a-w c:\winnt\system32\fxsmon.dll
- 2004-08-04 07:56:42 8,704 —-a-w c:\winnt\system32\fxsperf.dll
+ 2008-04-14 00:11:54 8,704 —-a-w c:\winnt\system32\fxsperf.dll
- 2004-08-04 07:56:06 6,656 —-a-w c:\winnt\system32\fxsres.dll
+ 2008-04-14 00:09:33 6,656 —-a-w c:\winnt\system32\fxsres.dll
- 2004-08-04 07:56:42 562,176 —-a-w c:\winnt\system32\fxsst.dll
+ 2008-04-14 00:11:54 562,176 —-a-w c:\winnt\system32\fxsst.dll
- 2004-08-04 07:56:49 267,776 —-a-w c:\winnt\system32\fxssvc.exe
+ 2008-04-14 00:12:21 267,776 —-a-w c:\winnt\system32\fxssvc.exe
- 2004-08-04 07:56:42 246,272 —-a-w c:\winnt\system32\fxst30.dll
+ 2008-04-14 00:11:54 246,272 —-a-w c:\winnt\system32\fxst30.dll
- 2004-08-04 07:56:42 397,312 —-a-w c:\winnt\system32\fxstiff.dll
+ 2008-04-14 00:11:54 397,312 —-a-w c:\winnt\system32\fxstiff.dll
- 2004-08-04 07:56:42 154,112 —-a-w c:\winnt\system32\fxsui.dll
+ 2008-04-14 00:11:54 154,112 —-a-w c:\winnt\system32\fxsui.dll
- 2004-08-04 07:56:42 192,512 —-a-w c:\winnt\system32\fxswzrd.dll
+ 2008-04-14 00:11:54 192,512 —-a-w c:\winnt\system32\fxswzrd.dll
- 2004-08-04 07:56:42 400,384 —-a-w c:\winnt\system32\fxsxp32.dll
+ 2008-04-14 00:11:54 400,384 —-a-w c:\winnt\system32\fxsxp32.dll
- 2008-10-23 13:01:36 283,648 —-a-w c:\winnt\system32\gdi32.dll
+ 2008-10-23 12:36:14 286,720 —-a-w c:\winnt\system32\gdi32.dll
- 2001-08-23 08:00:00 55,296 —-a-w c:\winnt\system32\getmac.exe
+ 2008-04-14 00:12:21 59,904 —-a-w c:\winnt\system32\getmac.exe
- 2004-08-04 07:56:42 122,880 —-a-w c:\winnt\system32\glu32.dll
+ 2008-04-14 00:11:54 122,880 —-a-w c:\winnt\system32\glu32.dll
- 2004-08-04 07:56:07 566,784 —-a-w c:\winnt\system32\gpedit.dll
+ 2008-04-14 00:09:35 566,784 —-a-w c:\winnt\system32\gpedit.dll
- 2004-08-04 07:56:07 9,728 —-a-w c:\winnt\system32\gpkrsrc.dll
+ 2006-12-31 01:26:44 9,728 —-a-w c:\winnt\system32\gpkrsrc.dll
- 2004-08-04 07:56:49 119,808 —-a-w c:\winnt\system32\gpresult.exe
+ 2008-04-14 00:12:21 120,832 —-a-w c:\winnt\system32\gpresult.exe
- 2004-08-04 07:56:42 198,656 —-a-w c:\winnt\system32\gptext.dll
+ 2008-04-14 00:11:54 199,680 —-a-w c:\winnt\system32\gptext.dll
- 2004-08-04 07:56:49 39,424 —-a-w c:\winnt\system32\grpconv.exe
+ 2008-04-14 00:12:21 39,424 —-a-w c:\winnt\system32\grpconv.exe
- 2004-08-04 07:56:42 614,912 —-a-w c:\winnt\system32\h323msp.dll
+ 2008-04-14 00:11:54 614,912 —-a-w c:\winnt\system32\h323msp.dll
- 2004-08-04 05:59:09 131,968 —-a-w c:\winnt\system32\HAL.DLL
+ 2008-04-13 18:31:28 131,840 —-a-w c:\winnt\system32\HAL.DLL
- 2004-08-04 07:56:42 7,168 —-a-w c:\winnt\system32\hccoin.dll
+ 2008-04-14 00:11:54 7,168 —-a-w c:\winnt\system32\hccoin.dll
- 2001-08-23 08:00:00 14,848 —-a-w c:\winnt\system32\help.exe
+ 2008-04-14 00:12:21 15,872 —-a-w c:\winnt\system32\help.exe
- 2005-05-27 02:04:27 41,472 —-a-w c:\winnt\system32\hhsetup.dll
+ 2008-04-14 00:11:54 41,472 —-a-w c:\winnt\system32\hhsetup.dll
- 2004-08-04 07:56:42 20,992 —-a-w c:\winnt\system32\hid.dll
+ 2008-04-14 00:11:54 20,992 —-a-w c:\winnt\system32\hid.dll
- 2004-08-04 07:56:42 21,504 —-a-w c:\winnt\system32\hidserv.dll
+ 2008-04-14 00:11:54 21,504 —-a-w c:\winnt\system32\hidserv.dll
- 2006-07-21 08:24:43 72,704 —-a-w c:\winnt\system32\hlink.dll
+ 2008-04-14 00:11:54 72,704 —-a-w c:\winnt\system32\hlink.dll
- 2004-08-04 07:56:42 344,064 —-a-w c:\winnt\system32\hnetcfg.dll
+ 2008-04-14 00:11:54 344,064 —-a-w c:\winnt\system32\hnetcfg.dll
- 2004-08-04 07:56:42 330,752 —-a-w c:\winnt\system32\hnetwiz.dll
+ 2008-04-14 00:11:54 330,752 —-a-w c:\winnt\system32\hnetwiz.dll
- 2004-08-04 07:56:42 144,896 —-a-w c:\winnt\system32\hotplug.dll
+ 2008-04-14 00:11:54 144,896 —-a-w c:\winnt\system32\hotplug.dll
- 2004-08-04 07:56:42 32,285 ——w c:\winnt\system32\hsfcisp2.dll
+ 2008-04-14 00:11:54 32,285 ——w c:\winnt\system32\hsfcisp2.dll
- 2004-08-04 07:56:42 24,576 ——w c:\winnt\system32\httpapi.dll
+ 2008-04-14 00:11:54 24,576 ——w c:\winnt\system32\httpapi.dll
- 2004-08-04 07:56:42 41,984 —-a-w c:\winnt\system32\htui.dll
+ 2008-04-14 00:11:54 41,984 —-a-w c:\winnt\system32\htui.dll
- 2004-11-17 17:41:24 347,136 —-a-w c:\winnt\system32\hypertrm.dll
+ 2008-04-14 00:11:54 347,136 —-a-w c:\winnt\system32\hypertrm.dll
- 2004-08-04 07:56:42 119,808 —-a-w c:\winnt\system32\iasrad.dll
+ 2008-04-14 00:11:54 119,808 —-a-w c:\winnt\system32\iasrad.dll
- 2004-08-04 07:56:42 11,264 —-a-w c:\winnt\system32\icaapi.dll
+ 2008-04-14 00:11:54 11,264 —-a-w c:\winnt\system32\icaapi.dll
+ 2008-07-30 00:24:50 622,080 —-a-w c:\winnt\system32\icardagt.exe
+ 2008-07-30 00:24:50 11,264 —-a-w c:\winnt\system32\icardres.dll
- 2004-08-04 07:56:42 80,384 —-a-w c:\winnt\system32\iccvid.dll
+ 2008-04-14 00:11:54 80,384 —-a-w c:\winnt\system32\iccvid.dll
- 2005-06-29 01:46:00 254,976 —-a-w c:\winnt\system32\icm32.dll
+ 2008-04-14 00:11:54 254,976 —-a-w c:\winnt\system32\icm32.dll
- 2004-08-04 07:56:07 3,584 —-a-w c:\winnt\system32\icmp.dll
+ 2008-04-14 00:09:40 3,584 —-a-w c:\winnt\system32\icmp.dll
- 2004-08-04 07:56:42 73,728 —-a-w c:\winnt\system32\icwdial.dll
+ 2008-04-14 00:11:54 73,728 —-a-w c:\winnt\system32\icwdial.dll
- 2004-08-04 07:56:42 65,536 —-a-w c:\winnt\system32\icwphbk.dll
+ 2008-04-14 00:11:54 65,536 —-a-w c:\winnt\system32\icwphbk.dll
- 2004-08-04 07:56:42 120,832 —-a-w c:\winnt\system32\idq.dll
+ 2008-04-14 00:11:54 120,832 —-a-w c:\winnt\system32\idq.dll
- 2004-08-04 07:56:50 34,304 —-a-w c:\winnt\system32\ie4uinit.exe
+ 2008-04-14 00:12:22 34,304 —-a-w c:\winnt\system32\ie4uinit.exe
- 2004-08-04 07:56:42 139,264 —-a-w c:\winnt\system32\ieakeng.dll
+ 2008-04-14 00:11:54 143,360 —-a-w c:\winnt\system32\ieakeng.dll
- 2004-08-04 07:56:42 216,576 —-a-w c:\winnt\system32\ieaksie.dll
+ 2008-04-14 00:11:54 216,576 —-a-w c:\winnt\system32\ieaksie.dll
- 2004-08-04 07:56:42 323,584 —-a-w c:\winnt\system32\iedkcs32.dll
+ 2008-04-14 00:11:54 323,584 —-a-w c:\winnt\system32\iedkcs32.dll
- 2004-08-04 07:56:42 81,920 ——w c:\winnt\system32\ieencode.dll
+ 2008-04-14 00:11:54 81,920 ——w c:\winnt\system32\ieencode.dll
- 2008-10-16 10:37:02 251,392 —-a-w c:\winnt\system32\iepeers.dll
+ 2008-04-14 00:11:54 251,904 —-a-w c:\winnt\system32\iepeers.dll
- 2004-08-04 07:56:42 48,640 —-a-w c:\winnt\system32\iernonce.dll
+ 2008-04-14 00:11:54 48,640 —-a-w c:\winnt\system32\iernonce.dll
- 2004-08-04 07:56:42 62,976 —-a-w c:\winnt\system32\iesetup.dll
+ 2008-04-14 00:11:54 62,976 —-a-w c:\winnt\system32\iesetup.dll
- 2004-08-04 07:56:50 114,688 —-a-w c:\winnt\system32\iexpress.exe
+ 2008-04-14 00:12:22 114,688 —-a-w c:\winnt\system32\iexpress.exe
- 2004-08-04 07:56:42 135,680 —-a-w c:\winnt\system32\ifmon.dll
+ 2008-04-14 00:11:54 135,680 —-a-w c:\winnt\system32\ifmon.dll
- 2004-08-04 07:56:42 8,192 —-a-w c:\winnt\system32\igmpagnt.dll
+ 2008-04-14 00:11:54 8,192 —-a-w c:\winnt\system32\igmpagnt.dll
- 2004-08-04 07:56:42 81,920 —-a-w c:\winnt\system32\ils.dll
+ 2008-04-14 00:11:54 81,920 —-a-w c:\winnt\system32\ils.dll
- 2004-08-04 07:56:42 144,384 —-a-w c:\winnt\system32\imagehlp.dll
+ 2008-04-14 00:11:54 144,384 —-a-w c:\winnt\system32\imagehlp.dll
- 2004-08-04 07:56:50 150,016 —-a-w c:\winnt\system32\imapi.exe
+ 2008-04-14 00:12:22 150,528 —-a-w c:\winnt\system32\imapi.exe
- 2004-08-04 07:56:42 36,921 —-a-w c:\winnt\system32\imeshare.dll
+ 2008-04-14 00:11:54 36,921 —-a-w c:\winnt\system32\imeshare.dll
- 2004-08-04 07:56:42 35,840 —-a-w c:\winnt\system32\imgutil.dll
+ 2008-04-14 00:11:54 35,840 —-a-w c:\winnt\system32\imgutil.dll
- 2004-08-04 07:56:42 110,080 —-a-w c:\winnt\system32\imm32.dll
+ 2008-04-14 00:11:54 110,080 —-a-w c:\winnt\system32\imm32.dll
- 2004-08-04 07:56:42 274,432 —-a-w c:\winnt\system32\inetcfg.dll
+ 2008-04-14 00:11:54 274,432 —-a-w c:\winnt\system32\inetcfg.dll
- 2008-04-11 18:50:43 683,520 —-a-w c:\winnt\system32\inetcomm.dll
+ 2008-04-11 19:04:26 691,712 —-a-w c:\winnt\system32\inetcomm.dll
- 2004-08-04 07:56:42 33,280 —-a-w c:\winnt\system32\inetmib1.dll
+ 2008-04-14 00:11:55 32,768 —-a-w c:\winnt\system32\inetmib1.dll
- 2004-08-04 07:56:42 75,264 —-a-w c:\winnt\system32\inetpp.dll
+ 2008-04-14 00:11:55 75,264 —-a-w c:\winnt\system32\inetpp.dll
- 2004-08-04 07:56:42 15,872 —-a-w c:\winnt\system32\inetppui.dll
+ 2008-04-14 00:11:55 15,872 —-a-w c:\winnt\system32\inetppui.dll
- 2004-08-04 07:56:08 48,128 —-a-w c:\winnt\system32\inetres.dll
+ 2008-04-13 16:22:12 48,128 —-a-w c:\winnt\system32\inetres.dll
- 2004-08-04 07:56:44 221,696 ——w c:\winnt\system32\inetsrv\seo.dll
+ 2008-04-14 00:12:05 221,696 ——w c:\winnt\system32\inetsrv\seo.dll
- 2004-08-04 07:56:45 189,440 ——w c:\winnt\system32\inetsrv\smtpadm.dll
+ 2008-04-14 00:12:06 189,440 ——w c:\winnt\system32\inetsrv\smtpadm.dll
- 2004-08-04 07:56:45 2,134,528 ——w c:\winnt\system32\inetsrv\smtpsnap.dll
+ 2008-04-14 00:12:06 2,134,528 ——w c:\winnt\system32\inetsrv\smtpsnap.dll
+ 2008-07-30 00:24:50 97,800 —-a-w c:\winnt\system32\infocardapi.dll
- 2004-08-04 07:56:42 147,456 —-a-w c:\winnt\system32\initpki.dll
+ 2008-04-14 00:11:55 147,456 —-a-w c:\winnt\system32\initpki.dll
- 2004-08-04 07:56:42 123,392 —-a-w c:\winnt\system32\input.dll
+ 2008-04-14 00:11:55 123,392 —-a-w c:\winnt\system32\input.dll
- 2008-10-16 10:37:02 96,256 —-a-w c:\winnt\system32\inseng.dll
+ 2008-04-14 00:11:55 96,256 —-a-w c:\winnt\system32\inseng.dll
- 2004-08-04 07:56:50 55,808 —-a-w c:\winnt\system32\ipconfig.exe
+ 2008-04-14 00:12:22 55,808 —-a-w c:\winnt\system32\ipconfig.exe
- 2006-05-19 12:59:41 94,720 —-a-w c:\winnt\system32\iphlpapi.dll
+ 2008-04-14 00:11:55 94,720 —-a-w c:\winnt\system32\iphlpapi.dll
- 2001-08-23 08:00:00 154,112 —-a-w c:\winnt\system32\ipmontr.dll
+ 2008-04-14 00:11:55 161,280 —-a-w c:\winnt\system32\ipmontr.dll
- 2004-08-04 07:56:42 331,264 —-a-w c:\winnt\system32\ipnathlp.dll
+ 2008-04-14 00:11:55 331,264 —-a-w c:\winnt\system32\ipnathlp.dll
- 2004-08-04 07:56:42 330,752 —-a-w c:\winnt\system32\ippromon.dll
+ 2008-04-14 00:11:55 330,752 —-a-w c:\winnt\system32\ippromon.dll
- 2001-08-23 08:00:00 169,984 —-a-w c:\winnt\system32\iprtrmgr.dll
+ 2008-04-14 00:11:55 177,152 —-a-w c:\winnt\system32\iprtrmgr.dll
- 2004-08-04 07:56:42 349,696 —-a-w c:\winnt\system32\ipsecsnp.dll
+ 2008-04-14 00:11:55 349,696 —-a-w c:\winnt\system32\ipsecsnp.dll
- 2004-08-04 07:56:42 182,784 —-a-w c:\winnt\system32\ipsecsvc.dll
+ 2008-04-14 00:11:55 183,808 —-a-w c:\winnt\system32\ipsecsvc.dll
- 2004-08-04 07:56:42 384,000 —-a-w c:\winnt\system32\ipsmsnap.dll
+ 2008-04-14 00:11:55 384,000 —-a-w c:\winnt\system32\ipsmsnap.dll
- 2004-08-04 07:56:50 53,248 —-a-w c:\winnt\system32\ipv6.exe
+ 2008-04-14 00:12:23 53,248 —-a-w c:\winnt\system32\ipv6.exe
- 2004-08-04 07:56:42 59,904 —-a-w c:\winnt\system32\ipv6mon.dll
+ 2008-04-14 00:11:55 59,904 —-a-w c:\winnt\system32\ipv6mon.dll
- 2004-08-04 07:56:50 23,552 —-a-w c:\winnt\system32\ipxroute.exe
+ 2008-04-14 00:12:23 23,552 —-a-w c:\winnt\system32\ipxroute.exe
- 2001-08-23 08:00:00 20,992 —-a-w c:\winnt\system32\ipxwan.dll
+ 2008-04-14 00:11:55 22,016 —-a-w c:\winnt\system32\ipxwan.dll
- 2004-08-04 07:56:42 120,320 —-a-w c:\winnt\system32\ir41_qc.dll
+ 2008-04-14 00:11:55 120,320 —-a-w c:\winnt\system32\ir41_qc.dll
- 2004-08-04 07:56:42 338,432 —-a-w c:\winnt\system32\ir41_qcx.dll
+ 2008-04-14 00:11:55 338,432 —-a-w c:\winnt\system32\ir41_qcx.dll
- 2004-08-04 07:56:42 755,200 ——w c:\winnt\system32\ir50_32.dll
+ 2008-04-14 00:11:55 755,200 ——w c:\winnt\system32\ir50_32.dll
- 2004-08-04 07:56:42 200,192 —-a-w c:\winnt\system32\ir50_qc.dll
+ 2008-04-14 00:11:55 200,192 —-a-w c:\winnt\system32\ir50_qc.dll
- 2004-08-04 07:56:42 183,808 —-a-w c:\winnt\system32\ir50_qcx.dll
+ 2008-04-14 00:11:55 183,808 —-a-w c:\winnt\system32\ir50_qcx.dll
- 2004-08-04 06:56:50 152,576 —-a-w c:\winnt\system32\irftp.exe
+ 2008-04-14 00:12:23 151,552 —-a-w c:\winnt\system32\irftp.exe
- 2004-08-04 06:56:42 27,136 —-a-w c:\winnt\system32\irmon.dll
+ 2008-04-14 00:11:55 28,160 —-a-w c:\winnt\system32\irmon.dll
- 2004-08-04 07:56:42 81,920 —-a-w c:\winnt\system32\isign32.dll
+ 2008-04-14 00:11:55 81,920 —-a-w c:\winnt\system32\isign32.dll
- 2004-08-04 07:56:42 32,768 —-a-w c:\winnt\system32\isrdbg32.dll
+ 2008-04-14 00:11:55 32,768 —-a-w c:\winnt\system32\isrdbg32.dll
- 2005-05-27 02:04:27 155,136 —-a-w c:\winnt\system32\itircl.dll
+ 2008-04-14 00:11:55 155,136 —-a-w c:\winnt\system32\itircl.dll
- 2005-05-27 02:04:27 137,216 —-a-w c:\winnt\system32\itss.dll
+ 2008-04-14 00:11:55 138,240 —-a-w c:\winnt\system32\itss.dll
- 2004-08-04 07:56:42 54,272 —-a-w c:\winnt\system32\ixsso.dll
+ 2008-04-14 00:11:55 54,272 —-a-w c:\winnt\system32\ixsso.dll
- 2004-08-04 07:56:42 47,616 —-a-w c:\winnt\system32\iyuv_32.dll
+ 2008-04-14 00:11:55 47,616 —-a-w c:\winnt\system32\iyuv_32.dll
- 2006-06-01 18:47:07 163,840 —-a-w c:\winnt\system32\jgdw400.dll
+ 2008-04-14 00:11:55 163,840 —-a-w c:\winnt\system32\jgdw400.dll
- 2006-06-01 18:47:07 27,648 —-a-w c:\winnt\system32\jgpl400.dll
+ 2008-04-14 00:11:55 27,648 —-a-w c:\winnt\system32\jgpl400.dll
- 2007-12-18 14:40:58 450,560 —-a-w c:\winnt\system32\jscript.dll
+ 2008-05-09 10:53:39 512,000 —-a-w c:\winnt\system32\jscript.dll
- 2008-10-16 10:37:03 16,384 —-a-w c:\winnt\system32\jsproxy.dll
+ 2008-04-14 00:11:56 15,872 —-a-w c:\winnt\system32\jsproxy.dll
+ 2008-04-14 00:09:55 6,144 ——w c:\winnt\system32\kbdbhc.dll
- 2004-08-04 07:56:10 7,168 ——w c:\winnt\system32\kbdfi1.dll
+ 2008-04-14 00:09:55 7,168 ——w c:\winnt\system32\kbdfi1.dll
- 2004-08-04 07:56:10 6,144 ——w c:\winnt\system32\kbdinbe1.dll
+ 2008-04-14 00:09:55 6,144 ——w c:\winnt\system32\kbdinbe1.dll
- 2004-08-04 07:56:10 6,656 ——w c:\winnt\system32\kbdinben.dll
+ 2008-04-14 00:09:55 6,144 ——w c:\winnt\system32\kbdinben.dll
- 2004-08-04 07:56:10 6,656 ——w c:\winnt\system32\kbdinmal.dll
+ 2008-04-14 00:09:55 6,656 ——w c:\winnt\system32\kbdinmal.dll
+ 2008-04-14 00:09:55 6,144 ——w c:\winnt\system32\kbdiultn.dll
- 2004-08-04 07:56:10 5,632 ——w c:\winnt\system32\kbdmaori.dll
+ 2008-04-14 00:09:55 5,632 ——w c:\winnt\system32\kbdmaori.dll
- 2004-08-04 07:56:10 6,144 ——w c:\winnt\system32\kbdmlt47.dll
+ 2008-04-14 00:09:55 6,144 ——w c:\winnt\system32\kbdmlt47.dll
- 2004-08-04 07:56:10 6,144 ——w c:\winnt\system32\kbdmlt48.dll
+ 2008-04-14 00:09:55 6,144 ——w c:\winnt\system32\kbdmlt48.dll
- 2001-08-23 08:00:00 7,168 —-a-w c:\winnt\system32\kbdnec.dll
+ 2008-04-14 00:09:55 7,168 —-a-w c:\winnt\system32\kbdnec.dll
+ 2008-04-14 00:09:55 6,144 ——w c:\winnt\system32\kbdnepr.dll
- 2004-08-04 07:56:10 7,168 ——w c:\winnt\system32\kbdno1.dll
+ 2008-04-14 00:09:55 7,168 ——w c:\winnt\system32\kbdno1.dll
+ 2008-04-14 00:09:55 6,144 ——w c:\winnt\system32\kbdpash.dll
- 2004-08-04 07:56:10 7,680 ——w c:\winnt\system32\kbdsmsfi.dll
+ 2008-04-14 00:09:55 7,680 ——w c:\winnt\system32\kbdsmsfi.dll
- 2004-08-04 07:56:10 7,680 ——w c:\winnt\system32\kbdsmsno.dll
+ 2008-04-14 00:09:55 7,680 ——w c:\winnt\system32\kbdsmsno.dll
- 2004-08-04 07:56:10 7,168 ——w c:\winnt\system32\kbdukx.dll
+ 2008-04-14 00:09:55 7,168 ——w c:\winnt\system32\kbdukx.dll
- 2004-08-04 05:59:23 7,424 —-a-w c:\winnt\system32\kd1394.dll
+ 2008-04-13 18:31:35 7,424 —-a-w c:\winnt\system32\kd1394.dll
- 2005-06-15 17:49:30 295,936 —-a-w c:\winnt\system32\kerberos.dll
+ 2008-04-14 00:11:56 299,520 —-a-w c:\winnt\system32\kerberos.dll
- 2007-04-16 15:52:53 984,576 —-a-w c:\winnt\system32\kernel32.dll
+ 2008-04-14 00:11:56 989,696 —-a-w c:\winnt\system32\kernel32.dll
- 2004-08-04 07:56:42 150,528 —-a-w c:\winnt\system32\keymgr.dll
+ 2008-04-14 00:11:56 150,528 —-a-w c:\winnt\system32\keymgr.dll
+ 2008-04-14 00:11:56 61,440 ——w c:\winnt\system32\kmsvc.dll
- 2004-08-04 06:56:42 4,096 —-a-w c:\winnt\system32\ksuser.dll
+ 2008-04-14 00:11:56 4,096 —-a-w c:\winnt\system32\ksuser.dll
+ 2008-04-14 00:11:56 37,376 ——w c:\winnt\system32\l2gpstore.dll
- 2006-12-12 14:45:04 1,474,864 —-a-w c:\winnt\system32\LegitCheckControl.DLL
+ 2008-09-06 04:30:06 1,480,232 —-a-w c:\winnt\system32\LegitCheckControl.dll
- 2004-08-04 05:56:44 423,936 —-a-w c:\winnt\system32\licdll.dll
+ 2008-04-14 10:41:58 423,936 —-a-w c:\winnt\system32\licdll.dll
- 2004-08-04 07:56:42 22,016 —-a-w c:\winnt\system32\licmgr10.dll
+ 2008-04-14 00:11:56 22,016 —-a-w c:\winnt\system32\licmgr10.dll
- 2004-08-04 07:56:42 58,880 —-a-w c:\winnt\system32\licwmi.dll
+ 2008-04-14 00:11:56 58,880 —-a-w c:\winnt\system32\licwmi.dll
- 2005-09-01 01:41:53 19,968 —-a-w c:\winnt\system32\linkinfo.dll
+ 2008-04-14 00:11:56 19,968 —-a-w c:\winnt\system32\linkinfo.dll
- 2004-08-04 07:56:42 13,824 —-a-w c:\winnt\system32\lmhsvc.dll
+ 2008-04-14 00:11:56 13,824 —-a-w c:\winnt\system32\lmhsvc.dll
- 2004-08-04 07:56:42 399,872 —-a-w c:\winnt\system32\lmrt.dll
+ 2008-04-14 00:11:56 399,872 —-a-w c:\winnt\system32\lmrt.dll
- 2004-08-04 07:56:42 97,280 —-a-w c:\winnt\system32\loadperf.dll
+ 2008-04-14 00:11:56 97,280 —-a-w c:\winnt\system32\loadperf.dll
- 2004-08-04 07:56:42 221,696 —-a-w c:\winnt\system32\localsec.dll
+ 2008-04-14 00:11:56 221,696 —-a-w c:\winnt\system32\localsec.dll
- 2004-08-04 07:56:42 341,504 —-a-w c:\winnt\system32\localspl.dll
+ 2008-04-14 00:11:56 343,040 —-a-w c:\winnt\system32\localspl.dll
- 2004-08-04 07:56:42 11,776 —-a-w c:\winnt\system32\localui.dll
+ 2008-04-14 00:11:56 11,776 —-a-w c:\winnt\system32\localui.dll
- 2004-08-04 07:56:50 75,264 —-a-w c:\winnt\system32\locator.exe
+ 2008-04-14 00:12:24 75,264 —-a-w c:\winnt\system32\locator.exe
- 2004-08-04 07:56:50 59,392 —-a-w c:\winnt\system32\logman.exe
+ 2008-04-14 00:12:24 59,392 —-a-w c:\winnt\system32\logman.exe
- 2004-08-04 07:56:57 220,672 —-a-w c:\winnt\system32\logon.scr
+ 2008-04-14 00:12:43 220,672 —-a-w c:\winnt\system32\logon.scr
- 2004-08-04 07:56:50 514,560 —-a-w c:\winnt\system32\logonui.exe
+ 2008-04-14 00:12:24 514,560 —-a-w c:\winnt\system32\logonui.exe
- 2004-08-04 07:56:42 22,016 —-a-w c:\winnt\system32\lpk.dll
+ 2008-04-14 00:11:56 22,016 —-a-w c:\winnt\system32\lpk.dll
- 2004-08-04 07:56:42 10,240 —-a-w c:\winnt\system32\lprhelp.dll
+ 2008-04-14 00:11:56 10,240 —-a-w c:\winnt\system32\lprhelp.dll
- 2007-11-07 09:26:56 721,920 —-a-w c:\winnt\system32\lsasrv.dll
+ 2008-04-14 00:11:56 728,064 —-a-w c:\winnt\system32\lsasrv.dll
- 2004-08-04 07:56:50 13,312 —-a-w c:\winnt\system32\lsass.exe
+ 2008-04-14 00:12:24 13,312 —-a-w c:\winnt\system32\lsass.exe
- 2004-08-04 07:56:50 72,704 —-a-w c:\winnt\system32\magnify.exe
+ 2008-04-14 00:12:24 72,704 —-a-w c:\winnt\system32\magnify.exe
- 2004-08-04 07:56:50 85,504 —-a-w c:\winnt\system32\makecab.exe
+ 2008-04-14 00:12:25 57,344 —-a-w c:\winnt\system32\makecab.exe
- 2004-08-04 07:56:42 14,848 —-a-w c:\winnt\system32\mcastmib.dll
+ 2008-04-14 00:11:56 14,336 —-a-w c:\winnt\system32\mcastmib.dll
- 2004-08-04 07:56:42 84,480 —-a-w c:\winnt\system32\mciavi32.dll
+ 2008-04-14 00:11:56 84,480 —-a-w c:\winnt\system32\mciavi32.dll
- 2004-08-04 07:56:42 35,328 —-a-w c:\winnt\system32\mciqtz32.dll
+ 2008-04-14 00:11:56 35,328 —-a-w c:\winnt\system32\mciqtz32.dll
- 2004-08-04 07:56:42 23,040 —-a-w c:\winnt\system32\mciseq.dll
+ 2008-04-14 00:11:56 23,040 —-a-w c:\winnt\system32\mciseq.dll
- 2004-08-04 07:56:42 23,552 —-a-w c:\winnt\system32\mciwave.dll
+ 2008-04-14 00:11:56 23,552 —-a-w c:\winnt\system32\mciwave.dll
- 2004-03-22 20:17:06 24,816 —-a-w c:\winnt\system32\mdimon.dll
+ 2007-04-09 18:23:54 28,040 —-a-w c:\winnt\system32\mdimon.dll
- 2004-08-04 07:56:42 118,272 —-a-w c:\winnt\system32\mdminst.dll
+ 2008-04-14 00:11:56 118,272 —-a-w c:\winnt\system32\mdminst.dll
- 2007-03-08 15:36:28 40,960 —-a-w c:\winnt\system32\mf3216.dll
+ 2008-04-14 00:11:56 40,960 —-a-w c:\winnt\system32\mf3216.dll
- 2006-11-01 19:17:45 927,504 —-a-w c:\winnt\system32\mfc40u.dll
+ 2008-04-14 00:11:56 927,504 —-a-w c:\winnt\system32\mfc40u.dll
- 2004-08-04 07:56:42 1,028,096 ——w c:\winnt\system32\mfc42.dll
+ 2008-04-14 00:11:56 1,028,096 —-a-w c:\winnt\system32\mfc42.dll
- 2004-08-04 07:56:42 22,528 —-a-w c:\winnt\system32\mfcsubs.dll
+ 2008-04-14 00:11:56 22,528 —-a-w c:\winnt\system32\mfcsubs.dll
- 2004-08-04 07:56:42 14,848 —-a-w c:\winnt\system32\mgmtapi.dll
+ 2008-04-14 00:11:56 14,848 —-a-w c:\winnt\system32\mgmtapi.dll
+ 2008-04-14 00:11:57 184,320 ——w c:\winnt\system32\microsoft.managementconsole.dll
- 2004-08-04 07:56:42 18,944 —-a-w c:\winnt\system32\midimap.dll
+ 2008-04-14 00:11:57 18,944 —-a-w c:\winnt\system32\midimap.dll
- 2004-08-04 07:56:42 60,928 —-a-w c:\winnt\system32\miglibnt.dll
+ 2008-04-14 00:11:57 60,928 —-a-w c:\winnt\system32\miglibnt.dll
- 2001-08-23 08:00:00 18,944 —-a-w c:\winnt\system32\mimefilt.dll
+ 2008-04-14 00:11:57 29,696 —-a-w c:\winnt\system32\mimefilt.dll
- 2004-08-04 07:56:42 586,240 —-a-w c:\winnt\system32\mlang.dll
+ 2008-04-14 00:11:57 586,240 —-a-w c:\winnt\system32\mlang.dll
- 2004-08-04 07:56:51 815,104 —-a-w c:\winnt\system32\mmc.exe
+ 2008-04-14 00:12:25 1,414,656 —-a-w c:\winnt\system32\mmc.exe
- 2004-08-04 07:56:42 70,656 —-a-w c:\winnt\system32\mmcbase.dll
+ 2008-04-14 00:11:57 163,328 —-a-w c:\winnt\system32\mmcbase.dll
+ 2008-04-14 00:11:57 397,312 ——w c:\winnt\system32\mmcex.dll
+ 2008-04-14 00:11:57 106,496 ——w c:\winnt\system32\mmcfxcommon.dll
- 2004-08-04 07:56:42 1,192,960 —-a-w c:\winnt\system32\mmcndmgr.dll
+ 2008-04-14 00:11:57 1,872,896 —-a-w c:\winnt\system32\mmcndmgr.dll
+ 2008-04-14 00:12:25 33,792 ——w c:\winnt\system32\mmcperf.exe
- 2004-08-04 07:56:42 50,688 —-a-w c:\winnt\system32\mmcshext.dll
+ 2008-04-14 00:11:57 61,440 —-a-w c:\winnt\system32\mmcshext.dll
- 2004-08-04 07:56:42 17,408 —-a-w c:\winnt\system32\mmfutil.dll
+ 2008-04-14 00:11:57 17,408 —-a-w c:\winnt\system32\mmfutil.dll
- 2004-08-04 07:56:42 34,560 —-a-w c:\winnt\system32\mnmdd.dll
+ 2008-04-14 00:11:57 34,560 —-a-w c:\winnt\system32\mnmdd.dll
- 2004-08-04 07:56:51 32,768 —-a-w c:\winnt\system32\mnmsrvc.exe
+ 2008-04-14 00:12:25 32,768 —-a-w c:\winnt\system32\mnmsrvc.exe
- 2004-08-04 07:56:42 207,360 —-a-w c:\winnt\system32\mobsync.dll
+ 2008-04-14 00:11:57 207,360 —-a-w c:\winnt\system32\mobsync.dll
- 2004-08-04 07:56:51 143,360 —-a-w c:\winnt\system32\mobsync.exe
+ 2008-04-14 00:12:26 143,360 —-a-w c:\winnt\system32\mobsync.exe
- 2004-08-04 07:56:42 153,600 —-a-w c:\winnt\system32\modemui.dll
+ 2008-04-14 00:11:57 153,600 —-a-w c:\winnt\system32\modemui.dll
- 2001-08-23 08:00:00 15,872 —-a-w c:\winnt\system32\more.com
+ 2008-04-14 00:12:42 16,896 —-a-w c:\winnt\system32\more.com
- 2004-08-04 07:56:11 216,064 —-a-w c:\winnt\system32\moricons.dll
+ 2008-04-13 16:45:30 216,064 —-a-w c:\winnt\system32\moricons.dll
- 2004-08-04 07:56:52 123,392 —-a-w c:\winnt\system32\mplay32.exe
+ 2008-04-14 00:12:27 123,392 —-a-w c:\winnt\system32\mplay32.exe
- 2004-08-04 07:56:42 59,904 —-a-w c:\winnt\system32\mpr.dll
+ 2008-04-14 00:11:57 59,904 —-a-w c:\winnt\system32\mpr.dll
- 2004-08-04 07:56:42 87,040 —-a-w c:\winnt\system32\mprapi.dll
+ 2008-04-14 00:11:57 87,040 —-a-w c:\winnt\system32\mprapi.dll
- 2001-08-23 08:00:00 49,152 —-a-w c:\winnt\system32\mprdim.dll
+ 2008-04-14 00:11:57 53,248 —-a-w c:\winnt\system32\mprdim.dll
- 2007-07-06 12:46:59 138,240 —-a-w c:\winnt\system32\mqad.dll
+ 2008-04-14 00:11:57 138,240 —-a-w c:\winnt\system32\mqad.dll
- 2004-08-04 07:56:53 19,968 —-a-w c:\winnt\system32\mqbkup.exe
+ 2008-04-14 00:12:27 19,968 —-a-w c:\winnt\system32\mqbkup.exe
- 2007-07-06 12:46:59 47,104 —-a-w c:\winnt\system32\mqdscli.dll
+ 2008-04-14 00:11:57 47,616 —-a-w c:\winnt\system32\mqdscli.dll
- 2007-07-06 12:46:59 16,896 —-a-w c:\winnt\system32\mqise.dll
+ 2008-04-14 00:11:57 16,896 —-a-w c:\winnt\system32\mqise.dll
- 2004-08-04 07:56:42 89,088 —-a-w c:\winnt\system32\mqlogmgr.dll
+ 2008-04-14 00:11:57 89,088 —-a-w c:\winnt\system32\mqlogmgr.dll
- 2004-08-04 07:56:42 225,280 —-a-w c:\winnt\system32\mqoa.dll
+ 2008-04-14 00:11:57 225,280 —-a-w c:\winnt\system32\mqoa.dll
- 2007-07-06 12:46:59 660,992 —-a-w c:\winnt\system32\mqqm.dll
+ 2008-04-14 00:11:57 663,040 —-a-w c:\winnt\system32\mqqm.dll
- 2007-07-06 12:46:59 177,152 —-a-w c:\winnt\system32\mqrt.dll
+ 2008-04-14 00:11:57 177,152 —-a-w c:\winnt\system32\mqrt.dll
- 2004-08-04 07:56:42 123,392 —-a-w c:\winnt\system32\mqrtdep.dll
+ 2008-04-14 00:11:57 123,904 —-a-w c:\winnt\system32\mqrtdep.dll
- 2007-07-06 12:46:59 95,744 —-a-w c:\winnt\system32\mqsec.dll
+ 2008-04-14 00:11:57 95,744 —-a-w c:\winnt\system32\mqsec.dll
- 2004-08-04 07:56:42 517,632 —-a-w c:\winnt\system32\mqsnap.dll
+ 2008-04-14 00:11:58 517,632 —-a-w c:\winnt\system32\mqsnap.dll
- 2004-08-04 07:56:53 4,608 —-a-w c:\winnt\system32\mqsvc.exe
+ 2008-04-14 00:12:27 4,608 —-a-w c:\winnt\system32\mqsvc.exe
- 2004-08-04 07:56:53 117,248 —-a-w c:\winnt\system32\mqtgsvc.exe
+ 2008-04-14 00:12:27 117,248 —-a-w c:\winnt\system32\mqtgsvc.exe
- 2004-08-04 07:56:42 186,880 —-a-w c:\winnt\system32\mqtrig.dll
+ 2008-04-14 00:11:58 187,392 —-a-w c:\winnt\system32\mqtrig.dll
- 2007-07-06 12:46:59 48,640 —-a-w c:\winnt\system32\mqupgrd.dll
+ 2008-04-14 00:11:58 49,152 —-a-w c:\winnt\system32\mqupgrd.dll
- 2007-07-06 12:46:59 471,552 —-a-w c:\winnt\system32\mqutil.dll
+ 2008-04-14 00:11:58 471,552 —-a-w c:\winnt\system32\mqutil.dll
+ 2009-02-12 01:56:18 21,244,872 —-a-w c:\winnt\system32\MRT.exe
- 2004-08-04 07:56:42 71,680 —-a-w c:\winnt\system32\msacm32.dll
+ 2008-04-14 00:11:58 71,680 —-a-w c:\winnt\system32\msacm32.dll
- 2004-08-04 07:56:12 3,584 —-a-w c:\winnt\system32\msafd.dll
+ 2008-04-14 00:10:06 3,584 —-a-w c:\winnt\system32\msafd.dll
- 2004-08-04 07:56:42 86,016 —-a-w c:\winnt\system32\msapsspc.dll
+ 2008-04-14 00:11:58 86,016 —-a-w c:\winnt\system32\msapsspc.dll
- 2004-08-04 07:56:42 57,344 —-a-w c:\winnt\system32\msasn1.dll
+ 2008-04-14 00:11:58 57,344 —-a-w c:\winnt\system32\msasn1.dll
- 2008-06-24 16:23:05 74,240 —-a-w c:\winnt\system32\mscms.dll
+ 2008-06-24 16:43:16 74,240 —-a-w c:\winnt\system32\mscms.dll
- 2004-08-04 07:56:42 69,632 —-a-w c:\winnt\system32\msconf.dll
+ 2008-04-14 00:11:58 69,632 —-a-w c:\winnt\system32\msconf.dll
- 2006-12-22 16:28:14 271,360 —-a-w c:\winnt\system32\mscoree.dll
+ 2008-07-25 16:16:58 282,112 —-a-w c:\winnt\system32\mscoree.dll
- 2005-09-23 11:28:52 150,016 —-a-w c:\winnt\system32\mscorier.dll
+ 2008-07-25 16:16:58 158,720 —-a-w c:\winnt\system32\mscorier.dll
- 2005-09-23 11:28:52 74,240 —-a-w c:\winnt\system32\mscories.dll
+ 2008-07-25 16:16:58 83,968 —-a-w c:\winnt\system32\mscories.dll
- 2004-08-04 07:56:12 12,288 —-a-w c:\winnt\system32\mscpx32r.dll
+ 2008-04-13 17:26:07 12,288 —-a-w c:\winnt\system32\mscpx32r.dll
- 2004-08-04 07:56:42 36,864 —-a-w c:\winnt\system32\mscpxl32.dll
+ 2008-04-14 00:11:58 36,864 —-a-w c:\winnt\system32\mscpxl32.dll
- 2004-08-04 07:56:42 294,400 —-a-w c:\winnt\system32\msctf.dll
+ 2008-04-14 00:11:58 297,984 —-a-w c:\winnt\system32\msctf.dll
- 2004-08-04 07:56:42 69,120 —-a-w c:\winnt\system32\msctfp.dll
+ 2008-04-14 00:11:58 68,608 —-a-w c:\winnt\system32\msctfp.dll
- 2004-08-04 07:56:42 118,784 ——w c:\winnt\system32\msdadiag.dll
+ 2008-04-14 00:11:58 118,784 ——w c:\winnt\system32\msdadiag.dll
- 2004-08-04 07:56:43 151,552 —-a-w c:\winnt\system32\msdart.dll
+ 2008-04-14 00:11:59 151,552 —-a-w c:\winnt\system32\msdart.dll
- 2004-08-04 07:56:43 14,336 —-a-w c:\winnt\system32\msdmo.dll
+ 2008-04-14 00:11:59 14,336 —-a-w c:\winnt\system32\msdmo.dll
- 2004-08-04 07:56:53 6,144 —-a-w c:\winnt\system32\msdtc.exe
+ 2008-04-14 00:12:27 6,144 —-a-w c:\winnt\system32\msdtc.exe
- 2004-08-04 07:56:43 58,880 —-a-w c:\winnt\system32\msdtclog.dll
+ 2008-04-14 00:11:59 58,880 —-a-w c:\winnt\system32\msdtclog.dll
- 2006-03-01 19:42:42 426,496 —-a-w c:\winnt\system32\msdtcprx.dll
+ 2008-04-14 00:11:59 427,008 —-a-w c:\winnt\system32\msdtcprx.dll
- 2006-03-01 19:42:42 956,416 —-a-w c:\winnt\system32\msdtctm.dll
+ 2008-04-14 00:11:59 956,928 —-a-w c:\winnt\system32\msdtctm.dll
- 2006-03-01 19:42:42 161,280 —-a-w c:\winnt\system32\msdtcuiu.dll
+ 2008-04-14 00:11:59 161,792 —-a-w c:\winnt\system32\msdtcuiu.dll
- 2004-08-04 07:56:13 4,126 —-a-w c:\winnt\system32\msdxmlc.dll
+ 2008-04-14 00:10:08 4,126 —-a-w c:\winnt\system32\msdxmlc.dll
- 2006-11-27 14:54:06 539,136 —-a-w c:\winnt\system32\msftedit.dll
+ 2008-04-14 00:11:59 539,136 —-a-w c:\winnt\system32\msftedit.dll
- 2004-08-04 07:56:43 994,304 —-a-w c:\winnt\system32\msgina.dll
+ 2008-04-14 00:11:59 997,376 —-a-w c:\winnt\system32\msgina.dll
- 2004-08-04 07:56:43 33,792 —-a-w c:\winnt\system32\msgsvc.dll
+ 2008-04-14 00:11:59 33,792 —-a-w c:\winnt\system32\msgsvc.dll
- 2004-08-04 07:56:57 188,416 —-a-w c:\winnt\system32\msh261.drv
+ 2008-04-14 00:12:45 188,416 —-a-w c:\winnt\system32\msh261.drv
- 2004-08-04 06:56:58 294,912 —-a-w c:\winnt\system32\msh263.drv
+ 2008-04-14 00:12:45 294,912 —-a-w c:\winnt\system32\msh263.drv
- 2004-08-04 07:56:53 29,184 —-a-w c:\winnt\system32\mshta.exe
+ 2008-04-14 00:12:27 29,184 —-a-w c:\winnt\system32\mshta.exe
- 2008-12-12 17:33:23 3,060,224 —-a-w c:\winnt\system32\mshtml.dll
+ 2008-12-12 17:01:00 3,067,904 —-a-w c:\winnt\system32\mshtml.dll
- 2008-10-16 10:37:03 449,024 —-a-w c:\winnt\system32\mshtmled.dll
+ 2008-04-14 00:11:59 449,024 —-a-w c:\winnt\system32\mshtmled.dll
- 2004-08-04 07:56:14 56,832 —-a-w c:\winnt\system32\mshtmler.dll
+ 2008-04-13 16:26:26 56,832 —-a-w c:\winnt\system32\mshtmler.dll
- 2007-04-18 16:12:23 2,854,400 —-a-w c:\winnt\system32\msi.dll
+ 2008-04-14 00:11:59 2,843,136 —-a-w c:\winnt\system32\msi.dll
- 2004-08-04 07:56:43 51,712 —-a-w c:\winnt\system32\msident.dll
+ 2008-04-14 00:11:59 51,712 —-a-w c:\winnt\system32\msident.dll
- 2004-08-04 07:56:43 6,656 —-a-w c:\winnt\system32\msidle.dll
+ 2008-04-14 00:11:59 6,656 —-a-w c:\winnt\system32\msidle.dll
- 2004-08-04 07:56:43 248,832 —-a-w c:\winnt\system32\msieftp.dll
+ 2008-04-14 00:11:59 248,832 —-a-w c:\winnt\system32\msieftp.dll
- 2005-03-21 19:00:22 78,848 —-a-w c:\winnt\system32\msiexec.exe
+ 2008-04-14 00:12:28 78,848 —-a-w c:\winnt\system32\msiexec.exe
- 2005-03-21 19:00:22 271,360 —-a-w c:\winnt\system32\msihnd.dll
+ 2008-04-14 00:11:59 271,360 —-a-w c:\winnt\system32\msihnd.dll
- 2004-08-04 07:56:43 4,608 —-a-w c:\winnt\system32\msimg32.dll
+ 2008-04-14 00:11:59 4,608 —-a-w c:\winnt\system32\msimg32.dll
- 2005-03-21 19:00:22 884,736 —-a-w c:\winnt\system32\msimsg.dll
+ 2008-04-13 15:39:43 884,736 —-a-w c:\winnt\system32\msimsg.dll
- 2004-08-04 07:56:43 159,232 —-a-w c:\winnt\system32\msimtf.dll
+ 2008-04-14 00:11:59 159,232 —-a-w c:\winnt\system32\msimtf.dll
- 2005-03-21 19:00:22 15,360 —-a-w c:\winnt\system32\msisip.dll
+ 2008-04-14 00:11:59 15,360 —-a-w c:\winnt\system32\msisip.dll
- 2008-03-26 08:09:15 151,583 —-a-w c:\winnt\system32\msjint40.dll
+ 2008-04-14 00:12:00 151,583 —-a-w c:\winnt\system32\msjint40.dll
- 2004-08-04 07:56:43 25,088 —-a-w c:\winnt\system32\mslbui.dll
+ 2008-04-14 00:12:00 25,088 —-a-w c:\winnt\system32\mslbui.dll
- 2004-08-04 07:56:43 290,816 —-a-w c:\winnt\system32\msnsspc.dll
+ 2008-04-14 00:12:00 290,816 —-a-w c:\winnt\system32\msnsspc.dll
- 2004-08-04 07:56:43 252,928 —-a-w c:\winnt\system32\msoeacct.dll
+ 2008-04-14 00:12:00 252,928 —-a-w c:\winnt\system32\msoeacct.dll
- 2004-08-04 07:56:43 105,984 —-a-w c:\winnt\system32\msoert2.dll
+ 2008-04-14 00:12:00 105,984 —-a-w c:\winnt\system32\msoert2.dll
- 2004-08-04 07:56:18 20,480 —-a-w c:\winnt\system32\msorc32r.dll
+ 2008-04-13 17:24:14 20,480 —-a-w c:\winnt\system32\msorc32r.dll
- 2004-08-04 07:56:43 143,360 —-a-w c:\winnt\system32\msorcl32.dll
+ 2008-04-14 00:12:00 143,360 —-a-w c:\winnt\system32\msorcl32.dll
- 2004-08-04 07:56:53 343,040 —-a-w c:\winnt\system32\mspaint.exe
+ 2008-04-14 00:12:28 343,040 —-a-w c:\winnt\system32\mspaint.exe
- 2004-08-04 07:56:43 30,208 —-a-w c:\winnt\system32\mspatcha.dll
+ 2008-04-14 00:12:00 29,696 —-a-w c:\winnt\system32\mspatcha.dll
- 2004-08-04 07:56:18 48,128 —-a-w c:\winnt\system32\msprivs.dll
+ 2008-04-13 16:23:31 48,128 —-a-w c:\winnt\system32\msprivs.dll
- 2008-10-16 10:37:02 146,432 —-a-w c:\winnt\system32\msrating.dll
+ 2008-04-14 00:12:00 146,432 —-a-w c:\winnt\system32\msrating.dll
- 2004-08-04 07:56:43 11,264 —-a-w c:\winnt\system32\msrle32.dll
+ 2008-04-14 00:12:00 11,264 —-a-w c:\winnt\system32\msrle32.dll
- 2004-08-04 07:56:43 134,656 —-a-w c:\winnt\system32\mssap.dll
+ 2008-04-14 00:12:00 134,656 —-a-w c:\winnt\system32\mssap.dll
+ 2008-04-14 00:12:00 155,136 ——w c:\winnt\system32\mssha.dll
+ 2008-04-13 18:14:58 76,800 ——w c:\winnt\system32\msshavmsg.dll
- 2004-08-04 07:56:43 274,944 —-a-w c:\winnt\system32\mstask.dll
+ 2008-04-14 00:12:00 274,944 —-a-w c:\winnt\system32\mstask.dll
- 2008-10-16 10:37:02 532,480 —-a-w c:\winnt\system32\mstime.dll
+ 2008-04-14 00:12:00 532,480 —-a-w c:\winnt\system32\mstime.dll
- 2004-08-04 07:56:53 12,288 —-a-w c:\winnt\system32\mstinit.exe
+ 2008-04-14 00:12:29 12,288 —-a-w c:\winnt\system32\mstinit.exe
- 2004-08-04 07:56:43 115,712 —-a-w c:\winnt\system32\mstlsapi.dll
+ 2008-04-14 00:12:00 116,224 —-a-w c:\winnt\system32\mstlsapi.dll
- 2004-08-04 05:59:40 407,552 —-a-w c:\winnt\system32\mstsc.exe
+ 2008-04-14 00:12:23 677,888 —-a-w c:\winnt\system32\mstsc.exe
- 2004-08-04 05:59:43 655,360 —-a-w c:\winnt\system32\mstscax.dll
+ 2008-04-14 00:11:56 2,061,824 —-a-w c:\winnt\system32\mstscax.dll
- 2004-08-04 07:56:43 195,072 —-a-w c:\winnt\system32\msutb.dll
+ 2008-04-14 00:12:00 195,072 —-a-w c:\winnt\system32\msutb.dll
- 2004-08-04 07:56:43 129,536 —-a-w c:\winnt\system32\msv1_0.dll
+ 2008-04-14 00:12:00 132,608 —-a-w c:\winnt\system32\msv1_0.dll
- 2004-08-04 07:56:43 1,392,671 —-a-w c:\winnt\system32\msvbvm60.dll
+ 2008-04-14 00:12:00 1,384,479 —-a-w c:\winnt\system32\msvbvm60.dll
- 2004-08-04 07:56:43 54,784 ——w c:\winnt\system32\msvcirt.dll
+ 2008-04-14 00:12:01 57,344 —-a-w c:\winnt\system32\msvcirt.dll
- 2004-08-04 07:56:43 343,040 ——w c:\winnt\system32\msvcrt.dll
+ 2008-04-14 00:12:01 343,040 —-a-w c:\winnt\system32\msvcrt.dll
- 2004-08-04 05:58:25 61,440 —-a-w c:\winnt\system32\msvcrt40.dll
+ 2008-04-13 18:30:46 61,440 —-a-w c:\winnt\system32\msvcrt40.dll
- 2004-08-04 07:56:43 120,832 —-a-w c:\winnt\system32\msvfw32.dll
+ 2008-04-14 00:12:01 121,344 —-a-w c:\winnt\system32\msvfw32.dll
- 2004-08-04 07:56:43 1,428,480 —-a-w c:\winnt\system32\msvidctl.dll
+ 2008-04-14 00:12:01 1,428,992 —-a-w c:\winnt\system32\msvidctl.dll
- 2004-08-04 07:56:43 72,704 —-a-w c:\winnt\system32\msw3prt.dll
+ 2008-04-14 00:12:01 72,704 —-a-w c:\winnt\system32\msw3prt.dll
- 2004-08-04 07:56:44 204,288 —-a-w c:\winnt\system32\mswebdvd.dll
+ 2008-04-14 00:12:01 203,776 —-a-w c:\winnt\system32\mswebdvd.dll
- 2008-06-20 17:41:10 245,248 —-a-w c:\winnt\system32\mswsock.dll
+ 2008-06-20 17:46:57 245,248 —-a-w c:\winnt\system32\mswsock.dll
- 2004-08-04 07:56:44 506,368 —-a-w c:\winnt\system32\msxml.dll
+ 2008-04-14 00:12:01 506,368 —-a-w c:\winnt\system32\msxml.dll
- 2004-08-04 07:56:44 701,440 —-a-w c:\winnt\system32\msxml2.dll
+ 2008-04-14 00:12:01 701,440 —-a-w c:\winnt\system32\msxml2.dll
- 2008-09-04 16:42:02 1,106,944 —-a-w c:\winnt\system32\msxml3.dll
+ 2008-09-04 17:15:04 1,106,944 —-a-w c:\winnt\system32\msxml3.dll
- 2006-10-05 08:31:10 79,872 —-a-w c:\winnt\system32\msxml6r.dll
+ 2008-04-13 17:27:18 79,872 —-a-w c:\winnt\system32\msxml6r.dll
- 2004-08-04 07:56:44 17,408 —-a-w c:\winnt\system32\msyuv.dll
+ 2008-04-14 00:12:01 16,896 —-a-w c:\winnt\system32\msyuv.dll
- 2006-03-01 19:42:42 66,560 —-a-w c:\winnt\system32\mtxclu.dll
+ 2008-04-14 00:12:01 66,560 —-a-w c:\winnt\system32\mtxclu.dll
- 2001-08-23 08:00:00 20,480 —-a-w c:\winnt\system32\mtxdm.dll
+ 2008-04-14 00:12:01 30,720 —-a-w c:\winnt\system32\mtxdm.dll
- 2001-08-23 08:00:00 4,096 —-a-w c:\winnt\system32\mtxex.dll
+ 2008-04-14 00:12:01 4,096 —-a-w c:\winnt\system32\mtxex.dll
- 2001-08-23 08:00:00 25,088 —-a-w c:\winnt\system32\mtxlegih.dll
+ 2008-04-14 00:12:01 34,304 —-a-w c:\winnt\system32\mtxlegih.dll
- 2006-03-01 19:42:42 91,136 —-a-w c:\winnt\system32\mtxoci.dll
+ 2008-04-14 00:12:01 91,648 —-a-w c:\winnt\system32\mtxoci.dll
- 2004-08-04 07:56:44 1,737,856 ——w c:\winnt\system32\mtxparhd.dll
+ 2008-04-14 00:12:01 1,737,856 ——w c:\winnt\system32\mtxparhd.dll
- 2004-08-04 07:56:21 393,728 ——w c:\winnt\system32\mui\
0401\xpob2res.dll
+ 2008-04-13 18:40:07 393,728 ——w c:\winnt\system32\mui\
0401\xpob2res.dll
- 2004-08-04 07:56:29 186,880 —-a-w c:\winnt\system32\mui\
0401\xpsp1res.dll
+ 2008-04-13 18:35:06 186,880 —-a-w c:\winnt\system32\mui\
0401\xpsp1res.dll
- 2004-08-04 07:56:29 2,869,248 ——w c:\winnt\system32\mui\
0401\xpsp2res.dll
+ 2008-04-13 18:35:49 2,869,248 ——w c:\winnt\system32\mui\
0401\xpsp2res.dll
+ 2008-04-13 18:39:02 656,896 ——w c:\winnt\system32\mui\
0401\xpsp3res.dll
- 2004-08-04 07:56:29 189,440 —-a-w c:\winnt\system32\mui\
0402\xpsp1res.dll
+ 2008-04-13 18:35:08 189,440 —-a-w c:\winnt\system32\mui\
0402\xpsp1res.dll
- 2004-08-04 07:56:21 212,480 ——w c:\winnt\system32\mui\
0404\xpob2res.dll
+ 2008-04-13 18:40:23 212,480 ——w c:\winnt\system32\mui\
0404\xpob2res.dll
- 2004-08-04 07:56:29 161,280 —-a-w c:\winnt\system32\mui\
0404\xpsp1res.dll
+ 2008-04-13 18:35:09 161,280 —-a-w c:\winnt\system32\mui\
0404\xpsp1res.dll
- 2004-08-04 07:56:29 477,696 ——w c:\winnt\system32\mui\
0404\xpsp2res.dll
+ 2008-04-13 18:36:10 477,696 ——w c:\winnt\system32\mui\
0404\xpsp2res.dll
+ 2008-04-13 18:39:13 327,680 ——w c:\winnt\system32\mui\
0404\xpsp3res.dll
- 2004-08-04 07:56:21 428,032 ——w c:\winnt\system32\mui\
0405\xpob2res.dll
+ 2008-04-13 18:40:24 428,032 ——w c:\winnt\system32\mui\
0405\xpob2res.dll
- 2004-08-04 07:56:29 188,928 —-a-w c:\winnt\system32\mui\
0405\xpsp1res.dll
+ 2008-04-13 18:35:09 188,928 —-a-w c:\winnt\system32\mui\
0405\xpsp1res.dll
- 2004-08-04 07:56:29 734,720 ——w c:\winnt\system32\mui\
0405\xpsp2res.dll
+ 2008-04-13 18:36:10 734,720 ——w c:\winnt\system32\mui\
0405\xpsp2res.dll
+ 2008-04-13 18:39:02 601,088 ——w c:\winnt\system32\mui\
0405\xpsp3res.dll
- 2004-08-04 07:56:21 418,816 ——w c:\winnt\system32\mui\
0406\xpob2res.dll
+ 2008-04-13 18:40:27 418,816 ——w c:\winnt\system32\mui\
0406\xpob2res.dll
- 2004-08-04 07:56:29 192,512 —-a-w c:\winnt\system32\mui\
0406\xpsp1res.dll
+ 2008-04-13 18:35:09 192,000 —-a-w c:\winnt\system32\mui\
0406\xpsp1res.dll
- 2004-08-04 07:56:29 742,912 ——w c:\winnt\system32\mui\
0406\xpsp2res.dll
+ 2008-04-13 18:36:10 742,912 ——w c:\winnt\system32\mui\
0406\xpsp2res.dll
+ 2008-04-13 18:39:12 605,696 ——w c:\winnt\system32\mui\
0406\xpsp3res.dll
- 2004-08-04 07:56:21 403,456 ——w c:\winnt\system32\mui\
0407\xpob2res.dll
+ 2008-04-13 18:40:34 403,456 ——w c:\winnt\system32\mui\
0407\xpob2res.dll
- 2004-08-04 07:56:29 199,680 —-a-w c:\winnt\system32\mui\
0407\xpsp1res.dll
+ 2008-04-13 18:35:21 199,680 —-a-w c:\winnt\system32\mui\
0407\xpsp1res.dll
- 2004-08-04 07:56:29 788,992 ——w c:\winnt\system32\mui\
0407\xpsp2res.dll
+ 2008-04-13 18:37:03 788,480 ——w c:\winnt\system32\mui\
0407\xpsp2res.dll
+ 2008-04-13 18:39:19 663,552 ——w c:\winnt\system32\mui\
0407\xpsp3res.dll
- 2004-08-04 07:56:21 419,328 ——w c:\winnt\system32\mui\
0408\xpob2res.dll
+ 2008-04-13 18:40:30 419,328 ——w c:\winnt\system32\mui\
0408\xpob2res.dll
- 2004-08-04 07:56:29 197,632 —-a-w c:\winnt\system32\mui\
0408\xpsp1res.dll
+ 2008-04-13 18:35:11 197,632 —-a-w c:\winnt\system32\mui\
0408\xpsp1res.dll
- 2004-08-04 07:56:29 801,280 ——w c:\winnt\system32\mui\
0408\xpsp2res.dll
+ 2008-04-13 18:36:35 801,280 ——w c:\winnt\system32\mui\
0408\xpsp2res.dll
+ 2008-04-13 18:39:12 679,936 ——w c:\winnt\system32\mui\
0408\xpsp3res.dll
- 2006-12-22 17:02:36 6,144 —-a-w c:\winnt\system32\mui\
0409\mscorees.dll
+ 2008-07-25 16:17:04 15,360 —-a-w c:\winnt\system32\mui\
0409\mscorees.dll
- 2004-08-04 07:56:21 405,504 ——w c:\winnt\system32\mui\
040b\xpob2res.dll
+ 2008-04-13 18:40:32 405,504 ——w c:\winnt\system32\mui\
040b\xpob2res.dll
- 2004-08-04 07:56:29 186,368 —-a-w c:\winnt\system32\mui\
040b\xpsp1res.dll
+ 2008-04-13 18:35:11 186,368 —-a-w c:\winnt\system32\mui\
040b\xpsp1res.dll
- 2004-08-04 07:56:29 729,088 ——w c:\winnt\system32\mui\
040b\xpsp2res.dll
+ 2008-04-13 18:36:39 729,088 ——w c:\winnt\system32\mui\
040b\xpsp2res.dll
+ 2008-04-13 18:39:17 604,672 ——w c:\winnt\system32\mui\
040b\xpsp3res.dll
- 2004-08-04 07:56:22 410,624 ——w c:\winnt\system32\mui\
040C\xpob2res.dll
+ 2008-04-13 18:40:33 410,624 ——w c:\winnt\system32\mui\
040C\xpob2res.dll
- 2004-08-04 07:56:29 197,632 —-a-w c:\winnt\system32\mui\
040C\xpsp1res.dll
+ 2008-04-13 18:35:20 197,632 —-a-w c:\winnt\system32\mui\
040C\xpsp1res.dll
- 2004-08-04 07:56:29 793,600 ——w c:\winnt\system32\mui\
040C\xpsp2res.dll
+ 2008-04-13 18:36:55 793,088 ——w c:\winnt\system32\mui\
040C\xpsp2res.dll
+ 2008-04-13 18:39:20 663,040 ——w c:\winnt\system32\mui\
040C\xpsp3res.dll
- 2004-08-04 07:56:22 384,000 ——w c:\winnt\system32\mui\
040D\xpob2res.dll
+ 2008-04-13 18:40:32 384,000 ——w c:\winnt\system32\mui\
040D\xpob2res.dll
- 2004-08-04 07:56:29 181,760 —-a-w c:\winnt\system32\mui\
040D\xpsp1res.dll
+ 2008-04-13 18:35:21 181,760 —-a-w c:\winnt\system32\mui\
040D\xpsp1res.dll
- 2004-08-04 07:56:29 2,842,112 ——w c:\winnt\system32\mui\
040D\xpsp2res.dll
+ 2008-04-13 18:37:07 2,842,112 ——w c:\winnt\system32\mui\
040D\xpsp2res.dll
+ 2008-04-13 18:39:28 620,544 ——w c:\winnt\system32\mui\
040D\xpsp3res.dll
- 2004-08-04 07:56:22 434,176 ——w c:\winnt\system32\mui\
040e\xpob2res.dll
+ 2008-04-13 18:40:39 434,176 ——w c:\winnt\system32\mui\
040e\xpob2res.dll
- 2004-08-04 07:56:29 195,584 —-a-w c:\winnt\system32\mui\
040e\xpsp1res.dll
+ 2008-04-13 18:35:23 195,584 —-a-w c:\winnt\system32\mui\
040e\xpsp1res.dll
- 2004-08-04 07:56:29 769,536 ——w c:\winnt\system32\mui\
040e\xpsp2res.dll
+ 2008-04-13 18:37:22 769,536 ——w c:\winnt\system32\mui\
040e\xpsp2res.dll
+ 2008-04-13 18:39:28 645,120 ——w c:\winnt\system32\mui\
040e\xpsp3res.dll
- 2004-08-04 07:56:22 413,696 ——w c:\winnt\system32\mui\
0410\xpob2res.dll
+ 2008-04-13 18:40:39 413,696 ——w c:\winnt\system32\mui\
0410\xpob2res.dll
- 2004-08-04 07:56:29 195,072 —-a-w c:\winnt\system32\mui\
0410\xpsp1res.dll
+ 2008-04-13 18:35:23 195,072 —-a-w c:\winnt\system32\mui\
0410\xpsp1res.dll
- 2004-08-04 07:56:29 769,536 ——w c:\winnt\system32\mui\
0410\xpsp2res.dll
+ 2008-04-13 18:37:22 769,536 ——w c:\winnt\system32\mui\
0410\xpsp2res.dll
+ 2008-04-13 18:39:28 658,432 ——w c:\winnt\system32\mui\
0410\xpsp3res.dll
- 2004-08-04 07:56:22 275,456 ——w c:\winnt\system32\mui\
0411\xpob2res.dll
+ 2008-04-13 18:40:44 275,456 ——w c:\winnt\system32\mui\
0411\xpob2res.dll
- 2004-08-04 07:56:29 171,008 —-a-w c:\winnt\system32\mui\
0411\xpsp1res.dll
+ 2008-04-13 18:35:23 171,008 —-a-w c:\winnt\system32\mui\
0411\xpsp1res.dll
- 2004-08-04 07:56:29 562,688 ——w c:\winnt\system32\mui\
0411\xpsp2res.dll
+ 2008-04-13 18:37:34 562,688 ——w c:\winnt\system32\mui\
0411\xpsp2res.dll
+ 2008-04-13 18:39:49 412,672 ——w c:\winnt\system32\mui\
0411\xpsp3res.dll
- 2004-08-04 07:56:22 306,688 ——w c:\winnt\system32\mui\
0412\xpob2res.dll
+ 2008-04-13 18:40:48 306,688 ——w c:\winnt\system32\mui\
0412\xpob2res.dll
- 2004-08-04 07:56:29 167,936 —-a-w c:\winnt\system32\mui\
0412\xpsp1res.dll
+ 2008-04-13 18:35:23 167,936 —-a-w c:\winnt\system32\mui\
0412\xpsp1res.dll
- 2004-08-04 07:56:29 543,744 ——w c:\winnt\system32\mui\
0412\xpsp2res.dll
+ 2008-04-13 18:37:37 543,744 ——w c:\winnt\system32\mui\
0412\xpsp2res.dll
+ 2008-04-13 18:39:49 392,704 ——w c:\winnt\system32\mui\
0412\xpsp3res.dll
- 2004-08-04 07:56:22 401,920 ——w c:\winnt\system32\mui\
0413\xpob2res.dll
+ 2008-04-13 18:40:44 401,920 ——w c:\winnt\system32\mui\
0413\xpob2res.dll
- 2004-08-04 07:56:29 196,096 —-a-w c:\winnt\system32\mui\
0413\xpsp1res.dll
+ 2008-04-13 18:35:25 196,096 —-a-w c:\winnt\system32\mui\
0413\xpsp1res.dll
- 2004-08-04 07:56:29 769,024 ——w c:\winnt\system32\mui\
0413\xpsp2res.dll
+ 2008-04-13 18:38:00 769,024 ——w c:\winnt\system32\mui\
0413\xpsp2res.dll
+ 2008-04-13 18:39:47 645,120 ——w c:\winnt\system32\mui\
0413\xpsp3res.dll
- 2004-08-04 07:56:22 353,792 ——w c:\winnt\system32\mui\
0414\xpob2res.dll
+ 2008-04-13 18:40:44 353,792 ——w c:\winnt\system32\mui\
0414\xpob2res.dll
- 2004-08-04 07:56:29 189,440 —-a-w c:\winnt\system32\mui\
0414\xpsp1res.dll
+ 2008-04-13 18:35:25 189,440 —-a-w c:\winnt\system32\mui\
0414\xpsp1res.dll
- 2004-08-04 07:56:29 716,288 ——w c:\winnt\system32\mui\
0414\xpsp2res.dll
+ 2008-04-13 18:38:02 716,288 ——w c:\winnt\system32\mui\
0414\xpsp2res.dll
+ 2008-04-13 18:39:48 591,872 ——w c:\winnt\system32\mui\
0414\xpsp3res.dll
- 2004-08-04 07:56:22 391,680 ——w c:\winnt\system32\mui\
0415\xpob2res.dll
+ 2008-04-13 18:40:47 391,680 ——w c:\winnt\system32\mui\
0415\xpob2res.dll
- 2004-08-04 07:56:29 194,560 —-a-w c:\winnt\system32\mui\
0415\xpsp1res.dll
+ 2008-04-13 18:35:26 194,560 —-a-w c:\winnt\system32\mui\
0415\xpsp1res.dll
- 2004-08-04 07:56:29 759,808 ——w c:\winnt\system32\mui\
0415\xpsp2res.dll
+ 2008-04-13 18:38:05 759,808 ——w c:\winnt\system32\mui\
0415\xpsp2res.dll
+ 2008-04-13 18:39:52 641,024 ——w c:\winnt\system32\mui\
0415\xpsp3res.dll
- 2004-08-04 07:56:22 409,600 ——w c:\winnt\system32\mui\
0416\xpob2res.dll
+ 2008-04-13 18:40:10 409,600 ——w c:\winnt\system32\mui\
0416\xpob2res.dll
- 2004-08-04 07:56:29 192,512 —-a-w c:\winnt\system32\mui\
0416\xpsp1res.dll
+ 2008-04-13 18:35:08 192,512 —-a-w c:\winnt\system32\mui\
0416\xpsp1res.dll
- 2004-08-04 07:56:29 752,128 ——w c:\winnt\system32\mui\
0416\xpsp2res.dll
+ 2008-04-13 18:35:43 752,128 ——w c:\winnt\system32\mui\
0416\xpsp2res.dll
+ 2008-04-13 18:38:56 620,032 ——w c:\winnt\system32\mui\
0416\xpsp3res.dll
- 2004-08-04 07:56:29 190,464 —-a-w c:\winnt\system32\mui\
0418\xpsp1res.dll
+ 2008-04-13 18:35:27 190,464 —-a-w c:\winnt\system32\mui\
0418\xpsp1res.dll
- 2004-08-04 07:56:22 427,008 ——w c:\winnt\system32\mui\
0419\xpob2res.dll
+ 2008-04-13 18:40:50 427,008 ——w c:\winnt\system32\mui\
0419\xpob2res.dll
- 2004-08-04 07:56:29 192,512 —-a-w c:\winnt\system32\mui\
0419\xpsp1res.dll
+ 2008-04-13 18:35:27 192,512 —-a-w c:\winnt\system32\mui\
0419\xpsp1res.dll
- 2004-08-04 07:56:29 736,768 ——w c:\winnt\system32\mui\
0419\xpsp2res.dll
+ 2008-04-13 18:38:28 736,768 ——w c:\winnt\system32\mui\
0419\xpsp2res.dll
+ 2008-04-13 18:39:56 627,200 ——w c:\winnt\system32\mui\
0419\xpsp3res.dll
- 2004-08-04 07:56:29 188,928 —-a-w c:\winnt\system32\mui\
041a\xpsp1res.dll
+ 2008-04-13 18:35:21 188,928 —-a-w c:\winnt\system32\mui\
041a\xpsp1res.dll
- 2004-08-04 07:56:22 405,504 ——w c:\winnt\system32\mui\
041b\xpob2res.dll
+ 2008-04-13 18:40:52 405,504 ——w c:\winnt\system32\mui\
041b\xpob2res.dll
- 2004-08-04 07:56:29 193,024 —-a-w c:\winnt\system32\mui\
041b\xpsp1res.dll
+ 2008-04-13 18:35:28 192,512 —-a-w c:\winnt\system32\mui\
041b\xpsp1res.dll
- 2004-08-04 07:56:29 757,248 ——w c:\winnt\system32\mui\
041b\xpsp2res.dll
+ 2008-04-13 18:38:37 757,248 ——w c:\winnt\system32\mui\
041b\xpsp2res.dll
+ 2008-04-13 18:40:04 577,536 ——w c:\winnt\system32\mui\
041b\xpsp3res.dll
- 2004-08-04 07:56:22 363,520 ——w c:\winnt\system32\mui\
041D\xpob2res.dll
+ 2008-04-13 18:40:56 363,008 ——w c:\winnt\system32\mui\
041D\xpob2res.dll
- 2004-08-04 07:56:29 188,928 —-a-w c:\winnt\system32\mui\
041D\xpsp1res.dll
+ 2008-04-13 18:35:28 188,928 —-a-w c:\winnt\system32\mui\
041D\xpsp1res.dll
- 2004-08-04 07:56:29 724,992 ——w c:\winnt\system32\mui\
041D\xpsp2res.dll
+ 2008-04-13 18:38:47 724,480 ——w c:\winnt\system32\mui\
041D\xpsp2res.dll
+ 2008-04-13 18:40:05 590,848 ——w c:\winnt\system32\mui\
041D\xpsp3res.dll
- 2004-08-04 07:56:29 188,416 —-a-w c:\winnt\system32\mui\
041e\xpsp1res.dll
+ 2008-04-13 18:35:29 188,416 —-a-w c:\winnt\system32\mui\
041e\xpsp1res.dll
- 2004-08-04 07:56:22 390,144 ——w c:\winnt\system32\mui\
041f\xpob2res.dll
+ 2008-04-13 18:41:00 390,144 ——w c:\winnt\system32\mui\
041f\xpob2res.dll
- 2004-08-04 07:56:29 188,928 —-a-w c:\winnt\system32\mui\
041f\xpsp1res.dll
+ 2008-04-13 18:35:30 188,928 —-a-w c:\winnt\system32\mui\
041f\xpsp1res.dll
- 2004-08-04 07:56:30 724,480 ——w c:\winnt\system32\mui\
041f\xpsp2res.dll
+ 2008-04-13 18:38:51 724,480 ——w c:\winnt\system32\mui\
041f\xpsp2res.dll
+ 2008-04-13 18:40:09 592,896 ——w c:\winnt\system32\mui\
041f\xpsp3res.dll
- 2004-08-04 07:56:22 408,576 ——w c:\winnt\system32\mui\
0424\xpob2res.dll
+ 2008-04-13 18:40:56 408,576 ——w c:\winnt\system32\mui\
0424\xpob2res.dll
- 2004-08-04 07:56:29 192,512 —-a-w c:\winnt\system32\mui\
0424\xpsp1res.dll
+ 2008-04-13 18:35:28 192,512 —-a-w c:\winnt\system32\mui\
0424\xpsp1res.dll
- 2004-08-04 07:56:30 732,160 ——w c:\winnt\system32\mui\
0424\xpsp2res.dll
+ 2008-04-13 18:38:36 732,160 ——w c:\winnt\system32\mui\
0424\xpsp2res.dll
+ 2008-04-13 18:40:05 576,512 ——w c:\winnt\system32\mui\
0424\xpsp3res.dll
- 2004-08-04 07:56:29 187,392 —-a-w c:\winnt\system32\mui\
0425\xpsp1res.dll
+ 2008-04-13 18:35:11 186,880 —-a-w c:\winnt\system32\mui\
0425\xpsp1res.dll
- 2004-08-04 07:56:29 188,928 —-a-w c:\winnt\system32\mui\
0426\xpsp1res.dll
+ 2008-04-13 18:35:24 188,928 —-a-w c:\winnt\system32\mui\
0426\xpsp1res.dll
- 2004-08-04 07:56:29 189,952 —-a-w c:\winnt\system32\mui\
0427\xpsp1res.dll
+ 2008-04-13 18:35:24 189,952 —-a-w c:\winnt\system32\mui\
0427\xpsp1res.dll
- 2004-08-04 07:56:22 270,336 ——w c:\winnt\system32\mui\
0804\xpob2res.dll
+ 2008-04-13 18:40:24 270,336 ——w c:\winnt\system32\mui\
0804\xpob2res.dll
- 2004-08-04 07:56:29 161,280 —-a-w c:\winnt\system32\mui\
0804\xpsp1res.dll
+ 2008-04-13 18:35:06 161,280 —-a-w c:\winnt\system32\mui\
0804\xpsp1res.dll
- 2004-08-04 07:56:30 470,016 ——w c:\winnt\system32\mui\
0804\xpsp2res.dll
+ 2008-04-13 18:35:54 470,016 ——w c:\winnt\system32\mui\
0804\xpsp2res.dll
+ 2008-04-13 18:39:03 322,560 ——w c:\winnt\system32\mui\
0804\xpsp3res.dll
- 2004-08-04 07:56:22 435,200 ——w c:\winnt\system32\mui\
0816\xpob2res.dll
+ 2008-04-13 18:40:48 435,200 ——w c:\winnt\system32\mui\
0816\xpob2res.dll
- 2004-08-04 07:56:29 194,560 —-a-w c:\winnt\system32\mui\
0816\xpsp1res.dll
+ 2008-04-13 18:35:26 194,560 —-a-w c:\winnt\system32\mui\
0816\xpsp1res.dll
- 2004-08-04 07:56:30 751,616 ——w c:\winnt\system32\mui\
0816\xpsp2res.dll
+ 2008-04-13 18:38:06 751,616 ——w c:\winnt\system32\mui\
0816\xpsp2res.dll
+ 2008-04-13 18:39:53 639,488 ——w c:\winnt\system32\mui\
0816\xpsp3res.dll
- 2004-08-04 07:56:22 446,464 ——w c:\winnt\system32\mui\
0C0A\xpob2res.dll
+ 2008-04-13 18:40:30 446,464 ——w c:\winnt\system32\mui\
0C0A\xpob2res.dll
- 2004-08-04 07:56:29 196,096 —-a-w c:\winnt\system32\mui\
0C0A\xpsp1res.dll
+ 2008-04-13 18:35:11 196,096 —-a-w c:\winnt\system32\mui\
0C0A\xpsp1res.dll
- 2004-08-04 07:56:30 773,632 ——w c:\winnt\system32\mui\
0C0A\xpsp2res.dll
+ 2008-04-13 18:36:38 773,632 ——w c:\winnt\system32\mui\
0C0A\xpsp2res.dll
+ 2008-04-13 18:39:13 648,704 ——w c:\winnt\system32\mui\
0C0A\xpsp3res.dll
- 2004-08-04 07:56:44 90,624 —-a-w c:\winnt\system32\mydocs.dll
+ 2008-04-14 00:12:01 90,624 —-a-w c:\winnt\system32\mydocs.dll
+ 2008-04-14 00:12:01 30,208 ——w c:\winnt\system32\napipsec.dll
+ 2008-04-14 00:12:01 193,024 ——w c:\winnt\system32\napmontr.dll
+ 2008-04-14 00:12:29 176,640 ——w c:\winnt\system32\napstat.exe
- 2004-08-04 07:56:54 53,760 —-a-w c:\winnt\system32\narrator.exe
+ 2008-04-14 00:12:29 53,760 —-a-w c:\winnt\system32\narrator.exe
- 2004-08-04 07:56:44 36,352 —-a-w c:\winnt\system32\ncobjapi.dll
+ 2008-04-14 00:12:01 36,352 —-a-w c:\winnt\system32\ncobjapi.dll
- 2004-08-04 07:56:44 17,920 —-a-w c:\winnt\system32\nddeapi.dll
+ 2008-04-14 00:12:01 17,920 —-a-w c:\winnt\system32\nddeapi.dll
- 2004-08-04 07:56:54 4,096 —-a-w c:\winnt\system32\nddeapir.exe
+ 2008-04-14 00:12:29 4,096 —-a-w c:\winnt\system32\nddeapir.exe
- 2005-02-10 17:26:31 18,944 —-a-w c:\winnt\system32\nddenb32.dll
+ 2008-04-14 00:12:01 18,944 —-a-w c:\winnt\system32\nddenb32.dll
- 2004-08-04 07:56:54 42,496 —-a-w c:\winnt\system32\net.exe
+ 2008-04-14 00:12:29 42,496 —-a-w c:\winnt\system32\net.exe
- 2004-08-04 07:56:54 124,928 —-a-w c:\winnt\system32\net1.exe
+ 2008-04-14 00:12:29 124,928 —-a-w c:\winnt\system32\net1.exe
- 2008-10-15 16:57:55 332,800 —-a-w c:\winnt\system32\netapi32.dll
+ 2008-10-15 16:34:24 337,408 —-a-w c:\winnt\system32\netapi32.dll
- 2004-08-04 07:56:44 622,080 —-a-w c:\winnt\system32\netcfgx.dll
+ 2008-04-14 00:12:01 622,592 —-a-w c:\winnt\system32\netcfgx.dll
- 2004-08-04 07:56:54 111,104 —-a-w c:\winnt\system32\netdde.exe
+ 2008-04-14 00:12:29 111,104 —-a-w c:\winnt\system32\netdde.exe
- 2004-08-04 07:56:44 139,264 —-a-w c:\winnt\system32\netid.dll
+ 2008-04-14 00:12:01 139,264 —-a-w c:\winnt\system32\netid.dll
- 2004-08-04 07:56:44 407,040 —-a-w c:\winnt\system32\netlogon.dll
+ 2008-04-14 00:12:01 407,040 —-a-w c:\winnt\system32\netlogon.dll
- 2005-08-22 18:29:46 197,632 —-a-w c:\winnt\system32\netman.dll
+ 2008-04-14 00:12:01 198,144 —-a-w c:\winnt\system32\netman.dll
- 2004-08-04 07:56:44 875,008 —-a-w c:\winnt\system32\netplwiz.dll
+ 2008-04-14 00:12:01 875,008 —-a-w c:\winnt\system32\netplwiz.dll
- 2004-08-04 07:56:44 12,288 —-a-w c:\winnt\system32\netrap.dll
+ 2008-04-14 00:12:01 11,776 —-a-w c:\winnt\system32\netrap.dll
- 2004-08-04 08:02:44 329,728 —-a-w c:\winnt\system32\netsetup.exe
+ 2008-04-14 00:16:51 329,728 —-a-w c:\winnt\system32\netsetup.exe
- 2004-08-04 07:56:54 86,016 —-a-w c:\winnt\system32\netsh.exe
+ 2008-04-14 00:12:29 86,016 —-a-w c:\winnt\system32\netsh.exe
- 2004-08-04 07:56:44 1,708,032 —-a-w c:\winnt\system32\netshell.dll
+ 2008-04-14 00:12:02 1,703,936 —-a-w c:\winnt\system32\netshell.dll
- 2004-08-04 07:56:54 36,864 —-a-w c:\winnt\system32\netstat.exe
+ 2008-04-14 00:12:29 36,864 —-a-w c:\winnt\system32\netstat.exe
- 2004-08-04 07:56:44 80,896 —-a-w c:\winnt\system32\netui0.dll
+ 2008-04-14 00:12:02 80,896 —-a-w c:\winnt\system32\netui0.dll
- 2004-08-04 07:56:44 245,760 —-a-w c:\winnt\system32\netui1.dll
+ 2008-04-14 00:12:02 245,760 —-a-w c:\winnt\system32\netui1.dll
- 2004-08-04 07:56:44 248,832 —-a-w c:\winnt\system32\newdev.dll
+ 2008-04-14 00:12:02 247,808 —-a-w c:\winnt\system32\newdev.dll
- 2004-08-04 07:56:44 103,936 —-a-w c:\winnt\system32\nlhtml.dll
+ 2008-04-14 00:12:02 98,304 —-a-w c:\winnt\system32\nlhtml.dll
- 2004-08-04 07:56:44 28,672 —-a-w c:\winnt\system32\nmmkcert.dll
+ 2008-04-14 00:12:02 28,672 —-a-w c:\winnt\system32\nmmkcert.dll
- 2004-08-04 07:56:54 69,120 —-a-w c:\winnt\system32\notepad.exe
+ 2008-04-14 00:12:29 69,120 —-a-w c:\winnt\system32\notepad.exe
- 2004-08-04 07:56:44 57,344 —-a-w c:\winnt\system32\npp\ndisnpp.dll
+ 2008-04-14 00:12:01 57,344 —-a-w c:\winnt\system32\npp\ndisnpp.dll
- 2004-08-04 07:56:54 15,360 —-a-w c:\winnt\system32\npp\nppagent.exe
+ 2008-04-14 00:12:29 15,360 —-a-w c:\winnt\system32\npp\nppagent.exe
- 2004-08-04 07:56:44 54,784 —-a-w c:\winnt\system32\npptools.dll
+ 2008-04-14 00:12:02 54,784 —-a-w c:\winnt\system32\npptools.dll
- 2004-08-04 07:56:54 76,800 —-a-w c:\winnt\system32\nslookup.exe
+ 2008-04-14 00:12:29 76,800 —-a-w c:\winnt\system32\nslookup.exe
- 2004-08-04 07:56:54 1,200,128 —-a-w c:\winnt\system32\ntbackup.exe
+ 2008-04-14 00:12:30 1,200,640 —-a-w c:\winnt\system32\ntbackup.exe
- 2004-08-04 07:56:36 708,096 —-a-w c:\winnt\system32\ntdll.dll
+ 2008-04-14 00:11:24 706,048 —-a-w c:\winnt\system32\ntdll.dll
- 2004-08-04 07:56:44 67,072 —-a-w c:\winnt\system32\ntdsapi.dll
+ 2008-04-14 00:12:02 67,072 —-a-w c:\winnt\system32\ntdsapi.dll
- 2008-08-14 09:22:13 2,057,728 —-a-w c:\winnt\system32\ntkrnlpa.exe
+ 2008-08-14 09:33:16 2,066,048 —-a-w c:\winnt\system32\ntkrnlpa.exe
- 2004-08-04 07:56:44 43,520 —-a-w c:\winnt\system32\ntlanman.dll
+ 2008-04-14 00:12:02 44,032 —-a-w c:\winnt\system32\ntlanman.dll
- 2004-08-04 07:56:44 8,192 —-a-w c:\winnt\system32\ntlsapi.dll
+ 2008-04-14 00:12:02 8,192 —-a-w c:\winnt\system32\ntlsapi.dll
- 2004-08-04 07:56:44 118,784 —-a-w c:\winnt\system32\ntmarta.dll
+ 2008-04-14 00:12:02 118,784 —-a-w c:\winnt\system32\ntmarta.dll
- 2004-08-04 07:56:44 40,960 —-a-w c:\winnt\system32\ntmsapi.dll
+ 2008-04-14 00:12:02 40,960 —-a-w c:\winnt\system32\ntmsapi.dll
- 2004-08-04 07:56:44 179,712 —-a-w c:\winnt\system32\ntmsdba.dll
+ 2008-04-14 00:12:02 179,200 —-a-w c:\winnt\system32\ntmsdba.dll
- 2004-08-04 07:56:44 488,448 —-a-w c:\winnt\system32\ntmsmgr.dll
+ 2008-04-14 00:12:02 488,448 —-a-w c:\winnt\system32\ntmsmgr.dll
- 2004-08-04 07:56:44 435,200 —-a-w c:\winnt\system32\ntmssvc.dll
+ 2008-04-14 00:12:02 435,200 —-a-w c:\winnt\system32\ntmssvc.dll
- 2008-08-14 10:00:45 2,180,352 —-a-w c:\winnt\system32\ntoskrnl.exe
+ 2008-08-14 10:11:02 2,189,184 —-a-w c:\winnt\system32\ntoskrnl.exe
- 2004-08-04 07:56:44 91,136 —-a-w c:\winnt\system32\ntprint.dll
+ 2008-04-14 00:12:02 91,136 —-a-w c:\winnt\system32\ntprint.dll
- 2004-08-04 07:56:44 143,872 —-a-w c:\winnt\system32\ntshrui.dll
+ 2008-04-14 00:12:02 143,360 —-a-w c:\winnt\system32\ntshrui.dll
- 2004-08-04 07:56:54 419,840 —-a-w c:\winnt\system32\ntvdm.exe
+ 2008-04-14 00:12:30 420,864 —-a-w c:\winnt\system32\ntvdm.exe
- 2004-06-17 17:58:35 13,312 —-a-w c:\winnt\system32\ntvdmd.dll
+ 2008-04-14 00:12:02 15,360 —-a-w c:\winnt\system32\ntvdmd.dll
- 2004-08-04 07:56:44 4,274,816 ——w c:\winnt\system32\nv4_disp.dll
+ 2008-04-14 00:12:02 4,274,816 ——w c:\winnt\system32\nv4_disp.dll
- 2006-10-13 12:35:12 64,000 —-a-w c:\winnt\system32\nwapi32.dll
+ 2008-04-14 00:12:02 64,000 —-a-w c:\winnt\system32\nwapi32.dll
- 2006-10-13 12:35:12 142,336 —-a-w c:\winnt\system32\nwprovau.dll
+ 2008-04-14 00:12:02 142,336 —-a-w c:\winnt\system32\nwprovau.dll
- 2006-10-13 12:35:12 65,536 —-a-w c:\winnt\system32\nwwks.dll
+ 2008-04-14 00:12:02 65,536 —-a-w c:\winnt\system32\nwwks.dll
- 2004-08-04 07:56:44 266,752 —-a-w c:\winnt\system32\oakley.dll
+ 2008-04-14 00:12:02 270,336 —-a-w c:\winnt\system32\oakley.dll
- 2004-08-04 07:56:44 285,696 —-a-w c:\winnt\system32\objsel.dll
+ 2008-04-14 00:12:02 286,208 —-a-w c:\winnt\system32\objsel.dll
- 2004-08-04 07:56:44 96,256 —-a-w c:\winnt\system32\occache.dll
+ 2008-04-14 00:12:02 96,256 —-a-w c:\winnt\system32\occache.dll
- 2001-08-23 08:00:00 60,928 —-a-w c:\winnt\system32\ocmanage.dll
+ 2008-04-14 00:12:02 67,584 —-a-w c:\winnt\system32\ocmanage.dll
- 2004-08-04 07:56:44 249,856 —-a-w c:\winnt\system32\odbc32.dll
+ 2008-04-14 00:12:02 249,856 —-a-w c:\winnt\system32\odbc32.dll
- 2004-08-04 07:56:44 16,384 —-a-w c:\winnt\system32\odbc32gt.dll
+ 2008-04-14 00:12:02 16,384 —-a-w c:\winnt\system32\odbc32gt.dll
- 2004-08-04 07:56:54 32,768 —-a-w c:\winnt\system32\odbcad32.exe
+ 2008-04-14 00:12:30 32,768 —-a-w c:\winnt\system32\odbcad32.exe
- 2004-08-04 07:56:44 24,576 —-a-w c:\winnt\system32\odbcbcp.dll
+ 2008-04-14 00:12:02 24,576 —-a-w c:\winnt\system32\odbcbcp.dll
- 2004-08-04 07:56:44 135,168 —-a-w c:\winnt\system32\odbcconf.dll
+ 2008-04-14 00:12:02 135,168 —-a-w c:\winnt\system32\odbcconf.dll
- 2004-08-04 07:56:54 69,632 —-a-w c:\winnt\system32\odbcconf.exe
+ 2008-04-14 00:12:30 69,632 —-a-w c:\winnt\system32\odbcconf.exe
- 2004-08-04 07:56:44 106,496 —-a-w c:\winnt\system32\odbccp32.dll
+ 2008-04-14 00:12:02 106,496 —-a-w c:\winnt\system32\odbccp32.dll
- 2004-08-04 07:56:44 65,536 —-a-w c:\winnt\system32\odbccr32.dll
+ 2008-04-14 00:12:02 65,536 —-a-w c:\winnt\system32\odbccr32.dll
- 2004-08-04 07:56:44 65,536 —-a-w c:\winnt\system32\odbccu32.dll
+ 2008-04-14 00:12:02 65,536 —-a-w c:\winnt\system32\odbccu32.dll
- 2004-08-04 07:56:22 94,208 —-a-w c:\winnt\system32\odbcint.dll
+ 2008-04-13 17:26:05 94,208 —-a-w c:\winnt\system32\odbcint.dll
- 2004-08-04 07:56:22 53,279 —-a-w c:\winnt\system32\odbcji32.dll
+ 2008-04-14 00:10:31 53,279 —-a-w c:\winnt\system32\odbcji32.dll
- 2004-08-04 07:56:44 278,559 —-a-w c:\winnt\system32\odbcjt32.dll
+ 2008-04-14 00:12:02 278,559 —-a-w c:\winnt\system32\odbcjt32.dll
- 2004-08-04 07:56:22 12,288 —-a-w c:\winnt\system32\odbcp32r.dll
+ 2008-04-13 17:26:05 12,288 —-a-w c:\winnt\system32\odbcp32r.dll
- 2004-08-04 07:56:44 147,456 —-a-w c:\winnt\system32\odbctrac.dll
+ 2008-04-14 00:12:02 147,456 —-a-w c:\winnt\system32\odbctrac.dll
- 2004-08-04 07:56:44 20,511 —-a-w c:\winnt\system32\oddbse32.dll
+ 2008-04-14 00:12:02 20,511 —-a-w c:\winnt\system32\oddbse32.dll
- 2004-08-04 07:56:44 20,510 —-a-w c:\winnt\system32\odexl32.dll
+ 2008-04-14 00:12:02 20,510 —-a-w c:\winnt\system32\odexl32.dll
- 2004-08-04 07:56:44 20,510 —-a-w c:\winnt\system32\odfox32.dll
+ 2008-04-14 00:12:02 20,510 —-a-w c:\winnt\system32\odfox32.dll
- 2004-08-04 07:56:44 20,510 —-a-w c:\winnt\system32\odpdx32.dll
+ 2008-04-14 00:12:02 20,510 —-a-w c:\winnt\system32\odpdx32.dll
- 2004-08-04 07:56:44 20,511 —-a-w c:\winnt\system32\odtext32.dll
+ 2008-04-14 00:12:02 20,511 —-a-w c:\winnt\system32\odtext32.dll
- 2004-08-04 07:56:44 120,832 —-a-w c:\winnt\system32\offfilt.dll
+ 2008-04-14 00:12:02 192,000 —-a-w c:\winnt\system32\offfilt.dll
- 2005-07-26 04:39:48 1,285,120 —-a-w c:\winnt\system32\ole32.dll
+ 2008-04-14 00:12:02 1,287,168 —-a-w c:\winnt\system32\ole32.dll
- 2007-12-04 18:38:13 550,912 ——w c:\winnt\system32\oleaut32.dll
+ 2008-04-14 00:12:02 551,936 ——w c:\winnt\system32\oleaut32.dll
- 2005-07-26 04:39:48 74,752 —-a-w c:\winnt\system32\olecli32.dll
+ 2008-04-14 00:12:02 74,752 —-a-w c:\winnt\system32\olecli32.dll
- 2005-07-26 04:39:49 37,888 —-a-w c:\winnt\system32\olecnv32.dll
+ 2008-04-14 00:12:02 37,376 —-a-w c:\winnt\system32\olecnv32.dll
- 2006-10-16 16:15:00 122,880 —-a-w c:\winnt\system32\oledlg.dll
+ 2008-04-14 00:12:02 122,880 —-a-w c:\winnt\system32\oledlg.dll
- 2004-08-04 07:56:44 107,008 —-a-w c:\winnt\system32\oleprn.dll
+ 2008-04-14 00:12:02 107,008 —-a-w c:\winnt\system32\oleprn.dll
- 2004-08-04 07:56:44 83,456 ——w c:\winnt\system32\olepro32.dll
+ 2008-04-14 00:12:02 84,992 —-a-w c:\winnt\system32\olepro32.dll
+ 2008-04-14 00:12:02 144,384 ——w c:\winnt\system32\onex.dll
- 2004-08-04 07:56:43 122,368 —-a-w c:\winnt\system32\oobe\msobcomm.dll
+ 2008-04-14 00:12:00 122,368 —-a-w c:\winnt\system32\oobe\msobcomm.dll
- 2004-08-04 07:56:43 16,384 —-a-w c:\winnt\system32\oobe\msobdl.dll
+ 2008-04-14 00:12:00 16,384 —-a-w c:\winnt\system32\oobe\msobdl.dll
- 2004-08-04 07:56:43 561,664 —-a-w c:\winnt\system32\oobe\msobmain.dll
+ 2008-04-14 00:12:00 565,248 —-a-w c:\winnt\system32\oobe\msobmain.dll
- 2004-08-04 07:56:43 30,720 —-a-w c:\winnt\system32\oobe\msobshel.dll
+ 2008-04-14 00:12:00 30,720 —-a-w c:\winnt\system32\oobe\msobshel.dll
- 2004-08-04 07:56:43 18,944 —-a-w c:\winnt\system32\oobe\msobweb.dll
+ 2008-04-14 00:12:00 19,456 —-a-w c:\winnt\system32\oobe\msobweb.dll
- 2001-08-23 08:00:00 28,160 —-a-w c:\winnt\system32\oobe\msoobe.exe
+ 2008-04-14 00:12:28 29,184 —-a-w c:\winnt\system32\oobe\msoobe.exe
- 2004-08-04 07:56:54 51,200 —-a-w c:\winnt\system32\oobe\oobebaln.exe
+ 2008-04-14 00:12:31 51,200 —-a-w c:\winnt\system32\oobe\oobebaln.exe
- 2004-08-04 07:56:54 67,584 —-a-w c:\winnt\system32\openfiles.exe
+ 2008-04-14 00:12:31 67,584 —-a-w c:\winnt\system32\openfiles.exe
- 2004-08-04 07:56:44 713,728 —-a-w c:\winnt\system32\opengl32.dll
+ 2008-04-14 00:12:02 713,728 —-a-w c:\winnt\system32\opengl32.dll
- 2004-08-04 07:56:55 215,552 —-a-w c:\winnt\system32\osk.exe
+ 2008-04-14 00:12:31 215,552 —-a-w c:\winnt\system32\osk.exe
- 2004-08-04 07:56:44 67,584 —-a-w c:\winnt\system32\osuninst.dll
+ 2008-04-14 00:12:02 67,584 —-a-w c:\winnt\system32\osuninst.dll
- 2004-08-04 07:56:44 116,224 ——w c:\winnt\system32\p2p.dll
+ 2008-04-14 00:12:02 153,600 ——w c:\winnt\system32\p2p.dll
- 2004-08-04 07:56:44 86,016 ——w c:\winnt\system32\p2pgasvc.dll
+ 2008-04-14 00:12:02 105,472 ——w c:\winnt\system32\p2pgasvc.dll
- 2004-08-04 07:56:44 312,320 ——w c:\winnt\system32\p2pgraph.dll
+ 2008-04-14 00:12:02 313,856 ——w c:\winnt\system32\p2pgraph.dll
- 2004-08-04 07:56:44 88,064 ——w c:\winnt\system32\p2pnetsh.dll
+ 2008-04-14 00:12:02 115,712 ——w c:\winnt\system32\p2pnetsh.dll
- 2004-08-04 07:56:44 526,848 ——w c:\winnt\system32\p2psvc.dll
+ 2008-04-14 00:12:02 554,496 ——w c:\winnt\system32\p2psvc.dll
- 2004-08-04 07:56:55 58,368 —-a-w c:\winnt\system32\packager.exe
+ 2008-04-14 00:12:31 58,368 —-a-w c:\winnt\system32\packager.exe
- 2004-08-04 07:56:44 62,976 —-a-w c:\winnt\system32\pautoenr.dll
+ 2008-04-14 00:12:02 67,584 —-a-w c:\winnt\system32\pautoenr.dll
- 2004-08-04 07:56:44 283,648 —-a-w c:\winnt\system32\pdh.dll
+ 2008-04-14 00:12:02 284,160 —-a-w c:\winnt\system32\pdh.dll
- 2009-01-05 04:48:36 64,640 —-a-w c:\winnt\system32\perfc009.dat
+ 2009-02-21 04:40:42 73,356 —-a-w c:\winnt\system32\perfc009.dat
- 2004-08-04 07:56:44 39,936 —-a-w c:\winnt\system32\perfctrs.dll
+ 2008-04-14 00:12:02 39,936 —-a-w c:\winnt\system32\perfctrs.dll
- 2004-08-04 07:56:44 26,624 —-a-w c:\winnt\system32\perfdisk.dll
+ 2008-04-14 00:12:02 26,624 —-a-w c:\winnt\system32\perfdisk.dll
- 2009-01-05 04:48:36 407,362 —-a-w c:\winnt\system32\perfh009.dat
+ 2009-02-21 04:40:42 447,422 —-a-w c:\winnt\system32\perfh009.dat
- 2004-08-04 07:56:55 15,872 —-a-w c:\winnt\system32\perfmon.exe
+ 2008-04-14 00:12:31 15,872 —-a-w c:\winnt\system32\perfmon.exe
- 2001-08-23 08:00:00 16,896 —-a-w c:\winnt\system32\perfnet.dll
+ 2008-04-14 00:12:02 17,920 —-a-w c:\winnt\system32\perfnet.dll
- 2004-08-04 07:56:44 25,088 —-a-w c:\winnt\system32\perfos.dll
+ 2008-04-14 00:12:02 25,088 —-a-w c:\winnt\system32\perfos.dll
- 2004-08-04 07:56:44 34,816 —-a-w c:\winnt\system32\perfproc.dll
+ 2008-04-14 00:12:02 34,816 —-a-w c:\winnt\system32\perfproc.dll
+ 2008-04-14 00:12:02 412,160 ——w c:\winnt\system32\photometadatahandler.dll
- 2004-08-04 07:56:44 176,128 —-a-w c:\winnt\system32\photowiz.dll
+ 2008-04-14 00:12:02 176,128 —-a-w c:\winnt\system32\photowiz.dll
- 2004-08-04 07:56:44 35,328 —-a-w c:\winnt\system32\pid.dll
+ 2008-04-14 00:12:02 35,328 —-a-w c:\winnt\system32\pid.dll
- 2004-08-04 07:56:04 24,064 —-a-w c:\winnt\system32\pidgen.dll
+ 2008-04-14 00:09:24 24,064 —-a-w c:\winnt\system32\pidgen.dll
- 2004-08-04 07:56:55 17,920 —-a-w c:\winnt\system32\ping.exe
+ 2008-04-14 00:12:31 17,920 —-a-w c:\winnt\system32\ping.exe
- 2004-08-04 07:56:44 15,360 —-a-w c:\winnt\system32\pjlmon.dll
+ 2008-04-14 00:12:02 15,360 —-a-w c:\winnt\system32\pjlmon.dll
- 2008-10-16 10:37:02 39,424 —-a-w c:\winnt\system32\pngfilt.dll
+ 2008-04-14 00:12:02 39,424 —-a-w c:\winnt\system32\pngfilt.dll
- 2004-08-04 07:56:44 48,640 ——w c:\winnt\system32\pnrpnsp.dll
+ 2008-04-14 00:12:02 58,880 ——w c:\winnt\system32\pnrpnsp.dll
- 2004-08-04 07:56:44 105,472 —-a-w c:\winnt\system32\polstore.dll
+ 2008-04-14 00:12:02 105,472 —-a-w c:\winnt\system32\polstore.dll
- 2004-08-04 07:56:55 49,152 ——w c:\winnt\system32\powercfg.exe
+ 2008-04-14 00:12:31 49,152 ——w c:\winnt\system32\powercfg.exe
- 2004-08-04 07:56:44 17,408 —-a-w c:\winnt\system32\powrprof.dll
+ 2008-04-14 00:12:03 17,408 —-a-w c:\winnt\system32\powrprof.dll
+ 2008-07-30 00:59:58 105,016 —-a-w c:\winnt\system32\PresentationCFFRasterizerNative_v0300.dll
+ 2008-07-30 01:35:46 326,160 —-a-w c:\winnt\system32\PresentationHost.exe
+ 2008-07-30 00:59:58 43,544 —-a-w c:\winnt\system32\PresentationHostProxy.dll
+ 2008-07-30 00:59:58 781,344 —-a-w c:\winnt\system32\PresentationNative_v0300.dll
- 2004-08-04 07:56:44 560,640 —-a-w c:\winnt\system32\printui.dll
+ 2008-04-14 00:12:03 560,640 —-a-w c:\winnt\system32\printui.dll
- 2004-08-04 07:56:44 27,648 —-a-w c:\winnt\system32\profmap.dll
+ 2008-04-14 00:12:03 27,648 —-a-w c:\winnt\system32\profmap.dll
- 2004-08-04 07:56:55 109,568 —-a-w c:\winnt\system32\progman.exe
+ 2008-04-14 00:12:31 109,568 —-a-w c:\winnt\system32\progman.exe
- 2004-08-04 07:56:55 50,176 —-a-w c:\winnt\system32\proquota.exe
+ 2008-04-14 00:12:32 50,176 —-a-w c:\winnt\system32\proquota.exe
- 2004-08-04 07:56:55 9,216 —-a-w c:\winnt\system32\proxycfg.exe
+ 2008-04-14 00:12:32 9,216 —-a-w c:\winnt\system32\proxycfg.exe
- 2004-08-04 07:56:44 23,040 ——w c:\winnt\system32\psapi.dll
+ 2008-04-14 00:12:03 23,040 —-a-w c:\winnt\system32\psapi.dll
- 2004-08-04 07:56:44 96,768 —-a-w c:\winnt\system32\psbase.dll
+ 2008-04-14 00:12:03 96,768 —-a-w c:\winnt\system32\psbase.dll
- 2004-08-04 07:56:44 363,520 —-a-w c:\winnt\system32\psisdecd.dll
+ 2008-04-14 00:12:03 363,520 —-a-w c:\winnt\system32\psisdecd.dll
- 2004-08-04 07:56:44 43,520 —-a-w c:\winnt\system32\pstorec.dll
+ 2008-04-14 00:12:03 43,520 —-a-w c:\winnt\system32\pstorec.dll
- 2004-08-04 07:56:44 34,304 —-a-w c:\winnt\system32\pstorsvc.dll
+ 2008-04-14 00:12:03 34,304 —-a-w c:\winnt\system32\pstorsvc.dll
+ 2008-04-14 00:12:03 150,528 ——w c:\winnt\system32\qagent.dll
+ 2008-04-14 00:12:03 291,328 ——w c:\winnt\system32\qagentrt.dll
- 2004-08-04 07:56:44 192,512 —-a-w c:\winnt\system32\qcap.dll
+ 2008-04-14 00:12:03 192,512 —-a-w c:\winnt\system32\qcap.dll
+ 2008-04-14 00:12:03 62,464 ——w c:\winnt\system32\qcliprov.dll
- 2004-08-04 07:56:44 279,040 —-a-w c:\winnt\system32\qdv.dll
+ 2008-04-14 00:12:03 279,040 —-a-w c:\winnt\system32\qdv.dll
- 2004-08-04 07:56:44 385,024 —-a-w c:\winnt\system32\qdvd.dll
+ 2008-04-14 00:12:03 386,048 —-a-w c:\winnt\system32\qdvd.dll
- 2004-08-04 07:56:44 562,176 —-a-w c:\winnt\system32\qedit.dll
+ 2008-04-14 00:12:03 562,176 —-a-w c:\winnt\system32\qedit.dll
- 2004-08-04 07:56:24 733,696 —-a-w c:\winnt\system32\qedwipes.dll
+ 2008-04-13 17:21:32 733,696 —-a-w c:\winnt\system32\qedwipes.dll
- 2004-08-04 07:56:44 382,464 —-a-w c:\winnt\system32\qmgr.dll
+ 2008-04-14 00:12:03 409,088 —-a-w c:\winnt\system32\qmgr.dll
- 2004-08-04 07:56:44 18,944 —-a-w c:\winnt\system32\qmgrprxy.dll
+ 2008-04-14 00:12:03 18,944 —-a-w c:\winnt\system32\qmgrprxy.dll
- 2004-08-04 07:56:55 20,480 —-a-w c:\winnt\system32\qprocess.exe
+ 2008-04-14 00:12:32 19,968 —-a-w c:\winnt\system32\qprocess.exe
- 2008-05-07 05:18:48 1,287,680 —-a-w c:\winnt\system32\quartz.dll
+ 2008-05-07 05:12:40 1,288,192 —-a-w c:\winnt\system32\quartz.dll
- 2006-06-22 05:06:30 1,435,648 —-a-w c:\winnt\system32\query.dll
+ 2008-04-14 00:12:03 1,435,648 —-a-w c:\winnt\system32\query.dll
+ 2008-04-14 00:12:03 76,800 ——w c:\winnt\system32\qutil.dll
- 2004-08-04 07:56:44 43,520 —-a-w c:\winnt\system32\racpldlg.dll
+ 2008-04-14 00:12:03 43,520 —-a-w c:\winnt\system32\racpldlg.dll
- 2006-06-26 17:37:10 8,192 —-a-w c:\winnt\system32\rasadhlp.dll
+ 2008-04-14 00:12:03 7,680 —-a-w c:\winnt\system32\rasadhlp.dll
- 2004-08-04 07:56:44 236,544 —-a-w c:\winnt\system32\rasapi32.dll
+ 2008-04-14 00:12:03 237,056 —-a-w c:\winnt\system32\rasapi32.dll
- 2004-08-04 07:56:44 89,088 —-a-w c:\winnt\system32\rasauto.dll
+ 2008-04-14 00:12:03 88,576 —-a-w c:\winnt\system32\rasauto.dll
- 2004-08-04 07:56:44 69,632 —-a-w c:\winnt\system32\raschap.dll
+ 2008-04-14 00:12:03 79,872 —-a-w c:\winnt\system32\raschap.dll
- 2004-08-04 07:56:44 657,920 —-a-w c:\winnt\system32\rasdlg.dll
+ 2008-04-14 00:12:03 658,432 —-a-w c:\winnt\system32\rasdlg.dll
- 2004-08-04 07:56:44 61,440 —-a-w c:\winnt\system32\rasman.dll
+ 2008-04-14 00:12:03 61,440 —-a-w c:\winnt\system32\rasman.dll
- 2006-05-14 08:44:08 181,248 —-a-w c:\winnt\system32\rasmans.dll
+ 2008-04-14 00:12:03 186,368 —-a-w c:\winnt\system32\rasmans.dll
- 2004-08-04 07:56:55 56,832 —-a-w c:\winnt\system32\rasphone.exe
+ 2008-04-14 00:12:32 56,832 —-a-w c:\winnt\system32\rasphone.exe
- 2004-08-04 07:56:44 206,336 —-a-w c:\winnt\system32\rasppp.dll
+ 2008-04-14 00:12:03 210,944 —-a-w c:\winnt\system32\rasppp.dll
+ 2008-04-14 00:12:03 61,952 ——w c:\winnt\system32\rasqec.dll
- 2004-08-04 07:56:44 16,896 —-a-w c:\winnt\system32\rassapi.dll
+ 2008-04-14 00:12:03 16,384 —-a-w c:\winnt\system32\rassapi.dll
- 2004-08-04 07:56:44 58,880 —-a-w c:\winnt\system32\rastapi.dll
+ 2008-04-14 00:12:03 58,368 —-a-w c:\winnt\system32\rastapi.dll
- 2004-08-04 07:56:44 112,128 —-a-w c:\winnt\system32\rastls.dll
+ 2008-04-14 00:12:03 150,016 —-a-w c:\winnt\system32\rastls.dll
- 2004-08-04 07:56:44 102,400 —-a-w c:\winnt\system32\rcbdyctl.dll
+ 2008-04-14 00:12:03 102,400 —-a-w c:\winnt\system32\rcbdyctl.dll
- 2004-08-04 07:56:55 35,840 —-a-w c:\winnt\system32\rcimlby.exe
+ 2008-04-14 00:12:32 35,840 —-a-w c:\winnt\system32\rcimlby.exe
- 2004-08-04 07:56:55 21,504 —-a-w c:\winnt\system32\rcp.exe
+ 2008-04-14 00:12:32 21,504 —-a-w c:\winnt\system32\rcp.exe
- 2004-08-04 07:56:44 147,968 —-a-w c:\winnt\system32\rdchost.dll
+ 2008-04-14 00:12:03 147,968 —-a-w c:\winnt\system32\rdchost.dll
- 2004-08-04 07:56:55 62,464 —-a-w c:\winnt\system32\rdpclip.exe
+ 2008-04-14 00:12:32 62,976 —-a-w c:\winnt\system32\rdpclip.exe
- 2004-08-04 08:01:07 92,168 —-a-w c:\winnt\system32\rdpdd.dll
+ 2008-04-14 00:13:22 92,424 —-a-w c:\winnt\system32\rdpdd.dll
- 2004-08-04 07:56:44 19,968 —-a-w c:\winnt\system32\rdpsnd.dll
+ 2008-04-14 00:12:04 19,968 —-a-w c:\winnt\system32\rdpsnd.dll
- 2004-08-04 08:01:08 87,176 —-a-w c:\winnt\system32\rdpwsx.dll
+ 2008-04-14 00:13:22 87,176 —-a-w c:\winnt\system32\rdpwsx.dll
- 2004-08-04 07:56:55 13,824 —-a-w c:\winnt\system32\rdsaddin.exe
+ 2008-04-14 00:12:32 13,824 —-a-w c:\winnt\system32\rdsaddin.exe
- 2004-08-04 07:56:55 67,072 —-a-w c:\winnt\system32\rdshost.exe
+ 2008-04-14 00:12:32 67,072 —-a-w c:\winnt\system32\rdshost.exe
- 2004-08-04 07:56:55 50,176 —-a-w c:\winnt\system32\reg.exe
+ 2008-04-14 00:12:32 50,176 —-a-w c:\winnt\system32\reg.exe
- 2004-08-04 07:56:44 49,664 —-a-w c:\winnt\system32\regapi.dll
+ 2008-04-14 00:12:04 49,664 —-a-w c:\winnt\system32\regapi.dll
- 2004-08-04 07:56:44 59,904 —-a-w c:\winnt\system32\regsvc.dll
+ 2008-04-14 00:12:04 59,904 —-a-w c:\winnt\system32\regsvc.dll
- 2004-08-04 07:56:55 11,776 ——w c:\winnt\system32\regsvr32.exe
+ 2008-04-14 00:12:32 11,776 ——w c:\winnt\system32\regsvr32.exe
- 2004-08-04 07:56:44 397,824 —-a-w c:\winnt\system32\regwizc.dll
+ 2008-04-14 00:12:04 397,824 —-a-w c:\winnt\system32\regwizc.dll
+ 2004-08-04 06:10:38 17,024 —-a-w c:\winnt\system32\ReinstallBackups\
0011\DriverFiles\i386\bthenum.sys
+ 2004-08-04 06:10:38 38,016 —-a-w c:\winnt\system32\ReinstallBackups\
0013\DriverFiles\i386\bthmodem.sys
+ 2004-08-04 05:58:38 100,992 —-a-w c:\winnt\system32\ReinstallBackups\
0014\DriverFiles\i386\bthpan.sys
+ 2004-08-04 06:10:38 17,024 —-a-w c:\winnt\system32\ReinstallBackups\
0015\DriverFiles\i386\BthEnum.sys
+ 2004-08-04 06:56:50 152,576 —-a-w c:\winnt\system32\ReinstallBackups\
0015\DriverFiles\i386\irftp.exe
+ 2004-08-04 06:56:42 27,136 —-a-w c:\winnt\system32\ReinstallBackups\
0015\DriverFiles\i386\irmon.dll
+ 2004-08-04 06:10:39 59,648 —-a-w c:\winnt\system32\ReinstallBackups\
0015\DriverFiles\i386\rfcomm.sys
+ 2004-08-04 07:56:46 108,032 —-a-w c:\winnt\system32\ReinstallBackups\
0015\DriverFiles\i386\wshBth.dll
+ 2004-08-04 06:56:46 8,192 —-a-w c:\winnt\system32\ReinstallBackups\
0015\DriverFiles\i386\wshirda.dll
+ 2004-08-04 06:10:38 38,016 —-a-w c:\winnt\system32\ReinstallBackups\
0016\DriverFiles\i386\bthmodem.sys
+ 2004-08-04 06:10:38 38,016 —-a-w c:\winnt\system32\ReinstallBackups\
0017\DriverFiles\i386\bthmodem.sys
+ 2004-08-04 05:59:19 36,096 —-a-w c:\winnt\system32\ReinstallBackups\
0018\DriverFiles\i386\intelppm.sys
- 2004-08-04 07:56:44 60,416 —-a-w c:\winnt\system32\remotepg.dll
+ 2008-04-14 00:12:04 60,416 —-a-w c:\winnt\system32\remotepg.dll
- 2004-08-04 07:56:55 380,416 —-a-w c:\winnt\system32\Restore\rstrui.exe
+ 2008-04-14 00:12:33 380,416 —-a-w c:\winnt\system32\Restore\rstrui.exe
- 2004-08-04 07:56:44 58,880 —-a-w c:\winnt\system32\resutils.dll
+ 2008-04-14 00:12:04 58,880 —-a-w c:\winnt\system32\resutils.dll
- 2004-08-04 07:56:55 13,824 —-a-w c:\winnt\system32\rexec.exe
+ 2008-04-14 00:12:33 13,824 —-a-w c:\winnt\system32\rexec.exe
+ 2006-08-24 21:15:06 150,808 —-a-w c:\winnt\system32\rgb9rast_2.dll
+ 2008-04-14 00:12:04 290,304 ——w c:\winnt\system32\rhttpaa.dll
- 2006-11-27 14:54:06 433,152 —-a-w c:\winnt\system32\riched20.dll
+ 2008-04-14 00:12:04 433,664 —-a-w c:\winnt\system32\riched20.dll
- 2007-07-09 13:09:42 584,192 —-a-w c:\winnt\system32\rpcrt4.dll
+ 2008-04-14 00:12:04 584,704 —-a-w c:\winnt\system32\rpcrt4.dll
- 2005-07-26 04:39:49 397,824 —-a-w c:\winnt\system32\rpcss.dll
+ 2008-04-14 00:12:04 399,360 —-a-w c:\winnt\system32\rpcss.dll
- 2004-08-04 05:31:43 152,576 —-a-w c:\winnt\system32\rsaenh.dll
+ 2008-04-13 17:37:57 208,384 —-a-w c:\winnt\system32\rsaenh.dll
- 2004-08-04 07:56:55 14,848 —-a-w c:\winnt\system32\rsh.exe
+ 2008-04-14 00:12:33 14,848 —-a-w c:\winnt\system32\rsh.exe
- 2004-08-04 07:56:44 39,936 —-a-w c:\winnt\system32\rshx32.dll
+ 2008-04-14 00:12:04 39,936 —-a-w c:\winnt\system32\rshx32.dll
- 2004-08-04 07:56:44 18,944 —-a-w c:\winnt\system32\rsmps.dll
+ 2008-04-14 00:12:04 18,944 —-a-w c:\winnt\system32\rsmps.dll
- 2004-08-04 07:56:55 107,520 —-a-w c:\winnt\system32\rsnotify.exe
+ 2008-04-14 00:12:33 107,520 —-a-w c:\winnt\system32\rsnotify.exe
- 2001-08-23 08:00:00 90,112 —-a-w c:\winnt\system32\rsvpsp.dll
+ 2008-04-14 00:12:04 92,672 —-a-w c:\winnt\system32\rsvpsp.dll
- 2004-08-04 07:56:55 77,312 —-a-w c:\winnt\system32\rtcshare.exe
+ 2008-04-14 00:12:33 77,312 —-a-w c:\winnt\system32\rtcshare.exe
- 2004-08-04 07:56:44 31,744 —-a-w c:\winnt\system32\rtipxmib.dll
+ 2008-04-14 00:12:04 31,744 —-a-w c:\winnt\system32\rtipxmib.dll
- 2004-08-04 07:56:44 44,032 —-a-w c:\winnt\system32\rtutils.dll
+ 2008-04-14 00:12:04 44,032 —-a-w c:\winnt\system32\rtutils.dll
- 2004-08-04 07:56:55 33,280 —-a-w c:\winnt\system32\rundll32.exe
+ 2008-04-14 00:12:33 33,280 —-a-w c:\winnt\system32\rundll32.exe
- 2004-08-04 07:56:55 14,336 —-a-w c:\winnt\system32\runonce.exe
+ 2008-04-14 00:12:33 14,336 —-a-w c:\winnt\system32\runonce.exe
- 2004-08-04 07:56:44 9,728 ——w c:\winnt\system32\rwnh.dll
+ 2008-04-14 00:12:04 9,728 ——w c:\winnt\system32\rwnh.dll
- 2004-08-04 07:56:44 397,056 ——w c:\winnt\system32\s3gnb.dll
+ 2008-04-14 00:12:04 397,056 ——w c:\winnt\system32\s3gnb.dll
- 2004-08-04 07:56:44 43,520 —-a-w c:\winnt\system32\safrcdlg.dll
+ 2008-04-14 00:12:04 43,520 —-a-w c:\winnt\system32\safrcdlg.dll
- 2004-08-04 07:56:44 29,696 —-a-w c:\winnt\system32\safrdm.dll
+ 2008-04-14 00:12:04 29,696 —-a-w c:\winnt\system32\safrdm.dll
- 2004-08-04 07:56:44 45,568 —-a-w c:\winnt\system32\safrslv.dll
+ 2008-04-14 00:12:04 45,568 —-a-w c:\winnt\system32\safrslv.dll
- 2004-08-04 07:56:44 64,000 —-a-w c:\winnt\system32\samlib.dll
+ 2008-04-14 00:12:04 64,000 —-a-w c:\winnt\system32\samlib.dll
- 2004-08-04 07:56:44 415,744 —-a-w c:\winnt\system32\samsrv.dll
+ 2008-04-14 00:12:04 415,744 —-a-w c:\winnt\system32\samsrv.dll
- 2004-08-04 07:56:55 13,312 —-a-w c:\winnt\system32\savedump.exe
+ 2008-04-14 00:12:33 13,312 —-a-w c:\winnt\system32\savedump.exe
- 2004-08-04 07:56:44 270,848 —-a-w c:\winnt\system32\sbe.dll
+ 2008-04-14 00:12:04 270,848 —-a-w c:\winnt\system32\sbe.dll
- 2004-08-04 07:56:44 159,232 —-a-w c:\winnt\system32\sbeio.dll
+ 2008-04-14 00:12:04 159,232 —-a-w c:\winnt\system32\sbeio.dll
- 2004-08-04 07:56:44 69,632 —-a-w c:\winnt\system32\scarddlg.dll
+ 2008-04-14 00:12:04 69,632 —-a-w c:\winnt\system32\scarddlg.dll
- 2004-08-04 07:56:55 95,744 —-a-w c:\winnt\system32\scardsvr.exe
+ 2008-04-14 00:12:33 95,744 —-a-w c:\winnt\system32\scardsvr.exe
- 2004-08-04 07:56:44 171,008 —-a-w c:\winnt\system32\sccsccp.dll
+ 2008-04-14 00:12:05 171,008 —-a-w c:\winnt\system32\sccsccp.dll
- 2004-08-04 07:56:44 180,224 —-a-w c:\winnt\system32\scecli.dll
+ 2008-04-14 00:12:05 181,248 —-a-w c:\winnt\system32\scecli.dll
- 2004-08-04 07:56:44 313,856 —-a-w c:\winnt\system32\scesrv.dll
+ 2008-04-14 00:12:05 314,880 —-a-w c:\winnt\system32\scesrv.dll
- 2007-04-25 14:21:15 144,896 —-a-w c:\winnt\system32\schannel.dll
+ 2008-04-14 00:12:05 144,384 —-a-w c:\winnt\system32\schannel.dll
- 2004-08-04 07:56:44 190,976 —-a-w c:\winnt\system32\schedsvc.dll
+ 2008-04-14 00:12:05 192,512 —-a-w c:\winnt\system32\schedsvc.dll
- 2004-08-04 07:56:55 121,856 —-a-w c:\winnt\system32\schtasks.exe
+ 2008-04-14 00:12:34 121,856 —-a-w c:\winnt\system32\schtasks.exe
- 2004-08-04 07:56:44 20,992 —-a-w c:\winnt\system32\sclgntfy.dll
+ 2008-04-14 00:12:05 20,480 —-a-w c:\winnt\system32\sclgntfy.dll
- 2004-08-04 07:56:57 9,216 —-a-w c:\winnt\system32\scrnsave.scr
+ 2008-04-14 00:12:43 9,216 —-a-w c:\winnt\system32\scrnsave.scr
- 2004-08-04 07:56:44 159,744 —-a-w c:\winnt\system32\scrobj.dll
+ 2008-05-09 10:53:39 180,224 —-a-w c:\winnt\system32\scrobj.dll
- 2004-08-04 07:56:44 151,552 —-a-w c:\winnt\system32\scrrun.dll
+ 2008-05-09 10:53:40 172,032 —-a-w c:\winnt\system32\scrrun.dll
- 2004-08-04 07:56:55 77,312 —-a-w c:\winnt\system32\sdbinst.exe
+ 2008-04-14 00:12:34 77,312 —-a-w c:\winnt\system32\sdbinst.exe
- 2004-08-04 07:56:44 29,184 ——w c:\winnt\system32\sdhcinst.dll
+ 2008-04-14 00:12:05 29,184 ——w c:\winnt\system32\sdhcinst.dll
- 2004-08-04 07:56:55 18,432 —-a-w c:\winnt\system32\secedit.exe
+ 2008-04-14 00:12:34 18,944 —-a-w c:\winnt\system32\secedit.exe
- 2004-08-04 07:56:44 18,944 —-a-w c:\winnt\system32\seclogon.dll
+ 2008-04-14 00:12:05 18,944 —-a-w c:\winnt\system32\seclogon.dll
- 2004-08-04 07:56:44 55,808 —-a-w c:\winnt\system32\secur32.dll
+ 2008-04-14 00:12:05 56,320 —-a-w c:\winnt\system32\secur32.dll
- 2004-08-04 07:56:44 5,632 —-a-w c:\winnt\system32\security.dll
+ 2008-04-14 00:12:05 5,632 —-a-w c:\winnt\system32\security.dll
- 2004-08-04 07:56:44 29,184 —-a-w c:\winnt\system32\sendcmsg.dll
+ 2008-04-14 00:12:05 29,184 —-a-w c:\winnt\system32\sendcmsg.dll
- 2004-08-04 07:56:44 55,296 —-a-w c:\winnt\system32\sendmail.dll
+ 2008-04-14 00:12:05 54,784 —-a-w c:\winnt\system32\sendmail.dll
- 2004-08-04 07:56:44 38,912 —-a-w c:\winnt\system32\sens.dll
+ 2008-04-14 00:12:05 39,424 —-a-w c:\winnt\system32\sens.dll
- 2004-08-04 07:56:44 6,656 —-a-w c:\winnt\system32\sensapi.dll
+ 2008-04-14 00:12:05 7,168 —-a-w c:\winnt\system32\sensapi.dll
- 2004-08-04 07:56:44 56,320 —-a-w c:\winnt\system32\servdeps.dll
+ 2008-04-14 00:12:05 56,320 —-a-w c:\winnt\system32\servdeps.dll
- 2004-08-04 07:56:55 108,032 —-a-w c:\winnt\system32\services.exe
+ 2008-04-14 00:12:34 108,544 —-a-w c:\winnt\system32\services.exe
- 2004-08-04 07:56:56 140,800 —-a-w c:\winnt\system32\sessmgr.exe
+ 2008-04-14 00:12:34 141,312 —-a-w c:\winnt\system32\sessmgr.exe
- 2004-08-04 07:56:56 31,232 —-a-w c:\winnt\system32\sethc.exe
+ 2008-04-14 00:12:34 31,232 —-a-w c:\winnt\system32\sethc.exe
- 2004-08-04 07:56:56 23,040 —-a-w c:\winnt\system32\setup.exe
+ 2008-04-14 00:12:34 23,040 —-a-w c:\winnt\system32\setup.exe
- 2001-08-23 08:00:00 259,584 —-a-w c:\winnt\system32\Setup\comsetup.dll
+ 2008-04-14 00:11:51 274,944 —-a-w c:\winnt\system32\Setup\comsetup.dll
- 2004-08-04 07:56:42 32,828 —-a-w c:\winnt\system32\Setup\fp40ext.dll
+ 2008-04-14 00:11:53 32,828 —-a-w c:\winnt\system32\Setup\fp40ext.dll
- 2004-08-04 07:56:42 132,608 —-a-w c:\winnt\system32\Setup\fxsocm.dll
+ 2008-04-14 00:11:54 132,608 —-a-w c:\winnt\system32\Setup\fxsocm.dll
- 2004-08-04 07:56:42 505,344 —-a-w c:\winnt\system32\Setup\iis.dll
+ 2008-04-14 00:11:54 505,344 —-a-w c:\winnt\system32\Setup\iis.dll
- 2001-08-23 08:00:00 115,712 —-a-w c:\winnt\system32\Setup\imsinsnt.dll
+ 2008-04-14 00:11:54 123,392 —-a-w c:\winnt\system32\Setup\imsinsnt.dll
+ 2008-04-14 00:11:56 8,192 —-a-w c:\winnt\system32\Setup\koc.dll
- 2004-08-04 07:56:42 16,896 —-a-w c:\winnt\system32\Setup\medctroc.dll
+ 2008-04-14 00:11:56 16,896 —-a-w c:\winnt\system32\Setup\medctroc.dll
- 2001-08-23 08:00:00 82,432 —-a-w c:\winnt\system32\Setup\msdtcstp.dll
+ 2008-04-14 00:11:59 90,112 —-a-w c:\winnt\system32\Setup\msdtcstp.dll
- 2004-08-04 07:56:43 15,360 —-a-w c:\winnt\system32\Setup\msgrocm.dll
+ 2008-04-14 00:11:59 15,360 —-a-w c:\winnt\system32\Setup\msgrocm.dll
- 2004-08-04 07:56:43 169,984 —-a-w c:\winnt\system32\Setup\msmqocm.dll
+ 2008-04-14 00:12:00 170,496 —-a-w c:\winnt\system32\Setup\msmqocm.dll
- 2004-08-04 07:56:44 77,312 —-a-w c:\winnt\system32\Setup\netoc.dll
+ 2008-04-14 00:12:01 77,312 —-a-w c:\winnt\system32\Setup\netoc.dll
- 2004-08-04 07:56:44 62,976 —-a-w c:\winnt\system32\Setup\ntoc.dll
+ 2008-04-14 00:12:02 62,976 —-a-w c:\winnt\system32\Setup\ntoc.dll
- 2004-08-04 07:56:44 15,872 —-a-w c:\winnt\system32\Setup\ocgen.dll
+ 2008-04-14 00:12:02 15,360 —-a-w c:\winnt\system32\Setup\ocgen.dll
- 2004-08-04 07:56:44 17,408 —-a-w c:\winnt\system32\Setup\ocmsn.dll
+ 2008-04-14 00:12:02 17,408 —-a-w c:\winnt\system32\Setup\ocmsn.dll
- 2004-08-04 07:56:44 101,376 —-a-w c:\winnt\system32\Setup\setupqry.dll
+ 2008-04-14 00:12:05 101,376 —-a-w c:\winnt\system32\Setup\setupqry.dll
- 2004-08-04 07:56:46 33,792 —-a-w c:\winnt\system32\Setup\tabletoc.dll
+ 2008-04-14 00:12:07 33,792 —-a-w c:\winnt\system32\Setup\tabletoc.dll
- 2004-08-04 07:56:46 121,856 —-a-w c:\winnt\system32\Setup\tsoc.dll
+ 2008-04-14 00:12:07 130,048 —-a-w c:\winnt\system32\Setup\tsoc.dll
- 2004-08-04 05:56:46 983,552 —-a-w c:\winnt\system32\setupapi.dll
+ 2008-04-14 10:42:06 985,088 —-a-w c:\winnt\system32\setupapi.dll
+ 2008-04-14 00:12:35 32,768 ——w c:\winnt\system32\setupn.exe
- 2004-08-04 07:56:44 5,120 —-a-w c:\winnt\system32\sfc.dll
+ 2008-04-14 00:12:05 5,120 —-a-w c:\winnt\system32\sfc.dll
- 2004-08-04 07:56:44 140,288 —-a-w c:\winnt\system32\sfc_os.dll
+ 2008-04-14 00:12:05 140,288 —-a-w c:\winnt\system32\sfc_os.dll
- 2004-08-04 07:56:45 1,580,544 —-a-w c:\winnt\system32\sfcfiles.dll
+ 2008-04-14 00:12:05 1,614,848 —-a-w c:\winnt\system32\sfcfiles.dll
- 2004-08-04 07:56:27 549,376 —-a-w c:\winnt\system32\shdoclc.dll
+ 2008-04-13 17:03:19 549,376 —-a-w c:\winnt\system32\shdoclc.dll
- 2008-10-16 10:37:03 1,494,528 —-a-w c:\winnt\system32\shdocvw.dll
+ 2008-10-16 01:00:10 1,499,136 —-a-w c:\winnt\system32\shdocvw.dll
- 2007-10-26 03:36:51 8,454,656 —-a-w c:\winnt\system32\shell32.dll
+ 2008-04-14 00:12:05 8,461,312 —-a-w c:\winnt\system32\shell32.dll
- 2004-08-04 07:56:45 25,088 —-a-w c:\winnt\system32\shfolder.dll
+ 2008-04-14 00:12:05 25,088 —-a-w c:\winnt\system32\shfolder.dll
- 2004-08-04 07:56:45 68,096 —-a-w c:\winnt\system32\shgina.dll
+ 2008-04-14 00:12:05 68,096 —-a-w c:\winnt\system32\shgina.dll
- 2004-08-04 07:56:45 65,536 —-a-w c:\winnt\system32\shimeng.dll
+ 2008-04-14 00:12:05 65,024 —-a-w c:\winnt\system32\shimeng.dll
- 2004-08-04 07:56:45 438,272 —-a-w c:\winnt\system32\shimgvw.dll
+ 2008-04-14 00:12:05 438,272 —-a-w c:\winnt\system32\shimgvw.dll
- 2008-10-16 10:37:03 474,112 —-a-w c:\winnt\system32\shlwapi.dll
+ 2008-04-14 00:12:05 474,112 —-a-w c:\winnt\system32\shlwapi.dll
- 2004-08-04 07:56:45 151,552 —-a-w c:\winnt\system32\shmedia.dll
+ 2008-04-14 00:12:05 152,064 —-a-w c:\winnt\system32\shmedia.dll
- 2004-08-04 07:56:56 42,496 —-a-w c:\winnt\system32\shmgrate.exe
+ 2008-04-14 00:12:35 45,056 —-a-w c:\winnt\system32\shmgrate.exe
- 2004-08-04 07:56:56 77,824 —-a-w c:\winnt\system32\shrpubw.exe
+ 2008-04-14 00:12:35 77,824 —-a-w c:\winnt\system32\shrpubw.exe
- 2004-08-04 07:56:45 27,648 —-a-w c:\winnt\system32\shscrap.dll
+ 2008-04-14 00:12:05 27,648 —-a-w c:\winnt\system32\shscrap.dll
- 2006-12-19 21:52:18 134,656 —-a-w c:\winnt\system32\shsvcs.dll
+ 2008-04-14 00:12:05 135,168 —-a-w c:\winnt\system32\shsvcs.dll
- 2004-08-04 07:56:56 19,456 —-a-w c:\winnt\system32\shutdown.exe
+ 2008-04-14 00:12:35 19,456 —-a-w c:\winnt\system32\shutdown.exe
- 2004-08-04 07:56:45 13,312 —-a-w c:\winnt\system32\sigtab.dll
+ 2008-04-14 00:12:05 13,312 —-a-w c:\winnt\system32\sigtab.dll
- 2004-08-04 07:56:56 70,144 —-a-w c:\winnt\system32\sigverif.exe
+ 2008-04-14 00:12:35 70,144 —-a-w c:\winnt\system32\sigverif.exe
- 2004-08-04 07:56:56 26,112 —-a-w c:\winnt\system32\skeys.exe
+ 2008-04-14 00:12:35 26,112 —-a-w c:\winnt\system32\skeys.exe
- 2004-08-04 07:56:45 25,088 —-a-w c:\winnt\system32\slayerxp.dll
+ 2008-04-14 00:12:06 25,088 —-a-w c:\winnt\system32\slayerxp.dll
- 2004-08-04 07:56:45 98,304 —-a-w c:\winnt\system32\slbiop.dll
+ 2008-04-14 00:12:06 98,304 —-a-w c:\winnt\system32\slbiop.dll
- 2004-08-04 07:56:45 73,832 ——w c:\winnt\system32\slcoinst.dll
+ 2008-04-14 00:12:06 73,832 ——w c:\winnt\system32\slcoinst.dll
- 2004-08-04 07:56:45 286,792 ——w c:\winnt\system32\slextspk.dll
+ 2008-04-14 00:12:06 286,792 ——w c:\winnt\system32\slextspk.dll
- 2004-08-04 07:56:45 188,508 ——w c:\winnt\system32\slgen.dll
+ 2008-04-14 00:12:06 188,508 ——w c:\winnt\system32\slgen.dll
- 2004-08-04 07:56:56 32,866 ——w c:\winnt\system32\slrundll.exe
+ 2008-04-14 00:12:35 32,866 ——w c:\winnt\system32\slrundll.exe
- 2004-08-04 07:56:56 73,796 ——w c:\winnt\system32\slserv.exe
+ 2008-04-14 00:12:35 73,796 ——w c:\winnt\system32\slserv.exe
- 2004-08-04 07:56:56 8,192 ——w c:\winnt\system32\smbinst.exe
+ 2008-04-14 00:12:35 8,192 ——w c:\winnt\system32\smbinst.exe
- 2004-08-04 07:56:45 363,008 —-a-w c:\winnt\system32\smlogcfg.dll
+ 2008-04-14 00:12:06 362,496 —-a-w c:\winnt\system32\smlogcfg.dll
- 2004-08-04 07:56:56 89,600 —-a-w c:\winnt\system32\smlogsvc.exe
+ 2008-04-14 00:12:35 89,600 —-a-w c:\winnt\system32\smlogsvc.exe
- 2004-08-04 07:56:56 50,688 —-a-w c:\winnt\system32\smss.exe
+ 2008-04-14 00:12:36 50,688 —-a-w c:\winnt\system32\smss.exe
- 2004-08-04 07:56:45 10,752 ——w c:\winnt\system32\smtpapi.dll
+ 2008-04-14 00:12:06 10,752 ——w c:\winnt\system32\smtpapi.dll
- 2004-08-04 07:56:56 131,584 —-a-w c:\winnt\system32\sndrec32.exe
+ 2008-04-14 00:12:36 131,584 —-a-w c:\winnt\system32\sndrec32.exe
- 2004-08-04 07:56:45 18,944 —-a-w c:\winnt\system32\snmpapi.dll
+ 2008-04-14 00:12:06 18,944 —-a-w c:\winnt\system32\snmpapi.dll
- 2004-08-04 07:56:45 182,272 —-a-w c:\winnt\system32\snmpsnap.dll
+ 2008-04-14 00:12:06 182,272 —-a-w c:\winnt\system32\snmpsnap.dll
+ 2008-10-16 19:12:20 561,688 —-a-w c:\winnt\system32\SoftwareDistribution\Setup\ServiceStartup\wuapi.dll\7.2.6001.788\wuapi.dll
+ 2008-10-16 19:08:58 34,328 —-a-w c:\winnt\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.2.6001.788\wups.dll
+ 2008-10-16 19:09:44 43,544 —-a-w c:\winnt\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.2.6001.788\wups2.dll
- 2001-08-23 08:00:00 23,552 —-a-w c:\winnt\system32\sort.exe
+ 2008-04-14 00:12:36 24,576 —-a-w c:\winnt\system32\sort.exe
- 2004-08-04 07:56:56 8,192 —-a-w c:\winnt\system32\spdwnwxp.exe
+ 2008-04-14 00:12:36 7,680 —-a-w c:\winnt\system32\spdwnwxp.exe
- 2004-08-04 07:56:57 538,624 —-a-w c:\winnt\system32\spider.exe
+ 2008-04-14 00:12:36 538,624 —-a-w c:\winnt\system32\spider.exe
- 2004-08-04 05:59:34 12,800 —-a-w c:\winnt\system32\spiisupd.exe
+ 2008-04-13 18:43:31 12,800 —-a-w c:\winnt\system32\spiisupd.exe
- 2007-11-30 12:39:22 17,272 ——w c:\winnt\system32\spmsg.dll
+ 2008-07-09 07:38:24 17,272 ——w c:\winnt\system32\spmsg.dll
- 2004-08-04 05:56:58 11,776 ——w c:\winnt\system32\spnpinst.exe
+ 2008-04-14 10:42:38 11,264 ——w c:\winnt\system32\spnpinst.exe
- 2004-08-04 07:56:42 452,096 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\fxsapi.dll
+ 2008-04-14 00:11:53 451,584 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\fxsapi.dll
- 2004-08-04 07:56:42 27,136 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\fxsdrv.dll
+ 2008-04-14 00:11:54 26,624 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\fxsdrv.dll
- 2004-08-04 07:56:06 6,656 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\fxsres.dll
+ 2008-04-14 00:09:33 6,656 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\fxsres.dll
- 2004-08-04 07:56:42 397,312 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\fxstiff.dll
+ 2008-04-14 00:11:54 397,312 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\fxstiff.dll
- 2004-08-04 07:56:42 154,112 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\fxsui.dll
+ 2008-04-14 00:11:54 154,112 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\fxsui.dll
- 2004-08-04 07:56:42 192,512 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\fxswzrd.dll
+ 2008-04-14 00:11:54 192,512 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\fxswzrd.dll
- 2004-08-04 07:56:42 87,552 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\hpfud50.dll
+ 2008-04-14 00:11:54 87,552 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\hpfud50.dll
- 2004-03-22 20:17:04 765,680 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\mdigraph.dll
+ 2007-04-09 18:24:04 758,664 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\mdigraph.dll
- 2004-03-22 20:17:10 42,224 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\mdiui.dll
+ 2007-04-09 18:23:58 46,472 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\mdiui.dll
+ 2008-07-06 12:06:10 765,440 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\mxdwdrv.dll
+ 2008-07-06 12:06:10 198,656 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\mxdwdui.dll
- 2004-08-04 07:56:46 264,704 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\unidrv.dll
+ 2008-07-06 12:06:10 373,248 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\unidrv.dll
- 2004-08-04 07:56:46 197,120 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\unidrvui.dll
+ 2008-07-06 12:06:10 744,960 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\unidrvui.dll
- 2004-08-04 07:56:34 619,520 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\unires.dll
+ 2008-03-13 04:52:36 761,344 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\unires.dll
+ 2008-07-06 12:06:10 1,676,288 —-a-w c:\winnt\system32\spool\drivers\w32x86\3\XpsSvcs.dll
- 2004-03-22 20:17:04 765,680 —-a-w c:\winnt\system32\spool\drivers\w32x86\mdigraph.dll
+ 2007-04-09 18:24:04 758,664 —-a-w c:\winnt\system32\spool\drivers\w32x86\mdigraph.dll
- 2004-03-22 20:17:10 42,224 —-a-w c:\winnt\system32\spool\drivers\w32x86\mdiui.dll
+ 2007-04-09 18:23:58 46,472 —-a-w c:\winnt\system32\spool\drivers\w32x86\mdiui.dll
+ 2008-07-06 12:06:10 89,088 —-a-w c:\winnt\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
- 2004-03-22 20:17:08 25,840 —-a-w c:\winnt\system32\spool\prtprocs\w32x86\mdippr.dll
+ 2007-04-09 18:23:54 28,552 —-a-w c:\winnt\system32\spool\prtprocs\w32x86\mdippr.dll
+ 2008-07-06 10:50:03 597,504 ——w c:\winnt\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
+ 2008-07-06 12:06:10 147,456 —-a-w c:\winnt\system32\spool\prtprocs\x64\filterpipelineprintproc.dll
+ 2008-07-06 12:06:10 748,032 —-a-w c:\winnt\system32\spool\XPSEP\amd64\amd64\mxdwdrv.dll
+ 2008-07-06 22:36:12 2,936,832 —-a-w c:\winnt\system32\spool\XPSEP\amd64\amd64\xpssvcs.dll
+ 2008-07-06 12:06:10 748,032 —-a-w c:\winnt\system32\spool\XPSEP\amd64\mxdwdrv.dll
+ 2008-07-06 22:36:12 2,936,832 —-a-w c:\winnt\system32\spool\XPSEP\amd64\xpssvcs.dll
+ 2008-07-06 12:06:10 765,440 —-a-w c:\winnt\system32\spool\XPSEP\i386\i386\mxdwdrv.dll
+ 2008-07-06 12:06:10 1,676,288 —-a-w c:\winnt\system32\spool\XPSEP\i386\i386\xpssvcs.dll
+ 2008-07-06 12:06:10 765,440 —-a-w c:\winnt\system32\spool\XPSEP\i386\mxdwdrv.dll
+ 2008-07-06 12:06:10 1,676,288 —-a-w c:\winnt\system32\spool\XPSEP\i386\xpssvcs.dll
- 2004-08-04 07:56:45 74,752 —-a-w c:\winnt\system32\spoolss.dll
+ 2008-04-14 00:12:06 75,264 —-a-w c:\winnt\system32\spoolss.dll
- 2005-06-10 23:53:32 57,856 —-a-w c:\winnt\system32\spoolsv.exe
+ 2008-04-14 00:12:36 57,856 —-a-w c:\winnt\system32\spoolsv.exe
- 2006-09-25 22:58:48 23,856 —-a-w c:\winnt\system32\spupdsvc.exe
+ 2007-11-30 11:18:51 26,488 —-a-w c:\winnt\system32\spupdsvc.exe
- 2004-08-04 07:56:57 21,504 ——w c:\winnt\system32\spupdwxp.exe
+ 2008-04-14 00:12:36 20,992 ——w c:\winnt\system32\spupdwxp.exe
- 2004-08-04 07:56:45 442,368 —-a-w c:\winnt\system32\sqlsrv32.dll
+ 2008-04-14 00:12:06 442,368 —-a-w c:\winnt\system32\sqlsrv32.dll
- 2004-08-04 07:56:45 180,800 —-a-w c:\winnt\system32\sqlunirl.dll
+ 2008-04-14 00:12:06 180,800 —-a-w c:\winnt\system32\sqlunirl.dll
- 2004-08-04 07:56:45 67,584 —-a-w c:\winnt\system32\srclient.dll
+ 2008-04-14 00:12:07 67,584 —-a-w c:\winnt\system32\srclient.dll
- 2004-08-04 07:56:45 239,104 —-a-w c:\winnt\system32\srrstr.dll
+ 2008-04-14 00:12:07 239,104 —-a-w c:\winnt\system32\srrstr.dll
- 2004-08-04 07:56:45 170,496 —-a-w c:\winnt\system32\srsvc.dll
+ 2008-04-14 00:12:07 171,008 —-a-w c:\winnt\system32\srsvc.dll
- 2004-12-07 19:32:34 96,768 —-a-w c:\winnt\system32\srvsvc.dll
+ 2008-04-14 00:12:07 96,768 —-a-w c:\winnt\system32\srvsvc.dll
- 2004-08-04 07:56:57 704,512 —-a-w c:\winnt\system32\ss3dfo.scr
+ 2008-04-14 00:12:43 704,512 —-a-w c:\winnt\system32\ss3dfo.scr
- 2004-08-04 07:56:57 19,968 —-a-w c:\winnt\system32\ssbezier.scr
+ 2008-04-14 00:12:43 19,968 —-a-w c:\winnt\system32\ssbezier.scr
- 2004-08-04 07:56:45 34,816 —-a-w c:\winnt\system32\ssdpapi.dll
+ 2008-04-14 00:12:07 34,816 —-a-w c:\winnt\system32\ssdpapi.dll
- 2004-08-04 07:56:45 71,680 —-a-w c:\winnt\system32\ssdpsrv.dll
+ 2008-04-14 00:12:07 71,680 —-a-w c:\winnt\system32\ssdpsrv.dll
- 2004-08-04 07:56:57 393,216 —-a-w c:\winnt\system32\ssflwbox.scr
+ 2008-04-14 00:12:43 393,216 —-a-w c:\winnt\system32\ssflwbox.scr
- 2004-08-04 07:56:57 20,992 —-a-w c:\winnt\system32\ssmarque.scr
+ 2008-04-14 00:12:44 20,992 —-a-w c:\winnt\system32\ssmarque.scr
- 2004-08-04 07:56:57 47,104 —-a-w c:\winnt\system32\ssmypics.scr
+ 2008-04-14 00:12:44 47,104 —-a-w c:\winnt\system32\ssmypics.scr
- 2004-08-04 07:56:57 18,944 —-a-w c:\winnt\system32\ssmyst.scr
+ 2008-04-14 00:12:44 18,944 —-a-w c:\winnt\system32\ssmyst.scr
- 2004-08-04 07:56:57 610,304 —-a-w c:\winnt\system32\sspipes.scr
+ 2008-04-14 00:12:44 610,304 —-a-w c:\winnt\system32\sspipes.scr
- 2004-08-04 07:56:57 14,336 —-a-w c:\winnt\system32\ssstars.scr
+ 2008-04-14 00:12:44 14,336 —-a-w c:\winnt\system32\ssstars.scr
- 2004-08-04 07:56:57 679,936 —-a-w c:\winnt\system32\sstext3d.scr
+ 2008-04-14 00:12:44 679,936 —-a-w c:\winnt\system32\sstext3d.scr
- 2001-08-23 08:00:00 54,272 —-a-w c:\winnt\system32\stclient.dll
+ 2008-04-14 00:12:07 59,392 —-a-w c:\winnt\system32\stclient.dll
- 2004-08-04 07:56:45 67,584 —-a-w c:\winnt\system32\sti.dll
+ 2008-04-14 00:12:07 68,096 —-a-w c:\winnt\system32\sti.dll
- 2004-08-04 07:56:45 136,704 —-a-w c:\winnt\system32\sti_ci.dll
+ 2008-04-14 00:12:07 136,704 —-a-w c:\winnt\system32\sti_ci.dll
- 2004-08-04 07:56:57 14,848 —-a-w c:\winnt\system32\stimon.exe
+ 2008-04-14 00:12:36 14,848 —-a-w c:\winnt\system32\stimon.exe
- 2004-08-04 07:56:45 121,856 —-a-w c:\winnt\system32\stobject.dll
+ 2008-04-14 00:12:07 121,856 —-a-w c:\winnt\system32\stobject.dll
- 2004-08-04 07:56:45 74,752 —-a-w c:\winnt\system32\storprop.dll
+ 2008-04-14 00:12:07 74,752 —-a-w c:\winnt\system32\storprop.dll
- 2008-10-03 10:15:47 247,326 —-a-w c:\winnt\system32\strmdll.dll
+ 2008-10-03 10:02:42 247,326 —-a-w c:\winnt\system32\strmdll.dll
- 2004-08-04 07:56:45 75,776 ——w c:\winnt\system32\strmfilt.dll
+ 2008-04-14 00:12:07 75,776 ——w c:\winnt\system32\strmfilt.dll
- 2004-08-04 07:56:57 14,336 —-a-w c:\winnt\system32\svchost.exe
+ 2008-04-14 00:12:36 14,336 —-a-w c:\winnt\system32\svchost.exe
- 2006-10-19 13:56:32 713,216 —-a-w c:\winnt\system32\sxs.dll
+ 2008-04-14 00:12:07 713,216 —-a-w c:\winnt\system32\sxs.dll
- 2004-08-04 07:56:46 57,856 —-a-w c:\winnt\system32\synceng.dll
+ 2008-04-14 00:12:07 57,856 —-a-w c:\winnt\system32\synceng.dll
- 2004-08-04 07:56:46 191,488 —-a-w c:\winnt\system32\syncui.dll
+ 2008-04-14 00:12:07 191,488 —-a-w c:\winnt\system32\syncui.dll
- 2004-08-04 07:56:57 105,984 —-a-w c:\winnt\system32\sysocmgr.exe
+ 2008-04-14 00:12:37 106,496 —-a-w c:\winnt\system32\sysocmgr.exe
- 2004-08-04 07:56:46 984,576 —-a-w c:\winnt\system32\syssetup.dll
+ 2008-04-14 00:12:07 990,208 —-a-w c:\winnt\system32\syssetup.dll
- 2001-08-23 08:00:00 68,096 —-a-w c:\winnt\system32\systeminfo.exe
+ 2008-04-14 00:12:36 71,680 —-a-w c:\winnt\system32\systeminfo.exe
- 2005-10-17 21:14:46 118,272 —-a-w c:\winnt\system32\t2embed.dll
+ 2008-04-14 00:12:07 117,760 —-a-w c:\winnt\system32\t2embed.dll
- 2004-08-04 07:56:46 858,624 —-a-w c:\winnt\system32\tapi3.dll
+ 2008-04-14 00:12:07 858,624 —-a-w c:\winnt\system32\tapi3.dll
- 2004-08-04 07:56:46 181,760 —-a-w c:\winnt\system32\tapi32.dll
+ 2008-04-14 00:12:07 181,760 —-a-w c:\winnt\system32\tapi32.dll
- 2005-07-08 16:27:56 249,344 —-a-w c:\winnt\system32\tapisrv.dll
+ 2008-04-14 00:12:07 249,856 —-a-w c:\winnt\system32\tapisrv.dll
- 2001-08-23 08:00:00 72,192 —-a-w c:\winnt\system32\taskkill.exe
+ 2008-04-14 00:12:37 76,288 —-a-w c:\winnt\system32\taskkill.exe
- 2001-08-23 08:00:00 72,192 —-a-w c:\winnt\system32\tasklist.exe
+ 2008-04-14 00:12:37 77,824 —-a-w c:\winnt\system32\tasklist.exe
- 2004-08-04 07:56:57 135,680 —-a-w c:\winnt\system32\taskmgr.exe
+ 2008-04-14 00:12:37 135,680 —-a-w c:\winnt\system32\taskmgr.exe
- 2004-08-04 07:56:46 14,848 —-a-w c:\winnt\system32\tcpmib.dll
+ 2008-04-14 00:12:07 14,848 —-a-w c:\winnt\system32\tcpmib.dll
- 2004-08-04 07:56:46 45,568 —-a-w c:\winnt\system32\tcpmon.dll
+ 2008-04-14 00:12:07 45,568 —-a-w c:\winnt\system32\tcpmon.dll
- 2004-08-04 07:56:46 45,568 —-a-w c:\winnt\system32\tcpmonui.dll
+ 2008-04-14 00:12:07 45,568 —-a-w c:\winnt\system32\tcpmonui.dll
- 2005-05-10 23:45:48 75,776 —-a-w c:\winnt\system32\telnet.exe
+ 2008-04-14 00:12:37 75,776 —-a-w c:\winnt\system32\telnet.exe
- 2004-08-04 07:56:46 358,400 —-a-w c:\winnt\system32\termmgr.dll
+ 2008-04-14 00:12:07 358,400 —-a-w c:\winnt\system32\termmgr.dll
- 2004-08-04 07:56:46 295,424 —-a-w c:\winnt\system32\termsrv.dll
+ 2008-04-14 00:12:07 295,424 —-a-w c:\winnt\system32\termsrv.dll
- 2004-08-04 07:56:46 385,536 —-a-w c:\winnt\system32\themeui.dll
+ 2008-04-14 00:12:07 385,536 —-a-w c:\winnt\system32\themeui.dll
- 2004-08-04 07:56:57 61,440 —-a-w c:\winnt\system32\tlntadmn.exe
+ 2008-04-14 00:12:37 61,440 —-a-w c:\winnt\system32\tlntadmn.exe
- 2004-08-04 07:56:57 78,336 —-a-w c:\winnt\system32\tlntsess.exe
+ 2008-04-14 00:12:37 78,336 —-a-w c:\winnt\system32\tlntsess.exe
- 2004-08-04 07:56:57 73,216 —-a-w c:\winnt\system32\tlntsvr.exe
+ 2008-04-14 00:12:38 73,216 —-a-w c:\winnt\system32\tlntsvr.exe
- 2004-08-04 07:56:46 7,168 —-a-w c:\winnt\system32\tlntsvrp.dll
+ 2008-04-14 00:12:07 7,168 —-a-w c:\winnt\system32\tlntsvrp.dll
- 2004-08-04 07:56:57 347,136 —-a-w c:\winnt\system32\tourstart.exe
+ 2008-04-14 00:12:38 347,136 —-a-w c:\winnt\system32\tourstart.exe
- 2004-08-04 07:56:57 259,584 —-a-w c:\winnt\system32\tracerpt.exe
+ 2008-04-14 00:12:38 259,584 —-a-w c:\winnt\system32\tracerpt.exe
- 2004-08-04 07:56:57 12,288 —-a-w c:\winnt\system32\tracert.exe
+ 2008-04-14 00:12:38 12,288 —-a-w c:\winnt\system32\tracert.exe
- 2001-08-23 08:00:00 11,264 —-a-w c:\winnt\system32\tree.com
+ 2008-04-14 00:12:42 12,800 —-a-w c:\winnt\system32\tree.com
- 2004-08-04 07:56:46 90,624 —-a-w c:\winnt\system32\trkwks.dll
+ 2008-04-14 00:12:07 90,112 —-a-w c:\winnt\system32\trkwks.dll
- 2004-08-04 07:56:46 93,696 —-a-w c:\winnt\system32\tscfgwmi.dll
+ 2008-04-14 00:12:07 93,696 —-a-w c:\winnt\system32\tscfgwmi.dll
- 2004-08-04 08:01:07 12,168 —-a-w c:\winnt\system32\tsddd.dll
+ 2008-04-14 00:13:21 12,168 —-a-w c:\winnt\system32\tsddd.dll
+ 2008-04-14 00:12:07 53,248 ——w c:\winnt\system32\tsgqec.dll
+ 2008-04-14 00:12:07 50,688 ——w c:\winnt\system32\tspkg.dll
+ 2008-07-30 02:10:04 26,112 —-a-w c:\winnt\system32\TsWpfWrp.exe
- 2004-08-04 07:56:46 44,032 ——w c:\winnt\system32\twext.dll
+ 2008-04-14 00:12:07 57,856 ——w c:\winnt\system32\twext.dll
- 2005-07-26 04:39:49 101,376 —-a-w c:\winnt\system32\txflog.dll
+ 2008-04-14 00:12:07 101,376 —-a-w c:\winnt\system32\txflog.dll
- 2007-11-13 11:31:11 60,416 ——w c:\winnt\system32\tzchange.exe
+ 2008-10-23 10:06:59 62,976 ——w c:\winnt\system32\tzchange.exe
- 2004-08-04 07:56:46 25,600 —-a-w c:\winnt\system32\udhisapi.dll
+ 2008-04-14 00:12:07 26,624 —-a-w c:\winnt\system32\udhisapi.dll
+ 2008-07-30 00:59:58 161,296 —-a-w c:\winnt\system32\UIAutomationCore.dll
- 2004-08-04 07:56:46 275,456 —-a-w c:\winnt\system32\ulib.dll
+ 2008-04-14 00:12:07 275,456 —-a-w c:\winnt\system32\ulib.dll
- 2004-08-04 07:56:46 35,840 —-a-w c:\winnt\system32\umandlg.dll
+ 2008-04-14 00:12:07 35,840 —-a-w c:\winnt\system32\umandlg.dll
- 2005-08-23 03:35:42 123,392 —-a-w c:\winnt\system32\umpnpmgr.dll
+ 2008-04-14 00:12:07 123,392 —-a-w c:\winnt\system32\umpnpmgr.dll
- 2004-08-04 07:56:46 74,240 —-a-w c:\winnt\system32\unimdmat.dll
+ 2008-04-14 00:12:07 74,240 —-a-w c:\winnt\system32\unimdmat.dll
- 2004-08-04 07:56:46 13,824 —-a-w c:\winnt\system32\uniplat.dll
+ 2008-04-14 00:12:07 13,824 —-a-w c:\winnt\system32\uniplat.dll
- 2004-08-04 07:56:46 316,416 —-a-w c:\winnt\system32\untfs.dll
+ 2008-04-14 00:12:07 316,416 —-a-w c:\winnt\system32\untfs.dll
- 2004-08-04 07:56:46 132,608 —-a-w c:\winnt\system32\upnp.dll
+ 2008-04-14 00:12:08 133,632 —-a-w c:\winnt\system32\upnp.dll
- 2004-08-04 07:56:57 16,896 —-a-w c:\winnt\system32\upnpcont.exe
+ 2008-04-14 00:12:38 16,896 —-a-w c:\winnt\system32\upnpcont.exe
- 2007-02-05 20:17:02 185,344 —-a-w c:\winnt\system32\upnphost.dll
+ 2008-04-14 00:12:08 185,856 —-a-w c:\winnt\system32\upnphost.dll
- 2004-08-04 07:56:46 239,616 —-a-w c:\winnt\system32\upnpui.dll
+ 2008-04-14 00:12:08 239,616 —-a-w c:\winnt\system32\upnpui.dll
- 2004-08-04 07:56:57 18,432 —-a-w c:\winnt\system32\ups.exe
+ 2008-04-14 00:12:38 18,432 —-a-w c:\winnt\system32\ups.exe
- 2004-08-04 07:56:46 37,888 —-a-w c:\winnt\system32\url.dll
+ 2008-04-14 00:12:08 37,888 —-a-w c:\winnt\system32\url.dll
- 2008-10-16 10:37:04 615,936 —-a-w c:\winnt\system32\urlmon.dll
+ 2008-10-16 01:00:11 619,520 —-a-w c:\winnt\system32\urlmon.dll
- 2004-08-04 07:56:46 16,896 —-a-w c:\winnt\system32\usbmon.dll
+ 2008-04-14 00:12:08 16,896 —-a-w c:\winnt\system32\usbmon.dll
- 2004-08-04 07:56:46 74,240 —-a-w c:\winnt\system32\usbui.dll
+ 2008-04-14 00:12:08 74,240 —-a-w c:\winnt\system32\usbui.dll
- 2007-03-08 15:36:28 577,536 —-a-w c:\winnt\system32\user32.dll
+ 2008-04-14 00:12:08 578,560 —-a-w c:\winnt\system32\user32.dll
- 2004-08-04 07:56:46 723,456 —-a-w c:\winnt\system32\userenv.dll
+ 2008-04-14 00:12:08 727,040 —-a-w c:\winnt\system32\userenv.dll
- 2004-08-04 07:56:57 24,576 —-a-w c:\winnt\system32\userinit.exe
+ 2008-04-14 00:12:38 26,112 —-a-w c:\winnt\system32\userinit.exe
+ 2008-04-13 16:44:16 17,920 ——w c:\winnt\system32\usmt\cobramsg.dll
- 2004-08-04 07:56:42 123,904 —-a-w c:\winnt\system32\usmt\guitrn.dll
+ 2008-04-14 00:11:54 133,120 —-a-w c:\winnt\system32\usmt\guitrn.dll
+ 2008-04-14 00:11:54 115,200 ——w c:\winnt\system32\usmt\guitrna.dll
- 2004-08-04 07:56:42 4,096 —-a-w c:\winnt\system32\usmt\iconlib.dll
+ 2008-04-13 16:44:29 2,560 —-a-w c:\winnt\system32\usmt\iconlib.dll
- 2004-08-04 07:56:42 19,968 —-a-w c:\winnt\system32\usmt\log.dll
+ 2008-04-14 00:11:56 19,968 —-a-w c:\winnt\system32\usmt\log.dll
- 2004-08-04 07:56:42 201,216 —-a-w c:\winnt\system32\usmt\migism.dll
+ 2008-04-14 00:11:57 274,432 —-a-w c:\winnt\system32\usmt\migism.dll
+ 2008-04-14 00:11:57 261,120 ——w c:\winnt\system32\usmt\migisma.dll
- 2004-08-04 07:56:50 103,424 —-a-w c:\winnt\system32\usmt\migload.exe
+ 2008-04-14 00:12:25 103,936 —-a-w c:\winnt\system32\usmt\migload.exe
- 2004-08-04 07:56:51 240,128 —-a-w c:\winnt\system32\usmt\migwiz.exe
+ 2008-04-14 00:12:25 245,248 —-a-w c:\winnt\system32\usmt\migwiz.exe
+ 2008-04-14 00:12:25 241,152 ——w c:\winnt\system32\usmt\migwiza.exe
- 2004-08-04 07:56:44 202,752 —-a-w c:\winnt\system32\usmt\script.dll
+ 2008-04-14 00:12:05 215,552 —-a-w c:\winnt\system32\usmt\script.dll
+ 2008-04-14 00:12:05 199,680 ——w c:\winnt\system32\usmt\scripta.dll
- 2004-08-04 07:56:46 168,960 —-a-w c:\winnt\system32\usmt\sysmod.dll
+ 2008-04-14 00:12:07 193,024 —-a-w c:\winnt\system32\usmt\sysmod.dll
+ 2008-04-14 00:12:07 173,568 ——w c:\winnt\system32\usmt\sysmoda.dll
- 2004-08-04 07:56:46 406,528 —-a-w c:\winnt\system32\usp10.dll
+ 2008-04-14 00:12:08 406,016 —-a-w c:\winnt\system32\usp10.dll
- 2004-08-04 07:56:57 50,176 —-a-w c:\winnt\system32\utilman.exe
+ 2008-04-14 00:12:38 50,176 —-a-w c:\winnt\system32\utilman.exe
- 2004-08-04 07:56:46 218,624 —-a-w c:\winnt\system32\uxtheme.dll
+ 2008-04-14 00:12:08 218,624 —-a-w c:\winnt\system32\uxtheme.dll
- 2004-08-04 07:56:46 30,749 —-a-w c:\winnt\system32\vbajet32.dll
+ 2008-04-14 00:12:08 30,749 —-a-w c:\winnt\system32\vbajet32.dll
- 2007-12-18 14:40:58 417,792 —-a-w c:\winnt\system32\vbscript.dll
+ 2008-05-09 10:53:40 430,080 —-a-w c:\winnt\system32\vbscript.dll
- 2004-08-04 07:56:46 26,112 —-a-w c:\winnt\system32\vdmdbg.dll
+ 2008-04-14 00:12:08 26,112 —-a-w c:\winnt\system32\vdmdbg.dll
- 2004-08-04 07:56:46 51,712 —-a-w c:\winnt\system32\vdmredir.dll
+ 2008-04-14 00:12:08 51,712 —-a-w c:\winnt\system32\vdmredir.dll
- 2006-03-17 00:38:01 28,672 ——w c:\winnt\system32\verclsid.exe
+ 2008-04-14 00:12:38 28,672 ——w c:\winnt\system32\verclsid.exe
- 2001-08-23 08:00:00 13,312 —-a-w c:\winnt\system32\verifier.dll
+ 2008-04-14 00:12:08 26,624 —-a-w c:\winnt\system32\verifier.dll
- 2004-08-04 07:56:46 18,944 —-a-w c:\winnt\system32\version.dll
+ 2008-04-14 00:12:08 18,944 —-a-w c:\winnt\system32\version.dll
- 2004-08-04 07:56:46 53,760 —-a-w c:\winnt\system32\vfwwdm32.dll
+ 2008-04-14 00:12:08 53,760 —-a-w c:\winnt\system32\vfwwdm32.dll
- 2004-08-04 07:56:46 430,592 —-a-w c:\winnt\system32\vssapi.dll
+ 2008-04-14 00:12:08 430,592 —-a-w c:\winnt\system32\vssapi.dll
- 2004-08-04 07:56:57 289,792 —-a-w c:\winnt\system32\vssvc.exe
+ 2008-04-14 00:12:38 289,792 —-a-w c:\winnt\system32\vssvc.exe
- 2004-08-04 07:56:46 174,592 —-a-w c:\winnt\system32\w32time.dll
+ 2008-04-14 00:12:08 175,104 —-a-w c:\winnt\system32\w32time.dll
- 2004-08-04 07:56:46 15,872 ——w c:\winnt\system32\w3ssl.dll
+ 2008-04-14 00:12:08 15,872 ——w c:\winnt\system32\w3ssl.dll
- 2004-08-04 06:07:32 17,664 —-a-w c:\winnt\system32\watchdog.sys
+ 2008-04-13 18:44:59 17,664 —-a-w c:\winnt\system32\watchdog.sys
- 2001-08-23 08:00:00 208,896 —-a-w c:\winnt\system32\wavemsp.dll
+ 2008-04-14 00:12:08 215,552 —-a-w c:\winnt\system32\wavemsp.dll
- 2004-08-04 07:56:41 1,352,192 —-a-w c:\winnt\system32\wbem\cimwin32.dll
+ 2008-04-14 00:11:50 1,358,848 —-a-w c:\winnt\system32\wbem\cimwin32.dll
- 2004-08-04 07:56:42 45,568 —-a-w c:\winnt\system32\wbem\cmdevtgprov.dll
+ 2008-04-14 00:11:53 45,056 —-a-w c:\winnt\system32\wbem\cmdevtgprov.dll
- 2004-08-04 07:56:42 247,808 —-a-w c:\winnt\system32\wbem\esscli.dll
+ 2008-04-14 00:11:53 247,808 —-a-w c:\winnt\system32\wbem\esscli.dll
- 2004-08-04 07:56:42 22,016 —-a-w c:\winnt\system32\wbem\evntrprv.dll
+ 2008-04-14 00:11:53 21,504 —-a-w c:\winnt\system32\wbem\evntrprv.dll
- 2004-08-04 07:56:42 472,064 —-a-w c:\winnt\system32\wbem\fastprox.dll
+ 2008-04-14 00:11:53 472,064 —-a-w c:\winnt\system32\wbem\fastprox.dll
- 2004-08-04 07:56:42 185,856 —-a-w c:\winnt\system32\wbem\framedyn.dll
+ 2008-04-14 00:11:53 185,344 —-a-w c:\winnt\system32\wbem\framedyn.dll
- 2004-08-04 07:56:42 24,576 —-a-w c:\winnt\system32\wbem\krnlprov.dll
+ 2008-04-14 00:11:56 24,576 —-a-w c:\winnt\system32\wbem\krnlprov.dll
- 2004-08-04 07:56:51 16,384 —-a-w c:\winnt\system32\wbem\mofcomp.exe
+ 2008-04-14 00:12:26 16,384 —-a-w c:\winnt\system32\wbem\mofcomp.exe
- 2004-08-04 07:56:42 123,904 —-a-w c:\winnt\system32\wbem\mofd.dll
+ 2008-04-14 00:11:57 123,904 —-a-w c:\winnt\system32\wbem\mofd.dll
- 2004-08-04 07:56:44 47,104 —-a-w c:\winnt\system32\wbem\ncprov.dll
+ 2008-04-14 00:12:01 47,104 —-a-w c:\winnt\system32\wbem\ncprov.dll
- 2004-08-04 07:56:44 212,992 —-a-w c:\winnt\system32\wbem\ntevt.dll
+ 2008-04-14 00:12:02 212,992 —-a-w c:\winnt\system32\wbem\ntevt.dll
- 2004-08-04 07:56:44 92,672 —-a-w c:\winnt\system32\wbem\policman.dll
+ 2008-04-14 00:12:02 92,672 —-a-w c:\winnt\system32\wbem\policman.dll
- 2004-08-04 07:56:44 237,056 —-a-w c:\winnt\system32\wbem\provthrd.dll
+ 2008-04-14 00:12:03 237,056 —-a-w c:\winnt\system32\wbem\provthrd.dll
- 2004-08-04 07:56:44 177,152 —-a-w c:\winnt\system32\wbem\repdrvfs.dll
+ 2008-04-14 00:12:04 178,176 —-a-w c:\winnt\system32\wbem\repdrvfs.dll
- 2004-08-04 07:56:55 36,864 —-a-w c:\winnt\system32\wbem\scrcons.exe
+ 2008-04-14 00:12:34 36,352 —-a-w c:\winnt\system32\wbem\scrcons.exe
- 2004-08-04 07:56:45 259,072 —-a-w c:\winnt\system32\wbem\snmpcl.dll
+ 2008-04-14 00:12:06 259,072 —-a-w c:\winnt\system32\wbem\snmpcl.dll
- 2004-08-04 07:56:45 40,448 —-a-w c:\winnt\system32\wbem\snmpthrd.dll
+ 2008-04-14 00:12:06 39,936 —-a-w c:\winnt\system32\wbem\snmpthrd.dll
- 2004-08-04 07:56:45 86,528 —-a-w c:\winnt\system32\wbem\stdprov.dll
+ 2008-04-14 00:12:07 86,528 —-a-w c:\winnt\system32\wbem\stdprov.dll
- 2004-08-04 07:56:46 131,584 —-a-w c:\winnt\system32\wbem\viewprov.dll
+ 2008-04-14 00:12:08 131,584 —-a-w c:\winnt\system32\wbem\viewprov.dll
- 2004-08-04 07:56:46 196,608 —-a-w c:\winnt\system32\wbem\wbemcntl.dll
+ 2008-04-14 00:12:08 196,608 —-a-w c:\winnt\system32\wbem\wbemcntl.dll
- 2004-08-04 07:56:46 214,528 —-a-w c:\winnt\system32\wbem\wbemcomn.dll
+ 2008-04-14 00:12:08 214,528 —-a-w c:\winnt\system32\wbem\wbemcomn.dll
- 2004-08-04 07:56:46 71,680 —-a-w c:\winnt\system32\wbem\wbemcons.dll
+ 2008-04-14 00:12:08 71,680 —-a-w c:\winnt\system32\wbem\wbemcons.dll
- 2004-08-04 07:56:46 530,944 —-a-w c:\winnt\system32\wbem\wbemcore.dll
+ 2008-04-14 00:12:08 531,456 —-a-w c:\winnt\system32\wbem\wbemcore.dll
- 2004-08-04 07:56:46 178,176 —-a-w c:\winnt\system32\wbem\wbemdisp.dll
+ 2008-04-14 00:12:08 178,176 —-a-w c:\winnt\system32\wbem\wbemdisp.dll
- 2004-08-04 07:56:46 273,920 —-a-w c:\winnt\system32\wbem\wbemess.dll
+ 2008-04-14 00:12:08 273,920 —-a-w c:\winnt\system32\wbem\wbemess.dll
- 2004-08-04 07:56:46 43,008 —-a-w c:\winnt\system32\wbem\wbemperf.dll
+ 2008-04-14 00:12:08 43,008 —-a-w c:\winnt\system32\wbem\wbemperf.dll
- 2004-08-04 07:56:46 18,944 —-a-w c:\winnt\system32\wbem\wbemprox.dll
+ 2008-04-14 00:12:08 18,944 —-a-w c:\winnt\system32\wbem\wbemprox.dll
- 2004-08-04 07:56:46 43,520 —-a-w c:\winnt\system32\wbem\wbemsvc.dll
+ 2008-04-14 00:12:08 43,520 —-a-w c:\winnt\system32\wbem\wbemsvc.dll
- 2004-08-04 07:56:57 116,224 —-a-w c:\winnt\system32\wbem\wbemtest.exe
+ 2008-04-14 00:12:39 116,224 —-a-w c:\winnt\system32\wbem\wbemtest.exe
- 2004-08-04 07:56:46 197,120 —-a-w c:\winnt\system32\wbem\wbemupgd.dll
+ 2008-04-14 00:12:08 197,120 —-a-w c:\winnt\system32\wbem\wbemupgd.dll
- 2004-08-04 07:56:57 196,608 —-a-w c:\winnt\system32\wbem\wmiadap.exe
+ 2008-04-14 00:12:40 196,608 —-a-w c:\winnt\system32\wbem\wmiadap.exe
- 2004-08-04 07:56:35 6,656 —-a-w c:\winnt\system32\wbem\wmiapres.dll
+ 2008-04-13 17:10:20 6,656 —-a-w c:\winnt\system32\wbem\wmiapres.dll
- 2004-08-04 07:56:46 89,088 —-a-w c:\winnt\system32\wbem\wmiaprpl.dll
+ 2008-04-14 00:12:09 88,576 —-a-w c:\winnt\system32\wbem\wmiaprpl.dll
- 2004-08-04 07:56:57 126,464 —-a-w c:\winnt\system32\wbem\wmiapsrv.exe
+ 2008-04-14 00:12:40 126,464 —-a-w c:\winnt\system32\wbem\wmiapsrv.exe
- 2004-08-04 07:56:57 358,912 —-a-w c:\winnt\system32\wbem\wmic.exe
+ 2008-04-14 00:12:40 358,912 —-a-w c:\winnt\system32\wbem\wmic.exe
- 2004-08-04 07:56:46 60,928 —-a-w c:\winnt\system32\wbem\wmicookr.dll
+ 2008-04-14 00:12:09 60,928 —-a-w c:\winnt\system32\wbem\wmicookr.dll
- 2004-08-04 07:56:46 140,800 —-a-w c:\winnt\system32\wbem\wmidcprv.dll
+ 2008-04-14 00:12:09 140,800 —-a-w c:\winnt\system32\wbem\wmidcprv.dll
- 2004-08-04 07:56:46 156,672 —-a-w c:\winnt\system32\wbem\wmipcima.dll
+ 2008-04-14 00:12:09 156,672 —-a-w c:\winnt\system32\wbem\wmipcima.dll
- 2004-08-04 07:56:46 132,096 —-a-w c:\winnt\system32\wbem\wmipdskq.dll
+ 2008-04-14 00:12:09 132,096 —-a-w c:\winnt\system32\wbem\wmipdskq.dll
- 2004-08-04 07:56:46 62,464 —-a-w c:\winnt\system32\wbem\wmipiprt.dll
+ 2008-04-14 00:12:09 61,952 —-a-w c:\winnt\system32\wbem\wmipiprt.dll
- 2004-08-04 07:56:46 62,976 —-a-w c:\winnt\system32\wbem\wmipjobj.dll
+ 2008-04-14 00:12:09 62,464 —-a-w c:\winnt\system32\wbem\wmipjobj.dll
- 2004-08-04 07:56:46 144,896 —-a-w c:\winnt\system32\wbem\wmiprov.dll
+ 2008-04-14 00:12:09 144,896 —-a-w c:\winnt\system32\wbem\wmiprov.dll
- 2004-08-04 07:56:46 437,248 —-a-w c:\winnt\system32\wbem\wmiprvsd.dll
+ 2008-04-14 00:12:09 437,248 —-a-w c:\winnt\system32\wbem\wmiprvsd.dll
- 2004-08-04 07:56:57 218,112 —-a-w c:\winnt\system32\wbem\wmiprvse.exe
+ 2008-04-14 00:12:40 218,112 —-a-w c:\winnt\system32\wbem\wmiprvse.exe
- 2004-08-04 07:56:46 41,472 —-a-w c:\winnt\system32\wbem\wmipsess.dll
+ 2008-04-14 00:12:09 41,472 —-a-w c:\winnt\system32\wbem\wmipsess.dll
- 2004-08-04 07:56:46 144,896 —-a-w c:\winnt\system32\wbem\wmisvc.dll
+ 2008-04-14 00:12:09 144,896 —-a-w c:\winnt\system32\wbem\wmisvc.dll
- 2004-08-04 07:56:46 95,232 —-a-w c:\winnt\system32\wbem\wmiutils.dll
+ 2008-04-14 00:12:09 95,232 —-a-w c:\winnt\system32\wbem\wmiutils.dll
- 2004-08-04 07:56:46 49,152 —-a-w c:\winnt\system32\wdigest.dll
+ 2008-04-14 00:12:08 49,152 —-a-w c:\winnt\system32\wdigest.dll
- 2004-08-04 07:56:57 23,552 —-a-w c:\winnt\system32\wdmaud.drv
+ 2008-04-14 00:12:45 23,552 —-a-w c:\winnt\system32\wdmaud.drv
- 2004-08-04 07:56:46 276,480 —-a-w c:\winnt\system32\webcheck.dll
+ 2008-04-14 00:12:08 276,480 —-a-w c:\winnt\system32\webcheck.dll
- 2006-01-04 03:35:05 68,096 —-a-w c:\winnt\system32\webclnt.dll
+ 2008-04-14 00:12:08 68,096 —-a-w c:\winnt\system32\webclnt.dll
- 2004-08-04 07:56:46 135,680 —-a-w c:\winnt\system32\webvw.dll
+ 2008-04-14 00:12:08 135,680 —-a-w c:\winnt\system32\webvw.dll
- 2004-08-04 07:56:57 65,536 —-a-w c:\winnt\system32\wextract.exe
+ 2008-04-14 00:12:39 65,024 —-a-w c:\winnt\system32\wextract.exe
- 2006-06-19 20:20:42 702,768 —-a-w c:\winnt\system32\WgaLogon.dll
+ 2008-09-06 04:30:42 241,704 —-a-w c:\winnt\system32\WgaLogon.dll
- 2006-06-19 20:19:26 304,944 ——w c:\winnt\system32\WgaTray.exe
+ 2008-09-06 04:29:58 917,032 ——w c:\winnt\system32\WgaTray.exe
- 2004-08-04 07:56:57 433,664 —-a-w c:\winnt\system32\wiaacmgr.exe
+ 2008-04-14 00:12:39 433,664 —-a-w c:\winnt\system32\wiaacmgr.exe
- 2004-08-04 07:56:46 463,360 —-a-w c:\winnt\system32\wiadefui.dll
+ 2008-04-14 00:12:08 463,360 —-a-w c:\winnt\system32\wiadefui.dll
- 2004-08-04 07:56:46 124,416 —-a-w c:\winnt\system32\wiadss.dll
+ 2008-04-14 00:12:08 124,416 —-a-w c:\winnt\system32\wiadss.dll
- 2004-08-04 07:56:46 75,776 —-a-w c:\winnt\system32\wiascr.dll
+ 2008-04-14 00:12:08 75,776 —-a-w c:\winnt\system32\wiascr.dll
- 2006-12-19 18:16:47 333,824 —-a-w c:\winnt\system32\wiaservc.dll
+ 2008-04-14 00:12:08 333,824 —-a-w c:\winnt\system32\wiaservc.dll
- 2004-08-04 07:56:46 589,312 —-a-w c:\winnt\system32\wiashext.dll
+ 2008-04-14 00:12:08 589,312 —-a-w c:\winnt\system32\wiashext.dll
- 2004-08-04 07:56:46 111,104 —-a-w c:\winnt\system32\wiavideo.dll
+ 2008-04-14 00:12:08 111,104 —-a-w c:\winnt\system32\wiavideo.dll
- 2008-09-15 11:57:41 1,846,016 —-a-w c:\winnt\system32\win32k.sys
+ 2008-09-15 12:12:56 1,846,400 —-a-w c:\winnt\system32\win32k.sys
- 2004-08-04 07:56:46 101,888 —-a-w c:\winnt\system32\win32spl.dll
+ 2008-04-14 00:12:08 102,400 —-a-w c:\winnt\system32\win32spl.dll
- 2004-08-04 07:56:35 937,984 —-a-w c:\winnt\system32\winbrand.dll
+ 2008-04-13 16:48:53 1,647,616 —-a-w c:\winnt\system32\winbrand.dll
+ 2008-04-14 00:12:08 712,704 ——w c:\winnt\system32\windowscodecs.dll
+ 2008-04-14 00:12:08 346,112 ——w c:\winnt\system32\windowscodecsext.dll
- 2004-08-04 07:56:46 351,232 —-a-w c:\winnt\system32\winhttp.dll
+ 2008-04-14 00:12:08 354,304 —-a-w c:\winnt\system32\winhttp.dll
- 2008-10-16 10:37:03 659,456 —-a-w c:\winnt\system32\wininet.dll
+ 2008-10-16 01:00:11 666,112 —-a-w c:\winnt\system32\wininet.dll
- 2004-08-04 07:56:46 32,768 —-a-w c:\winnt\system32\winipsec.dll
+ 2008-04-14 00:12:09 32,256 —-a-w c:\winnt\system32\winipsec.dll
- 2004-08-04 07:56:57 502,272 —-a-w c:\winnt\system32\winlogon.exe
+ 2008-04-14 00:12:39 507,904 —-a-w c:\winnt\system32\winlogon.exe
- 2004-08-04 07:56:46 176,128 —-a-w c:\winnt\system32\winmm.dll
+ 2008-04-14 00:12:09 176,128 —-a-w c:\winnt\system32\winmm.dll
- 2004-08-04 07:56:35 764,928 —-a-w c:\winnt\system32\winntbbu.dll
+ 2008-04-14 00:11:11 756,224 —-a-w c:\winnt\system32\winntbbu.dll
- 2004-08-04 07:56:46 16,896 —-a-w c:\winnt\system32\winrnr.dll
+ 2008-04-14 00:12:09 16,896 —-a-w c:\winnt\system32\winrnr.dll
- 2004-08-04 07:56:46 99,328 —-a-w c:\winnt\system32\winscard.dll
+ 2008-04-14 00:12:09 99,328 —-a-w c:\winnt\system32\winscard.dll
- 2004-08-04 07:56:46 17,408 ——w c:\winnt\system32\winshfhc.dll
+ 2008-04-14 00:12:09 17,408 ——w c:\winnt\system32\winshfhc.dll
- 2004-08-04 07:56:57 146,432 —-a-w c:\winnt\system32\winspool.drv
+ 2008-04-14 00:12:45 146,432 —-a-w c:\winnt\system32\winspool.drv
- 2007-03-17 13:43:01 292,864 —-a-w c:\winnt\system32\winsrv.dll
+ 2008-04-14 00:12:09 293,376 —-a-w c:\winnt\system32\winsrv.dll
- 2004-08-04 07:56:46 53,760 —-a-w c:\winnt\system32\winsta.dll
+ 2008-04-14 00:12:09 53,760 —-a-w c:\winnt\system32\winsta.dll
- 2004-08-04 07:56:46 176,640 —-a-w c:\winnt\system32\wintrust.dll
+ 2008-04-14 00:12:09 176,640 —-a-w c:\winnt\system32\wintrust.dll
- 2004-08-04 07:56:57 5,632 —-a-w c:\winnt\system32\winver.exe
+ 2008-04-14 00:12:40 5,632 —-a-w c:\winnt\system32\winver.exe
- 2006-08-17 12:28:27 132,096 —-a-w c:\winnt\system32\wkssvc.dll
+ 2008-04-14 00:12:09 132,096 —-a-w c:\winnt\system32\wkssvc.dll
+ 2008-04-14 00:12:09 69,120 ——w c:\winnt\system32\wlanapi.dll
- 2004-08-04 07:56:46 172,032 —-a-w c:\winnt\system32\wldap32.dll
+ 2008-04-14 00:12:09 172,032 —-a-w c:\winnt\system32\wldap32.dll
- 2004-08-04 07:56:46 92,672 —-a-w c:\winnt\system32\wlnotify.dll
+ 2008-04-14 00:12:09 92,672 —-a-w c:\winnt\system32\wlnotify.dll
- 2004-08-04 07:56:35 5,632 —-a-w c:\winnt\system32\wmi.dll
+ 2008-04-14 00:11:15 5,632 —-a-w c:\winnt\system32\wmi.dll
- 2006-10-19 02:47:20 295,936 ——w c:\winnt\system32\wmpeffects.dll
+ 2008-06-24 23:12:58 295,936 ——w c:\winnt\system32\wmpeffects.dll
+ 2008-04-14 00:12:09 276,992 ——w c:\winnt\system32\wmphoto.dll
- 2004-08-04 07:56:46 115,200 —-a-w c:\winnt\system32\wmsdmoe.dll
+ 2008-04-14 00:12:09 115,200 —-a-w c:\winnt\system32\wmsdmoe.dll
- 2004-08-04 07:56:46 303,616 —-a-w c:\winnt\system32\wmstream.dll
+ 2008-04-14 00:12:10 303,616 —-a-w c:\winnt\system32\wmstream.dll
- 2004-08-04 07:56:46 264,192 —-a-w c:\winnt\system32\wow32.dll
+ 2008-04-14 00:12:10 264,192 —-a-w c:\winnt\system32\wow32.dll
- 2004-08-04 07:56:57 32,256 —-a-w c:\winnt\system32\wpabaln.exe
+ 2008-04-14 00:12:40 32,256 —-a-w c:\winnt\system32\wpabaln.exe
- 2004-08-04 07:56:57 32,256 —-a-w c:\winnt\system32\wpnpinst.exe
+ 2008-04-14 00:12:41 11,264 —-a-w c:\winnt\system32\wpnpinst.exe
- 2004-08-04 07:56:46 82,944 —-a-w c:\winnt\system32\ws2_32.dll
+ 2008-04-14 00:12:10 82,432 —-a-w c:\winnt\system32\ws2_32.dll
- 2004-08-04 07:56:46 19,968 —-a-w c:\winnt\system32\ws2help.dll
+ 2008-04-14 00:12:10 19,968 —-a-w c:\winnt\system32\ws2help.dll
- 2004-08-04 07:56:57 13,824 ——w c:\winnt\system32\wscntfy.exe
+ 2008-04-14 00:12:41 13,824 ——w c:\winnt\system32\wscntfy.exe
- 2004-08-04 07:56:57 114,688 —-a-w c:\winnt\system32\wscript.exe
+ 2008-05-08 11:24:44 155,648 —-a-w c:\winnt\system32\wscript.exe
- 2004-08-04 07:56:46 81,408 ——w c:\winnt\system32\wscsvc.dll
+ 2008-04-14 00:12:10 80,896 —-a-w c:\winnt\system32\wscsvc.dll
- 2004-08-04 07:56:46 596,992 —-a-w c:\winnt\system32\wsecedit.dll
+ 2008-04-14 00:12:10 604,160 —-a-w c:\winnt\system32\wsecedit.dll
- 2004-08-04 07:56:46 108,032 ——w c:\winnt\system32\wshbth.dll
+ 2008-04-14 00:12:10 108,032 —-a-w c:\winnt\system32\wshbth.dll
- 2004-08-04 07:56:46 28,672 —-a-w c:\winnt\system32\wshcon.dll
+ 2008-04-14 00:12:10 36,864 —-a-w c:\winnt\system32\wshcon.dll
- 2004-08-04 07:56:46 65,536 —-a-w c:\winnt\system32\wshext.dll
+ 2008-05-09 10:53:40 90,112 —-a-w c:\winnt\system32\wshext.dll
- 2004-08-04 07:56:46 14,336 —-a-w c:\winnt\system32\wship6.dll
+ 2008-04-14 00:12:10 14,336 —-a-w c:\winnt\system32\wship6.dll
- 2004-08-04 06:56:46 8,192 —-a-w c:\winnt\system32\wshirda.dll
+ 2008-04-14 00:12:10 8,192 —-a-w c:\winnt\system32\wshirda.dll
- 2004-08-04 07:56:46 11,776 —-a-w c:\winnt\system32\wshrm.dll
+ 2008-04-14 00:12:10 11,264 —-a-w c:\winnt\system32\wshrm.dll
- 2004-08-04 07:56:46 19,968 —-a-w c:\winnt\system32\wshtcpip.dll
+ 2008-04-14 00:12:10 19,456 —-a-w c:\winnt\system32\wshtcpip.dll
- 2004-08-04 07:56:46 42,496 —-a-w c:\winnt\system32\wsnmp32.dll
+ 2008-04-14 00:12:10 41,984 —-a-w c:\winnt\system32\wsnmp32.dll
- 2004-08-04 07:56:46 22,528 —-a-w c:\winnt\system32\wsock32.dll
+ 2008-04-14 00:12:10 22,528 —-a-w c:\winnt\system32\wsock32.dll
- 2004-08-04 07:56:46 50,688 —-a-w c:\winnt\system32\wstdecod.dll
+ 2008-04-14 00:12:10 50,688 —-a-w c:\winnt\system32\wstdecod.dll
- 2004-08-04 07:56:46 18,432 —-a-w c:\winnt\system32\wtsapi32.dll
+ 2008-04-14 00:12:10 18,432 —-a-w c:\winnt\system32\wtsapi32.dll
- 2007-07-30 23:19:36 549,720 —-a-w c:\winnt\system32\wuapi.dll
+ 2008-10-16 19:12:20 561,688 —-a-w c:\winnt\system32\wuapi.dll
- 2007-07-30 23:19:16 53,080 —-a-w c:\winnt\system32\wuauclt.exe
+ 2008-10-16 19:09:44 51,224 —-a-w c:\winnt\system32\wuauclt.exe
- 2007-07-30 23:19:42 1,712,984 —-a-w c:\winnt\system32\wuaueng.dll
+ 2008-10-16 19:13:40 1,809,944 —-a-w c:\winnt\system32\wuaueng.dll
- 2004-08-04 07:56:46 6,656 —-a-w c:\winnt\system32\wuauserv.dll
+ 2008-04-14 00:12:11 6,656 —-a-w c:\winnt\system32\wuauserv.dll
- 2007-07-30 23:19:32 325,976 —-a-w c:\winnt\system32\wucltui.dll
+ 2008-10-16 19:12:22 323,608 —-a-w c:\winnt\system32\wucltui.dll
- 2007-07-30 23:18:40 33,624 —-a-w c:\winnt\system32\wups.dll
+ 2008-10-16 19:08:58 34,328 —-a-w c:\winnt\system32\wups.dll
- 2007-07-30 23:19:12 43,352 —-a-w c:\winnt\system32\wups2.dll
+ 2008-10-16 19:09:44 43,544 —-a-w c:\winnt\system32\wups2.dll
- 2004-08-04 07:56:46 378,368 —-a-w c:\winnt\system32\wzcdlg.dll
+ 2008-04-14 00:12:11 383,488 —-a-w c:\winnt\system32\wzcdlg.dll
- 2004-08-04 07:56:46 51,712 —-a-w c:\winnt\system32\wzcsapi.dll
+ 2008-04-14 00:12:11 52,736 —-a-w c:\winnt\system32\wzcsapi.dll
- 2004-08-04 07:56:46 359,936 —-a-w c:\winnt\system32\wzcsvc.dll
+ 2008-04-14 00:12:11 483,840 —-a-w c:\winnt\system32\wzcsvc.dll
- 2004-08-04 07:56:46 91,648 —-a-w c:\winnt\system32\xactsrv.dll
+ 2008-04-14 00:12:11 91,648 —-a-w c:\winnt\system32\xactsrv.dll
- 2004-08-04 07:56:57 30,720 —-a-w c:\winnt\system32\xcopy.exe
+ 2008-04-14 00:12:41 30,720 —-a-w c:\winnt\system32\xcopy.exe
+ 2008-04-14 00:12:11 121,856 ——w c:\winnt\system32\xmllite.dll
- 2004-08-04 07:56:46 129,536 ——w c:\winnt\system32\xmlprov.dll
+ 2008-04-14 00:12:11 129,024 ——w c:\winnt\system32\xmlprov.dll
- 2004-08-04 07:56:46 50,176 ——w c:\winnt\system32\xmlprovi.dll
+ 2008-04-14 00:12:11 50,176 ——w c:\winnt\system32\xmlprovi.dll
- 2006-03-01 19:42:42 11,776 —-a-w c:\winnt\system32\xolehlp.dll
+ 2008-04-14 00:12:11 11,776 —-a-w c:\winnt\system32\xolehlp.dll
- 2004-08-04 07:56:36 438,784 ——w c:\winnt\system32\xpob2res.dll
+ 2008-04-13 17:39:29 438,784 ——w c:\winnt\system32\xpob2res.dll
- 2004-08-04 07:56:36 187,392 —-a-w c:\winnt\system32\xpsp1res.dll
+ 2008-04-13 17:39:22 187,392 —-a-w c:\winnt\system32\xpsp1res.dll
- 2004-08-04 07:56:36 2,897,920 —-a-w c:\winnt\system32\xpsp2res.dll
+ 2008-04-13 17:39:24 2,897,920 —-a-w c:\winnt\system32\xpsp2res.dll
- 2008-10-15 14:00:41 351,744 —-a-w c:\winnt\system32\xpsp3res.dll
+ 2008-04-13 17:39:26 689,152 —-a-w c:\winnt\system32\xpsp3res.dll
+ 2008-07-30 02:26:06 301,568 —-a-w c:\winnt\system32\XPSViewer\XPSViewer.exe
- 2004-08-04 07:56:46 337,920 —-a-w c:\winnt\system32\zipfldr.dll
+ 2008-04-14 00:12:11 338,432 —-a-w c:\winnt\system32\zipfldr.dll
- 2004-08-04 07:56:57 283,648 —-a-w c:\winnt\winhlp32.exe
+ 2008-04-14 00:12:39 283,648 —-a-w c:\winnt\winhlp32.exe
+ 2009-02-21 00:35:56 8,192 —-a-w c:\winnt\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
- 2007-01-19 20:15:24 74,802 —-a-w c:\winnt\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\atl.dll
+ 2008-04-14 00:12:50 74,802 —-a-w c:\winnt\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\atl.dll
- 2007-01-19 20:15:24 995,383 —-a-w c:\winnt\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\mfc42.dll
+ 2008-04-14 00:12:50 995,383 —-a-w c:\winnt\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\mfc42.dll
- 2007-01-19 20:15:24 1,011,774 —-a-w c:\winnt\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\mfc42u.dll
+ 2008-04-14 00:12:50 1,011,774 —-a-w c:\winnt\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\mfc42u.dll
- 2007-01-19 20:15:24 401,462 —-a-w c:\winnt\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\msvcp60.dll
+ 2008-04-14 00:12:50 401,462 —-a-w c:\winnt\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\msvcp60.dll
+ 2008-07-25 16:17:20 479,232 —-a-w c:\winnt\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcm80.dll
+ 2008-07-25 16:17:20 558,080 —-a-w c:\winnt\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcp80.dll
+ 2008-07-25 16:17:20 635,904 —-a-w c:\winnt\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcr80.dll
+ 2007-11-07 02:23:56 224,768 —-a-w c:\winnt\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcm90.dll
+ 2007-11-07 07:19:32 568,832 —-a-w c:\winnt\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcp90.dll
+ 2007-11-07 07:19:32 655,872 —-a-w c:\winnt\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375\msvcr90.dll
+ 2008-04-14 00:12:51 1,054,208 —-a-w c:\winnt\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
+ 2008-04-14 00:12:51 57,344 —-a-w c:\winnt\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcirt.dll
+ 2008-04-14 00:12:51 343,040 —-a-w c:\winnt\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll
+ 2008-04-14 00:12:47 1,724,416 —-a-w c:\winnt\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.5512_x-ww_dfb54e0c\GdiPlus.dll
- 2004-08-04 07:56:59 853,504 —-a-w c:\winnt\WinSxS\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7\dxmrtp.dll
+ 2008-04-14 00:12:49 853,504 —-a-w c:\winnt\WinSxS\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7\dxmrtp.dll
- 2004-08-04 07:56:59 991,232 —-a-w c:\winnt\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\rtcdll.dll
+ 2008-04-14 00:12:50 991,232 —-a-w c:\winnt\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\rtcdll.dll
- 2004-08-04 07:55:56 132,096 —-a-w c:\winnt\WinSxS\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc
0\rtcres.dll
+ 2008-04-13 18:26:33 132,096 —-a-w c:\winnt\WinSxS\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_en_16a24bc
0\rtcres.dll
- 2008-09-18 03:38:35 258,048 —-a-w c:\winnt\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2009-02-21 00:36:03 258,048 —-a-w c:\winnt\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
- 2008-09-18 03:38:35 114,176 —-a-w c:\winnt\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
+ 2009-02-21 00:36:03 113,664 —-a-w c:\winnt\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{263bea5d-83ca-4197-95c1-6192454c115d}]
c:\winnt\system32\hokakale.dll [BU]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d528dc7d-3f68-42e3-8105-5611ffd81e6f}]
c:\winnt\system32\zqrtba.dll [BU]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\winnt\system32\ctfmon.exe" [2008-04-13 15360]
"NetSP - restore settings on power failure"="c:\program files\AT&T Global Network Client\NetSP.exe" [2007-09-07 56624]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"start dr install service"="c:\winnt\startsrv" [X]
"IgfxTray"="c:\winnt\System32\igfxtray.exe" [2003-12-14 155648]
"HotKeysCmds"="c:\winnt\System32\hkcmd.exe" [2003-12-14 118784]
"Smapp"="c:\program files\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 143360]
"DrvLsnr"="c:\program files\Analog Devices\SoundMAX\DrvLsnr.exe" [2003-05-08 69632]
"ChkAdmin"="c:\progra~1\Compaq\COMPAQ~1\CHKADMIN.EXE" [2003-12-03 81920]
"CPQEASYACC"="c:\program files\COMPAQ\Easy Access Button Support\StartEAK.exe" [2003-12-17 40960]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UdaterUI.exe" [2007-12-14 136512]
"Doctor Install"="c:\program files\Doctor Install\InstallMgr.exe" [2002-04-10 761856]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-02-05 849280]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2008-07-16 111952]
"Pointsec Tray"="c:\program files\Pointsec\Pointsec for PC\P95Tray.exe" [2008-02-12 666176]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2008-06-10 1442888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"vasobupizu"="c:\winnt\system32\suzodata.dll" [BU]
"CARPService"="carpserv.exe" [2001-12-23 c:\winnt\system32\carpserv.exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 c:\winnt\KHALMNPR.Exe]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 c:\winnt\LOGI_MWX.EXE]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-13 c:\winnt\system32\bthprops.cpl]
c:\documents and settings\Default User\Start Menu\Programs\Startup\
ropu.bat [2004-02-09 103]
c:\documents and settings\m16738\Start Menu\Programs\Startup\
ropu.bat [2004-02-09 103]
c:\documents and settings\ap0064\Start Menu\Programs\Startup\
ropu.bat [2004-02-09 103]
c:\documents and settings\esdrun\Start Menu\Programs\Startup\
ropu.bat [2004-02-09 103]
c:\documents and settings\JS8394\Start Menu\Programs\Startup\
ropu.bat [2004-02-09 103]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-01-04 113664]
AT&T Global Network Client Monitor.lnk - c:\winnt\Installer\{FC0FC4BA-17D0-493C-AFF4-1FDF92657457}\NetGM_1B536450052A4C0BA1B8FC31F1D473F7.exe [2009-01-08 69632]
BTTray.lnk - c:\program files\Linksys\Bluetooth Utility\BTTray.exe [2004-11-30 569405]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"consentpromptbehavioruser"= 0 (0x0)
"HideFastUserSwitching"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"UseDefaultTile"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\policies\microsoft\windows\windowsupdate\au]
"NoAutoUpdate"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.DVSD"= pdvcodec.dll
"vidc.ffds"= ffdshow.ax
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\
0\
0]
"Script"=drustatus.vbe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\
0\1]
"Script"=newhealth.vbs
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CXMon]
–a—— 2000-08-14 15:48 32768 c:\program files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_monitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE2]
c:\program files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe [BU]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-09-06 14:09 413696 c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SBCAssess]
–a—— 2001-04-09 12:17 45056 c:\program files\Compapps\SBCAssess\SBCAssess.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Network Associates\\Common Framework\\FrameworkService.exe"=
"c:\program files\AT&T Global Network Client\NetClient.exe"= c:\program files\AT&T Global Network Client\NetClient.exe:10.0.0.0/255.0.0.0,32.70.1.0/255.255.255.0,130.1.0.0/255.255.0.0,130.2.0.0/255.254.0.0,135.0.0.0/255.0.0.0,192.20.0.0/255.255.0.0,192.128.0.0/255.255.0.0,192.151.83.0/255.255.255.0,192.205.0.0/255.255.0.0,192.206.169.0/255.255.255.0,204.159.0.0/255.255.0.0,206.121.250.0/255.255.255.0,206.121.253.0/255.255.255.0:Enabled:AT&T Global Network Client
"c:\\Program Files\\1E\\SMSWakeUp50\\SMSWUagent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"6000:TCP"= 6000:TCP:xceed telnet
"9001:TCP"= 9001:TCP:10.0.0.0/255.0.0.0,32.70.1.0/255.255.255.0,130.1.0.0/255.255.0.0,130.2.0.0/255.254.0.0,135.0.0.0/255.0.0.0,192.20.0.0/255.255.0.0,192.128.0.0/255.255.0.0,192.151.83.0/255.255.255.0,192.205.0.0/255.255.0.0,192.206.169.0/255.255.255.0,204.159.0.0/255.255.0.0,206.121.250.0/255.255.255.0,206.121.253.0/255.255.255.0:Enabled:Q Team-Link Messenger
"9002:TCP"= 9002:TCP:10.0.0.0/255.0.0.0,32.70.1.0/255.255.255.0,130.1.0.0/255.255.0.0,130.2.0.0/255.254.0.0,135.0.0.0/255.0.0.0,192.20.0.0/255.255.0.0,192.128.0.0/255.255.0.0,192.151.83.0/255.255.255.0,192.205.0.0/255.255.0.0,192.206.169.0/255.255.255.0,204.159.0.0/255.255.0.0,206.121.250.0/255.255.255.0,206.121.253.0/255.255.255.0:Enabled:Q Team-Link Messenger
"9003:TCP"= 9003:TCP:10.0.0.0/255.0.0.0,32.70.1.0/255.255.255.0,130.1.0.0/255.255.0.0,130.2.0.0/255.254.0.0,135.0.0.0/255.0.0.0,192.20.0.0/255.255.0.0,192.128.0.0/255.255.0.0,192.151.83.0/255.255.255.0,192.205.0.0/255.255.0.0,192.206.169.0/255.255.255.0,204.159.0.0/255.255.0.0,206.121.250.0/255.255.255.0,206.121.253.0/255.255.255.0:Enabled:Q Team-Link Messenger
"9004:TCP"= 9004:TCP:10.0.0.0/255.0.0.0,32.70.1.0/255.255.255.0,130.1.0.0/255.255.0.0,130.2.0.0/255.254.0.0,135.0.0.0/255.0.0.0,192.20.0.0/255.255.0.0,192.128.0.0/255.255.0.0,192.151.83.0/255.255.255.0,192.205.0.0/255.255.0.0,192.206.169.0/255.255.255.0,204.159.0.0/255.255.0.0,206.121.250.0/255.255.255.0,206.121.253.0/255.255.255.0:Enabled:Q Team-Link Messenger
"9005:TCP"= 9005:TCP:10.0.0.0/255.0.0.0,32.70.1.0/255.255.255.0,130.1.0.0/255.255.0.0,130.2.0.0/255.254.0.0,135.0.0.0/255.0.0.0,192.20.0.0/255.255.0.0,192.128.0.0/255.255.0.0,192.151.83.0/255.255.255.0,192.205.0.0/255.255.0.0,192.206.169.0/255.255.255.0,204.159.0.0/255.255.0.0,206.121.250.0/255.255.255.0,206.121.253.0/255.255.255.0:Enabled:Q Team-Link Messenger
R0 prot_2k;prot_2k;c:\winnt\system32\drivers\prot_2k.sys [2008-02-12 220096]
R1 ClntMgmt;HP Client Management Driver;c:\winnt\system32\drivers\Clntmgmt.sys [2004-08-22 59044]
R1 snmpdm_;snmpdm_;c:\winnt\system32\snmpdm_.sys [2007-12-13 25472]
R2 agnwifi;AT&T Wi-Fi Support Driver;c:\winnt\system32\drivers\agnwifi.sys [2005-08-25 24752]
R2 DRUAgent;DRUAgent;c:\program files\DRU\bin\DRUService.exe [2007-11-06 139264]
R2 Pointsec;Pointsec;c:\winnt\system32\Prot_srv.exe [2008-02-12 367168]
R2 Pointsec_start;Pointsec Service Start;c:\winnt\system32\pstartSr.exe [2008-02-12 145984]
R2 SMSWUagent;SMSWUagent;c:\program files\1E\SMSWakeUp50\SMSWUagent.exe [2007-07-06 218568]
R2 snmpdm;snmpdm;c:\winnt\system32\snmpdm.exe -l 8161 –> c:\winnt\system32\snmpdm.exe -l 8161 [?]
R2 ssserviceWinService;AT&T Software Store;c:\program files\Compapps\swstore\ssservice.exe [2008-07-23 81408]
R2 Svc_DrInstal;Doctor Install;c:\program files\Doctor Install\DrInstalSvc.exe [2002-04-10 782336]
R2 TRCTARGET;IBM Tivoli Remote Control - Target;c:\program files\IBM\Tivoli\Remote Control\Target\trc_base.exe [2008-04-29 356864]
R3 agnfilt;AGN Filter Interface;c:\winnt\system32\drivers\agnfilt.sys [2007-08-09 217728]
S1 CCDevice;CCDevice; [x]
S2 IPSECEXT;Nortel Extranet Access Protocol;c:\winnt\system32\drivers\ipsecw2k.sys [2004-08-22 113984]
S3 avpnnic;AGN Virtual Network Adapter;c:\winnt\system32\drivers\avpnnic.sys [2004-08-22 11392]
S3 ExtranetAccess;Contivity VPN Service;c:\program files\Nortel Networks\Extranet_serv.exe [2004-08-22 565248]
S3 OracleOraHome90ClientCache;OracleOraHome90ClientCache;c:\oracle\ora90\bin\ONRSD.EXE [2001-08-14 425828]
S3 rcmdsvc;Remote Command Service;\\bcantrell2\c$\Temp\rcmdsvc.exe [2008-07-11 41472]
S3 scsiscan;SCSI Scanner Driver;c:\winnt\system32\drivers\scsiscan.sys [2004-10-04 11520]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{RUNONCE_MICROSOFT INTERNET EXPLORER, VERSION 6.0 SP11}]
c:\winnt\USERRU~1\runonce.exe /ec:\program files\INTERNET EXPLORER\CUSTOM\POSTMSIE.EXE /g /V /W /lc:\progra~1\COMMON~1\SOFTMGMT\LOGS\MICROSOFT INTERNET EXPLORER, VERSION 6.0 SP1.LOG
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{RUNONCE_UNINSTALL_ACTIVATESS1021}]
c:\winnt\USERRU~1\runonce.exe /ec:\program files\ATTMGMT\ACTIVATE SCREEN SAVER\ACTIVATESS.EXE /g/UNINSTALL /V /C /lc:\progra~1\COMMON~1\SOFTMGMT\LOGS\UNINSTALL_ACTIVATESS102.LOG
.
Contents of the 'Scheduled Tasks' folder
2005-04-02 c:\winnt\Tasks\IM.job
- c:\progra~1\AT&T\MESSEN~1\JABBER~1.EXE []
2006-01-30 c:\winnt\Tasks\weftp.job
- c:\scripts\weftp.bat [2005-07-21 13:53]
.
.
——- Supplementary Scan ——-
.
uInternet Settings,ProxyOverride =
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send To &Bluetooth - c:\program files\Linksys\Bluetooth Utility\btsendto_ie_ctx.htm
IE: {{D666CFDA-F583-889A-323D-9F8FAF7144C3} - c:\program files\knowledgegateway\launch.htm
DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
DPF: {08288600-E9D9-11D1-9C84-006008319186} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\vantfind.cab
DPF: {14924309-C4D4-11D1-85ED-006097794610} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\ucStkCst.cab
DPF: {1C8B8F66-60FA-11D1-8B99-0020AFF5AA3B} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\icccdf4.cab
DPF: {201CF4B6-C42D-11D1-A0EC-006008936BDD} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\ucItmStk.cab
DPF: {3D82A12A-C1FA-11D0-9B21-0080C79EFE90} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\vanfind.cab
DPF: {4117ECE7-C7FE-11D1-9844-0060089F7AEB} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\ucStkLkp.cab
DPF: {413D6754-BFD4-47FE-9346-319559290BFA} - hxxps://www.webpcfos.com/webpcfos/websabre/HTEweb_new.cab
DPF: {4E192D78-E515-11D1-B89E-0020AFF695A0} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\ucItmMst.cab
DPF: {51BB7DFD-A6F5-4FAC-B8C9-E71CF84D082C} - hxxp://pdsnsm1/Altiris/NS/NSCap/Bin/Win32/x86/AltirisNSConsole.cab
DPF: {60046ED9-8E77-11D0-9B21-0080C79EFE90} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\vangrid.cab
DPF: {603607C4-BE6F-11D1-983A-0060089F7AEB} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\ucCarrier.cab
DPF: {9345E91A-BF88-11D1-8AFE-00A02470741B} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\ucVendCt.cab
DPF: {97EEFD1A-C41D-11D1-A0EC-006008936BDD} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\ucCusLbl.cab
DPF: {9E85612B-D0A6-11D1-89BF-0060089F7A3E} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\SHIPVIEW.cab
DPF: {AA64AF34-C45D-11D1-85ED-006097794610} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\ucVirDm.cab
DPF: {ABDE29F2-6F9C-11D1-9B21-0080C79EFE90} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\VanLiteral.CAB
DPF: {B86D4018-C597-11D1-9843-0060089F7AEB} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\ucUOM.cab
DPF: {B86D4502-C597-11D1-9843-0060089F7AEB} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\ucItmCat.cab
DPF: {B8958DE0-BAC9-101C-933E-0000C005958C} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\edt32x20.ocx
DPF: {BE033B8C-722E-11D1-9B21-0080C79EFE90} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\VanMessage.CAB
DPF: {BE77224A-C41F-11D1-85ED-006097794610} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\ucStkDt.cab
DPF: {D7553B82-8EEC-11D4-AAE3-005056A35A1F} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\UPLOADCOMPONENT.cab
DPF: {EB0CF3B4-C33B-11D1-A0EC-006008936BDD} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\ucStkSt.cab
DPF: {EB52CF7B-3917-11CE-80FB-0000C0C14E92} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\sscala32.cab
DPF: {EBF47667-BF3F-11D1-983D-0060089F7AEB} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\ucCarCont.cab
DPF: {ED738376-C44A-11D1-A0EC-006008936BDD} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\ucBusDom.cab
DPF: {F29BE3C6-BE82-11D1-91FE-0020AFF5AA68} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\ucCurr.cab
DPF: {F39FD815-E9C3-11D1-9C83-006008319186} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\vantree.cab
DPF: {F74887C8-C44B-11D1-85ED-006097794610} - file://c:\docume~1\BCANTR~1\LOCALS~1\Temp\ucVend.cab
FF - ProfilePath - c:\documents and settings\briant\Application Data\Mozilla\Firefox\Profiles\shcr89fe.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/
FF - plugin: c:\program files\Java\jre1.5.0_13\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0_13\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0_13\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0_13\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0_13\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0_13\bin\NPJPI150_13.dll
FF - plugin: c:\program files\Java\jre1.5.0_13\bin\NPOJI610.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2009-02-23 09:15:06
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(1428)
c:\winnt\system32\pssogina.dll
c:\winnt\system32\netgina.dll
c:\program files\AT&T Global Network Client\NetClient.dll
.
Completion time: 2009-02-23 9:17:05
ComboFix-quarantined-files.txt 2009-02-23 14:16:41
Pre-Run: 14,470,246,400 bytes free
Post-Run: 14,485,405,696 bytes free
10755 — E O F — 2008-03-20 07:02:49
*******************************
GMER.Log
GMER 1.0.14.14536 -
http://www.gmer.net
Rootkit scan 2009-02-23 09:38:36
Windows 5.1.2600 Service Pack 3
—- System - GMER 1.0.14 —-
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0xAF209ABB]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateKey [0xAF209A3B]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0xAF209AE5]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteKey [0xAF209A4F]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xAF209A7B]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xAF209B0F]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenKey [0xAF209A27]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xAF209ACF]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRenameKey [0xAF209A65]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetValueKey [0xAF209A91]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0xAF209AA7]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xAF209B25]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0xAF209AF9]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection
—- Kernel code sections - GMER 1.0.14 —-
.text ntoskrnl.exe!ZwYieldExecution 804F0EA6 7 Bytes JMP AF209AFD \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwOpenKey 80568D59 5 Bytes JMP AF209A2B \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtCreateFile 8056CDC0 5 Bytes JMP AF209ABF \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwCreateKey 8057065D 5 Bytes JMP AF209A3F \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwProtectVirtualMemory 80571CB1 7 Bytes JMP AF209AD3 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwSetValueKey 80572889 7 Bytes JMP AF209A95 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwUnmapViewOfSection 805736E6 5 Bytes JMP AF209B29 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!NtMapViewOfSection 80573B61 7 Bytes JMP AF209B13 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwTerminateProcess 805822EC 5 Bytes JMP AF209AAB \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwDeleteValueKey 80592D5C 7 Bytes JMP AF209A7F \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwDeleteKey 805952CA 7 Bytes JMP AF209A53 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwCreateProcess 805B136A 5 Bytes JMP AF209AE9 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwRenameKey 8064E7B6 7 Bytes JMP AF209A69 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
? C:\WINNT\system32\drivers\prot_2k.sys The process cannot access the file because it is being used by another process.
? C:\WINNT\system32\Drivers\PROCEXP90.SYS The system cannot find the file specified. !
? C:\ComboFix\catchme.sys The system cannot find the path specified. !
—- User code sections - GMER 1.0.14 —-
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 006A0FEF
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 006A0040
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 006A0F4B
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 006A0F5C
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 006A0025
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 006A0F94
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 006A0F0C
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 006A0F1D
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 006A008A
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 006A0EF1
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 006A0ED6
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 006A0F83
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 006A0FD4
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 006A0F3A
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 006A0FAF
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 006A0000
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 006A006F
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 3 Bytes JMP 0069001B
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] ADVAPI32.dll!RegOpenKeyExW + 4 77DD6AA3 1 Byte [ 88 ]
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] ADVAPI32.dll!RegCreateKeyExW 77DD775C 3 Bytes JMP 00690073
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] ADVAPI32.dll!RegCreateKeyExW + 4 77DD7760 1 Byte [ 88 ]
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] ADVAPI32.dll!RegOpenKeyExA 77DD7842 3 Bytes JMP 0069000A
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] ADVAPI32.dll!RegOpenKeyExA + 4 77DD7846 1 Byte [ 88 ]
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] ADVAPI32.dll!RegOpenKeyW 77DD7936 3 Bytes JMP 00690FD4
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] ADVAPI32.dll!RegOpenKeyW + 4 77DD793A 1 Byte [ 88 ]
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 3 Bytes JMP 00690062
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] ADVAPI32.dll!RegCreateKeyExA + 4 77DDE9E8 1 Byte [ 88 ]
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 3 Bytes JMP 00690FE5
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] ADVAPI32.dll!RegOpenKeyA + 4 77DDEFBC 1 Byte [ 88 ]
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] ADVAPI32.dll!RegCreateKeyW 77DFBA25 5 Bytes JMP 00690047
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 00690036
.text c:\Program Files\Network Associates\Common Framework\naPrdMgr.exe[212] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00670FEF
.text C:\WINNT\System32\svchost.exe[284] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 02760FEF
.text C:\WINNT\System32\svchost.exe[284] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 02760089
.text C:\WINNT\System32\svchost.exe[284] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 0276006E
.text C:\WINNT\System32\svchost.exe[284] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0276005D
.text C:\WINNT\System32\svchost.exe[284] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 02760F9E
.text C:\WINNT\System32\svchost.exe[284] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 02760036
.text C:\WINNT\System32\svchost.exe[284] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 02760F6F
.text C:\WINNT\System32\svchost.exe[284] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 027600B7
.text C:\WINNT\System32\svchost.exe[284] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 02760F43
.text C:\WINNT\System32\svchost.exe[284] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 02760F54
.text C:\WINNT\System32\svchost.exe[284] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 02760F28
.text C:\WINNT\System32\svchost.exe[284] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 02760FB9
.text C:\WINNT\System32\svchost.exe[284] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 0276000A
.text C:\WINNT\System32\svchost.exe[284] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 0276009A
.text C:\WINNT\System32\svchost.exe[284] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 02760FCA
.text C:\WINNT\System32\svchost.exe[284] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 0276001B
.text C:\WINNT\System32\svchost.exe[284] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 027600DC
.text C:\WINNT\System32\svchost.exe[284] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 02750F9E
.text C:\WINNT\System32\svchost.exe[284] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 02750F4A
.text C:\WINNT\System32\svchost.exe[284] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 02750FAF
.text C:\WINNT\System32\svchost.exe[284] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 02750FD4
.text C:\WINNT\System32\svchost.exe[284] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 02750F6F
.text C:\WINNT\System32\svchost.exe[284] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 02750FEF
.text C:\WINNT\System32\svchost.exe[284] ADVAPI32.dll!RegCreateKeyW 77DFBA25 5 Bytes JMP 02750011
.text C:\WINNT\System32\svchost.exe[284] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 02750000
.text C:\WINNT\System32\svchost.exe[284] WS2_32.dll!socket 71AB4211 5 Bytes JMP 02720000
.text C:\WINNT\System32\svchost.exe[284] WININET.dll!InternetOpenW 771BAF39 5 Bytes JMP 02730025
.text C:\WINNT\System32\svchost.exe[284] WININET.dll!InternetOpenA 771C5786 5 Bytes JMP 02730000
.text C:\WINNT\System32\svchost.exe[284] WININET.dll!InternetOpenUrlA 771C5A52 5 Bytes JMP 02730FEF
.text C:\WINNT\System32\svchost.exe[284] WININET.dll!InternetOpenUrlW 771D5BA2 5 Bytes JMP 02730FD2
.text C:\WINNT\System32\svchost.exe[328] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 007B0000
.text C:\WINNT\System32\svchost.exe[328] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 007B0090
.text C:\WINNT\System32\svchost.exe[328] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 007B0F9B
.text C:\WINNT\System32\svchost.exe[328] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 007B0FB6
.text C:\WINNT\System32\svchost.exe[328] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 007B0FC7
.text C:\WINNT\System32\svchost.exe[328] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 007B0058
.text C:\WINNT\System32\svchost.exe[328] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 007B00BC
.text C:\WINNT\System32\svchost.exe[328] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 007B0F80
.text C:\WINNT\System32\svchost.exe[328] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 007B0F3E
.text C:\WINNT\System32\svchost.exe[328] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 007B00D7
.text C:\WINNT\System32\svchost.exe[328] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 007B00E8
.text C:\WINNT\System32\svchost.exe[328] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 007B0069
.text C:\WINNT\System32\svchost.exe[328] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 007B001B
.text C:\WINNT\System32\svchost.exe[328] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 007B00AB
.text C:\WINNT\System32\svchost.exe[328] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 007B003D
.text C:\WINNT\System32\svchost.exe[328] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 007B002C
.text C:\WINNT\System32\svchost.exe[328] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 007B0F4F
.text C:\WINNT\System32\svchost.exe[328] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 007A0FCA
.text C:\WINNT\System32\svchost.exe[328] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 007A0F8A
.text C:\WINNT\System32\svchost.exe[328] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 007A0011
.text C:\WINNT\System32\svchost.exe[328] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 007A0FDB
.text C:\WINNT\System32\svchost.exe[328] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 007A0047
.text C:\WINNT\System32\svchost.exe[328] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 007A0000
.text C:\WINNT\System32\svchost.exe[328] ADVAPI32.dll!RegCreateKeyW 77DFBA25 5 Bytes JMP 007A0036
.text C:\WINNT\System32\svchost.exe[328] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 007A0FAF
.text C:\WINNT\System32\svchost.exe[328] WS2_32.dll!socket 71AB4211 5 Bytes JMP 0074000A
.text C:\WINNT\System32\svchost.exe[792] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00B40FEF
.text C:\WINNT\System32\svchost.exe[792] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00B40F9E
.text C:\WINNT\System32\svchost.exe[792] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00B40FAF
.text C:\WINNT\System32\svchost.exe[792] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00B4007D
.text C:\WINNT\System32\svchost.exe[792] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00B40062
.text C:\WINNT\System32\svchost.exe[792] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00B40040
.text C:\WINNT\System32\svchost.exe[792] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00B400BF
.text C:\WINNT\System32\svchost.exe[792] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00B40F83
.text C:\WINNT\System32\svchost.exe[792] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00B40F52
.text C:\WINNT\System32\svchost.exe[792] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00B400EB
.text C:\WINNT\System32\svchost.exe[792] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 00B40106
.text C:\WINNT\System32\svchost.exe[792] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 00B40051
.text C:\WINNT\System32\svchost.exe[792] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 00B4000A
.text C:\WINNT\System32\svchost.exe[792] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 00B400AE
.text C:\WINNT\System32\svchost.exe[792] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 00B40025
.text C:\WINNT\System32\svchost.exe[792] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 00B40FD4
.text C:\WINNT\System32\svchost.exe[792] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 00B400D0
.text C:\WINNT\System32\svchost.exe[792] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 00B3002F
.text C:\WINNT\System32\svchost.exe[792] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 00B30FAF
.text C:\WINNT\System32\svchost.exe[792] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 00B30FD4
.text C:\WINNT\System32\svchost.exe[792] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 00B30FE5
.text C:\WINNT\System32\svchost.exe[792] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 00B3006C
.text C:\WINNT\System32\svchost.exe[792] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 00B30000
.text C:\WINNT\System32\svchost.exe[792] ADVAPI32.dll!RegCreateKeyW 77DFBA25 5 Bytes JMP 00B30051
.text C:\WINNT\System32\svchost.exe[792] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 00B30040
.text C:\WINNT\system32\svchost.exe[980] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00BF0FEF
.text C:\WINNT\system32\svchost.exe[980] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00BF0062
.text C:\WINNT\system32\svchost.exe[980] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00BF0F6D
.text C:\WINNT\system32\svchost.exe[980] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00BF0F7E
.text C:\WINNT\system32\svchost.exe[980] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00BF0047
.text C:\WINNT\system32\svchost.exe[980] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00BF0036
.text C:\WINNT\system32\svchost.exe[980] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00BF007D
.text C:\WINNT\system32\svchost.exe[980] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00BF0F35
.text C:\WINNT\system32\svchost.exe[980] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00BF0EFF
.text C:\WINNT\system32\svchost.exe[980] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00BF0098
.text C:\WINNT\system32\svchost.exe[980] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 00BF0EE4
.text C:\WINNT\system32\svchost.exe[980] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 00BF0FA5
.text C:\WINNT\system32\svchost.exe[980] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 00BF000A
.text C:\WINNT\system32\svchost.exe[980] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 00BF0F5C
.text C:\WINNT\system32\svchost.exe[980] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 00BF0FD4
.text C:\WINNT\system32\svchost.exe[980] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 00BF001B
.text C:\WINNT\system32\svchost.exe[980] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 00BF0F1A
.text C:\WINNT\system32\svchost.exe[980] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 00BE0FAF
.text C:\WINNT\system32\svchost.exe[980] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 00BE0F80
.text C:\WINNT\system32\svchost.exe[980] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 00BE0FC0
.text C:\WINNT\system32\svchost.exe[980] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 00BE0FE5
.text C:\WINNT\system32\svchost.exe[980] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 00BE003D
.text C:\WINNT\system32\svchost.exe[980] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 00BE0000
.text C:\WINNT\system32\svchost.exe[980] ADVAPI32.dll!RegCreateKeyW 77DFBA25 5 Bytes JMP 00BE002C
.text C:\WINNT\system32\svchost.exe[980] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 00BE0011
.text C:\WINNT\system32\svchost.exe[980] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00BA0000
.text C:\WINNT\system32\svchost.exe[980] WININET.dll!InternetOpenW 771BAF39 5 Bytes JMP 00BB000A
.text C:\WINNT\system32\svchost.exe[980] WININET.dll!InternetOpenA 771C5786 5 Bytes JMP 00BB0FE5
.text C:\WINNT\system32\svchost.exe[980] WININET.dll!InternetOpenUrlA 771C5A52 5 Bytes JMP 00BB001B
.text C:\WINNT\system32\svchost.exe[980] WININET.dll!InternetOpenUrlW 771D5BA2 5 Bytes JMP 00BB0FC8
.text C:\WINNT\system32\svchost.exe[1228] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00660FE5
.text C:\WINNT\system32\svchost.exe[1228] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00660F3A
.text C:\WINNT\system32\svchost.exe[1228] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00660F55
.text C:\WINNT\system32\svchost.exe[1228] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0066002F
.text C:\WINNT\system32\svchost.exe[1228] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00660F72
.text C:\WINNT\system32\svchost.exe[1228] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00660F9E
.text C:\WINNT\system32\svchost.exe[1228] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00660F0E
.text C:\WINNT\system32\svchost.exe[1228] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00660F1F
.text C:\WINNT\system32\svchost.exe[1228] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00660EC7
.text C:\WINNT\system32\svchost.exe[1228] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00660EE2
.text C:\WINNT\system32\svchost.exe[1228] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 0066007B
.text C:\WINNT\system32\svchost.exe[1228] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 00660F8D
.text C:\WINNT\system32\svchost.exe[1228] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 00660FD4
.text C:\WINNT\system32\svchost.exe[1228] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 00660040
.text C:\WINNT\system32\svchost.exe[1228] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 00660FAF
.text C:\WINNT\system32\svchost.exe[1228] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 00660000
.text C:\WINNT\system32\svchost.exe[1228] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 00660EFD
.text C:\WINNT\system32\svchost.exe[1228] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 00650036
.text C:\WINNT\system32\svchost.exe[1228] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 00650080
.text C:\WINNT\system32\svchost.exe[1228] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 00650FE5
.text C:\WINNT\system32\svchost.exe[1228] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 0065001B
.text C:\WINNT\system32\svchost.exe[1228] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 00650FB9
.text C:\WINNT\system32\svchost.exe[1228] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 00650000
.text C:\WINNT\system32\svchost.exe[1228] ADVAPI32.dll!RegCreateKeyW 77DFBA25 2 Bytes JMP 00650FCA
.text C:\WINNT\system32\svchost.exe[1228] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA28 2 Bytes [ 85, 88 ]
.text C:\WINNT\system32\svchost.exe[1228] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 00650047
.text C:\WINNT\system32\svchost.exe[1228] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00630FEF
.text C:\WINNT\system32\services.exe[1472] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00EC0FEF
.text C:\WINNT\system32\services.exe[1472] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00EC008C
.text C:\WINNT\system32\services.exe[1472] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00EC0F8D
.text C:\WINNT\system32\services.exe[1472] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00EC0067
.text C:\WINNT\system32\services.exe[1472] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00EC0F9E
.text C:\WINNT\system32\services.exe[1472] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00EC0040
.text C:\WINNT\system32\services.exe[1472] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00EC00B3
.text C:\WINNT\system32\services.exe[1472] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00EC0F6B
.text C:\WINNT\system32\services.exe[1472] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00EC00D8
.text C:\WINNT\system32\services.exe[1472] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00EC0F3F
.text C:\WINNT\system32\services.exe[1472] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 00EC0F24
.text C:\WINNT\system32\services.exe[1472] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 00EC0FAF
.text C:\WINNT\system32\services.exe[1472] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 00EC000A
.text C:\WINNT\system32\services.exe[1472] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 00EC0F7C
.text C:\WINNT\system32\services.exe[1472] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 00EC0025
.text C:\WINNT\system32\services.exe[1472] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 00EC0FD4
.text C:\WINNT\system32\services.exe[1472] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 00EC0F50
.text C:\WINNT\system32\services.exe[1472] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 00EB0FC3
.text C:\WINNT\system32\services.exe[1472] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 00EB0F6B
.text C:\WINNT\system32\services.exe[1472] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 00EB0FD4
.text C:\WINNT\system32\services.exe[1472] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 00EB000A
.text C:\WINNT\system32\services.exe[1472] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 00EB0F7C
.text C:\WINNT\system32\services.exe[1472] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 00EB0FE5
.text C:\WINNT\system32\services.exe[1472] ADVAPI32.dll!RegCreateKeyW 77DFBA25 2 Bytes JMP 00EB0F8D
.text C:\WINNT\system32\services.exe[1472] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA28 2 Bytes [ 0B, 89 ]
.text C:\WINNT\system32\services.exe[1472] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 00EB0FA8
.text C:\WINNT\system32\services.exe[1472] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00E90000
.text C:\WINNT\system32\lsass.exe[1492] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00CA0FEF
.text C:\WINNT\system32\lsass.exe[1492] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00CA0F5C
.text C:\WINNT\system32\lsass.exe[1492] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00CA0F77
.text C:\WINNT\system32\lsass.exe[1492] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00CA0F88
.text C:\WINNT\system32\lsass.exe[1492] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00CA0FA5
.text C:\WINNT\system32\lsass.exe[1492] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00CA0FD4
.text C:\WINNT\system32\lsass.exe[1492] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00CA0F37
.text C:\WINNT\system32\lsass.exe[1492] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00CA007D
.text C:\WINNT\system32\lsass.exe[1492] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00CA00B5
.text C:\WINNT\system32\lsass.exe[1492] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00CA00A4
.text C:\WINNT\system32\lsass.exe[1492] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 00CA00D0
.text C:\WINNT\system32\lsass.exe[1492] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 00CA0051
.text C:\WINNT\system32\lsass.exe[1492] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 00CA000A
.text C:\WINNT\system32\lsass.exe[1492] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 00CA006C
.text C:\WINNT\system32\lsass.exe[1492] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 00CA0040
.text C:\WINNT\system32\lsass.exe[1492] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 00CA0025
.text C:\WINNT\system32\lsass.exe[1492] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 00CA0F26
.text C:\WINNT\system32\lsass.exe[1492] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 00C90FC0
.text C:\WINNT\system32\lsass.exe[1492] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 00C90F83
.text C:\WINNT\system32\lsass.exe[1492] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 00C90011
.text C:\WINNT\system32\lsass.exe[1492] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 00C90000
.text C:\WINNT\system32\lsass.exe[1492] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 00C90040
.text C:\WINNT\system32\lsass.exe[1492] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 00C90FE5
.text C:\WINNT\system32\lsass.exe[1492] ADVAPI32.dll!RegCreateKeyW 77DFBA25 2 Bytes JMP 00C90F9E
.text C:\WINNT\system32\lsass.exe[1492] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA28 2 Bytes JMP C89FEDB5
.text C:\WINNT\system32\lsass.exe[1492] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 00C90FAF
.text C:\WINNT\system32\lsass.exe[1492] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00C70FEF
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 010D000A
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 010D0067
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 010D0F72
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 010D0040
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 010D0F83
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 010D0FB9
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 010D00A4
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 010D0093
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 010D00D3
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 010D0F30
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 010D0F1F
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 010D0FA8
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] kernel32.dll!CreateFileW 7C8107F0 3 Bytes JMP 010D001B
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] kernel32.dll!CreateFileW + 4 7C8107F4 1 Byte [ 84 ]
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] kernel32.dll!CreatePipe 7C81D827 3 Bytes JMP 010D0078
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] kernel32.dll!CreatePipe + 4 7C81D82B 1 Byte [ 84 ]
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 010D0FCA
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 010D0FE5
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 010D0F41
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 010C0036
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 010C006C
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 010C0025
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 010C0FEF
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 010C0051
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 010C000A
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] ADVAPI32.dll!RegCreateKeyW 77DFBA25 2 Bytes JMP 010C0FB9
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA28 2 Bytes [ 2C, 89 ]
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 010C0FCA
.text c:\Program Files\Network Associates\Common Framework\FrameworkService.exe[1664] WS2_32.dll!socket 71AB4211 5 Bytes JMP 010A0FEF
.text C:\WINNT\system32\svchost.exe[1748] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00AA000A
.text C:\WINNT\system32\svchost.exe[1748] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00AA0F70
.text C:\WINNT\system32\svchost.exe[1748] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00AA0F8B
.text C:\WINNT\system32\svchost.exe[1748] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00AA0065
.text C:\WINNT\system32\svchost.exe[1748] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00AA0FA8
.text C:\WINNT\system32\svchost.exe[1748] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00AA0040
.text C:\WINNT\system32\svchost.exe[1748] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00AA00B8
.text C:\WINNT\system32\svchost.exe[1748] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00AA009D
.text C:\WINNT\system32\svchost.exe[1748] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00AA0F4B
.text C:\WINNT\system32\svchost.exe[1748] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00AA00E4
.text C:\WINNT\system32\svchost.exe[1748] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 00AA00FF
.text C:\WINNT\system32\svchost.exe[1748] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 00AA0FC3
.text C:\WINNT\system32\svchost.exe[1748] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 00AA001B
.text C:\WINNT\system32\svchost.exe[1748] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 00AA0080
.text C:\WINNT\system32\svchost.exe[1748] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 00AA0FD4
.text C:\WINNT\system32\svchost.exe[1748] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 00AA0FE5
.text C:\WINNT\system32\svchost.exe[1748] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 00AA00D3
.text C:\WINNT\system32\svchost.exe[1748] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 00A90FAF
.text C:\WINNT\system32\svchost.exe[1748] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 00A90F5E
.text C:\WINNT\system32\svchost.exe[1748] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 00A90FC0
.text C:\WINNT\system32\svchost.exe[1748] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 00A90000
.text C:\WINNT\system32\svchost.exe[1748] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 00A9001B
.text C:\WINNT\system32\svchost.exe[1748] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 00A90FEF
.text C:\WINNT\system32\svchost.exe[1748] ADVAPI32.dll!RegCreateKeyW 77DFBA25 2 Bytes JMP 00A90F79
.text C:\WINNT\system32\svchost.exe[1748] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA28 2 Bytes [ C9, 88 ]
.text C:\WINNT\system32\svchost.exe[1748] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 00A90F9E
.text C:\WINNT\system32\svchost.exe[1748] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00A7000A
.text C:\WINNT\system32\svchost.exe[1808] kernel32.dll!CreateFileA 7C801A28 5 Bytes JMP 00BE0FEF
.text C:\WINNT\system32\svchost.exe[1808] kernel32.dll!VirtualProtectEx 7C801A61 5 Bytes JMP 00BE0F50
.text C:\WINNT\system32\svchost.exe[1808] kernel32.dll!VirtualProtect 7C801AD4 5 Bytes JMP 00BE0F6B
.text C:\WINNT\system32\svchost.exe[1808] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00BE0F7C
.text C:\WINNT\system32\svchost.exe[1808] kernel32.dll!LoadLibraryExA 7C801D53 5 Bytes JMP 00BE0F8D
.text C:\WINNT\system32\svchost.exe[1808] kernel32.dll!LoadLibraryA 7C801D7B 5 Bytes JMP 00BE001B
.text C:\WINNT\system32\svchost.exe[1808] kernel32.dll!GetStartupInfoW 7C801E54 5 Bytes JMP 00BE0F24
.text C:\WINNT\system32\svchost.exe[1808] kernel32.dll!GetStartupInfoA 7C801EF2 5 Bytes JMP 00BE006A
.text C:\WINNT\system32\svchost.exe[1808] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00BE009B
.text C:\WINNT\system32\svchost.exe[1808] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 00BE0EF8
.text C:\WINNT\system32\svchost.exe[1808] kernel32.dll!GetProcAddress 7C80AE30 5 Bytes JMP 00BE0EE7
.text C:\WINNT\system32\svchost.exe[1808] kernel32.dll!LoadLibraryW 7C80AEDB 5 Bytes JMP 00BE0F9E
.text C:\WINNT\system32\svchost.exe[1808] kernel32.dll!CreateFileW 7C8107F0 5 Bytes JMP 00BE000A
.text C:\WINNT\system32\svchost.exe[1808] kernel32.dll!CreatePipe 7C81D827 5 Bytes JMP 00BE0F3F
.text C:\WINNT\system32\svchost.exe[1808] kernel32.dll!CreateNamedPipeW 7C82F0C5 5 Bytes JMP 00BE0FAF
.text C:\WINNT\system32\svchost.exe[1808] kernel32.dll!CreateNamedPipeA 7C860B7C 5 Bytes JMP 00BE0FD4
.text C:\WINNT\system32\svchost.exe[1808] kernel32.dll!WinExec 7C8623AD 5 Bytes JMP 00BE0F13
.text C:\WINNT\system32\svchost.exe[1808] ADVAPI32.dll!RegOpenKeyExW 77DD6A9F 5 Bytes JMP 00BD0FAF
.text C:\WINNT\system32\svchost.exe[1808] ADVAPI32.dll!RegCreateKeyExW 77DD775C 5 Bytes JMP 00BD0F57
.text C:\WINNT\system32\svchost.exe[1808] ADVAPI32.dll!RegOpenKeyExA 77DD7842 5 Bytes JMP 00BD0FD4
.text C:\WINNT\system32\svchost.exe[1808] ADVAPI32.dll!RegOpenKeyW 77DD7936 5 Bytes JMP 00BD000A
.text C:\WINNT\system32\svchost.exe[1808] ADVAPI32.dll!RegCreateKeyExA 77DDE9E4 5 Bytes JMP 00BD0F68
.text C:\WINNT\system32\svchost.exe[1808] ADVAPI32.dll!RegOpenKeyA 77DDEFB8 5 Bytes JMP 00BD0FEF
.text C:\WINNT\system32\svchost.exe[1808] ADVAPI32.dll!RegCreateKeyW 77DFBA25 2 Bytes JMP 00BD0F83
.text C:\WINNT\system32\svchost.exe[1808] ADVAPI32.dll!RegCreateKeyW + 3 77DFBA28 2 Bytes [ DD, 88 ]
.text C:\WINNT\system32\svchost.exe[1808] ADVAPI32.dll!RegCreateKeyA 77DFBCC3 5 Bytes JMP 00BD0F94
.text C:\WINNT\system32\svchost.exe[1808] WS2_32.dll!socket 71AB4211 5 Bytes JMP 00BB000A
—- User IAT/EAT - GMER 1.0.14 —-
IAT C:\WINNT\explorer.exe[3948] @ C:\WINNT\explorer.exe [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\explorer.exe[3948] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\explorer.exe[3948] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\explorer.exe[3948] @ C:\WINNT\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\explorer.exe[3948] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\explorer.exe[3948] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\explorer.exe[3948] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\explorer.exe[3948] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\explorer.exe[3948] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\explorer.exe[3948] @ C:\WINNT\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\explorer.exe[3948] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\explorer.exe[3948] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\explorer.exe[3948] @ C:\WINNT\system32\USERENV.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\explorer.exe[3948] @ C:\WINNT\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\explorer.exe[3948] @ C:\WINNT\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT C:\WINNT\explorer.exe[3948] @ C:\WINNT\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINNT\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
—- Devices - GMER 1.0.14 —-
AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 prot_2k.sys
AttachedDevice \Driver\Tcpip \Device\Udp mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice \FileSystem\Fastfat \Fat mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
—- Registry - GMER 1.0.14 —-
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0016b6ee52bb
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0016b6ee52bb@001bafdb6a5c 0x21 0xB5 0x90 0xEB …
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0016b6ee52bb@001e7dca57b5 0x7E 0xBB 0x34 0x8E …
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0016b6ee52bb
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0016b6ee52bb@001bafdb6a5c 0x21 0xB5 0x90 0xEB …
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0016b6ee52bb@001e7dca57b5 0x7E 0xBB 0x34 0x8E …
—- Disk sectors - GMER 1.0.14 —-
Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior;
—- EOF - GMER 1.0.14 —-
*******************************************
HIJT.txt
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:40:02 AM, on 2/23/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Linksys\Bluetooth Utility\bin\btwdins.exe
C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
C:\PROGRAM FILES\DRU\bin\DRUService.exe
C:\WINNT\System32\Hummingbird\Connectivity\7.00\Inetd\inetd32.exe
C:\WINNT\System32\Hummingbird\Connectivity\7.00\Jconfig\jconfigdNT.exe
C:\WINNT\System32\Hummingbird\Connectivity\7.00\Jconfig\hjavaw.exe
c:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Java\jre1.5.0_13\bin\javaw.exe
c:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\AT&T Global Network Client\netcfgsvr.exe
C:\WINNT\system32\Prot_srv.exe
C:\WINNT\system32\pstartSr.exe
C:\WINNT\system32\snmpdm.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\compapps\swstore\ssservice.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Doctor Install\DrInstalSvc.exe
C:\Program Files\IBM\Tivoli\Remote Control\Target\trc_base.exe
C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
C:\WINNT\System32\MsPMSPSv.exe
C:\WINNT\system32\CCM\CcmExec.exe
C:\Program Files\1E\SMSWakeUp50\SMSWUagent.exe
C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
C:\WINNT\System32\igfxtray.exe
C:\WINNT\System32\hkcmd.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\Program Files\Network Associates\Common Framework\UdaterUI.exe
C:\Program Files\Doctor Install\InstallMgr.exe
C:\WINNT\system32\carpserv.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\WINNT\Logi_MwX.Exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\Pointsec\Pointsec for PC\P95Tray.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\WINNT\system32\ctfmon.exe
c:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
C:\Program Files\Linksys\Bluetooth Utility\BTTray.exe
C:\PROGRA~1\Linksys\BLUETO~1\BTSTAC~1.EXE
C:\WINNT\explorer.exe
C:\Program Files\IBM\Tivoli\Remote Control\Target\trc_gui.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {263bea5d-83ca-4197-95c1-6192454c115d} - C:\WINNT\system32\hokakale.dll (file missing)
O2 - BHO: CitiUS Shared Browser Helper Object - {387EDF53-1CF2-4523-BC2F-13462651BE8C} - C:\WINNT\system32\BhoCitUS.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_13\bin\ssv.dll
O2 - BHO: {f6e18dff-1165-5018-3e24-86f3d7cd825d} - {d528dc7d-3f68-42e3-8105-5611ffd81e6f} - C:\WINNT\system32\zqrtba.dll (file missing)
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [ChkAdmin] C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "c:\Program Files\Network Associates\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [start dr install service] c:\winnt\startsrv /service=svc_drinstal
O4 - HKLM\..\Run: [Doctor Install] C:\Program Files\Doctor Install\InstallMgr.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Pointsec Tray] C:\Program Files\Pointsec\Pointsec for PC\P95Tray.exe
O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [vasobupizu] Rundll32.exe "C:\WINNT\system32\suzodata.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [NetSP - restore settings on power failure] "C:\Program Files\AT&T Global Network Client\NetSP.exe" -show
O4 - S-1-5-18 Startup: ropu.bat (User 'SYSTEM')
O4 - .DEFAULT Startup: ropu.bat (User 'Default user')
O4 - .DEFAULT User Startup: ropu.bat (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AT&T Global Network Client Monitor.lnk = ?
O4 - Global Startup: BTTray.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\Linksys\Bluetooth Utility\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_13\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_13\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Linksys\Bluetooth Utility\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Linksys\Bluetooth Utility\btsendto_ie.htm
O9 - Extra button: Knowledge Gateway - {D666CFDA-F583-889A-323D-9F8FAF7144C3} - C:\Program Files\knowledgegateway\launch.htm
O9 - Extra 'Tools' menuitem: Knowledge Gateway - {D666CFDA-F583-889A-323D-9F8FAF7144C3} - C:\Program Files\knowledgegateway\launch.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=about:blank
O16 - DPF: {08288600-E9D9-11D1-9C84-006008319186} (VanTFind.VanTFindCtrl) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\vantfind.cab
O16 - DPF: {14924309-C4D4-11D1-85ED-006097794610} (StkCstUserControl.StkCstMaster) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\ucStkCst.cab
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) -
http://lmc.sbc.com/courses/aicc/download/a…yer/awswaxf.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1C8B8F66-60FA-11D1-8B99-0020AFF5AA3B} (ucCommonDataField.ucCmnDataField) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\icccdf4.cab
O16 - DPF: {201CF4B6-C42D-11D1-A0EC-006008936BDD} (ItemStUC.ItemStocking) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\ucItmStk.cab
O16 - DPF: {3D82A12A-C1FA-11D0-9B21-0080C79EFE90} (VanFind.VanFindCtrl) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\vanfind.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {4117ECE7-C7FE-11D1-9844-0060089F7AEB} (StkLkpUC.StockLookup) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\ucStkLkp.cab
O16 - DPF: {413D6754-BFD4-47FE-9346-319559290BFA} (HTECtrl Class) -
https://www.webpcfos.com/webpcfos/websabre/HTEweb_new.cab
O16 - DPF: {4E192D78-E515-11D1-B89E-0020AFF695A0} (ItmMastUC.ItemMaster) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\ucItmMst.cab
O16 - DPF: {51BB7DFD-A6F5-4FAC-B8C9-E71CF84D082C} (AeXNSConsoleContextHelp Class) -
http://pdsnsm1/Altiris/NS/NSCap/Bin/Win32/…isNSConsole.cab
O16 - DPF: {60046ED9-8E77-11D0-9B21-0080C79EFE90} (VanGrid.VanGridCtrl) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\vangrid.cab
O16 - DPF: {603607C4-BE6F-11D1-983A-0060089F7AEB} (CarrierUserControl.CarrierMaster) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\ucCarrier.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/microsoftupdat…b?1235086621796
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftupdat…b?1235086609093
O16 - DPF: {9345E91A-BF88-11D1-8AFE-00A02470741B} (VendorContUC.VendorCont) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\ucVendCt.cab
O16 - DPF: {97EEFD1A-C41D-11D1-A0EC-006008936BDD} (CustLabelsUsrCtrl.CustomLabels) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\ucCusLbl.cab
O16 - DPF: {9E85612B-D0A6-11D1-89BF-0060089F7A3E} (ShipComp.ShipmentViewer) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\SHIPVIEW.cab
O16 - DPF: {AA64AF34-C45D-11D1-85ED-006097794610} (VirDomUC.VirDomainMaster) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\ucVirDm.cab
O16 - DPF: {ABDE29F2-6F9C-11D1-9B21-0080C79EFE90} (VanLiteral.CodeSet) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\VanLiteral.CAB
O16 - DPF: {B86D4018-C597-11D1-9843-0060089F7AEB} (UOMUserControl.UOMMaster) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\ucUOM.cab
O16 - DPF: {B86D4502-C597-11D1-9843-0060089F7AEB} (ItemCat.ItmCatUC) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\ucItmCat.cab
O16 - DPF: {B8958DE0-BAC9-101C-933E-0000C005958C} (FarPoint DateTime Control) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\edt32x20.ocx
O16 - DPF: {BE033B8C-722E-11D1-9B21-0080C79EFE90} (VanMessage.Message) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\VanMessage.CAB
O16 - DPF: {BE77224A-C41F-11D1-85ED-006097794610} (StkDtUserControl.StkDtMaster) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\ucStkDt.cab
O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0) -
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_02) -
O16 - DPF: {D7553B82-8EEC-11D4-AAE3-005056A35A1F} (ATTCustomComponents.UploadComponent) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\UPLOADCOMPONENT.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) -
https://advancedmeetings.webex.com/client/v…bex/ieatgpc.cab
O16 - DPF: {EB0CF3B4-C33B-11D1-A0EC-006008936BDD} (StkStUC.StockStatusMaint) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\ucStkSt.cab
O16 - DPF: {EB52CF7B-3917-11CE-80FB-0000C0C14E92} (SSDateCombo Control) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\sscala32.cab
O16 - DPF: {EBF47667-BF3F-11D1-983D-0060089F7AEB} (CarrConUserControl.CarrierContactMaster) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\ucCarCont.cab
O16 - DPF: {ED738376-C44A-11D1-A0EC-006008936BDD} (BDUsrCtrl.BusinessDomain) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\ucBusDom.cab
O16 - DPF: {F29BE3C6-BE82-11D1-91FE-0020AFF5AA68} (CurrencyUserControl.CurrencyMaster) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\ucCurr.cab
O16 - DPF: {F39FD815-E9C3-11D1-9C83-006008319186} (VanTree.VanTreeCtrl) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\vantree.cab
O16 - DPF: {F74887C8-C44B-11D1-85ED-006097794610} (VendorUserControl.VendorMaster) - file://C:\DOCUME~1\BCANTR~1\LOCALS~1\Temp\ucVend.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ugd.att.com
O17 - HKLM\Software\..\Telephony: DomainName = ugd.att.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{5652F885-570C-4CD6-BC0A-7689B37B68CF}: Domain = ugd.att.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ugd.att.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = ugd.att.com,ems.att.com,ims.att.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ugd.att.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = ugd.att.com,ems.att.com,ims.att.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = ugd.att.com,ems.att.com,ims.att.com
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Linksys\Bluetooth Utility\bin\btwdins.exe
O23 - Service: Insight Local Alerter (CPQALERT) - Hewlett-Packard Company - C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
O23 - Service: cpqdmi - Compaq Computer Corporation - C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
O23 - Service: DRUAgent - AT&T - C:\PROGRAM FILES\DRU\bin\DRUService.exe
O23 - Service: Contivity VPN Service (ExtranetAccess) - Nortel Networks NA, Inc. - C:\Program Files\Nortel Networks\Extranet_serv.exe
O23 - Service: Hummingbird Inetd (HCLInetd) - Hummingbird Ltd. - C:\WINNT\System32\Hummingbird\Connectivity\7.00\Inetd\inetd32.exe
O23 - Service: Hummingbird Jconfig Daemon (Jconfigd) - Hummingbird Ltd. - C:\WINNT\System32\Hummingbird\Connectivity\7.00\Jconfig\jconfigdNT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - c:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
O23 - Service: Network Configuration Service (netcfgsvr) - AT&T - C:\Program Files\AT&T Global Network Client\netcfgsvr.exe
O23 - Service: OracleOraHome90ClientCache - Unknown owner - C:\oracle\ora90\BIN\ONRSD.EXE
O23 - Service: Pointsec - Unknown owner - C:\WINNT\system32\Prot_srv.exe
O23 - Service: Pointsec Service Start (Pointsec_start) - Unknown owner - C:\WINNT\system32\pstartSr.exe
O23 - Service: Remote Command Service (rcmdsvc) - Unknown owner - \\BCANTRELL2\c$\temp\rcmdsvc.exe (file missing)
O23 - Service: SMSWUagent - 1E Ltd. - C:\Program Files\1E\SMSWakeUp50\SMSWUagent.exe
O23 - Service: snmpdm - Unknown owner - C:\WINNT\system32\snmpdm.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: AT&T Software Store (ssserviceWinService) - Unknown owner - C:\Program Files\compapps\swstore\ssservice.exe
O23 - Service: Doctor Install (Svc_DrInstal) - AT&T - C:\Program Files\Doctor Install\DrInstalSvc.exe
O23 - Service: IBM Tivoli Remote Control - Target (TRCTARGET) - Unknown owner - C:\Program Files\IBM\Tivoli\Remote Control\Target\trc_base.exe
O23 - Service: Win32Sl (WIN32SL) - Intel - C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
–
End of file - 16117 bytes
The computer is running much better.
VirusScan has not issued any new VirusAlerts.
No popups like before.
I updated my system with the missing Windows updates over the weekend.
Still getting missing .dll message for suzodata.dll
Still unable to activate AutoUpdate Windows feature.
Desktop Icon, My Computer still missing.
Thanks for all the help!