Spyware / Malware / Virus Removal

[Closed] Possible Malware/Virus

22 min read

Looking for the outcome? Ask AI

codyrhoads Topic Starter

Post #1July 18, 2009, 12:06 AM UTC

Hi there. The other day I was surfing online with no problems. I left for a while and when I returned, there was a black screen that said Windows was improperly shutdown, even though this did occur. I could not reboot Windows in any mode. After reinstalling, I am still having quite a few troubles, such as whenclicking on links in Google it redirects me to the AIM search site. Here is the log from my computer, thanks for the help.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:58:37 PM, on 7/17/2009
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\WINDOWS\GWMDMMSG.exe
C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe
C:\Program Files\AIM6\aim6.exe
C:\WINDOWS\System32\urdvxc.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\program files\aim toolbar\aimtbServer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://aimzones.aol.com/homepage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gatewaybiz.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gatewaybiz.com
R3 - URLSearchHook: AIM Toolbar Search Class - {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll
R3 - URLSearchHook: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: AOL Search Enhancement - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll
O2 - BHO: AIM Toolbar Loader - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: AIM Toolbar - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll
O4 - HKLM\..\Run: [IgfxTray] "C:\WINDOWS\System32\igfxtray.exe"
O4 - HKLM\..\Run: [HotKeysCmds] "C:\WINDOWS\System32\hkcmd.exe"
O4 - HKLM\..\Run: [PRONoMgr.exe] "C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe"
O4 - HKLM\..\Run: [GWMDMMSG] "GWMDMMSG.exe"
O4 - HKLM\..\Run: [GWMDMpi] "C:\WINDOWS\GWMDMpi.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O8 - Extra context menu item: &AIM Toolbar Search - C:\Documents and Settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
O9 - Extra button: AIM Toolbar - {0b83c99c-1efa-4259-858f-bcb33e007a5b} - C:\Program Files\AIM Toolbar\aimtb.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - file://C:\Program Files\Gateway\helpspot\TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - file://C:\Program Files\Gateway\helpspot\RunExeActiveX.CAB
O23 - Service: Network Windows Service (MSWindows) - Unknown owner - C:\WINDOWS\System32\urdvxc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe

–
End of file - 4508 bytes

IndiGenus

Post #2July 18, 2009, 7:19 PM UTC

Hi codyrhoads and welcome back to the forums here at WTT.

You appear to be infected with the W32/Allaple-B worm. A couple of things to go over before we begin the fix.

You are only running Windows Service Pack 1. This is likely why you were infected as you are missing many essential security updates included with SP2, and this particular worm targets Windows vulnerabilities. Do not update at this time though. I will advise when to update after you are all clean.

Also, I do not see any Anti-virus program running here. Is that so? If so I would recommend you install one ASAP. Here are a few free for home use ones. Only install one.

AVG AntiVirus
Avast Antivirus Home Version–Free
Antivir Personal - Free

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. Please also post an updated HijackThis log and let me know how it's running.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

codyrhoads

Post #3July 18, 2009, 7:59 PM UTC

IndiGenus, thank you for your help. Below are both the ComboFix and HiJack This logs. My computer is still running poorly. I did have an Anti-Virus program running (McAfee), but it was somehow lost when I contracted the virus and had to reinstall Windows. I believe that might have been why I only have Service Pack 1 as well, if that is possible.

omboFix 09-07-14.08 - Cody Rhoads 07/18/2009 15:41.1.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.239.117 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\msa.exe
c:\windows\system32\.exe
c:\windows\system32\msxml71.dll
c:\windows\system32\urdvxc.exe
c:\windows\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job
c:\windows\Tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_MSWINDOWS
——-\Service_MSWindows

((((((((((((((((((((((((( Files Created from 2009-06-18 to 2009-07-18 )))))))))))))))))))))))))))))))
.

2009-07-17 23:58 . 2009-07-17 23:58 ——– d—–w- c:\program files\Trend Micro
2009-07-17 23:18 . 2009-07-17 23:18 ——– d—–w- c:\program files\MSSOAP
2009-07-17 23:17 . 2009-07-17 23:24 ——– d—–w- c:\documents and settings\All Users\Application Data\Webroot
2009-07-17 23:17 . 2009-07-17 23:17 ——– d—–w- c:\documents and settings\Cody Rhoads\Application Data\Webroot
2009-07-17 23:17 . 2009-05-13 19:39 1563008 —-a-w- c:\windows\WRSetup.dll
2009-07-17 23:17 . 2009-07-17 23:17 ——– d—–w- c:\program files\Webroot
2009-07-17 23:15 . 2009-07-17 23:15 164 —-a-w- c:\windows\install.dat
2009-07-17 22:29 . 2009-07-17 22:29 157807 —-a-w- c:\windows\system32\buy.exe
2009-07-17 00:53 . 2009-07-17 00:53 ——– d—–w- c:\documents and settings\Cody Rhoads\Local Settings\Application Data\AIM Toolbar
2009-07-17 00:30 . 2009-07-17 00:30 ——– d—–w- c:\documents and settings\Cody Rhoads\Application Data\acccore
2009-07-17 00:23 . 2009-07-17 00:28 ——– d—–w- c:\documents and settings\Cody Rhoads\Local Settings\Application Data\Google
2009-07-17 00:16 . 2002-12-11 23:12 316040 —-a-w- c:\windows\system32\mp43dmod.dll
2009-07-17 00:14 . 2003-02-03 12:23 69632 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2009-07-17 00:14 . 2003-02-03 12:23 122880 —-a-w- c:\windows\system32\JavaAccessBridge.dll
2009-07-17 00:14 . 2003-02-28 18:29 282624 —-a-w- c:\windows\system32\PCDrSystemInformation.dll
2009-07-17 00:14 . 2003-02-28 15:06 77824 —-a-w- c:\windows\system32\ProgressTrace.dll
2009-07-17 00:14 . 2003-02-28 15:05 20348 —-a-w- c:\windows\system32\drivers\pcdrsrvc.sys
2009-07-17 00:14 . 2003-02-28 15:05 94208 —-a-w- c:\windows\system32\PcdrKernelModeServices.dll
2009-07-17 00:12 . 2009-07-17 00:14 ——– d—–w- c:\program files\PC-Doctor for Windows
2009-07-17 00:11 . 2009-07-17 21:29 ——– d—–w- c:\program files\Gateway Rhapsody
2009-07-17 00:11 . 2009-07-17 00:11 ——– d—–w- c:\program files\SIFXINST
2009-07-17 00:11 . 2009-07-17 00:11 ——– d—–w- c:\windows\Profiles
2009-07-17 00:11 . 2009-07-17 00:11 ——– d—–w- c:\windows\system32\Adobe
2009-07-17 00:11 . 2009-07-17 00:11 ——– d—–w- c:\documents and settings\Cody Rhoads\Application Data\InterTrust
2009-07-17 00:11 . 1998-10-29 18:45 306688 —-a-w- c:\windows\IsUninst.exe
2009-07-16 23:46 . 2009-07-16 23:46 ——– d-s—w- c:\documents and settings\Cody Rhoads\UserData
2009-07-16 23:32 . 2009-07-16 23:15 53248 —-a-w- c:\windows\GWMDMpi.exe
2009-07-16 23:32 . 2002-08-29 06:01 134272 -c–a-w- c:\windows\system32\dllcache\portcls.sys
2009-07-16 23:32 . 2002-08-29 06:01 134272 —-a-w- c:\windows\system32\drivers\portcls.sys
2009-07-16 23:32 . 2002-08-29 05:32 57856 -c–a-w- c:\windows\system32\dllcache\drmk.sys
2009-07-16 23:32 . 2002-08-29 05:32 57856 —-a-w- c:\windows\system32\drivers\drmk.sys
2009-07-16 23:28 . 2009-07-16 23:28 57344 —-a-w- c:\windows\system32\PCTKRNT.SYS
2009-07-16 23:28 . 2009-07-16 23:28 ——– d—–w- c:\program files\Common Files\Lanovation
2009-07-16 23:25 . 2009-07-16 23:25 ——– d—–w- c:\program files\Microsoft Works
2009-07-16 23:25 . 2003-02-14 21:22 24576 —-a-w- c:\windows\system32\xpsp1hfm.exe
2009-07-16 23:23 . 2009-07-16 23:15 102400 —-a-w- c:\windows\system32\drivers\ianswxp.sys
2009-07-16 23:20 . 2001-08-17 17:58 35840 -c–a-w- c:\windows\system32\dllcache\isapnp.sys
2009-07-16 23:20 . 2001-08-17 17:58 35840 —-a-w- c:\windows\system32\drivers\isapnp.sys
2009-07-16 23:20 . 2002-08-29 05:09 62976 -c–a-w- c:\windows\system32\dllcache\pci.sys
2009-07-16 23:20 . 2002-08-29 05:09 62976 —-a-w- c:\windows\system32\drivers\pci.sys
2009-07-16 23:20 . 2009-07-17 00:14 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-07-16 23:19 . 2009-07-17 00:08 ——– d—–w- c:\program files\Common Files\InstallShield
2009-07-16 23:10 . 2009-07-16 23:15 155648 —-a-w- c:\windows\system32\igfxres.dll
2009-07-16 23:08 . 2009-07-16 23:08 ——– d-s—w- c:\windows\system32\Microsoft
2009-07-16 23:03 . 2001-08-18 02:37 22016 —-a-w- c:\windows\system32\wdmaud.drv

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-17 22:34 . 2009-07-17 22:34 122368 —-a-w- c:\windows\Web\wcxnjhhj.exe
2009-07-17 21:27 . 2009-07-17 21:27 122368 —-a-w- c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\ui\sjnsrkwe.exe
2009-07-17 00:31 . 2009-07-17 00:30 ——– d—–w- c:\documents and settings\All Users\Application Data\AOL OCP
2009-07-17 00:30 . 2009-07-17 00:29 ——– d—–w- c:\program files\AIM6
2009-07-17 00:30 . 2009-07-17 00:30 ——– d—–w- c:\program files\Common Files\Software Update Utility
2009-07-17 00:30 . 2009-07-17 00:30 ——– d—–w- c:\program files\AIM Toolbar
2009-07-17 00:30 . 2009-07-17 00:30 ——– d—–w- c:\documents and settings\All Users\Application Data\AIM Toolbar
2009-07-17 00:30 . 2009-07-17 00:30 ——– d—–w- c:\program files\AIM Search
2009-07-17 00:30 . 2009-07-17 00:30 ——– d—–w- c:\program files\Viewpoint
2009-07-17 00:30 . 2009-07-17 00:30 ——– d—–w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-07-17 00:30 . 2009-07-17 00:30 ——– d—–w- c:\documents and settings\All Users\Application Data\acccore
2009-07-17 00:30 . 2009-07-17 00:30 ——– d—–w- c:\documents and settings\All Users\Application Data\AOL
2009-07-17 00:29 . 2009-07-17 00:29 ——– d—–w- c:\program files\Common Files\AOL
2009-07-17 00:13 . 2009-07-16 22:11 83651 —-a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2009-07-17 00:12 . 2009-07-16 22:48 ——– d—–w- c:\program files\Gateway
2009-07-17 00:11 . 2009-07-16 22:28 ——– d—–w- c:\program files\Common Files\Adobe
2009-07-16 23:27 . 2009-07-16 23:27 2678 —-a-w- c:\windows\java\Packages\Data\1VL37J1N.DAT
2009-07-16 23:25 . 2009-07-16 23:25 0 —-a-w- c:\windows\system32\drivers\GATEWAY__101.MRK
2009-07-16 23:23 . 2009-07-16 23:21 ——– d—–w- c:\program files\Intel
2009-07-16 22:50 . 2009-07-16 22:50 315392 —-a-w- c:\windows\system32\igfxsrvc.dll
2009-07-16 22:50 . 2009-07-16 22:50 147456 —-a-w- c:\windows\system32\igfxdev.dll
2009-07-16 22:50 . 2009-07-16 22:50 118784 —-a-w- c:\windows\system32\igfxhk.dll
2009-07-16 22:50 . 2009-07-16 22:50 33792 —-a-w- c:\windows\system32\ialmrnt5.dll
2009-07-16 22:50 . 2009-07-16 22:50 194427 —-a-w- c:\windows\system32\ialmdev5.dll
2009-07-16 22:50 . 2009-07-16 22:50 114748 —-a-w- c:\windows\system32\ialmdnt5.dll
2009-07-16 22:50 . 2009-07-16 22:50 460866 —-a-w- c:\windows\system32\ialmdd5.dll
2009-07-16 22:50 . 2009-07-16 22:50 65536 —-a-w- c:\windows\system32\iAlmCoIn_v13.dll
2009-07-16 22:50 . 2009-07-16 22:50 118784 —-a-w- c:\windows\system32\hccutils.dll
2009-07-16 22:50 . 2009-07-16 22:50 114688 —-a-w- c:\windows\system32\hkcmd.exe
2009-07-16 22:12 . 2009-07-16 22:12 ——– d—–w- c:\program files\microsoft frontpage
2009-07-16 22:12 . 2009-07-16 22:12 2678 —-a-w- c:\windows\java\Packages\Data\VDBV3R5F.DAT
2009-07-16 22:12 . 2009-07-16 22:12 558142 —-a-w- c:\windows\java\Packages\OT71NR7X.ZIP
2009-07-16 22:12 . 2009-07-16 22:12 2678 —-a-w- c:\windows\java\Packages\Data\XJ57PZ31.DAT
2009-07-16 22:12 . 2009-07-16 22:12 155995 —-a-w- c:\windows\java\Packages\9VXFV5RX.ZIP
2009-07-16 22:11 . 2009-07-16 22:11 2678 —-a-w- c:\windows\java\Packages\Data\JJPNNJXZ.DAT
2009-07-16 22:11 . 2009-07-16 22:11 2678 —-a-w- c:\windows\java\Packages\Data\0E17V53F.DAT
2009-07-16 22:09 . 2009-07-16 22:09 21640 —-a-w- c:\windows\system32\emptyregdb.dat
2009-05-06 18:11 . 2009-05-06 18:11 69120 —-a-w- c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\aimtbres.dll
2009-04-21 22:27 . 2009-04-21 22:27 23152 —-a-w- c:\windows\system32\drivers\sshrmd.sys
2009-04-21 22:27 . 2009-04-21 22:27 176752 —-a-w- c:\windows\system32\drivers\ssidrv.sys
2009-04-21 22:27 . 2009-04-21 22:27 29808 —-a-w- c:\windows\system32\drivers\ssfs0bbc.sys
2002-09-03 13:00 . 2002-09-03 13:00 154406 –sha-r- c:\windows\system32\rwwcheh.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BackupIconOverlayId]
@="{2EE61E5C-8F94-4AAB-8A80-D2A8CD1FEDAD}"
[HKEY_CLASSES_ROOT\CLSID\{2EE61E5C-8F94-4AAB-8A80-D2A8CD1FEDAD}]
2009-05-13 19:34 238968 —-a-w- c:\program files\Webroot\WebrootSecurity\Backup\CtxMenu_1_0_0_10.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="c:\program files\AIM6\aim6.exe" [2009-07-09 49968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2009-07-16 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2009-07-16 114688]
"PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 86016]
"GWMDMpi"="c:\windows\GWMDMpi.exe" [2009-07-16 53248]
"SpySweeper"="c:\program files\Webroot\WebrootSecurity\SpySweeperUI.exe" [2009-05-13 6345840]
"GWMDMMSG"="GWMDMMSG.exe" - c:\windows\GWMDMMSG.exe [2009-07-16 90112]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"

R2 pvkke;Driver Helper;c:\windows\system32\svchost.exe [2002-09-03 12800]
S0 ssfs0bbc;ssfs0bbc;c:\windows\System32\DRIVERS\ssfs0bbc.sys [2009-04-21 29808]
S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\WebrootSecurity\WRConsumerService.exe [2009-07-17 1205760]

— Other Services/Drivers In Memory —

*NewlyCreated* - ALG
*NewlyCreated* - IPNAT

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
pvkke
.
Contents of the 'Scheduled Tasks' folder

2009-07-17 c:\windows\Tasks\wrSpySweeper_L29D0708E172F43C28A9BFBD9C7E3D15A.job
- c:\program files\Webroot\WebrootSecurity\SpySweeperUI.exe [2009-07-17 19:39]

2009-07-17 c:\windows\Tasks\wrSpySweeper_L29D0708E172F43C28A9BFBD9C7E3D15A.job
- c:\program files\Webroot\WebrootSecurity\SpySweeperUI.exe [2009-07-17 19:39]
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-HookURL - (no file)
URLSearchHooks-Rank - (no file)

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://aimzones.aol.com/homepage
mStart Page = hxxp://www.gatewaybiz.com
IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {511073AD-BE56-4D43-AE68-93390514385E} - file://c:\program files\Gateway\helpspot\TechTools.CAB
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-18 15:48
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\pvkke]
"ServiceDll"="c:\windows\System32\rwwcheh.dll"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(652)
c:\windows\System32\ODBC32.dll

- - - - - - - > 'lsass.exe'(708)
c:\windows\System32\dssenh.dll

- - - - - - - > 'explorer.exe'(2644)
c:\program files\Webroot\WebrootSecurity\Backup\CtxMenu_1_0_0_10.dll
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
c:\program files\Webroot\WebrootSecurity\SpySweeper.exe
c:\program files\AIM6\aolsoftware.exe
c:\program files\AIM6\aolsoftware.exe
c:\program files\Internet Explorer\IEXPLORE.EXE
c:\program files\AIM Toolbar\aimtbServer.exe
c:\program files\Webroot\WebrootSecurity\SSU.exe
.
**************************************************************************
.
Completion time: 2009-07-18 15:55 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-18 19:55

Pre-Run: 78,102,130,688 bytes free
Post-Run: 78,130,765,824 bytes free

winxpsp1_en_hom_bf.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect

206

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:56:47 PM, on 7/18/2009
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\WINDOWS\GWMDMMSG.exe
C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
c:\program files\aim toolbar\aimtbServer.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://aimzones.aol.com/homepage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gatewaybiz.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gatewaybiz.com
R3 - URLSearchHook: AIM Toolbar Search Class - {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll
R3 - URLSearchHook: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: AOL Search Enhancement - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll
O2 - BHO: AIM Toolbar Loader - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: AIM Toolbar - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll
O4 - HKLM\..\Run: [IgfxTray] "C:\WINDOWS\System32\igfxtray.exe"
O4 - HKLM\..\Run: [HotKeysCmds] "C:\WINDOWS\System32\hkcmd.exe"
O4 - HKLM\..\Run: [PRONoMgr.exe] "C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe"
O4 - HKLM\..\Run: [GWMDMMSG] "GWMDMMSG.exe"
O4 - HKLM\..\Run: [GWMDMpi] "C:\WINDOWS\GWMDMpi.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O8 - Extra context menu item: &AIM Toolbar Search - C:\Documents and Settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
O9 - Extra button: AIM Toolbar - {0b83c99c-1efa-4259-858f-bcb33e007a5b} - C:\Program Files\AIM Toolbar\aimtb.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - file://C:\Program Files\Gateway\helpspot\TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - file://C:\Program Files\Gateway\helpspot\RunExeActiveX.CAB
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe

–
End of file - 4408 bytes

IndiGenus

Post #4July 18, 2009, 8:08 PM UTC

While I'm looking at the logs I have a couple of questions. When you say it's still running poorly, how so? Also, when did you re-install Windows? And did you completely reformat the drive and do a fresh install?

IndiGenus

Post #5July 18, 2009, 8:29 PM UTC

Also, please do the following….

Please go to http://virusscan.jotti.org, click on Browse, and upload the following file for analysis:

C:\WINDOWS\SYSTEM32\buy.exe

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.

If Jotti is too busy you can try these.

http://www.kaspersky.com/scanforvirus.html
http://www.virustotal.com/en/indexf.html

Please also do the same with the following file:

c:\windows\system32\svchost.exe

codyrhoads

Post #6July 19, 2009, 6:52 PM UTC last edited July 19, 2009, 7:10 PM UTC

IndiGenus, one of the problems I am still having is effecting me completing this process. When I click on the links you provide, all that it does is take me to the AIM search page. I can't even get to the site to perform the task. I also can't update to IE8, which might be a result of not having SP2. I'd also like to get rid of Webroot AntiVirus. I will continue to try to get those links to work and provide you with the information you requested. Also, I reinstalled Windows after I was unable to boot in any mode (safe, last known configs., etc.). I did not reformat the drive and do a fresh install as I do not know how to do that.

IndiGenus

Post #7July 19, 2009, 10:10 PM UTC

Okay let's do this. Run the following script with combofix as advised, then see if you can go back and do the other steps I gave without being redirected.

1. Open Notepad

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
c:\windows\System32\rwwcheh.dll

Driver::
pvkke

NetSvc::
pvkke

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt
A new HijackThis log.

codyrhoads

Post #8July 19, 2009, 11:08 PM UTC

IndiGenus, I followed your instructions and everything went smooth. Here are the new logs.

ComboFix 09-07-19.02 - Cody Rhoads 07/19/2009 18:49.2.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.239.13 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Cody Rhoads\Desktop\CFScript.txt

FILE ::
"c:\windows\System32\rwwcheh.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\.exe
c:\windows\System32\rwwcheh.dll
c:\windows\system32\urdvxc.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_PVKKE
——-\Service_pvkke

((((((((((((((((((((((((( Files Created from 2009-06-19 to 2009-07-19 )))))))))))))))))))))))))))))))
.

2009-07-17 23:58 . 2009-07-17 23:58 ——– d—–w- c:\program files\Trend Micro
2009-07-17 23:18 . 2009-07-17 23:18 ——– d—–w- c:\program files\MSSOAP
2009-07-17 23:17 . 2009-07-17 23:24 ——– d—–w- c:\documents and settings\All Users\Application Data\Webroot
2009-07-17 23:17 . 2009-07-17 23:17 ——– d—–w- c:\documents and settings\Cody Rhoads\Application Data\Webroot
2009-07-17 23:17 . 2009-05-13 19:39 1563008 —-a-w- c:\windows\WRSetup.dll
2009-07-17 23:17 . 2009-07-17 23:17 ——– d—–w- c:\program files\Webroot
2009-07-17 23:15 . 2009-07-17 23:15 164 —-a-w- c:\windows\install.dat
2009-07-17 22:29 . 2009-07-17 22:29 157807 —-a-w- c:\windows\system32\buy.exe
2009-07-17 00:53 . 2009-07-17 00:53 ——– d—–w- c:\documents and settings\Cody Rhoads\Local Settings\Application Data\AIM Toolbar
2009-07-17 00:30 . 2009-07-17 00:30 ——– d—–w- c:\documents and settings\Cody Rhoads\Application Data\acccore
2009-07-17 00:23 . 2009-07-17 00:28 ——– d—–w- c:\documents and settings\Cody Rhoads\Local Settings\Application Data\Google
2009-07-17 00:16 . 2002-12-11 23:12 316040 —-a-w- c:\windows\system32\mp43dmod.dll
2009-07-17 00:14 . 2003-02-03 12:23 69632 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2009-07-17 00:14 . 2003-02-03 12:23 122880 —-a-w- c:\windows\system32\JavaAccessBridge.dll
2009-07-17 00:14 . 2003-02-28 18:29 282624 —-a-w- c:\windows\system32\PCDrSystemInformation.dll
2009-07-17 00:14 . 2003-02-28 15:06 77824 —-a-w- c:\windows\system32\ProgressTrace.dll
2009-07-17 00:14 . 2003-02-28 15:05 20348 —-a-w- c:\windows\system32\drivers\pcdrsrvc.sys
2009-07-17 00:14 . 2003-02-28 15:05 94208 —-a-w- c:\windows\system32\PcdrKernelModeServices.dll
2009-07-17 00:12 . 2009-07-17 00:14 ——– d—–w- c:\program files\PC-Doctor for Windows
2009-07-17 00:11 . 2009-07-17 21:29 ——– d—–w- c:\program files\Gateway Rhapsody
2009-07-17 00:11 . 2009-07-17 00:11 ——– d—–w- c:\program files\SIFXINST
2009-07-17 00:11 . 2009-07-17 00:11 ——– d—–w- c:\windows\Profiles
2009-07-17 00:11 . 2009-07-17 00:11 ——– d—–w- c:\windows\system32\Adobe
2009-07-17 00:11 . 2009-07-17 00:11 ——– d—–w- c:\documents and settings\Cody Rhoads\Application Data\InterTrust
2009-07-17 00:11 . 1998-10-29 18:45 306688 —-a-w- c:\windows\IsUninst.exe
2009-07-16 23:46 . 2009-07-16 23:46 ——– d-s—w- c:\documents and settings\Cody Rhoads\UserData
2009-07-16 23:32 . 2009-07-16 23:15 53248 —-a-w- c:\windows\GWMDMpi.exe
2009-07-16 23:32 . 2002-08-29 06:01 134272 -c–a-w- c:\windows\system32\dllcache\portcls.sys
2009-07-16 23:32 . 2002-08-29 06:01 134272 —-a-w- c:\windows\system32\drivers\portcls.sys
2009-07-16 23:32 . 2002-08-29 05:32 57856 -c–a-w- c:\windows\system32\dllcache\drmk.sys
2009-07-16 23:32 . 2002-08-29 05:32 57856 —-a-w- c:\windows\system32\drivers\drmk.sys
2009-07-16 23:28 . 2009-07-16 23:28 57344 —-a-w- c:\windows\system32\PCTKRNT.SYS
2009-07-16 23:28 . 2009-07-16 23:28 ——– d—–w- c:\program files\Common Files\Lanovation
2009-07-16 23:25 . 2009-07-16 23:25 ——– d—–w- c:\program files\Microsoft Works
2009-07-16 23:25 . 2003-02-14 21:22 24576 —-a-w- c:\windows\system32\xpsp1hfm.exe
2009-07-16 23:23 . 2009-07-16 23:15 102400 —-a-w- c:\windows\system32\drivers\ianswxp.sys
2009-07-16 23:20 . 2001-08-17 17:58 35840 -c–a-w- c:\windows\system32\dllcache\isapnp.sys
2009-07-16 23:20 . 2001-08-17 17:58 35840 —-a-w- c:\windows\system32\drivers\isapnp.sys
2009-07-16 23:20 . 2002-08-29 05:09 62976 -c–a-w- c:\windows\system32\dllcache\pci.sys
2009-07-16 23:20 . 2002-08-29 05:09 62976 —-a-w- c:\windows\system32\drivers\pci.sys
2009-07-16 23:20 . 2009-07-17 00:14 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-07-16 23:19 . 2009-07-17 00:08 ——– d—–w- c:\program files\Common Files\InstallShield
2009-07-16 23:10 . 2009-07-16 23:15 155648 —-a-w- c:\windows\system32\igfxres.dll
2009-07-16 23:08 . 2009-07-16 23:08 ——– d-s—w- c:\windows\system32\Microsoft
2009-07-16 23:03 . 2001-08-18 02:37 22016 —-a-w- c:\windows\system32\wdmaud.drv

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-17 22:34 . 2009-07-17 22:34 122368 —-a-w- c:\windows\Web\wcxnjhhj.exe
2009-07-17 21:27 . 2009-07-17 21:27 122368 —-a-w- c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\ui\sjnsrkwe.exe
2009-07-17 00:31 . 2009-07-17 00:30 ——– d—–w- c:\documents and settings\All Users\Application Data\AOL OCP
2009-07-17 00:30 . 2009-07-17 00:29 ——– d—–w- c:\program files\AIM6
2009-07-17 00:30 . 2009-07-17 00:30 ——– d—–w- c:\program files\Common Files\Software Update Utility
2009-07-17 00:30 . 2009-07-17 00:30 ——– d—–w- c:\program files\AIM Toolbar
2009-07-17 00:30 . 2009-07-17 00:30 ——– d—–w- c:\documents and settings\All Users\Application Data\AIM Toolbar
2009-07-17 00:30 . 2009-07-17 00:30 ——– d—–w- c:\program files\AIM Search
2009-07-17 00:30 . 2009-07-17 00:30 ——– d—–w- c:\program files\Viewpoint
2009-07-17 00:30 . 2009-07-17 00:30 ——– d—–w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-07-17 00:30 . 2009-07-17 00:30 ——– d—–w- c:\documents and settings\All Users\Application Data\acccore
2009-07-17 00:30 . 2009-07-17 00:30 ——– d—–w- c:\documents and settings\All Users\Application Data\AOL
2009-07-17 00:29 . 2009-07-17 00:29 ——– d—–w- c:\program files\Common Files\AOL
2009-07-17 00:13 . 2009-07-16 22:11 83651 —-a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2009-07-17 00:12 . 2009-07-16 22:48 ——– d—–w- c:\program files\Gateway
2009-07-17 00:11 . 2009-07-16 22:28 ——– d—–w- c:\program files\Common Files\Adobe
2009-07-16 23:27 . 2009-07-16 23:27 2678 —-a-w- c:\windows\java\Packages\Data\1VL37J1N.DAT
2009-07-16 23:25 . 2009-07-16 23:25 0 —-a-w- c:\windows\system32\drivers\GATEWAY__101.MRK
2009-07-16 23:23 . 2009-07-16 23:21 ——– d—–w- c:\program files\Intel
2009-07-16 22:50 . 2009-07-16 22:50 315392 —-a-w- c:\windows\system32\igfxsrvc.dll
2009-07-16 22:50 . 2009-07-16 22:50 147456 —-a-w- c:\windows\system32\igfxdev.dll
2009-07-16 22:50 . 2009-07-16 22:50 118784 —-a-w- c:\windows\system32\igfxhk.dll
2009-07-16 22:50 . 2009-07-16 22:50 33792 —-a-w- c:\windows\system32\ialmrnt5.dll
2009-07-16 22:50 . 2009-07-16 22:50 194427 —-a-w- c:\windows\system32\ialmdev5.dll
2009-07-16 22:50 . 2009-07-16 22:50 114748 —-a-w- c:\windows\system32\ialmdnt5.dll
2009-07-16 22:50 . 2009-07-16 22:50 460866 —-a-w- c:\windows\system32\ialmdd5.dll
2009-07-16 22:50 . 2009-07-16 22:50 65536 —-a-w- c:\windows\system32\iAlmCoIn_v13.dll
2009-07-16 22:50 . 2009-07-16 22:50 118784 —-a-w- c:\windows\system32\hccutils.dll
2009-07-16 22:50 . 2009-07-16 22:50 114688 —-a-w- c:\windows\system32\hkcmd.exe
2009-07-16 22:12 . 2009-07-16 22:12 ——– d—–w- c:\program files\microsoft frontpage
2009-07-16 22:12 . 2009-07-16 22:12 2678 —-a-w- c:\windows\java\Packages\Data\VDBV3R5F.DAT
2009-07-16 22:12 . 2009-07-16 22:12 558142 —-a-w- c:\windows\java\Packages\OT71NR7X.ZIP
2009-07-16 22:12 . 2009-07-16 22:12 2678 —-a-w- c:\windows\java\Packages\Data\XJ57PZ31.DAT
2009-07-16 22:12 . 2009-07-16 22:12 155995 —-a-w- c:\windows\java\Packages\9VXFV5RX.ZIP
2009-07-16 22:11 . 2009-07-16 22:11 2678 —-a-w- c:\windows\java\Packages\Data\JJPNNJXZ.DAT
2009-07-16 22:11 . 2009-07-16 22:11 2678 —-a-w- c:\windows\java\Packages\Data\0E17V53F.DAT
2009-07-16 22:09 . 2009-07-16 22:09 21640 —-a-w- c:\windows\system32\emptyregdb.dat
2009-05-06 18:11 . 2009-05-06 18:11 69120 —-a-w- c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\aimtbres.dll
2009-04-21 22:27 . 2009-04-21 22:27 23152 —-a-w- c:\windows\system32\drivers\sshrmd.sys
2009-04-21 22:27 . 2009-04-21 22:27 176752 —-a-w- c:\windows\system32\drivers\ssidrv.sys
2009-04-21 22:27 . 2009-04-21 22:27 29808 —-a-w- c:\windows\system32\drivers\ssfs0bbc.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-07-18_19.48.51 )))))))))))))))))))))))))))))))))))))))))
.
- 2002-09-03 13:00 . 2009-07-16 23:39 39992 c:\windows\system32\perfc009.dat
+ 2002-09-03 13:00 . 2009-07-18 19:50 39992 c:\windows\system32\perfc009.dat
- 2009-07-16 22:14 . 2009-07-18 19:48 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-16 22:14 . 2009-07-19 22:57 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-16 22:14 . 2009-07-18 19:48 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-07-16 22:14 . 2009-07-19 22:57 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-07-16 22:14 . 2009-07-18 19:48 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-07-16 22:14 . 2009-07-19 22:57 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2002-09-03 13:00 . 2009-07-18 19:50 311604 c:\windows\system32\perfh009.dat
- 2002-09-03 13:00 . 2009-07-16 23:39 311604 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BackupIconOverlayId]
@="{2EE61E5C-8F94-4AAB-8A80-D2A8CD1FEDAD}"
[HKEY_CLASSES_ROOT\CLSID\{2EE61E5C-8F94-4AAB-8A80-D2A8CD1FEDAD}]
2009-05-13 19:34 238968 —-a-w- c:\program files\Webroot\WebrootSecurity\Backup\CtxMenu_1_0_0_10.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="c:\program files\AIM6\aim6.exe" [2009-07-09 49968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2009-07-16 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2009-07-16 114688]
"PRONoMgr.exe"="c:\program files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-03-11 86016]
"GWMDMpi"="c:\windows\GWMDMpi.exe" [2009-07-16 53248]
"SpySweeper"="c:\program files\Webroot\WebrootSecurity\SpySweeperUI.exe" [2009-05-13 6345840]
"GWMDMMSG"="GWMDMMSG.exe" - c:\windows\GWMDMMSG.exe [2009-07-16 90112]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"

R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [4/21/2009 6:27 PM 29808]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [7/16/2009 8:30 PM 24652]
R2 WRConsumerService;Webroot Client Service;c:\program files\Webroot\WebrootSecurity\WRConsumerService.exe [7/17/2009 7:21 PM 1205760]
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-HookURL - (no file)
URLSearchHooks-Rank - (no file)

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://aimzones.aol.com/homepage
mStart Page = hxxp://www.gatewaybiz.com
IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {511073AD-BE56-4D43-AE68-93390514385E} - file://c:\program files\Gateway\helpspot\TechTools.CAB
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-19 18:57
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(652)
c:\windows\System32\ODBC32.dll

- - - - - - - > 'lsass.exe'(708)
c:\windows\System32\dssenh.dll

- - - - - - - > 'explorer.exe'(2264)
c:\program files\Webroot\WebrootSecurity\Backup\CtxMenu_1_0_0_10.dll
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
c:\program files\Webroot\WebrootSecurity\SpySweeper.exe
c:\program files\AIM6\aolsoftware.exe
c:\program files\AIM6\aolsoftware.exe
c:\program files\Internet Explorer\IEXPLORE.EXE
c:\program files\AIM Toolbar\aimtbServer.exe
c:\program files\Webroot\WebrootSecurity\SSU.exe
.
**************************************************************************
.
Completion time: 2009-07-19 19:05 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-19 23:05
ComboFix2.txt 2009-07-18 19:55

Pre-Run: 78,108,483,584 bytes free
Post-Run: 78,093,737,984 bytes free

198

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:07:29 PM, on 7/19/2009
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\WINDOWS\GWMDMMSG.exe
C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\program files\aim toolbar\aimtbServer.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\System32\cmd.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://aimzones.aol.com/homepage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gatewaybiz.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gatewaybiz.com
R3 - URLSearchHook: AIM Toolbar Search Class - {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll
R3 - URLSearchHook: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: AOL Search Enhancement - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll
O2 - BHO: AIM Toolbar Loader - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: AIM Toolbar - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll
O4 - HKLM\..\Run: [IgfxTray] "C:\WINDOWS\System32\igfxtray.exe"
O4 - HKLM\..\Run: [HotKeysCmds] "C:\WINDOWS\System32\hkcmd.exe"
O4 - HKLM\..\Run: [PRONoMgr.exe] "C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe"
O4 - HKLM\..\Run: [GWMDMMSG] "GWMDMMSG.exe"
O4 - HKLM\..\Run: [GWMDMpi] "C:\WINDOWS\GWMDMpi.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O8 - Extra context menu item: &AIM Toolbar Search - C:\Documents and Settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
O9 - Extra button: AIM Toolbar - {0b83c99c-1efa-4259-858f-bcb33e007a5b} - C:\Program Files\AIM Toolbar\aimtb.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - file://C:\Program Files\Gateway\helpspot\TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - file://C:\Program Files\Gateway\helpspot\RunExeActiveX.CAB
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe

–
End of file - 4470 bytes

IndiGenus

Post #9July 19, 2009, 11:16 PM UTC

How's it running now? Are you able to go back to my post #5 and upload those files to be checked?

codyrhoads

Post #10July 19, 2009, 11:45 PM UTC

The machine is running quicker. I was able to do what you requested in post #5. Here are the results. please let me know if this is what you are looking for. Filename: buy.exe Status: Scan finished. 15 out of 21 scanners reported malware. Scan taken on: Mon 20 Jul 2009 01:42:21 (CET) Permalink 2009-07-19 Trojan.Poison.Ajrq 2009-07-20 Backdoor.Agent.VB.AK 2009-07-20 Riskware.Win32.Vbinder!IK 2009-07-19 VirTool.Win32.Vbinder 2009-07-19 Win32:Trojan-gen {Other} 2009-07-19 Backdoor.Win32.Poison.ajrq 2009-07-19 BackDoor.Generic11.ADEH 2009-07-19 Found nothing 2009-07-19 TR/Dropper.Gen 2009-07-17 Found nothing 2009-07-19 Backdoor.Agent.VB.AK 2009-07-19 Found nothing 2009-07-19 Found nothing 2009-07-16 Found nothing 2009-07-19 BackDoor.W32.Poison.ajrq 2009-07-20 Mal/Generic-A 2009-07-19 BackDoor.Bifrost.1002 2009-07-18 Backdoor.Win32.Poison.ajrq 2009-07-19 Found nothing 2009-07-19 Backdoor.Poison.OLV 2009-07-19 Backdoor.Win32.Poison.ajrq Filename: svchost.exe Status: Scan finished. 0 out of 21 scanners reported malware. Scan taken on: Mon 20 Jul 2009 01:44:39 (CET) Permalink

IndiGenus

Post #11July 19, 2009, 11:51 PM UTC

Great, glad it's running better and nice job. More work to do though…we need to delete that buy.exe file as it's bad.

Please download the OTM by OldTimer.

Save it to your desktop.
Please double-click OTM.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
```
:processes
explorer.exe

:files
c:\windows\system32\buy.exe

:commands
[purity]
[emptytemp]
[start explorer]
[reboot]
```
Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTM

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please download Malwarebytes' Anti-Malware from Here
Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy and Paste the entire report in your next reply along with a Hijackthis log.

codyrhoads

Post #12July 21, 2009, 12:58 AM UTC

IndiGenus, I was able to complete the first part of what you asked. I again ran into the problem of being directed to AIM Search when clicking on the Anti-Malware link and could not get to the site. Here is the first log and a Hijack This log. I will continue to try and get the Anti-Malware to work.

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
c:\windows\system32\buy.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Cody Rhoads
->Temp folder emptied: 40218 bytes
File delete failed. C:\Documents and Settings\Cody Rhoads\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 201069254 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1099790 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 192.88 mb

OTM by OldTimer - Version 3.0.0.5 log created on 07202009_195720

Files moved on Reboot…

Registry entries deleted on Reboot…

ogfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:57:47 PM, on 7/20/2009
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\notepad.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\WINDOWS\GWMDMMSG.exe
C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\AIM6\aolsoftware.exe
c:\program files\aim toolbar\aimtbServer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://aimzones.aol.com/homepage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gatewaybiz.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gatewaybiz.com
R3 - URLSearchHook: AIM Toolbar Search Class - {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll
R3 - URLSearchHook: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: AOL Search Enhancement - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll
O2 - BHO: AIM Toolbar Loader - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: AIM Toolbar - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll
O4 - HKLM\..\Run: [IgfxTray] "C:\WINDOWS\System32\igfxtray.exe"
O4 - HKLM\..\Run: [HotKeysCmds] "C:\WINDOWS\System32\hkcmd.exe"
O4 - HKLM\..\Run: [PRONoMgr.exe] "C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe"
O4 - HKLM\..\Run: [GWMDMMSG] "GWMDMMSG.exe"
O4 - HKLM\..\Run: [GWMDMpi] "C:\WINDOWS\GWMDMpi.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O8 - Extra context menu item: &AIM Toolbar Search - C:\Documents and Settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
O9 - Extra button: AIM Toolbar - {0b83c99c-1efa-4259-858f-bcb33e007a5b} - C:\Program Files\AIM Toolbar\aimtb.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - file://C:\Program Files\Gateway\helpspot\TechTools.CAB
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - file://C:\Program Files\Gateway\helpspot\RunExeActiveX.CAB
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\System32\PCTKRNT.SYS
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe

–
End of file - 4399 bytes

IndiGenus

Post #13July 21, 2009, 2:08 AM UTC

Let's get a better look at things here.

Download RootRepeal.zip and unzip it to your Desktop.

Double click RootRepeal.exe to start the program
Click on the Report tab at the bottom of the program window
Click the Scan button
In the Select Scan dialog, check:
- Drivers
- Files
- Processes
- SSDT
- Stealth Objects
- Hidden Services
Click the OK button
In the next dialog, select all drives showing
Click OK to start the scan

Note: The scan can take some time. DO NOT run any other programs while the scan is running
When the scan is complete, the Save Report button will become available
Click this and save the report to your Desktop as RootRepeal.txt
Go to File, then Exit to close the program

If the report is not too long, post the contents of RootRepeal.txt in your next reply. If the report is very long, it will not be complete if you post it, so please attach it to your reply instead.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Run OTL

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

codyrhoads

Post #14July 21, 2009, 8:50 PM UTC

IndiGenus, this is the message I receive when trying to access RootRepeal: "The bandwidth or page view limit for this site has been exceeded and the page cannot be viewed at this time. Once the site is below the limit, it will once again begin serving as normal. " I will continue trying to work on that. Here are the logs from OTL. First OTL.Txt in this post and then Extras.Txt in the second reply.

OTL logfile created on: 7/21/2009 4:44:54 PM - Run 1
OTL by OldTimer - Version 3.0.9.2 Folder = C:\Documents and Settings\Cody Rhoads\Desktop
Windows XP Home Edition Service Pack 1 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2800.1106)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

238.73 Mb Total Physical Memory | 115.70 Mb Available Physical Memory | 48.46% Memory free
586.10 Mb Paging File | 275.88 Mb Available in Paging File | 47.07% Paging File free
Paging file location(s): C:\pagefile.sys 360 720 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 76.32 Gb Total Space | 73.06 Gb Free Space | 95.73% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: CODY
Current User Name: Cody Rhoads
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe (Webroot Software, Inc. )
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\System32\hkcmd.exe (Intel Corporation)
PRC - C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe (Intel® Corporation)
PRC - C:\WINDOWS\GWMDMMSG.exe (GTW)
PRC - C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe (Webroot Software, Inc.)
PRC - C:\Program Files\AIM6\aim6.exe (AOL LLC)
PRC - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS (Lanovation)
PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
PRC - C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe (Webroot Software, Inc. (www.webroot.com))
PRC - C:\Program Files\AIM6\aolsoftware.exe (AOL LLC)
PRC - C:\Program Files\AIM6\aolsoftware.exe (AOL LLC)
PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Program Files\Webroot\WebrootSecurity\SSU.EXE (Webroot Software, Inc. (www.webroot.com))
PRC - c:\program files\aim toolbar\aimtbServer.exe (AOL LLC.)
PRC - C:\Program Files\internet explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Documents and Settings\Cody Rhoads\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (gzrpgx [Auto | Stopped]) – C:\WINDOWS\System32\rwwcheh.dll ()
SRV - (helpsvc [Auto | Running]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (NetSvc [On_Demand | Stopped]) – C:\Program Files\Intel\NCS\Sync\NetSvc.exe (Intel® Corporation)
SRV - (PictureTaker [On_Demand | Stopped]) – C:\WINDOWS\System32\PCTKRNT.SYS (LANovation)
SRV - (PrismXL [Auto | Running]) – C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS (Lanovation)
SRV - (uploadmgr [Auto | Running]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (Viewpoint Manager Service [Auto | Running]) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
SRV - (WebrootSpySweeperService [Auto | Running]) – C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe (Webroot Software, Inc. (www.webroot.com))
SRV - (WRConsumerService [Auto | Running]) – C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exe (Webroot Software, Inc. )

========== Driver Services (SafeList) ==========

DRV - (aeaudio [On_Demand | Running]) – C:\WINDOWS\System32\drivers\aeaudio.sys (Andrea Electronics Corporation)
DRV - (BCMModem [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\BCMDM.sys (BCM)
DRV - (E100B [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\e100b325.sys (Intel Corporation)
DRV - (GTWModem [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\GWMDM.sys (GTW)
DRV - (ialm [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ialmnt5.sys (Intel Corporation)
DRV - (MODEMCSA [On_Demand | Running]) – C:\WINDOWS\System32\drivers\MODEMCSA.sys (Microsoft Corporation)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (Secdrv [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\secdrv.sys ()
DRV - (smwdm [On_Demand | Running]) – C:\WINDOWS\System32\drivers\smwdm.sys (Analog Devices, Inc.)
DRV - (ssfs0bbc [Boot | Running]) – C:\WINDOWS\System32\DRIVERS\ssfs0bbc.sys (Webroot Software, Inc. (www.webroot.com))
DRV - (sshrmd [Boot | Running]) – C:\WINDOWS\System32\DRIVERS\sshrmd.sys (Webroot Software, Inc. (www.webroot.com))
DRV - (ssidrv [Boot | Running]) – C:\WINDOWS\System32\DRIVERS\ssidrv.sys (Webroot Software, Inc. (www.webroot.com))
DRV - ({6080A529-897E-4629-A488-ABA0C29B635E} [On_Demand | Running]) – C:\WINDOWS\System32\drivers\ialmsbw.sys (Intel Corporation)
DRV - ({D31A0762-0CEB-444e-ACFF-B049A1F6FE91} [On_Demand | Running]) – C:\WINDOWS\System32\drivers\ialmkchw.sys (Intel Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gatewaybiz.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.gatewaybiz.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
IE - URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\System32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://aimzones.aol.com/homepage
IE - URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
IE - URLSearchHook: {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll (America Online, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx ()
O2 - BHO: (AOLSearchHook Class) - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll (America Online, Inc.)
O2 - BHO: (AIM Toolbar Loader) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O3 - HKLM\..\Toolbar: (AIM Toolbar) - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O3 - HKLM\..\Toolbar: (&Radio) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx ()
O3 - HKCU\..\Toolbar\WebBrowser: (AIM Toolbar) - {61539ECD-CC67-4437-A03C-9AACCBD14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O4 - HKLM..\Run: [GWMDMMSG] C:\WINDOWS\GWMDMMSG.exe (GTW)
O4 - HKLM..\Run: [GWMDMpi] C:\WINDOWS\GWMDMpi.exe ()
O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe (Intel® Corporation)
O4 - HKLM..\Run: [SpySweeper] File not found
O4 - HKCU..\Run: [Aim6] C:\Program Files\AIM6\aim6.exe (AOL LLC)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &AIM Toolbar Search - C:\Documents and Settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html ()
O9 - Extra Button: AIM Toolbar - {0b83c99c-1efa-4259-858f-bcb33e007a5b} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
O9 - Extra Button: @shdoclc.dll,-866 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm ()
O9 - Extra 'Tools' menuitem : @shdoclc.dll,-864 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm ()
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} file://C:\Program Files\Gateway\helpspot\TechTools.CAB (TechToolsActivex.TechTools)
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} file://C:\Program Files\Gateway\helpspot\RunExeActiveX.CAB (RunExeActiveX.RunExe)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\vnd.ms.radio {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINDOWS\System32\msdxm.ocx ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O30 - LSA: Authentication Packages - (OWS\S) - File not found
O30 - LSA: Security Packages - (icrosoft) - File not found
O30 - LSA: Security Packages - (corpora) - File not found
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/07/16 18:12:14 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found

========== Files/Folders - Created Within 30 Days ==========

[2009/07/21 16:44:16 | 00,513,536 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Cody Rhoads\Desktop\OTL.exe
[2009/07/20 20:34:11 | 00,000,000 | -HSD | C] – C:\RECYCLER
[2009/07/20 19:57:20 | 00,000,000 | —D | C] – C:\_OTM
[2009/07/20 19:55:54 | 00,407,552 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Cody Rhoads\Desktop\OTM.exe
[2009/07/19 21:45:37 | 00,122,368 | —- | C] () – C:\WINDOWS\System32\urdvxc.exe
[2009/07/19 19:05:23 | 00,000,000 | —D | C] – C:\WINDOWS\temp
[2009/07/19 19:03:55 | 01,157,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\sfcfiles.dll
[2009/07/19 19:03:55 | 00,082,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\rasauto.dll
[2009/07/19 19:03:54 | 00,924,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\mfc40u.dll
[2009/07/19 19:03:54 | 00,557,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\comctl32.dll
[2009/07/19 19:03:54 | 00,392,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ntmssvc.dll
[2009/07/19 19:03:54 | 00,260,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\rpcss.dll
[2009/07/19 19:03:54 | 00,142,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\aec.sys
[2009/07/19 19:03:54 | 00,034,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\msgsvc.dll
[2009/07/19 19:03:54 | 00,011,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\acpiec.sys
[2009/07/19 19:03:54 | 00,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\sfc.dll
[2009/07/19 19:03:53 | 00,792,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\comres.dll
[2009/07/19 19:03:53 | 00,103,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\imm32.dll
[2009/07/19 19:03:53 | 00,023,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\kbdclass.sys
[2009/07/19 19:03:53 | 00,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\lpk.dll
[2009/07/19 19:03:53 | 00,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\powrprof.dll
[2009/07/19 19:03:53 | 00,004,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\beep.sys
[2009/07/19 19:03:53 | 00,002,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\null.sys
[2009/07/19 19:03:52 | 00,930,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\kernel32.dll
[2009/07/19 19:03:52 | 00,200,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\termsrv.dll
[2009/07/19 19:03:52 | 00,139,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\wuauclt.exe
[2009/07/19 19:03:52 | 00,051,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\spoolsv.exe
[2009/07/19 19:03:52 | 00,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\userinit.exe
[2009/07/19 19:03:52 | 00,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ctfmon.exe
[2009/07/19 19:03:51 | 01,920,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ntkrnlpa.exe
[2009/07/19 19:03:51 | 01,891,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ntoskrnl.exe
[2009/07/19 19:03:51 | 01,004,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\explorer.exe
[2009/07/19 19:03:51 | 00,101,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\services.exe
[2009/07/19 19:03:51 | 00,011,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\lsass.exe
[2009/07/19 19:03:50 | 00,599,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\wininet.dll
[2009/07/19 19:03:50 | 00,560,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\user32.dll
[2009/07/19 19:03:50 | 00,518,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\winlogon.exe
[2009/07/19 19:03:50 | 00,332,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\tcpip.sys
[2009/07/19 19:03:50 | 00,167,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ndis.sys
[2009/07/19 19:03:50 | 00,075,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\ws2_32.dll
[2009/07/19 19:03:49 | 00,012,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cache\svchost.exe
[2009/07/19 18:24:29 | 00,000,534 | —- | C] () – C:\Documents and Settings\Cody Rhoads\My Documents\Shortcut to CFScript.lnk
[2009/07/18 15:52:59 | 00,000,000 | —D | C] – C:\WINDOWS\System32\dllcache\cache
[2009/07/18 15:40:56 | 00,000,194 | —- | C] () – C:\Boot.bak
[2009/07/18 15:40:53 | 00,245,920 | —- | C] () – C:\cmldr
[2009/07/18 15:40:49 | 00,000,000 | RHSD | C] – C:\cmdcons
[2009/07/18 15:39:38 | 00,219,648 | —- | C] () – C:\WINDOWS\PEV.exe
[2009/07/18 15:39:38 | 00,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2009/07/18 15:39:38 | 00,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2009/07/18 15:39:38 | 00,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2009/07/18 15:39:38 | 00,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2009/07/18 15:39:38 | 00,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2009/07/18 15:39:38 | 00,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2009/07/18 15:39:38 | 00,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2009/07/18 15:39:31 | 00,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2009/07/18 15:39:26 | 00,000,000 | —D | C] – C:\Qoobox
[2009/07/18 15:39:02 | 03,147,475 | R— | C] () – C:\Documents and Settings\Cody Rhoads\Desktop\ComboFix.exe
[2009/07/18 15:18:52 | 00,000,000 | —D | C] – C:\WINDOWS\pss
[2009/07/17 19:58:21 | 00,001,734 | —- | C] () – C:\Documents and Settings\Cody Rhoads\Desktop\HijackThis.lnk
[2009/07/17 19:58:21 | 00,000,000 | —D | C] – C:\Program Files\Trend Micro
[2009/07/17 19:58:09 | 00,812,344 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Cody Rhoads\Desktop\HJTInstall.exe
[2009/07/17 19:20:34 | 00,511,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\capicom.dll
[2009/07/17 19:20:34 | 00,001,669 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Webroot AntiVirus.lnk
[2009/07/17 19:18:18 | 00,000,000 | —D | C] – C:\Program Files\MSSOAP
[2009/07/17 19:17:51 | 01,563,008 | —- | C] (Webroot Software, Inc.) – C:\WINDOWS\WRSetup.dll
[2009/07/17 19:17:51 | 00,000,000 | —D | C] – C:\Documents and Settings\Cody Rhoads\Application Data\Webroot
[2009/07/17 19:17:51 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Webroot
[2009/07/17 19:17:50 | 00,000,000 | —D | C] – C:\Program Files\Webroot
[2009/07/17 19:15:47 | 00,000,164 | —- | C] () – C:\WINDOWS\install.dat
[2009/07/17 19:14:38 | 40,584,608 | —- | C] (Webroot Software, Inc. ) – C:\Documents and Settings\Cody Rhoads\Desktop\SpySweeperSNRSetup8200_EN.exe
[2009/07/17 17:45:12 | 73,290,9568 | —- | C] () – C:\Documents and Settings\Cody Rhoads\Desktop\ubuntu-9.04-desktop-i386.iso
[2009/07/16 20:59:00 | 00,000,000 | —D | C] – C:\Documents and Settings\Cody Rhoads\Application Data\Macromedia
[2009/07/16 20:53:17 | 00,000,000 | —D | C] – C:\Documents and Settings\Cody Rhoads\Local Settings\Application Data\AIM Toolbar
[2009/07/16 20:30:54 | 00,000,000 | —D | C] – C:\Documents and Settings\Cody Rhoads\Application Data\acccore
[2009/07/16 20:30:27 | 00,000,000 | —D | C] – C:\Documents and Settings\Cody Rhoads\Local Settings\Application Data\AOL OCP
[2009/07/16 20:30:26 | 00,000,000 | —D | C] – C:\Documents and Settings\Cody Rhoads\Local Settings\Application Data\AOL
[2009/07/16 20:30:19 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Software Update Utility
[2009/07/16 20:30:17 | 00,000,000 | —D | C] – C:\Program Files\AIM Toolbar
[2009/07/16 20:30:17 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AIM Toolbar
[2009/07/16 20:30:14 | 00,000,000 | —D | C] – C:\Program Files\AIM Search
[2009/07/16 20:30:12 | 00,000,000 | —D | C] – C:\Program Files\Viewpoint
[2009/07/16 20:30:12 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/07/16 20:30:11 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\acccore
[2009/07/16 20:30:10 | 00,001,634 | —- | C] () – C:\Documents and Settings\All Users\Desktop\AIM 6.lnk
[2009/07/16 20:30:05 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AOL OCP
[2009/07/16 20:30:05 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AOL
[2009/07/16 20:29:50 | 00,000,000 | —D | C] – C:\Program Files\Common Files\AOL
[2009/07/16 20:29:45 | 00,000,000 | —D | C] – C:\Program Files\AIM6
[2009/07/16 20:29:42 | 00,000,448 | -H– | C] () – C:\IPH.PH
[2009/07/16 20:29:23 | 14,518,208 | —- | C] (AOL LLC.) – C:\Documents and Settings\Cody Rhoads\Desktop\Install_AIM.exe
[2009/07/16 20:23:56 | 00,000,000 | —D | C] – C:\Documents and Settings\Cody Rhoads\Local Settings\Application Data\Google
[2009/07/16 20:23:53 | 00,570,024 | —- | C] (Google Inc.) – C:\Documents and Settings\Cody Rhoads\Desktop\ChromeSetup.exe
[2009/07/16 20:17:31 | 00,749,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\setup_wm.exe
[2009/07/16 20:17:25 | 00,192,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\unregmp2.exe
[2009/07/16 20:17:24 | 04,648,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmp.dll
[2009/07/16 20:17:24 | 00,225,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmpdxm.dll
[2009/07/16 20:17:24 | 00,167,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmerror.dll
[2009/07/16 20:17:24 | 00,106,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmpasf.dll
[2009/07/16 20:17:24 | 00,098,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmpshell.dll
[2009/07/16 20:17:24 | 00,098,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmpshell.dll
[2009/07/16 20:17:24 | 00,073,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmplayer.exe
[2009/07/16 20:17:24 | 00,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\asferror.dll
[2009/07/16 20:17:24 | 00,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\asferror.dll
[2009/07/16 20:17:23 | 02,940,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmploc.dll
[2009/07/16 20:17:23 | 02,940,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmploc.dll
[2009/07/16 20:17:22 | 00,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmpcore.dll
[2009/07/16 20:17:22 | 00,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmpcd.dll
[2009/07/16 20:17:22 | 00,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmp.ocx
[2009/07/16 20:17:22 | 00,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmpcore.dll
[2009/07/16 20:17:22 | 00,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmpcd.dll
[2009/07/16 20:17:22 | 00,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmp.ocx
[2009/07/16 20:17:21 | 00,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmpui.dll
[2009/07/16 20:17:21 | 00,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmpui.dll
[2009/07/16 20:17:15 | 00,358,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msscp.dll
[2009/07/16 20:17:15 | 00,201,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mspmsp.dll
[2009/07/16 20:17:15 | 00,201,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mspmsp.dll
[2009/07/16 20:17:15 | 00,159,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\CEWMDM.dll
[2009/07/16 20:17:15 | 00,159,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\CEWMDM.dll
[2009/07/16 20:17:15 | 00,052,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mspmsnsv.dll
[2009/07/16 20:17:15 | 00,027,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmdmlog.dll
[2009/07/16 20:17:15 | 00,027,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmdmlog.dll
[2009/07/16 20:17:15 | 00,023,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmdmps.dll
[2009/07/16 20:17:15 | 00,023,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmdmps.dll
[2009/07/16 20:17:14 | 00,358,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msscp.dll
[2009/07/16 20:17:14 | 00,245,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mswmdm.dll
[2009/07/16 20:17:14 | 00,245,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mswmdm.dll
[2009/07/16 20:16:43 | 00,316,640 | —- | C] () – C:\WINDOWS\WMSysPr9.prx
[2009/07/16 20:16:42 | 00,384,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mp4sdmod.dll
[2009/07/16 20:16:42 | 00,316,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mp43dmod.dll
[2009/07/16 20:16:42 | 00,241,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mpg4dmod.dll
[2009/07/16 20:16:42 | 00,241,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mpg4dmod.dll
[2009/07/16 20:16:41 | 01,111,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmsdmoe2.dll
[2009/07/16 20:16:41 | 00,997,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmvdmoe2.dll
[2009/07/16 20:16:41 | 00,892,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmspdmoe.dll
[2009/07/16 20:16:41 | 00,816,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmvdmod.dll
[2009/07/16 20:16:41 | 00,816,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmvdmod.dll
[2009/07/16 20:16:41 | 00,760,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmsdmod.dll
[2009/07/16 20:16:41 | 00,760,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmsdmod.dll
[2009/07/16 20:16:41 | 00,670,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmadmoe.dll
[2009/07/16 20:16:41 | 00,670,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmadmoe.dll
[2009/07/16 20:16:41 | 00,486,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmspdmod.dll
[2009/07/16 20:16:41 | 00,410,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmadmod.dll
[2009/07/16 20:16:41 | 00,410,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmadmod.dll
[2009/07/16 20:16:41 | 00,241,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\qasf.dll
[2009/07/16 20:16:40 | 02,058,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmvcore.dll
[2009/07/16 20:16:40 | 00,981,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmnetmgr.dll
[2009/07/16 20:16:40 | 00,981,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmnetmgr.dll
[2009/07/16 20:16:40 | 00,241,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\qasf.dll
[2009/07/16 20:16:40 | 00,143,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmidx.dll
[2009/07/16 20:16:40 | 00,081,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\logagent.exe
[2009/07/16 20:16:40 | 00,081,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\logagent.exe
[2009/07/16 20:16:40 | 00,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\laprxy.dll
[2009/07/16 20:16:40 | 00,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\laprxy.dll
[2009/07/16 20:16:39 | 02,058,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmvcore.dll
[2009/07/16 20:16:39 | 00,218,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmasf.dll
[2009/07/16 20:16:39 | 00,218,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmasf.dll
[2009/07/16 20:16:38 | 00,678,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drmv2clt.dll
[2009/07/16 20:16:38 | 00,678,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\drmv2clt.dll
[2009/07/16 20:16:38 | 00,301,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drmclien.dll
[2009/07/16 20:16:38 | 00,301,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\drmclien.dll
[2009/07/16 20:16:38 | 00,253,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msnetobj.dll
[2009/07/16 20:16:38 | 00,253,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msnetobj.dll
[2009/07/16 20:16:38 | 00,232,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\blackbox.dll
[2009/07/16 20:16:38 | 00,232,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\blackbox.dll
[2009/07/16 20:16:38 | 00,082,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drmstor.dll
[2009/07/16 20:16:38 | 00,082,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\drmstor.dll
[2009/07/16 20:16:37 | 00,217,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\npdrmv2.dll
[2009/07/16 20:16:37 | 00,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\npwmsdrm.dll
[2009/07/16 20:14:30 | 00,122,880 | —- | C] (Sun Microsystems) – C:\WINDOWS\System32\JavaAccessBridge.dll
[2009/07/16 20:14:30 | 00,069,632 | —- | C] (Sun Microsystems) – C:\WINDOWS\System32\WindowsAccessBridge.dll
[2009/07/16 20:14:13 | 00,282,624 | —- | C] () – C:\WINDOWS\System32\PCDrSystemInformation.dll
[2009/07/16 20:14:10 | 00,094,208 | —- | C] () – C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2009/07/16 20:14:10 | 00,077,824 | —- | C] () – C:\WINDOWS\System32\ProgressTrace.dll
[2009/07/16 20:14:10 | 00,020,348 | —- | C] (PC-Doctor, Inc.) – C:\WINDOWS\System32\drivers\pcdrsrvc.sys
[2009/07/16 20:12:58 | 00,000,000 | —D | C] – C:\Program Files\PC-Doctor for Windows
[2009/07/16 20:11:51 | 00,000,000 | —D | C] – C:\Program Files\SIFXINST
[2009/07/16 20:11:51 | 00,000,000 | —D | C] – C:\Program Files\Gateway Rhapsody
[2009/07/16 20:11:31 | 00,000,882 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Acrobat Reader 5.0.lnk
[2009/07/16 20:11:27 | 00,000,000 | —D | C] – C:\WINDOWS\Profiles
[2009/07/16 20:11:26 | 00,000,000 | —D | C] – C:\WINDOWS\System32\Adobe
[2009/07/16 20:11:26 | 00,000,000 | —D | C] – C:\Program Files\Adobe
[2009/07/16 20:11:26 | 00,000,000 | —D | C] – C:\Documents and Settings\Cody Rhoads\My Documents\My eBooks
[2009/07/16 20:11:26 | 00,000,000 | —D | C] – C:\Documents and Settings\Cody Rhoads\Application Data\InterTrust
[2009/07/16 20:11:26 | 00,000,000 | —D | C] – C:\Documents and Settings\Cody Rhoads\Application Data\Adobe
[2009/07/16 20:11:17 | 00,306,688 | —- | C] (InstallShield Software Corporation) – C:\WINDOWS\IsUninst.exe
[2009/07/16 20:09:23 | 00,140,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\comdlg32.ocx
[2009/07/16 19:47:21 | 17,259,504 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\Cody Rhoads\Desktop\IE8-Setup-Full.exe
[2009/07/16 19:32:53 | 00,053,248 | —- | C] () – C:\WINDOWS\GWMDMpi.exe
[2009/07/16 19:32:21 | 00,134,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\portcls.sys
[2009/07/16 19:32:21 | 00,134,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\portcls.sys
[2009/07/16 19:32:21 | 00,057,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\drmk.sys
[2009/07/16 19:32:21 | 00,057,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\drmk.sys
[2009/07/16 19:28:32 | 00,057,344 | —- | C] (LANovation) – C:\WINDOWS\System32\PCTKRNT.SYS
[2009/07/16 19:28:11 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Lanovation
[2009/07/16 19:25:55 | 00,000,000 | —D | C] – C:\Program Files\Microsoft Works
[2009/07/16 19:25:55 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\drivers\GATEWAY__101.MRK
[2009/07/16 19:25:06 | 00,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpsp1hfm.exe
[2009/07/16 19:24:27 | 00,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spmsg.dll
[2009/07/16 19:23:57 | 00,102,400 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\drivers\ianswxp.sys
[2009/07/16 19:21:17 | 00,000,000 | —D | C] – C:\Program Files\Intel
[2009/07/16 19:21:13 | 00,067,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\usbui.dll
[2009/07/16 19:21:13 | 00,067,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbui.dll
[2009/07/16 19:21:13 | 00,019,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\usbuhci.sys
[2009/07/16 19:21:13 | 00,019,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbuhci.sys
[2009/07/16 19:21:12 | 00,135,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\usbport.sys
[2009/07/16 19:21:12 | 00,135,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbport.sys
[2009/07/16 19:21:12 | 00,051,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\usbhub.sys
[2009/07/16 19:21:12 | 00,051,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbhub.sys
[2009/07/16 19:21:09 | 00,087,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\atapi.sys
[2009/07/16 19:21:09 | 00,087,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\atapi.sys
[2009/07/16 19:21:09 | 00,023,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\pciidex.sys
[2009/07/16 19:21:09 | 00,023,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pciidex.sys
[2009/07/16 19:21:09 | 00,003,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\pciide.sys
[2009/07/16 19:21:09 | 00,003,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pciide.sys
[2009/07/16 19:20:51 | 00,035,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\isapnp.sys
[2009/07/16 19:20:51 | 00,035,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\isapnp.sys
[2009/07/16 19:20:26 | 00,062,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\pci.sys
[2009/07/16 19:20:26 | 00,062,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pci.sys
[2009/07/16 19:20:20 | 00,000,000 | -H-D | C] – C:\Program Files\InstallShield Installation Information
[2009/07/16 19:19:57 | 00,000,000 | —D | C] – C:\Program Files\Common Files\InstallShield
[2009/07/16 19:11:14 | 00,002,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\drmkaud.sys
[2009/07/16 19:11:14 | 00,002,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\drmkaud.sys
[2009/07/16 19:11:12 | 00,077,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\wdmaud.sys
[2009/07/16 19:11:12 | 00,077,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wdmaud.sys
[2009/07/16 19:11:11 | 00,159,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\kmixer.sys
[2009/07/16 19:11:11 | 00,159,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kmixer.sys
[2009/07/16 19:11:09 | 00,056,832 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\sysaudio.sys
[2009/07/16 19:11:09 | 00,056,832 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sysaudio.sys
[2009/07/16 19:11:07 | 00,050,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\DMusic.sys
[2009/07/16 19:11:07 | 00,050,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dmusic.sys
[2009/07/16 19:11:06 | 00,054,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\swmidi.sys
[2009/07/16 19:11:06 | 00,054,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\swmidi.sys
[2009/07/16 19:11:04 | 00,142,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\aec.sys
[2009/07/16 19:11:04 | 00,142,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aec.sys
[2009/07/16 19:11:02 | 00,005,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\splitter.sys
[2009/07/16 19:11:02 | 00,005,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\splitter.sys
[2009/07/16 19:10:30 | 00,155,648 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxres.dll
[2009/07/16 19:08:58 | 00,000,000 | –SD | C] – C:\WINDOWS\System32\Microsoft
[2009/07/16 19:08:54 | 02,688,574 | -H– | C] () – C:\Documents and Settings\Cody Rhoads\Local Settings\Application Data\IconCache.db
[2009/07/16 19:03:17 | 00,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wdmaud.drv
[2009/07/16 19:02:55 | 00,000,000 | —D | C] – C:\WINDOWS\System32\ReinstallBackups
[2009/07/16 18:51:45 | 00,000,000 | —D | C] – C:\WINDOWS\RegisteredPackages
[2009/07/16 18:51:11 | 01,230,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msvidctl.dll
[2009/07/16 18:51:11 | 01,230,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msvidctl.dll
[2009/07/16 18:51:11 | 00,354,816 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2009/07/16 18:51:11 | 00,354,816 | —- | C] () – C:\WINDOWS\System32\dllcache\psisdecd.dll
[2009/07/16 18:51:11 | 00,274,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kstvtune.ax
[2009/07/16 18:51:11 | 00,274,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kstvtune.ax
[2009/07/16 18:51:11 | 00,226,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kswdmcap.ax
[2009/07/16 18:51:11 | 00,226,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kswdmcap.ax
[2009/07/16 18:51:11 | 00,083,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\nabtsfec.sys
[2009/07/16 18:51:11 | 00,083,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nabtsfec.sys
[2009/07/16 18:51:11 | 00,057,856 | —- | C] () – C:\WINDOWS\System32\mpeg2data.ax
[2009/07/16 18:51:11 | 00,052,224 | —- | C] () – C:\WINDOWS\System32\msdvbnp.ax
[2009/07/16 18:51:11 | 00,052,224 | —- | C] () – C:\WINDOWS\System32\dllcache\msdvbnp.ax
[2009/07/16 18:51:11 | 00,052,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\msdv.sys
[2009/07/16 18:51:11 | 00,052,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdv.sys
[2009/07/16 18:51:11 | 00,047,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wstdecod.dll
[2009/07/16 18:51:11 | 00,047,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wstdecod.dll
[2009/07/16 18:51:11 | 00,039,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ksxbar.ax
[2009/07/16 18:51:11 | 00,039,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ksxbar.ax
[2009/07/16 18:51:11 | 00,030,208 | —- | C] () – C:\WINDOWS\System32\psisrndr.ax
[2009/07/16 18:51:11 | 00,030,208 | —- | C] () – C:\WINDOWS\System32\dllcache\psisrndr.ax
[2009/07/16 18:51:11 | 00,027,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vbisurf.ax
[2009/07/16 18:51:11 | 00,027,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vbisurf.ax
[2009/07/16 18:51:11 | 00,018,688 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\wstcodec.sys
[2009/07/16 18:51:11 | 00,018,688 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wstcodec.sys
[2009/07/16 18:51:11 | 00,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msyuv.dll
[2009/07/16 18:51:11 | 00,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msyuv.dll
[2009/07/16 18:51:11 | 00,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\bdaplgin.ax
[2009/07/16 18:51:11 | 00,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\bdaplgin.ax
[2009/07/16 18:51:11 | 00,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\ccdecode.sys
[2009/07/16 18:51:11 | 00,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ccdecode.sys
[2009/07/16 18:51:11 | 00,015,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\mpe.sys
[2009/07/16 18:51:11 | 00,015,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mpe.sys
[2009/07/16 18:51:11 | 00,014,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\streamip.sys
[2009/07/16 18:51:11 | 00,014,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\streamip.sys
[2009/07/16 18:51:11 | 00,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ipsink.ax
[2009/07/16 18:51:11 | 00,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ipsink.ax
[2009/07/16 18:51:11 | 00,011,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\bdasup.sys
[2009/07/16 18:51:11 | 00,011,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\bdasup.sys
[2009/07/16 18:51:11 | 00,010,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\slip.sys
[2009/07/16 18:51:11 | 00,010,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\slip.sys
[2009/07/16 18:51:11 | 00,010,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\ndisip.sys
[2009/07/16 18:51:11 | 00,010,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ndisip.sys
[2009/07/16 18:50:31 | 00,720,896 | —- | C] (Sensaura Ltd) – C:\WINDOWS\System32\a3d.dll
[2009/07/16 18:50:31 | 00,542,976 | —- | C] (Analog Devices, Inc.) – C:\WINDOWS\System32\drivers\smwdm.sys
[2009/07/16 18:50:31 | 00,004,816 | —- | C] (Andrea Electronics Corporation) – C:\WINDOWS\System32\drivers\aeaudio.sys
[2009/07/16 18:50:31 | 00,003,744 | —- | C] (Analog Devices, Inc.) – C:\WINDOWS\System32\drivers\smsens.sys
[2009/07/16 18:50:25 | 00,145,408 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\drivers\e100b325.sys
[2009/07/16 18:50:25 | 00,145,408 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\e100b325.sys
[2009/07/16 18:50:25 | 00,024,064 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\IntelNic.dll
[2009/07/16 18:50:25 | 00,012,288 | —- | C] () – C:\WINDOWS\System32\e100bmsg.dll
[2009/07/16 18:50:25 | 00,005,110 | —- | C] () – C:\WINDOWS\System32\e100b325.din
[2009/07/16 18:50:24 | 00,118,784 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\Prounstl.exe
[2009/07/16 18:50:24 | 00,098,304 | —- | C] (GTW) – C:\WINDOWS\GWMDMU.exe
[2009/07/16 18:50:24 | 00,090,112 | —- | C] (GTW) – C:\WINDOWS\GWMDMMSG.exe
[2009/07/16 18:50:24 | 00,069,632 | —- | C] (GTW) – C:\WINDOWS\GWMDMD2K.exe
[2009/07/16 18:50:24 | 00,053,248 | —- | C] (GTW) – C:\WINDOWS\System32\GWMDM168.dll
[2009/07/16 18:50:23 | 01,107,680 | —- | C] (GTW) – C:\WINDOWS\System32\drivers\GWMDM.sys
[2009/07/16 18:50:23 | 00,315,392 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxsrvc.dll
[2009/07/16 18:50:23 | 00,159,744 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrptg.lrc
[2009/07/16 18:50:23 | 00,159,744 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrptb.lrc
[2009/07/16 18:50:23 | 00,159,744 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrplk.lrc
[2009/07/16 18:50:23 | 00,155,648 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxtray.exe
[2009/07/16 18:50:23 | 00,155,648 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrtrk.lrc
[2009/07/16 18:50:23 | 00,155,648 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrtha.lrc
[2009/07/16 18:50:23 | 00,155,648 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrsve.lrc
[2009/07/16 18:50:23 | 00,155,648 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrrus.lrc
[2009/07/16 18:50:23 | 00,032,823 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\drivers\wa301b.sys
[2009/07/16 18:50:23 | 00,032,823 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\drivers\wa301a.sys
[2009/07/16 18:50:22 | 00,503,808 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxress.dll
[2009/07/16 18:50:22 | 00,163,840 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrell.lrc
[2009/07/16 18:50:22 | 00,159,744 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrnld.lrc
[2009/07/16 18:50:22 | 00,159,744 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrita.lrc
[2009/07/16 18:50:22 | 00,159,744 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrhun.lrc
[2009/07/16 18:50:22 | 00,159,744 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrfrc.lrc
[2009/07/16 18:50:22 | 00,159,744 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrfra.lrc
[2009/07/16 18:50:22 | 00,159,744 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxresp.lrc
[2009/07/16 18:50:22 | 00,155,648 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrnor.lrc
[2009/07/16 18:50:22 | 00,155,648 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrkor.lrc
[2009/07/16 18:50:22 | 00,155,648 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrjpn.lrc
[2009/07/16 18:50:22 | 00,155,648 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrheb.lrc
[2009/07/16 18:50:22 | 00,155,648 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrfin.lrc
[2009/07/16 18:50:22 | 00,155,648 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrenu.lrc
[2009/07/16 18:50:22 | 00,155,648 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxreng.lrc
[2009/07/16 18:50:22 | 00,155,648 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrdeu.lrc
[2009/07/16 18:50:22 | 00,155,648 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrdan.lrc
[2009/07/16 18:50:21 | 00,221,184 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxeud.dll
[2009/07/16 18:50:21 | 00,204,800 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxpph.dll
[2009/07/16 18:50:21 | 00,155,648 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrcsy.lrc
[2009/07/16 18:50:21 | 00,155,648 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrcht.lrc
[2009/07/16 18:50:21 | 00,155,648 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrchs.lrc
[2009/07/16 18:50:21 | 00,155,648 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrarb.lrc
[2009/07/16 18:50:21 | 00,155,648 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrara.lrc
[2009/07/16 18:50:21 | 00,151,552 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxdiag.exe
[2009/07/16 18:50:21 | 00,147,456 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxdev.dll
[2009/07/16 18:50:21 | 00,118,784 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxhk.dll
[2009/07/16 18:50:21 | 00,094,208 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxcpl.cpl
[2009/07/16 18:50:21 | 00,090,112 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxext.exe
[2009/07/16 18:50:21 | 00,086,016 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxdo.dll
[2009/07/16 18:50:21 | 00,062,970 | —- | C] () – C:\WINDOWS\System32\igfxhkor.lhp
[2009/07/16 18:50:21 | 00,060,996 | —- | C] () – C:\WINDOWS\System32\igfxhtha.lhp
[2009/07/16 18:50:21 | 00,060,988 | —- | C] () – C:\WINDOWS\System32\igfxhhun.lhp
[2009/07/16 18:50:21 | 00,060,894 | —- | C] () – C:\WINDOWS\System32\igfxhdeu.lhp
[2009/07/16 18:50:21 | 00,060,400 | —- | C] () – C:\WINDOWS\System32\igfxhfrc.lhp
[2009/07/16 18:50:21 | 00,060,392 | —- | C] () – C:\WINDOWS\System32\igfxhheb.lhp
[2009/07/16 18:50:21 | 00,060,099 | —- | C] () – C:\WINDOWS\System32\igfxhfra.lhp
[2009/07/16 18:50:21 | 00,060,037 | —- | C] () – C:\WINDOWS\System32\igfxhplk.lhp
[2009/07/16 18:50:21 | 00,060,025 | —- | C] () – C:\WINDOWS\System32\igfxhell.lhp
[2009/07/16 18:50:21 | 00,059,819 | —- | C] () – C:\WINDOWS\System32\igfxhrus.lhp
[2009/07/16 18:50:21 | 00,059,052 | —- | C] () – C:\WINDOWS\System32\igfxhcht.lhp
[2009/07/16 18:50:21 | 00,058,967 | —- | C] () – C:\WINDOWS\System32\igfxhjpn.lhp
[2009/07/16 18:50:21 | 00,058,889 | —- | C] () – C:\WINDOWS\System32\igfxhfin.lhp
[2009/07/16 18:50:21 | 00,058,738 | —- | C] () – C:\WINDOWS\System32\igfxhnld.lhp
[2009/07/16 18:50:21 | 00,058,647 | —- | C] () – C:\WINDOWS\System32\igfxhcsy.lhp
[2009/07/16 18:50:21 | 00,058,528 | —- | C] () – C:\WINDOWS\System32\igfxhtrk.lhp
[2009/07/16 18:50:21 | 00,058,026 | —- | C] () – C:\WINDOWS\System32\igfxhdan.lhp
[2009/07/16 18:50:21 | 00,058,024 | —- | C] () – C:\WINDOWS\System32\igfxhsve.lhp
[2009/07/16 18:50:21 | 00,058,021 | —- | C] () – C:\WINDOWS\System32\igfxhnor.lhp
[2009/07/16 18:50:21 | 00,058,010 | —- | C] () – C:\WINDOWS\System32\igfxhesp.lhp
[2009/07/16 18:50:21 | 00,057,965 | —- | C] () – C:\WINDOWS\System32\igfxhptg.lhp
[2009/07/16 18:50:21 | 00,057,891 | —- | C] () – C:\WINDOWS\System32\igfxhita.lhp
[2009/07/16 18:50:21 | 00,057,434 | —- | C] () – C:\WINDOWS\System32\igfxhptb.lhp
[2009/07/16 18:50:21 | 00,056,845 | —- | C] () – C:\WINDOWS\System32\igfxharb.lhp
[2009/07/16 18:50:21 | 00,056,845 | —- | C] () – C:\WINDOWS\System32\igfxhara.lhp
[2009/07/16 18:50:21 | 00,056,835 | —- | C] () – C:\WINDOWS\System32\igfxhchs.lhp
[2009/07/16 18:50:21 | 00,056,580 | —- | C] () – C:\WINDOWS\System32\igfxheng.lhp
[2009/07/16 18:50:21 | 00,055,002 | —- | C] () – C:\WINDOWS\System32\igfxhenu.lhp
[2009/07/16 18:50:21 | 00,045,056 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxdgps.dll
[2009/07/16 18:50:21 | 00,032,768 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxexps.dll
[2009/07/16 18:50:20 | 01,859,584 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\ialmgicd.dll
[2009/07/16 18:50:20 | 00,487,424 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxcfg.exe
[2009/07/16 18:50:20 | 00,194,427 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\ialmdev5.dll
[2009/07/16 18:50:20 | 00,188,416 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\ialmgdev.dll
[2009/07/16 18:50:20 | 00,114,748 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\ialmdnt5.dll
[2009/07/16 18:50:20 | 00,112,288 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\drivers\ialmsbw.sys
[2009/07/16 18:50:20 | 00,090,395 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\drivers\ialmnt5.sys
[2009/07/16 18:50:20 | 00,078,496 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\drivers\ialmkchw.sys
[2009/07/16 18:50:20 | 00,033,792 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\ialmrnt5.dll
[2009/07/16 18:50:19 | 00,460,866 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\ialmdd5.dll
[2009/07/16 18:50:19 | 00,118,784 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\hccutils.dll
[2009/07/16 18:50:19 | 00,114,688 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\hkcmd.exe
[2009/07/16 18:50:19 | 00,065,536 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\iAlmCoIn_v13.dll
[2009/07/16 18:50:19 | 00,046,647 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\drivers\a304.sys
[2009/07/16 18:50:19 | 00,035,383 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\drivers\a313.sys
[2009/07/16 18:50:19 | 00,033,335 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\drivers\a310.sys
[2009/07/16 18:50:19 | 00,031,287 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\drivers\a311.sys
[2009/07/16 18:50:19 | 00,027,703 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\drivers\a303.sys
[2009/07/16 18:50:19 | 00,025,655 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\drivers\a309.sys
[2009/07/16 18:50:19 | 00,020,535 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\drivers\a307.sys
[2009/07/16 18:50:19 | 00,020,021 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\drivers\vch.sys
[2009/07/16 18:50:19 | 00,016,439 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\drivers\a306.sys
[2009/07/16 18:50:19 | 00,011,831 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\drivers\a305.sys
[2009/07/16 18:50:19 | 00,011,319 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\drivers\a302.sys
[2009/07/16 18:50:19 | 00,010,807 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\drivers\a314.sys
[2009/07/16 18:50:19 | 00,010,807 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\drivers\a312.sys
[2009/07/16 18:50:19 | 00,010,807 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\drivers\a308.sys
[2009/07/16 18:50:18 | 00,000,000 | —D | C] – C:\CABS
[2009/07/16 18:48:08 | 00,000,000 | —D | C] – C:\Program Files\Gateway
[2009/07/16 18:28:47 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Adobe
[2009/07/16 18:23:15 | 00,000,000 | -HSD | C] – C:\WINDOWS\Installer
[2009/07/16 18:23:11 | 00,000,000 | —D | C] – C:\Documents and Settings\Cody Rhoads\Application Data\Identities
[2009/07/16 18:23:03 | 00,000,000 | -H-D | C] – C:\Program Files\Uninstall Information
[2009/07/16 18:23:02 | 00,000,000 | R–D | C] – C:\Documents and Settings\Cody Rhoads\My Documents\My Music
[2009/07/16 18:23:01 | 00,000,000 | R–D | C] – C:\Documents and Settings\Cody Rhoads\My Documents\My Pictures
[2009/07/16 18:22:48 | 00,000,000 | —D | C] – C:\Documents and Settings\Cody Rhoads\Local Settings\Application Data\Microsoft
[2009/07/16 18:22:47 | 00,000,000 | –SD | C] – C:\Documents and Settings\Cody Rhoads\Application Data\Microsoft
[2009/07/16 18:17:24 | 00,000,000 | -HSD | C] – C:\System Volume Information
[2009/07/16 18:17:23 | 00,000,000 | —D | C] – C:\WINDOWS\Prefetch
[2009/07/16 18:16:09 | 00,008,192 | —- | C] () – C:\WINDOWS\REGLOCS.OLD
[2009/07/16 18:14:54 | 00,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2009/07/16 18:14:34 | 00,150,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winzm.ime
[2009/07/16 18:14:34 | 00,150,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winsp.ime
[2009/07/16 18:14:34 | 00,150,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winpy.ime
[2009/07/16 18:14:26 | 00,069,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wingb.ime
[2009/07/16 18:14:26 | 00,061,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winime.ime
[2009/07/16 18:14:25 | 00,074,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winar30.ime
[2009/07/16 18:14:25 | 00,041,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\weitekp9.dll
[2009/07/16 18:14:25 | 00,031,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\weitekp9.sys
[2009/07/16 18:14:23 | 00,086,074 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\voicesub.dll
[2009/07/16 18:14:23 | 00,048,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\w32.dll
[2009/07/16 18:14:22 | 00,426,042 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\voicepad.dll
[2009/07/16 18:14:21 | 00,072,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\uniime.dll
[2009/07/16 18:14:21 | 00,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\unicdime.ime
[2009/07/16 18:14:20 | 00,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tsprof.exe
[2009/07/16 18:14:19 | 00,574,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tintlgnt.ime
[2009/07/16 18:14:19 | 00,455,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tintsetp.exe
[2009/07/16 18:14:19 | 00,044,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tintlphr.exe
[2009/07/16 18:14:19 | 00,010,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tmigrate.dll
[2009/07/16 18:14:18 | 00,185,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\thawbrkr.dll
[2009/07/16 18:14:18 | 00,021,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tdipx.sys
[2009/07/16 18:14:18 | 00,019,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tdspx.sys
[2009/07/16 18:14:18 | 00,013,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tdasync.sys
[2009/07/16 18:14:16 | 00,101,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\srusbusd.dll
[2009/07/16 18:14:14 | 00,182,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmpsmir.dll
[2009/07/16 18:14:14 | 00,143,422 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\softkey.dll
[2009/07/16 18:14:14 | 00,036,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmpthrd.dll
[2009/07/16 18:14:14 | 00,010,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmpstup.dll
[2009/07/16 18:14:14 | 00,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmptrap.exe
[2009/07/16 18:14:14 | 00,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_snprfdll.dll
[2009/07/16 18:14:14 | 00,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmpmib.dll
[2009/07/16 18:14:13 | 00,431,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smtpsvc.dll
[2009/07/16 18:14:13 | 00,345,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmpincl.dll
[2009/07/16 18:14:13 | 00,246,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmpcl.dll
[2009/07/16 18:14:13 | 00,029,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmp.exe
[2009/07/16 18:14:13 | 00,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_smtpctrs.dll
[2009/07/16 18:14:13 | 00,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_smtpapi.dll
[2009/07/16 18:14:13 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smimsgif.dll
[2009/07/16 18:14:12 | 00,226,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smi2smir.exe
[2009/07/16 18:14:12 | 00,038,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm9aw.dll
[2009/07/16 18:14:12 | 00,031,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smb6w.dll
[2009/07/16 18:14:12 | 00,031,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sma3w.dll
[2009/07/16 18:14:12 | 00,030,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm87w.dll
[2009/07/16 18:14:12 | 00,030,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm81w.dll
[2009/07/16 18:14:12 | 00,029,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm8cw.dll
[2009/07/16 18:14:12 | 00,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm93w.dll
[2009/07/16 18:14:12 | 00,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm92w.dll
[2009/07/16 18:14:12 | 00,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm90w.dll
[2009/07/16 18:14:12 | 00,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm8dw.dll
[2009/07/16 18:14:12 | 00,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm8aw.dll
[2009/07/16 18:14:12 | 00,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm89w.dll
[2009/07/16 18:14:12 | 00,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smierrsm.dll
[2009/07/16 18:14:12 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smierrsy.dll
[2009/07/16 18:14:11 | 00,025,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm59w.dll
[2009/07/16 18:14:11 | 00,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\simptcp.dll
[2009/07/16 18:14:08 | 00,205,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_seo.dll
[2009/07/16 18:14:08 | 00,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_seos.dll
[2009/07/16 18:14:07 | 00,057,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_scripto.dll
[2009/07/16 18:14:06 | 00,079,872 | —- | C] (Ricoh Co., Ltd.) – C:\WINDOWS\System32\dllcache\rwia330.dll
[2009/07/16 18:14:06 | 00,079,872 | —- | C] (Ricoh Co., Ltd.) – C:\WINDOWS\System32\dllcache\rwia001.dll
[2009/07/16 18:14:06 | 00,026,624 | —- | C] (Ricoh Co., Ltd.) – C:\WINDOWS\System32\dllcache\rw330ext.dll
[2009/07/16 18:14:06 | 00,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rw001ext.dll
[2009/07/16 18:14:06 | 00,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_rwnh.dll
[2009/07/16 18:14:05 | 00,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\romanime.ime
[2009/07/16 18:14:04 | 00,023,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_regtrace.exe
[2009/07/16 18:14:04 | 00,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\register.exe
[2009/07/16 18:14:02 | 00,073,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\quick.ime
[2009/07/16 18:14:02 | 00,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\quser.exe
[2009/07/16 18:14:02 | 00,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\query.exe
[2009/07/16 18:14:01 | 00,131,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pmxviceo.dll
[2009/07/16 18:14:00 | 00,479,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pintlgnt.ime
[2009/07/16 18:14:00 | 00,175,104 | —- | C] () – C:\WINDOWS\System32\dllcache\pintlcsa.dll
[2009/07/16 18:14:00 | 00,070,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pintlphr.exe
[2009/07/16 18:14:00 | 00,067,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pmigrate.dll
[2009/07/16 18:14:00 | 00,053,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pintlcsd.dll
[2009/07/16 18:14:00 | 00,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pmxmcro.dll
[2009/07/16 18:14:00 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pmxgl.dll
[2009/07/16 18:13:59 | 00,075,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\phon.ime
[2009/07/16 18:13:59 | 00,036,927 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\padrs411.dll
[2009/07/16 18:13:59 | 00,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\padrs404.dll
[2009/07/16 18:13:59 | 00,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\padrs804.dll
[2009/07/16 18:13:59 | 00,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\padrs412.dll
[2009/07/16 18:13:57 | 00,038,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_ntfsdrv.dll
[2009/07/16 18:13:52 | 00,229,439 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\multibox.dll
[2009/07/16 18:13:52 | 00,111,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mtstocom.exe
[2009/07/16 18:13:48 | 01,875,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msir3jp.lex
[2009/07/16 18:13:48 | 00,098,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msir3jp.dll
[2009/07/16 18:13:48 | 00,034,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msiregmv.exe
[2009/07/16 18:13:42 | 00,092,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mga.sys
[2009/07/16 18:13:42 | 00,092,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mga.dll
[2009/07/16 18:13:42 | 00,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\migregdb.exe
[2009/07/16 18:13:40 | 00,065,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_mailmsg.dll
[2009/07/16 18:13:40 | 00,020,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lpdsvc.dll
[2009/07/16 18:13:40 | 00,017,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lprmon.dll
[2009/07/16 18:13:39 | 00,029,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lmmib2.dll
[2009/07/16 18:13:38 | 01,158,818 | —- | C] () – C:\WINDOWS\System32\dllcache\korwbrkr.lex
[2009/07/16 18:13:38 | 00,070,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\korwbrkr.dll
[2009/07/16 18:13:38 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdvntc.dll
[2009/07/16 18:13:38 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdusa.dll
[2009/07/16 18:13:38 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdurdu.dll
[2009/07/16 18:13:37 | 00,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdnecat.dll
[2009/07/16 18:13:37 | 00,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdnecnt.dll
[2009/07/16 18:13:37 | 00,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdnec95.dll
[2009/07/16 18:13:37 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdth3.dll
[2009/07/16 18:13:37 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdth2.dll
[2009/07/16 18:13:37 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdth1.dll
[2009/07/16 18:13:37 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdth0.dll
[2009/07/16 18:13:37 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdsyr2.dll
[2009/07/16 18:13:37 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdsyr1.dll
[2009/07/16 18:13:36 | 00,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdlk41a.dll
[2009/07/16 18:13:36 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdlk41j.dll
[2009/07/16 18:13:36 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinpun.dll
[2009/07/16 18:13:36 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdintel.dll
[2009/07/16 18:13:36 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdintam.dll
[2009/07/16 18:13:36 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinmar.dll
[2009/07/16 18:13:36 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinkan.dll
[2009/07/16 18:13:36 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinhin.dll
[2009/07/16 18:13:35 | 00,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdibm02.dll
[2009/07/16 18:13:35 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinguj.dll
[2009/07/16 18:13:35 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdindev.dll
[2009/07/16 18:13:35 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdheb.dll
[2009/07/16 18:13:35 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdfa.dll
[2009/07/16 18:13:35 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbddiv2.dll
[2009/07/16 18:13:35 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbddiv1.dll
[2009/07/16 18:13:35 | 00,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdgeo.dll
[2009/07/16 18:13:34 | 00,018,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\jupiw.dll
[2009/07/16 18:13:34 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdax2.dll
[2009/07/16 18:13:34 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbd106n.dll
[2009/07/16 18:13:34 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbd101a.dll
[2009/07/16 18:13:34 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbd101.dll
[2009/07/16 18:13:34 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbda3.dll
[2009/07/16 18:13:34 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbda2.dll
[2009/07/16 18:13:34 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbda1.dll
[2009/07/16 18:13:34 | 00,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdarmw.dll
[2009/07/16 18:13:34 | 00,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdarme.dll
[2009/07/16 18:13:32 | 00,033,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iprip.dll
[2009/07/16 18:13:31 | 00,471,102 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imskdic.dll
[2009/07/16 18:13:31 | 00,315,452 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imskf.dll
[2009/07/16 18:13:31 | 00,274,490 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjputyc.dll
[2009/07/16 18:13:31 | 00,262,201 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjputy.exe
[2009/07/16 18:13:31 | 00,233,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjprw.exe
[2009/07/16 18:13:31 | 00,208,953 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpmig.exe
[2009/07/16 18:13:31 | 00,102,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imlang.dll
[2009/07/16 18:13:31 | 00,059,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imkrinst.exe
[2009/07/16 18:13:31 | 00,059,392 | —- | C] () – C:\WINDOWS\System32\dllcache\imscinst.exe
[2009/07/16 18:13:31 | 00,045,109 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpuex.exe
[2009/07/16 18:13:30 | 00,827,438 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjp81k.dll
[2009/07/16 18:13:30 | 00,716,857 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpcus.dll
[2009/07/16 18:13:30 | 00,360,494 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpcic.dll
[2009/07/16 18:13:30 | 00,340,013 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjp81.ime
[2009/07/16 18:13:30 | 00,307,258 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpdct.exe
[2009/07/16 18:13:30 | 00,196,666 | —- | C] () – C:\WINDOWS\System32\dllcache\imjpinst.exe
[2009/07/16 18:13:30 | 00,155,706 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpdsvr.exe
[2009/07/16 18:13:30 | 00,081,977 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpdct.dll
[2009/07/16 18:13:30 | 00,057,398 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpdadm.exe
[2009/07/16 18:13:29 | 00,311,359 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imepadsv.exe
[2009/07/16 18:13:29 | 00,134,339 | —- | C] () – C:\WINDOWS\System32\dllcache\imekr.lex
[2009/07/16 18:13:29 | 00,102,463 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imepadsm.dll
[2009/07/16 18:13:29 | 00,099,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imekrcic.dll
[2009/07/16 18:13:29 | 00,089,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imekr61.ime
[2009/07/16 18:13:29 | 00,080,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imekrmbx.dll
[2009/07/16 18:13:29 | 00,044,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imekrmig.exe
[2009/07/16 18:13:25 | 10,129,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hwxkor.dll
[2009/07/16 18:13:21 | 13,463,552 | —- | C] () – C:\WINDOWS\System32\dllcache\hwxjpn.dll
[2009/07/16 18:13:19 | 10,096,640 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hwxcht.dll
[2009/07/16 18:13:18 | 00,035,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hostmib.dll
[2009/07/16 18:13:17 | 00,108,827 | —- | C] () – C:\WINDOWS\System32\dllcache\hanja.lex
[2009/07/16 18:13:17 | 00,036,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hanjadic.dll
[2009/07/16 18:13:16 | 00,559,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsst.dll
[2009/07/16 18:13:16 | 00,395,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsxp32.dll
[2009/07/16 18:13:16 | 00,391,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxstiff.dll
[2009/07/16 18:13:16 | 00,250,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxssvc.exe
[2009/07/16 18:13:16 | 00,236,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxst30.dll
[2009/07/16 18:13:16 | 00,185,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxswzrd.dll
[2009/07/16 18:13:16 | 00,149,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsui.dll
[2009/07/16 18:13:16 | 00,031,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsroute.dll
[2009/07/16 18:13:16 | 00,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsmon.dll
[2009/07/16 18:13:16 | 00,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxssend.exe
[2009/07/16 18:13:16 | 00,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsperf.dll
[2009/07/16 18:13:16 | 00,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsres.dll
[2009/07/16 18:13:15 | 00,443,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsapi.dll
[2009/07/16 18:13:15 | 00,271,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxscomex.dll
[2009/07/16 18:13:15 | 00,216,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxscover.exe
[2009/07/16 18:13:15 | 00,132,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsclntr.dll
[2009/07/16 18:13:15 | 00,130,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsclnt.exe
[2009/07/16 18:13:15 | 00,111,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxscfgwz.dll
[2009/07/16 18:13:15 | 00,068,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxscom.dll
[2009/07/16 18:13:15 | 00,053,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsevent.dll
[2009/07/16 18:13:15 | 00,024,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsdrv.dll
[2009/07/16 18:13:15 | 00,020,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsext32.dll
[2009/07/16 18:13:15 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ftlx041e.dll
[2009/07/16 18:13:14 | 00,094,208 | —- | C] () – C:\WINDOWS\System32\dllcache\fpencode.dll
[2009/07/16 18:13:14 | 00,020,541 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpadmdll.dll
[2009/07/16 18:13:13 | 00,618,605 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4autl.dll
[2009/07/16 18:13:13 | 00,024,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpadmcgi.exe
[2009/07/16 18:13:13 | 00,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\flattemp.exe
[2009/07/16 18:13:12 | 00,096,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\evntagnt.dll
[2009/07/16 18:13:12 | 00,084,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\evntwin.exe
[2009/07/16 18:13:12 | 00,043,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_fcachdll.dll
[2009/07/16 18:13:12 | 00,025,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\et4000.sys
[2009/07/16 18:13:12 | 00,022,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\evntcmd.exe
[2009/07/16 18:13:12 | 00,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\f3ahvoas.dll
[2009/07/16 18:13:11 | 00,057,856 | —- | C] (SEIKO EPSON CORP.) – C:\WINDOWS\System32\dllcache\esuimgd.dll
[2009/07/16 18:13:11 | 00,045,056 | —- | C] (SEIKO EPSON CORP.) – C:\WINDOWS\System32\dllcache\esunid.dll
[2009/07/16 18:13:11 | 00,031,744 | —- | C] (SEIKO EPSON CORP.) – C:\WINDOWS\System32\dllcache\esucmd.dll
[2009/07/16 18:13:10 | 00,514,587 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\edb500.dll
[2009/07/16 18:13:05 | 00,074,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dayi.ime
[2009/07/16 18:13:04 | 00,057,400 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cplexe.exe
[2009/07/16 18:13:04 | 00,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cprofile.exe
[2009/07/16 18:13:01 | 00,480,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cintsetp.exe
[2009/07/16 18:13:01 | 00,201,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cintime.dll
[2009/07/16 18:13:01 | 00,173,568 | —- | C] () – C:\WINDOWS\System32\dllcache\chtskf.dll
[2009/07/16 18:13:01 | 00,021,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cintlgnt.ime
[2009/07/16 18:13:00 | 01,677,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chsbrkr.dll
[2009/07/16 18:13:00 | 00,838,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chtbrkr.dll
[2009/07/16 18:13:00 | 00,097,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chtmbx.dll
[2009/07/16 18:13:00 | 00,056,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chtskdic.dll
[2009/07/16 18:13:00 | 00,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chgport.exe
[2009/07/16 18:13:00 | 00,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chgusr.exe
[2009/07/16 18:12:59 | 00,074,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chajei.ime
[2009/07/16 18:12:59 | 00,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chglogon.exe
[2009/07/16 18:12:59 | 00,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\change.exe
[2009/07/16 18:12:58 | 00,054,528 | —- | C] (Philips Semiconductors GmbH) – C:\WINDOWS\System32\dllcache\cap7146.sys
[2009/07/16 18:12:58 | 00,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\c_iscii.dll
[2009/07/16 18:12:57 | 00,218,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\c_g18030.dll
[2009/07/16 18:12:57 | 00,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\c_is2022.dll
[2009/07/16 18:12:55 | 00,312,832 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_aqueue.dll
[2009/07/16 18:12:55 | 00,045,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_aqadmin.dll
[2009/07/16 18:12:55 | 00,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0804.dll
[2009/07/16 18:12:55 | 00,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0412.dll
[2009/07/16 18:12:55 | 00,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0411.dll
[2009/07/16 18:12:54 | 00,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt040d.dll
[2009/07/16 18:12:54 | 00,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0404.dll
[2009/07/16 18:12:54 | 00,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0401.dll
[2009/07/16 18:12:54 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_adsiisex.dll
[2009/07/16 18:12:48 | 00,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tcptsat.dll
[2009/07/16 18:12:47 | 02,134,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_smtpsnap.dll
[2009/07/16 18:12:47 | 00,175,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_smtpadm.dll
[2009/07/16 18:12:47 | 00,032,827 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tcptest.exe
[2009/07/16 18:12:46 | 00,020,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\shtml.dll
[2009/07/16 18:12:46 | 00,016,437 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\shtml.exe
[2009/07/16 18:12:42 | 00,598,071 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpmmc.dll
[2009/07/16 18:12:42 | 00,208,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpmmcsat.dll
[2009/07/16 18:12:42 | 00,020,541 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpexedll.dll
[2009/07/16 18:12:42 | 00,020,538 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpremadm.exe
[2009/07/16 18:12:41 | 00,872,557 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4awel.dll
[2009/07/16 18:12:41 | 00,188,494 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpcount.exe
[2009/07/16 18:12:41 | 00,127,034 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4areg.dll
[2009/07/16 18:12:41 | 00,109,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp98swin.exe
[2009/07/16 18:12:41 | 00,102,509 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4atxt.dll
[2009/07/16 18:12:41 | 00,049,212 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4awebs.dll
[2009/07/16 18:12:41 | 00,041,020 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4avnb.dll
[2009/07/16 18:12:41 | 00,032,826 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4avss.dll
[2009/07/16 18:12:41 | 00,014,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp98sadm.exe
[2009/07/16 18:12:40 | 00,188,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cfgwiz.exe
[2009/07/16 18:12:40 | 00,184,435 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4amsft.dll
[2009/07/16 18:12:40 | 00,147,513 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4apws.dll
[2009/07/16 18:12:40 | 00,082,035 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4anscp.dll
[2009/07/16 18:12:39 | 00,020,540 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\author.dll
[2009/07/16 18:12:39 | 00,016,439 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\author.exe
[2009/07/16 18:12:39 | 00,016,439 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\admin.exe
[2009/07/16 18:12:38 | 00,020,540 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\admin.dll
[2009/07/16 18:12:31 | 00,000,000 | —D | C] – C:\WINDOWS\System32\xircom
[2009/07/16 18:12:31 | 00,000,000 | —D | C] – C:\Program Files\xerox
[2009/07/16 18:12:31 | 00,000,000 | —D | C] – C:\Program Files\microsoft frontpage
[2009/07/16 18:12:14 | 00,002,577 | —- | C] () – C:\WINDOWS\System32\CONFIG.NT
[2009/07/16 18:12:14 | 00,000,000 | RHS- | C] () – C:\MSDOS.SYS
[2009/07/16 18:12:14 | 00,000,000 | RHS- | C] () – C:\IO.SYS
[2009/07/16 18:12:14 | 00,000,000 | —- | C] () – C:\CONFIG.SYS
[2009/07/16 18:12:14 | 00,000,000 | —- | C] () – C:\AUTOEXEC.BAT
[2009/07/16 18:12:12 | 00,025,065 | —- | C] () – C:\WINDOWS\System32\wmpscheme.xml
[2009/07/16 18:12:12 | 00,023,392 | —- | C] () – C:\WINDOWS\System32\nscompat.tlb
[2009/07/16 18:12:12 | 00,016,832 | —- | C] () – C:\WINDOWS\System32\amcompat.tlb
[2009/07/16 18:12:11 | 00,299,552 | —- | C] () – C:\WINDOWS\WMSysPrx.prx
[2009/07/16 18:12:02 | 00,000,006 | -H– | C] () – C:\WINDOWS\tasks\SA.DAT
[2009/07/16 18:11:58 | 00,112,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mapi32.dll
[2009/07/16 18:10:55 | 00,000,488 | RH– | C] () – C:\WINDOWS\System32\WindowsLogon.manifest
[2009/07/16 18:10:55 | 00,000,488 | RH– | C] () – C:\WINDOWS\System32\logonui.exe.manifest
[2009/07/16 18:10:55 | 00,000,000 | –SD | C] – C:\WINDOWS\Downloaded Program Files
[2009/07/16 18:10:55 | 00,000,000 | R–D | C] – C:\WINDOWS\Offline Web Pages
[2009/07/16 18:10:49 | 00,000,749 | RH– | C] () – C:\WINDOWS\WindowsShell.Manifest
[2009/07/16 18:10:49 | 00,000,749 | RH– | C] () – C:\WINDOWS\System32\wuaucpl.cpl.manifest
[2009/07/16 18:10:49 | 00,000,749 | RH– | C] () – C:\WINDOWS\System32\sapi.cpl.manifest
[2009/07/16 18:10:49 | 00,000,749 | RH– | C] () – C:\WINDOWS\System32\nwc.cpl.manifest
[2009/07/16 18:10:49 | 00,000,749 | RH– | C] () – C:\WINDOWS\System32\ncpa.cpl.manifest
[2009/07/16 18:10:49 | 00,000,749 | RH– | C] () – C:\WINDOWS\System32\cdplayer.exe.manifest
[2009/07/16 18:10:29 | 04,399,505 | —- | C] () – C:\WINDOWS\System32\dllcache\nls302en.lex
[2009/07/16 18:10:29 | 00,106,562 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\srchctls.dll
[2009/07/16 18:10:28 | 03,346,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msgr3en.dll
[2009/07/16 18:10:23 | 00,000,000 | —D | C] – C:\WINDOWS\System32\DirectX
[2009/07/16 18:10:06 | 00,028,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msobshel.dll
[2009/07/16 18:10:06 | 00,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msobweb.dll
[2009/07/16 18:10:06 | 00,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msobdl.dll
[2009/07/16 18:10:05 | 00,028,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msoobe.exe
[2009/07/16 18:10:04 | 00,138,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\uploadm.exe
[2009/07/16 18:10:04 | 00,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\safrslv.dll
[2009/07/16 18:10:04 | 00,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\safrslv.dll
[2009/07/16 18:10:04 | 00,039,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\safrcdlg.dll
[2009/07/16 18:10:04 | 00,039,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\safrcdlg.dll
[2009/07/16 18:10:04 | 00,033,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\racpldlg.dll
[2009/07/16 18:10:04 | 00,033,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\racpldlg.dll
[2009/07/16 18:10:04 | 00,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\safrdm.dll
[2009/07/16 18:10:04 | 00,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\safrdm.dll
[2009/07/16 18:10:03 | 00,348,160 | —- | C] () – C:\WINDOWS\System32\dllcache\msinfo.dll
[2009/07/16 18:10:03 | 00,099,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\helphost.exe
[2009/07/16 18:10:03 | 00,035,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\notiflag.exe
[2009/07/16 18:10:03 | 00,021,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\brpinfo.dll
[2009/07/16 18:10:03 | 00,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\atrace.dll
[2009/07/16 18:10:03 | 00,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\atrace.dll
[2009/07/16 18:10:03 | 00,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hcappres.dll
[2009/07/16 18:10:02 | 00,048,680 | -HS- | C] () – C:\WINDOWS\winnt256.bmp
[2009/07/16 18:10:02 | 00,048,680 | -HS- | C] () – C:\WINDOWS\winnt.bmp
[2009/07/16 18:09:57 | 00,047,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\srdiag.exe
[2009/07/16 18:09:57 | 00,028,672 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\isrdbg32.dll
[2009/07/16 18:09:57 | 00,028,672 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\isrdbg32.dll
[2009/07/16 18:09:57 | 00,000,984 | —- | C] () – C:\WINDOWS\System32\dllcache\srframe.mmf
[2009/07/16 18:09:56 | 00,118,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msg723.acm
[2009/07/16 18:09:56 | 00,045,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\confmrsl.dll
[2009/07/16 18:09:56 | 00,039,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msinfo32.exe
[2009/07/16 18:09:56 | 00,032,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mnmsrvc.exe
[2009/07/16 18:09:56 | 00,032,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mnmsrvc.exe
[2009/07/16 18:09:56 | 00,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\nmevtmsg.dll
[2009/07/16 18:09:56 | 00,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wb32.exe
[2009/07/16 18:09:56 | 00,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nmevtmsg.dll
[2009/07/16 18:09:56 | 00,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cb32.exe
[2009/07/16 18:09:55 | 00,076,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wabimp.dll
[2009/07/16 18:09:55 | 00,064,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\acctres.dll
[2009/07/16 18:09:55 | 00,064,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\acctres.dll
[2009/07/16 18:09:55 | 00,043,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wab.exe
[2009/07/16 18:09:55 | 00,030,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wabfind.dll
[2009/07/16 18:09:55 | 00,027,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wabmig.exe
[2009/07/16 18:09:55 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Services
[2009/07/16 18:09:54 | 00,076,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\directdb.dll
[2009/07/16 18:09:54 | 00,047,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\inetres.dll
[2009/07/16 18:09:54 | 00,047,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetres.dll
[2009/07/16 18:09:53 | 00,092,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\oeimport.dll
[2009/07/16 18:09:52 | 02,479,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msoeres.dll
[2009/07/16 18:09:52 | 00,077,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\isign32.dll
[2009/07/16 18:09:52 | 00,077,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\isign32.dll
[2009/07/16 18:09:52 | 00,069,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\icwdial.dll
[2009/07/16 18:09:52 | 00,069,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icwdial.dll
[2009/07/16 18:09:52 | 00,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\icwphbk.dll
[2009/07/16 18:09:52 | 00,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icwphbk.dll
[2009/07/16 18:09:52 | 00,055,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\oemig50.exe
[2009/07/16 18:09:52 | 00,032,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\oemiglib.dll
[2009/07/16 18:09:52 | 00,000,000 | –SD | C] – C:\WINDOWS\Tasks
[2009/07/16 18:09:51 | 00,266,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\inetcfg.dll
[2009/07/16 18:09:51 | 00,266,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetcfg.dll
[2009/07/16 18:09:51 | 00,155,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icwhelp.dll
[2009/07/16 18:09:51 | 00,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icwres.dll
[2009/07/16 18:09:51 | 00,057,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icwconn.dll
[2009/07/16 18:09:51 | 00,045,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icwutil.dll
[2009/07/16 18:09:51 | 00,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\trialoc.dll
[2009/07/16 18:09:51 | 00,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icwrmind.exe
[2009/07/16 18:09:51 | 00,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icwdl.dll
[2009/07/16 18:09:51 | 00,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\icfgnt5.dll
[2009/07/16 18:09:51 | 00,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icfgnt5.dll
[2009/07/16 18:09:50 | 00,557,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dao360.dll
[2009/07/16 18:09:50 | 00,235,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mssoap1.dll
[2009/07/16 18:09:50 | 00,077,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icwconn2.exe
[2009/07/16 18:09:50 | 00,073,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icwtutor.exe
[2009/07/16 18:09:50 | 00,065,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\oledb32r.dll
[2009/07/16 18:09:50 | 00,025,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wisc10.dll
[2009/07/16 18:09:50 | 00,023,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mssoapr.dll
[2009/07/16 18:09:50 | 00,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetwiz.exe
[2009/07/16 18:09:50 | 00,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\isignup.exe
[2009/07/16 18:09:50 | 00,000,000 | —D | C] – C:\Program Files\Common Files\MSSoap
[2009/07/16 18:09:49 | 00,093,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieinfo5.ocx
[2009/07/16 18:09:49 | 00,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msader15.dll
[2009/07/16 18:09:49 | 00,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msaddsr.dll
[2009/07/16 18:09:49 | 00,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadcer.dll
[2009/07/16 18:09:49 | 00,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdasqlr.dll
[2009/07/16 18:09:49 | 00,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdaremr.dll
[2009/07/16 18:09:49 | 00,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdaprsr.dll
[2009/07/16 18:09:49 | 00,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdaorar.dll
[2009/07/16 18:09:49 | 00,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadcor.dll
[2009/07/16 18:09:49 | 00,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadcfr.dll
[2009/07/16 18:09:47 | 00,802,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vgx.dll
[2009/07/16 18:09:47 | 00,798,782 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\srchui.dll
[2009/07/16 18:09:47 | 00,000,000 | —D | C] – C:\WINDOWS\srchasst
[2009/07/16 18:09:46 | 00,520,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmpvis.dll
[2009/07/16 18:09:46 | 00,294,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dlimport.exe
[2009/07/16 18:09:46 | 00,221,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\qmgr.dll
[2009/07/16 18:09:46 | 00,221,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\qmgr.dll
[2009/07/16 18:09:46 | 00,017,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\qmgrprxy.dll
[2009/07/16 18:09:46 | 00,017,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\qmgrprxy.dll
[2009/07/16 18:09:46 | 00,000,000 | —D | C] – C:\WINDOWS\System32\Macromed
[2009/07/16 18:09:45 | 00,536,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msobmain.dll
[2009/07/16 18:09:45 | 00,319,542 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmmres.dll
[2009/07/16 18:09:45 | 00,163,897 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmmutil.dll
[2009/07/16 18:09:45 | 00,112,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msobcomm.dll
[2009/07/16 18:09:45 | 00,110,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmmfilt.dll
[2009/07/16 18:09:45 | 00,000,000 | —D | C] – C:\Program Files\Movie Maker
[2009/07/16 18:09:44 | 00,097,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pchshell.dll
[2009/07/16 18:09:44 | 00,049,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\oobebaln.exe
[2009/07/16 18:09:44 | 00,029,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pchsvc.dll
[2009/07/16 18:09:43 | 00,145,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msconfig.exe
[2009/07/16 18:09:42 | 00,742,400 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\helpctr.exe
[2009/07/16 18:09:42 | 00,703,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\helpsvc.exe
[2009/07/16 18:09:42 | 00,370,688 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rstrui.exe
[2009/07/16 18:09:42 | 00,226,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\srrstr.dll
[2009/07/16 18:09:42 | 00,226,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\srrstr.dll
[2009/07/16 18:09:42 | 00,158,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\srsvc.dll
[2009/07/16 18:09:42 | 00,158,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\srsvc.dll
[2009/07/16 18:09:42 | 00,069,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\sr.sys
[2009/07/16 18:09:42 | 00,069,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sr.sys
[2009/07/16 18:09:42 | 00,063,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\srclient.dll
[2009/07/16 18:09:42 | 00,063,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\srclient.dll
[2009/07/16 18:09:42 | 00,000,000 | —D | C] – C:\WINDOWS\System32\Restore
[2009/07/16 18:09:42 | 00,000,000 | —D | C] – C:\WINDOWS\PCHealth
[2009/07/16 18:09:41 | 00,364,544 | —- | C] (Microsoft Corporation (written by Digital Renaissance Inc.)) – C:\WINDOWS\System32\dllcache\npdsplay.dll
[2009/07/16 18:09:41 | 00,217,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nmas.dll
[2009/07/16 18:09:41 | 00,184,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msh261.drv
[2009/07/16 18:09:41 | 00,073,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ils.dll
[2009/07/16 18:09:41 | 00,073,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ils.dll
[2009/07/16 18:09:41 | 00,065,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msconf.dll
[2009/07/16 18:09:41 | 00,065,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msconf.dll
[2009/07/16 18:09:41 | 00,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dcap32.dll
[2009/07/16 18:09:41 | 00,032,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mnmdd.dll
[2009/07/16 18:09:41 | 00,032,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mnmdd.dll
[2009/07/16 18:09:41 | 00,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\nmmkcert.dll
[2009/07/16 18:09:41 | 00,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nmmkcert.dll
[2009/07/16 18:09:41 | 00,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nmasnt.dll
[2009/07/16 18:09:41 | 00,004,639 | —- | C] () – C:\WINDOWS\System32\dllcache\mplayer2.exe
[2009/07/16 18:09:40 | 00,360,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\callcont.dll
[2009/07/16 18:09:40 | 00,249,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mst120.dll
[2009/07/16 18:09:40 | 00,208,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nac.dll
[2009/07/16 18:09:40 | 00,180,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nmwb.dll
[2009/07/16 18:09:40 | 00,163,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nmoldwb.dll
[2009/07/16 18:09:40 | 00,143,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nmft.dll
[2009/07/16 18:09:40 | 00,077,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nmchat.dll
[2009/07/16 18:09:40 | 00,069,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nmcom.dll
[2009/07/16 18:09:40 | 00,057,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rrcm.dll
[2009/07/16 18:09:40 | 00,053,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\h323cc.dll
[2009/07/16 18:09:40 | 00,049,152 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mst123.dll
[2009/07/16 18:09:39 | 00,995,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\conf.exe
[2009/07/16 18:09:39 | 00,587,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\inetcomm.dll
[2009/07/16 18:09:39 | 00,587,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetcomm.dll
[2009/07/16 18:09:39 | 00,459,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wab32.dll
[2009/07/16 18:09:39 | 00,249,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wab32res.dll
[2009/07/16 18:09:39 | 00,228,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msoeacct.dll
[2009/07/16 18:09:39 | 00,228,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msoeacct.dll
[2009/07/16 18:09:39 | 00,081,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msoert2.dll
[2009/07/16 18:09:39 | 00,081,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msoert2.dll
[2009/07/16 18:09:39 | 00,057,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msimn.exe
[2009/07/16 18:09:39 | 00,000,000 | —D | C] – C:\Program Files\NetMeeting
[2009/07/16 18:09:38 | 01,174,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msoe.dll
[2009/07/16 18:09:38 | 00,250,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mstask.dll
[2009/07/16 18:09:38 | 00,250,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mstask.dll
[2009/07/16 18:09:38 | 00,159,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\schedsvc.dll
[2009/07/16 18:09:38 | 00,159,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\schedsvc.dll
[2009/07/16 18:09:38 | 00,067,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\setup50.exe
[2009/07/16 18:09:38 | 00,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mstinit.exe
[2009/07/16 18:09:38 | 00,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mstinit.exe
[2009/07/16 18:09:38 | 00,000,000 | —D | C] – C:\Program Files\Outlook Express
[2009/07/16 18:09:36 | 00,208,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icwconn1.exe
[2009/07/16 18:09:36 | 00,196,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sqlxmlx.dll
[2009/07/16 18:09:35 | 00,413,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\oledb32.dll
[2009/07/16 18:09:35 | 00,303,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdasql.dll
[2009/07/16 18:09:35 | 00,221,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdaora.dll
[2009/07/16 18:09:35 | 00,188,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdaps.dll
[2009/07/16 18:09:35 | 00,180,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadox.dll
[2009/07/16 18:09:35 | 00,090,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msjro.dll
[2009/07/16 18:09:35 | 00,086,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdatl3.dll
[2009/07/16 18:09:35 | 00,073,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdaosp.dll
[2009/07/16 18:09:35 | 00,053,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadrh15.dll
[2009/07/16 18:09:35 | 00,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msxactps.dll
[2009/07/16 18:09:35 | 00,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdatt.dll
[2009/07/16 18:09:35 | 00,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdaurl.dll
[2009/07/16 18:09:35 | 00,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdasc.dll
[2009/07/16 18:09:35 | 00,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdaer.dll
[2009/07/16 18:09:35 | 00,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdaenum.dll
[2009/07/16 18:09:35 | 00,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdadc.dll
[2009/07/16 18:09:34 | 00,487,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msado15.dll
[2009/07/16 18:09:34 | 00,307,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadce.dll
[2009/07/16 18:09:34 | 00,180,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdaprst.dll
[2009/07/16 18:09:34 | 00,159,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadomd.dll
[2009/07/16 18:09:34 | 00,147,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadds.dll
[2009/07/16 18:09:34 | 00,146,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\triedit.dll
[2009/07/16 18:09:34 | 00,131,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadco.dll
[2009/07/16 18:09:34 | 00,117,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dhtmled.ocx
[2009/07/16 18:09:34 | 00,110,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdarem.dll
[2009/07/16 18:09:34 | 00,081,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msado26.tlb
[2009/07/16 18:09:34 | 00,081,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msado25.tlb
[2009/07/16 18:09:34 | 00,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msado21.tlb
[2009/07/16 18:09:34 | 00,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msado20.tlb
[2009/07/16 18:09:34 | 00,057,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadcf.dll
[2009/07/16 18:09:34 | 00,053,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadcs.dll
[2009/07/16 18:09:34 | 00,049,152 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msador15.dll
[2009/07/16 18:09:34 | 00,032,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdfmap.dll
[2009/07/16 18:09:34 | 00,000,000 | —D | C] – C:\Program Files\Common Files\System
[2009/07/16 18:09:33 | 00,091,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iexplore.exe
[2009/07/16 18:09:33 | 00,036,352 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hmmapi.dll
[2009/07/16 18:09:31 | 00,000,000 | —D | C] – C:\Program Files\Internet Explorer
[2009/07/16 18:09:28 | 00,000,000 | R–D | C] – C:\Documents and Settings\All Users\Documents\My Pictures
[2009/07/16 18:09:28 | 00,000,000 | R–D | C] – C:\Documents and Settings\All Users\Documents\My Music
[2009/07/16 18:09:26 | 00,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2009/07/16 18:09:14 | 00,000,000 | —D | C] – C:\Program Files\ComPlus Applications
[2009/07/16 18:09:06 | 00,000,000 | —D | C] – C:\WINDOWS\Registration
[2009/07/16 18:08:34 | 00,000,000 | -H-D | C] – C:\Program Files\WindowsUpdate
[2009/07/16 18:08:34 | 00,000,000 | —D | C] – C:\Program Files\Windows Media Player
[2009/07/16 18:08:34 | 00,000,000 | —D | C] – C:\Program Files\Online Services
[2009/07/16 18:08:28 | 00,000,000 | —D | C] – C:\Program Files\Messenger
[2009/07/16 18:08:27 | 00,042,577 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\bckgzm.exe
[2009/07/16 18:08:26 | 02,178,131 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\shvlres.dll
[2009/07/16 18:08:26 | 01,817,687 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\bckgres.dll
[2009/07/16 18:08:26 | 00,780,885 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chkrres.dll
[2009/07/16 18:08:26 | 00,753,236 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rvseres.dll
[2009/07/16 18:08:26 | 00,082,501 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\bckg.dll
[2009/07/16 18:08:26 | 00,066,113 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\shvl.dll
[2009/07/16 18:08:26 | 00,048,706 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rvse.dll
[2009/07/16 18:08:26 | 00,042,575 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chkrzm.exe
[2009/07/16 18:08:26 | 00,042,574 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rvsezm.exe
[2009/07/16 18:08:26 | 00,042,573 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\shvlzm.exe
[2009/07/16 18:08:26 | 00,042,573 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hrtzzm.exe
[2009/07/16 18:08:26 | 00,040,515 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chkr.dll
[2009/07/16 18:08:25 | 01,175,635 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hrtzres.dll
[2009/07/16 18:08:25 | 01,039,955 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cmnresm.dll
[2009/07/16 18:08:25 | 00,217,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cmnclim.dll
[2009/07/16 18:08:25 | 00,113,222 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\zoneclim.dll
[2009/07/16 18:08:25 | 00,057,409 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hrtz.dll
[2009/07/16 18:08:25 | 00,041,029 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\zcorem.dll
[2009/07/16 18:08:25 | 00,032,339 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\uniansi.dll
[2009/07/16 18:08:25 | 00,013,894 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\zonelibm.dll
[2009/07/16 18:08:25 | 00,004,677 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\zeeverm.dll
[2009/07/16 18:08:24 | 00,036,937 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\zclientm.exe
[2009/07/16 18:08:24 | 00,029,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\znetm.dll
[2009/07/16 18:08:24 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\write.exe
[2009/07/16 18:08:24 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\write.exe
[2009/07/16 18:08:24 | 00,000,000 | —D | C] – C:\Program Files\MSN Gaming Zone
[2009/07/16 18:08:22 | 00,272,896 | —- | C] (Cinematronics) – C:\WINDOWS\System32\dllcache\pinball.exe
[2009/07/16 18:08:18 | 00,179,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\accwiz.exe
[2009/07/16 18:08:18 | 00,179,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\accwiz.exe
[2009/07/16 18:08:18 | 00,138,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sndvol32.exe
[2009/07/16 18:08:18 | 00,138,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sndvol32.exe
[2009/07/16 18:08:18 | 00,124,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sndrec32.exe
[2009/07/16 18:08:18 | 00,124,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sndrec32.exe
[2009/07/16 18:08:18 | 00,066,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\access.cpl
[2009/07/16 18:08:18 | 00,066,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\access.cpl
[2009/07/16 18:08:17 | 00,522,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dialer.exe
[2009/07/16 18:08:17 | 00,489,984 | —- | C] (Hilgraeve, Inc.) – C:\WINDOWS\System32\hypertrm.dll
[2009/07/16 18:08:17 | 00,227,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\avtapi.dll
[2009/07/16 18:08:17 | 00,227,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\avtapi.dll
[2009/07/16 18:08:17 | 00,073,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\avwav.dll
[2009/07/16 18:08:17 | 00,073,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\avwav.dll
[2009/07/16 18:08:17 | 00,044,544 | —- | C] (Hilgraeve, Inc.) – C:\WINDOWS\System32\hticons.dll
[2009/07/16 18:08:17 | 00,035,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\winchat.exe
[2009/07/16 18:08:17 | 00,035,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winchat.exe
[2009/07/16 18:08:17 | 00,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\avmeter.dll
[2009/07/16 18:08:17 | 00,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\avmeter.dll
[2009/07/16 18:08:17 | 00,013,312 | —- | C] (Hilgraeve, Inc.) – C:\WINDOWS\System32\dllcache\htrn_jis.dll
[2009/07/16 18:08:13 | 00,065,978 | —- | C] () – C:\WINDOWS\Soap Bubbles.bmp
[2009/07/16 18:08:13 | 00,065,954 | —- | C] () – C:\WINDOWS\Prairie Wind.bmp
[2009/07/16 18:08:13 | 00,065,832 | —- | C] () – C:\WINDOWS\Santa Fe Stucco.bmp
[2009/07/16 18:08:13 | 00,026,680 | —- | C] () – C:\WINDOWS\River Sumida.bmp
[2009/07/16 18:08:13 | 00,026,582 | —- | C] () – C:\WINDOWS\Greenstone.bmp
[2009/07/16 18:08:13 | 00,017,362 | —- | C] () – C:\WINDOWS\Rhododendron.bmp
[2009/07/16 18:08:13 | 00,017,336 | —- | C] () – C:\WINDOWS\Gone Fishing.bmp
[2009/07/16 18:08:13 | 00,017,062 | —- | C] () – C:\WINDOWS\Coffee Bean.bmp
[2009/07/16 18:08:13 | 00,016,730 | —- | C] () – C:\WINDOWS\FeatherTexture.bmp
[2009/07/16 18:08:13 | 00,009,522 | —- | C] () – C:\WINDOWS\Zapotec.bmp
[2009/07/16 18:08:13 | 00,001,272 | —- | C] () – C:\WINDOWS\Blue Lace 16.bmp
[2009/07/16 18:08:12 | 00,605,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\getuname.dll
[2009/07/16 18:08:12 | 00,605,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\getuname.dll
[2009/07/16 18:08:12 | 00,114,688 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\calc.exe
[2009/07/16 18:08:12 | 00,114,688 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\calc.exe
[2009/07/16 18:08:12 | 00,093,702 | —- | C] () – C:\WINDOWS\System32\subrange.uce
[2009/07/16 18:08:12 | 00,080,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\charmap.exe
[2009/07/16 18:08:12 | 00,080,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\charmap.exe
[2009/07/16 18:08:12 | 00,060,458 | —- | C] () – C:\WINDOWS\System32\ideograf.uce
[2009/07/16 18:08:12 | 00,024,006 | —- | C] () – C:\WINDOWS\System32\gb2312.uce
[2009/07/16 18:08:12 | 00,022,984 | —- | C] () – C:\WINDOWS\System32\bopomofo.uce
[2009/07/16 18:08:12 | 00,016,740 | —- | C] () – C:\WINDOWS\System32\shiftjis.uce
[2009/07/16 18:08:12 | 00,012,876 | —- | C] () – C:\WINDOWS\System32\korean.uce
[2009/07/16 18:08:12 | 00,008,484 | —- | C] () – C:\WINDOWS\System32\kanji_2.uce
[2009/07/16 18:08:12 | 00,006,948 | —- | C] () – C:\WINDOWS\System32\kanji_1.uce
[2009/07/16 18:08:11 | 00,126,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mshearts.exe
[2009/07/16 18:08:11 | 00,126,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mshearts.exe
[2009/07/16 18:08:11 | 00,119,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\winmine.exe
[2009/07/16 18:08:11 | 00,119,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winmine.exe
[2009/07/16 18:08:11 | 00,061,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rdshost.exe
[2009/07/16 18:08:11 | 00,061,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rdshost.exe
[2009/07/16 18:08:11 | 00,056,832 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sol.exe
[2009/07/16 18:08:11 | 00,056,832 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sol.exe
[2009/07/16 18:08:11 | 00,055,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\freecell.exe
[2009/07/16 18:08:11 | 00,055,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\freecell.exe
[2009/07/16 18:08:11 | 00,020,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\tdtcp.sys
[2009/07/16 18:08:11 | 00,020,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tdtcp.sys
[2009/07/16 18:08:11 | 00,011,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\tdpipe.sys
[2009/07/16 18:08:11 | 00,011,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tdpipe.sys
[2009/07/16 18:08:11 | 00,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\reset.exe
[2009/07/16 18:08:11 | 00,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\reset.exe
[2009/07/16 18:08:11 | 00,001,161 | —- | C] () – C:\WINDOWS\System32\usrlogon.cmd
[2009/07/16 18:08:10 | 00,151,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msdtcuiu.dll
[2009/07/16 18:08:10 | 00,151,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdtcuiu.dll
[2009/07/16 18:08:10 | 00,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\regini.exe
[2009/07/16 18:08:10 | 00,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\regini.exe
[2009/07/16 18:08:10 | 00,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\qwinsta.exe
[2009/07/16 18:08:10 | 00,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\qwinsta.exe
[2009/07/16 18:08:10 | 00,020,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msg.exe
[2009/07/16 18:08:10 | 00,020,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msg.exe
[2009/07/16 18:08:10 | 00,018,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\qprocess.exe
[2009/07/16 18:08:10 | 00,018,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\qprocess.exe
[2009/07/16 18:08:10 | 00,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tsshutdn.exe
[2009/07/16 18:08:10 | 00,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\qappsrv.exe
[2009/07/16 18:08:10 | 00,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tsshutdn.exe
[2009/07/16 18:08:10 | 00,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\qappsrv.exe
[2009/07/16 18:08:10 | 00,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tskill.exe
[2009/07/16 18:08:10 | 00,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tskill.exe
[2009/07/16 18:08:10 | 00,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rwinsta.exe
[2009/07/16 18:08:10 | 00,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rwinsta.exe
[2009/07/16 18:08:10 | 00,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cdmodem.dll
[2009/07/16 18:08:10 | 00,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cdmodem.dll
[2009/07/16 18:08:10 | 00,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\logoff.exe
[2009/07/16 18:08:10 | 00,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\logoff.exe
[2009/07/16 18:08:10 | 00,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tsdiscon.exe
[2009/07/16 18:08:10 | 00,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tscon.exe
[2009/07/16 18:08:10 | 00,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\shadow.exe
[2009/07/16 18:08:10 | 00,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tsdiscon.exe
[2009/07/16 18:08:10 | 00,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tscon.exe
[2009/07/16 18:08:10 | 00,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\shadow.exe
[2009/07/16 18:08:10 | 00,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rdpcfgex.dll
[2009/07/16 18:08:10 | 00,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rdpcfgex.dll
[2009/07/16 18:08:10 | 00,003,286 | —- | C] () – C:\WINDOWS\System32\tslabels.h
[2009/07/16 18:08:09 | 00,869,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msdtctm.dll
[2009/07/16 18:08:09 | 00,869,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdtctm.dll
[2009/07/16 18:08:09 | 00,083,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mtxoci.dll
[2009/07/16 18:08:09 | 00,083,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mtxoci.dll
[2009/07/16 18:08:09 | 00,054,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msdtclog.dll
[2009/07/16 18:08:09 | 00,054,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdtclog.dll
[2009/07/16 18:08:09 | 00,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mtsadmin.tlb
[2009/07/16 18:08:09 | 00,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xolehlp.dll
[2009/07/16 18:08:09 | 00,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xolehlp.dll
[2009/07/16 18:08:09 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msdtc.exe
[2009/07/16 18:08:09 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdtc.exe
[2009/07/16 18:08:09 | 00,000,768 | —- | C] () – C:\WINDOWS\System32\msdtcprf.h
[2009/07/16 18:08:08 | 00,215,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\catsrv.dll
[2009/07/16 18:08:08 | 00,215,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\catsrv.dll
[2009/07/16 18:08:08 | 00,100,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\clbcatex.dll
[2009/07/16 18:08:08 | 00,100,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\clbcatex.dll
[2009/07/16 18:08:08 | 00,085,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\catsrvps.dll
[2009/07/16 18:08:08 | 00,085,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\catsrvps.dll
[2009/07/16 18:08:08 | 00,082,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comrepl.dll
[2009/07/16 18:08:08 | 00,082,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\comrepl.dll
[2009/07/16 18:08:08 | 00,056,832 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\colbact.dll
[2009/07/16 18:08:08 | 00,056,832 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\colbact.dll
[2009/07/16 18:08:08 | 00,054,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\stclient.dll
[2009/07/16 18:08:08 | 00,054,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\stclient.dll
[2009/07/16 18:08:08 | 00,025,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comaddin.dll
[2009/07/16 18:08:08 | 00,025,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\comaddin.dll
[2009/07/16 18:08:08 | 00,025,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mtxlegih.dll
[2009/07/16 18:08:08 | 00,025,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mtxlegih.dll
[2009/07/16 18:08:08 | 00,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mtxdm.dll
[2009/07/16 18:08:08 | 00,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mtxdm.dll
[2009/07/16 18:08:08 | 00,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comrepl.exe
[2009/07/16 18:08:08 | 00,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dcomcnfg.exe
[2009/07/16 18:08:08 | 00,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comrereg.exe
[2009/07/16 18:08:08 | 00,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dcomcnfg.exe
[2009/07/16 18:08:08 | 00,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mtxex.dll
[2009/07/16 18:08:08 | 00,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mtxex.dll
[2009/07/16 18:08:07 | 00,495,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comuid.dll
[2009/07/16 18:08:07 | 00,495,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\comuid.dll
[2009/07/16 18:08:07 | 00,468,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\clbcatq.dll
[2009/07/16 18:08:07 | 00,468,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\clbcatq.dll
[2009/07/16 18:08:07 | 00,147,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comsnap.dll
[2009/07/16 18:08:07 | 00,147,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\comsnap.dll
[2009/07/16 18:08:07 | 00,045,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmi2xml.dll
[2009/07/16 18:08:05 | 00,052,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmitimep.dll
[2009/07/16 18:08:04 | 00,183,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiadap.exe
[2009/07/16 18:08:04 | 00,183,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemcntl.dll
[2009/07/16 18:08:04 | 00,167,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemdisp.dll
[2009/07/16 18:08:04 | 00,157,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemtest.exe
[2009/07/16 18:08:04 | 00,125,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\viewprov.dll
[2009/07/16 18:08:04 | 00,124,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmipdskq.dll
[2009/07/16 18:08:04 | 00,117,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiapsrv.exe
[2009/07/16 18:08:04 | 00,116,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\updprov.dll
[2009/07/16 18:08:04 | 00,082,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiaprpl.dll
[2009/07/16 18:08:04 | 00,075,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmipicmp.dll
[2009/07/16 18:08:04 | 00,066,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemcons.dll
[2009/07/16 18:08:04 | 00,061,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tmplprov.dll
[2009/07/16 18:08:04 | 00,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmimsg.dll
[2009/07/16 18:08:04 | 00,059,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmipjobj.dll
[2009/07/16 18:08:04 | 00,059,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemdisp.tlb
[2009/07/16 18:08:04 | 00,059,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\trnsprov.dll
[2009/07/16 18:08:04 | 00,058,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmipiprt.dll
[2009/07/16 18:08:04 | 00,048,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemsvc.dll
[2009/07/16 18:08:04 | 00,031,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemads.tlb
[2009/07/16 18:08:04 | 00,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\unsecapp.exe
[2009/07/16 18:08:04 | 00,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winmgmtr.dll
[2009/07/16 18:08:04 | 00,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winmgmt.exe
[2009/07/16 18:08:04 | 00,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemads.dll
[2009/07/16 18:08:04 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiapres.dll
[2009/07/16 18:08:03 | 00,273,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msiprov.dll
[2009/07/16 18:08:03 | 00,226,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\provthrd.dll
[2009/07/16 18:08:03 | 00,203,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntevt.dll
[2009/07/16 18:08:03 | 00,174,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\framedyn.dll
[2009/07/16 18:08:03 | 00,120,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dsprov.dll
[2009/07/16 18:08:03 | 00,063,488 | —- | C] () – C:\WINDOWS\System32\wmimgmt.msc
[2009/07/16 18:08:03 | 00,053,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\servdeps.dll
[2009/07/16 18:08:03 | 00,053,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\servdeps.dll
[2009/07/16 18:08:03 | 00,053,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fwdprov.dll
[2009/07/16 18:08:03 | 00,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smtpcons.dll
[2009/07/16 18:08:03 | 00,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\scrcons.exe
[2009/07/16 18:08:03 | 00,023,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\krnlprov.dll
[2009/07/16 18:08:02 | 00,174,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cmprops.dll
[2009/07/16 18:08:02 | 00,174,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cmprops.dll
[2009/07/16 18:08:02 | 00,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mmfutil.dll
[2009/07/16 18:08:02 | 00,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mmfutil.dll
[2009/07/16 18:07:58 | 00,534,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spider.exe
[2009/07/16 18:07:58 | 00,534,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\spider.exe
[2009/07/16 18:07:58 | 00,339,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mspaint.exe
[2009/07/16 18:07:58 | 00,339,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mspaint.exe
[2009/07/16 18:07:58 | 00,200,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wordpad.exe
[2009/07/16 18:07:58 | 00,139,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wuauclt.exe
[2009/07/16 18:07:58 | 00,139,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wuauclt.exe
[2009/07/16 18:07:58 | 00,116,736 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mplay32.exe
[2009/07/16 18:07:58 | 00,116,736 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mplay32.exe
[2009/07/16 18:07:58 | 00,098,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\clipbrd.exe
[2009/07/16 18:07:58 | 00,098,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\clipbrd.exe
[2009/07/16 18:07:58 | 00,000,000 | —D | C] – C:\Program Files\Windows NT
[2009/07/16 18:07:58 | 00,000,000 | —D | C] – C:\Program Files\MSN
[2009/07/16 18:07:57 | 00,598,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mstscax.dll
[2009/07/16 18:07:57 | 00,598,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mstscax.dll
[2009/07/16 18:07:57 | 00,388,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mstsc.exe
[2009/07/16 18:07:57 | 00,388,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mstsc.exe
[2009/07/16 18:07:57 | 00,189,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wuaueng.dll
[2009/07/16 18:07:57 | 00,189,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wuaueng.dll
[2009/07/16 18:07:57 | 00,135,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rdchost.dll
[2009/07/16 18:07:57 | 00,135,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rdchost.dll
[2009/07/16 18:07:57 | 00,129,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sessmgr.exe
[2009/07/16 18:07:57 | 00,129,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sessmgr.exe
[2009/07/16 18:07:57 | 00,115,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\rdpwd.sys
[2009/07/16 18:07:57 | 00,115,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rdpwd.sys
[2009/07/16 18:07:57 | 00,088,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tscfgwmi.dll
[2009/07/16 18:07:57 | 00,088,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tscfgwmi.dll
[2009/07/16 18:07:57 | 00,056,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\remotepg.dll
[2009/07/16 18:07:57 | 00,056,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\remotepg.dll
[2009/07/16 18:07:57 | 00,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rdsaddin.exe
[2009/07/16 18:07:57 | 00,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rdsaddin.exe
[2009/07/16 18:07:57 | 00,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wuauserv.dll
[2009/07/16 18:07:57 | 00,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wuauserv.dll
[2009/07/16 18:07:56 | 00,582,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\catsrvut.dll
[2009/07/16 18:07:56 | 00,582,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\catsrvut.dll
[2009/07/16 18:07:56 | 00,359,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msdtcprx.dll
[2009/07/16 18:07:56 | 00,359,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdtcprx.dll
[2009/07/16 18:07:56 | 00,200,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\termsrv.dll
[2009/07/16 18:07:56 | 00,200,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\termsrv.dll
[2009/07/16 18:07:56 | 00,186,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comadmin.dll
[2009/07/16 18:07:56 | 00,075,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rdpwsx.dll
[2009/07/16 18:07:56 | 00,075,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rdpwsx.dll
[2009/07/16 18:07:56 | 00,044,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rdpclip.exe
[2009/07/16 18:07:56 | 00,044,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rdpclip.exe
[2009/07/16 18:07:56 | 00,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tscupgrd.exe
[2009/07/16 18:07:56 | 00,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tscupgrd.exe
[2009/07/16 18:07:56 | 00,032,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cfgbkend.dll
[2009/07/16 18:07:56 | 00,032,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cfgbkend.dll
[2009/07/16 18:07:56 | 00,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rdpsnd.dll
[2009/07/16 18:07:56 | 00,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rdpsnd.dll
[2009/07/16 18:07:56 | 00,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\icaapi.dll
[2009/07/16 18:07:56 | 00,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icaapi.dll
[2009/07/16 18:07:56 | 00,000,000 | —D | C] – C:\WINDOWS\System32\MsDtc
[2009/07/16 18:07:56 | 00,000,000 | —D | C] – C:\WINDOWS\System32\Com
[2009/07/16 18:07:55 | 01,172,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comsvcs.dll
[2009/07/16 18:07:55 | 01,172,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\comsvcs.dll
[2009/07/16 18:07:55 | 00,408,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiprvsd.dll
[2009/07/16 18:07:55 | 00,203,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiprvse.exe
[2009/07/16 18:07:55 | 00,149,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmipcima.dll
[2009/07/16 18:07:55 | 00,138,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmidcprv.dll
[2009/07/16 18:07:55 | 00,122,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiprov.dll
[2009/07/16 18:07:55 | 00,101,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmisvc.dll
[2009/07/16 18:07:55 | 00,096,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiutils.dll
[2009/07/16 18:07:55 | 00,038,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmipsess.dll
[2009/07/16 18:07:54 | 00,565,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fastprox.dll
[2009/07/16 18:07:54 | 00,480,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemcore.dll
[2009/07/16 18:07:54 | 00,259,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemess.dll
[2009/07/16 18:07:54 | 00,235,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\esscli.dll
[2009/07/16 18:07:54 | 00,215,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemcomn.dll
[2009/07/16 18:07:54 | 00,138,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\repdrvfs.dll
[2009/07/16 18:07:54 | 00,111,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemupgd.dll
[2009/07/16 18:07:54 | 00,104,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mofd.dll
[2009/07/16 18:07:54 | 00,080,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\stdprov.dll
[2009/07/16 18:07:54 | 00,060,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ncprov.dll
[2009/07/16 18:07:54 | 00,055,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmicookr.dll
[2009/07/16 18:07:54 | 00,028,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemprox.dll
[2009/07/16 18:07:54 | 00,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mofcomp.exe
[2009/07/16 18:07:53 | 01,267,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cimwin32.dll
[2009/07/16 18:07:53 | 00,057,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\licwmi.dll
[2009/07/16 18:07:53 | 00,057,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\licwmi.dll
[2009/07/16 18:07:48 | 00,182,400 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\rdpdr.sys
[2009/07/16 18:07:48 | 00,038,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\termdd.sys
[2009/07/16 14:04:41 | 00,003,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\audstub.sys
[2009/07/16 14:04:29 | 00,016,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\MODEMCSA.sys
[2009/07/16 14:04:16 | 00,056,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\redbook.sys
[2009/07/16 14:04:14 | 00,024,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\usbprint.sys
[2009/07/16 14:03:45 | 00,871,388 | —- | C] (BCM) – C:\WINDOWS\System32\drivers\BCMDM.sys
[2009/07/16 14:02:12 | 00,001,374 | —- | C] () – C:\WINDOWS\imsins.BAK
[2009/07/16 14:02:08 | 00,000,000 | —D | C] – C:\Program Files\Common Files\ODBC
[2009/07/16 14:02:06 | 00,077,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\spcommon.dll
[2009/07/16 14:02:06 | 00,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\spcplui.dll
[2009/07/16 14:02:05 | 01,685,606 | —- | C] () – C:\WINDOWS\System32\dllcache\sam.spd
[2009/07/16 14:02:05 | 00,774,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\spttseng.dll
[2009/07/16 14:02:05 | 00,643,717 | —- | C] () – C:\WINDOWS\System32\dllcache\ltts1033.lxa
[2009/07/16 14:02:05 | 00,605,050 | —- | C] () – C:\WINDOWS\System32\dllcache\r1033tts.lxa
[2009/07/16 14:02:05 | 00,036,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sapisvr.exe
[2009/07/16 14:02:05 | 00,000,888 | —- | C] () – C:\WINDOWS\System32\dllcache\sam.sdf
[2009/07/16 14:02:05 | 00,000,000 | —D | C] – C:\Program Files\Common Files\SpeechEngines
[2009/07/16 14:02:04 | 00,696,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sapi.dll
[2009/07/16 14:02:04 | 00,147,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sapi.cpl
[2009/07/16 14:02:04 | 00,000,000 | R–D | C] – C:\Program Files
[2009/07/16 14:02:04 | 00,000,000 | —D | C] – C:\Program Files\Common Files\Microsoft Shared
[2009/07/16 14:02:04 | 00,000,000 | —D | C] – C:\Program Files\Common Files
[2009/07/16 14:02:03 | 00,066,082 | —- | C] () – C:\WINDOWS\System32\c_28603.nls
[2009/07/16 14:02:03 | 00,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt041f.dll
[2009/07/16 14:02:02 | 00,066,594 | —- | C] () – C:\WINDOWS\System32\c_857.nls
[2009/07/16 14:02:02 | 00,066,082 | —- | C] () – C:\WINDOWS\System32\c_28599.nls
[2009/07/16 14:02:02 | 00,066,082 | —- | C] () – C:\WINDOWS\System32\c_10081.nls
[2009/07/16 14:02:02 | 00,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0419.dll
[2009/07/16 14:02:02 | 00,006,144 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdtuq.dll
[2009/07/16 14:02:02 | 00,006,144 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdtuf.dll
[2009/07/16 14:02:02 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdtuq.dll
[2009/07/16 14:02:02 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdtuf.dll
[2009/07/16 14:02:02 | 00,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdazel.dll
[2009/07/16 14:02:02 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdazel.dll
[2009/07/16 14:02:00 | 00,066,082 | —- | C] () – C:\WINDOWS\System32\C_28595.NLS
[2009/07/16 14:02:00 | 00,066,082 | —- | C] () – C:\WINDOWS\System32\c_10017.nls
[2009/07/16 14:02:00 | 00,066,082 | —- | C] () – C:\WINDOWS\System32\c_10007.nls
[2009/07/16 14:02:00 | 00,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0408.dll
[2009/07/16 14:02:00 | 00,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdycc.dll
[2009/07/16 14:02:00 | 00,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbduzb.dll
[2009/07/16 14:02:00 | 00,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdur.dll
[2009/07/16 14:02:00 | 00,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdtat.dll
[2009/07/16 14:02:00 | 00,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdru1.dll
[2009/07/16 14:02:00 | 00,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdru.dll
[2009/07/16 14:02:00 | 00,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdmon.dll
[2009/07/16 14:02:00 | 00,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdkyr.dll
[2009/07/16 14:02:00 | 00,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdkaz.dll
[2009/07/16 14:02:00 | 00,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdbu.dll
[2009/07/16 14:02:00 | 00,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdblr.dll
[2009/07/16 14:02:00 | 00,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdaze.dll
[2009/07/16 14:02:00 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdycc.dll
[2009/07/16 14:02:00 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbduzb.dll
[2009/07/16 14:02:00 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdur.dll
[2009/07/16 14:02:00 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdtat.dll
[2009/07/16 14:02:00 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdru1.dll
[2009/07/16 14:02:00 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdru.dll
[2009/07/16 14:02:00 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdmon.dll
[2009/07/16 14:02:00 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdkyr.dll
[2009/07/16 14:02:00 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdkaz.dll
[2009/07/16 14:02:00 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdbu.dll
[2009/07/16 14:02:00 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdblr.dll
[2009/07/16 14:02:00 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdaze.dll
[2009/07/16 14:01:59 | 00,066,594 | —- | C] () – C:\WINDOWS\System32\c_869.nls
[2009/07/16 14:01:59 | 00,066,594 | —- | C] () – C:\WINDOWS\System32\c_737.nls
[2009/07/16 14:01:59 | 00,066,082 | —- | C] () – C:\WINDOWS\System32\c_875.nls
[2009/07/16 14:01:59 | 00,066,082 | —- | C] () – C:\WINDOWS\System32\C_28597.NLS
[2009/07/16 14:01:59 | 00,066,082 | —- | C] () – C:\WINDOWS\System32\c_10006.nls
[2009/07/16 14:01:59 | 00,008,192 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdhept.dll
[2009/07/16 14:01:59 | 00,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhept.dll
[2009/07/16 14:01:59 | 00,006,656 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdhela3.dll
[2009/07/16 14:01:59 | 00,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhela3.dll
[2009/07/16 14:01:59 | 00,006,144 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdhela2.dll
[2009/07/16 14:01:59 | 00,006,144 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdgkl.dll
[2009/07/16 14:01:59 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhela2.dll
[2009/07/16 14:01:59 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdgkl.dll
[2009/07/16 14:01:59 | 00,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdhe319.dll
[2009/07/16 14:01:59 | 00,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdhe220.dll
[2009/07/16 14:01:59 | 00,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdhe.dll
[2009/07/16 14:01:59 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhe319.dll
[2009/07/16 14:01:59 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhe220.dll
[2009/07/16 14:01:59 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhe.dll
[2009/07/16 14:01:58 | 00,006,144 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdlv1.dll
[2009/07/16 14:01:58 | 00,006,144 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdlv.dll
[2009/07/16 14:01:58 | 00,006,144 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdest.dll
[2009/07/16 14:01:58 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdlv1.dll
[2009/07/16 14:01:58 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdlv.dll
[2009/07/16 14:01:58 | 00,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdest.dll
[2009/07/16 14:01:58 | 00,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdlt1.dll
[2009/07/16 14:01:58 | 00,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdlt.dll
[2009/07/16 14:01:58 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdlt1.dll
[2009/07/16 14:01:58 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdlt.dll
[2009/07/16 14:01:57 | 00,066,594 | —- | C] () – C:\WINDOWS\System32\c_866.nls
[2009/07/16 14:01:57 | 00,066,594 | —- | C] () – C:\WINDOWS\System32\c_855.nls
[2009/07/16 14:01:57 | 00,066,082 | —- | C] () – C:\WINDOWS\System32\C_28594.NLS
[2009/07/16 14:01:57 | 00,019,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt040e.dll
[2009/07/16 14:01:57 | 00,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0415.dll
[2009/07/16 14:01:57 | 00,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0405.dll
[2009/07/16 14:01:56 | 00,066,594 | —- | C] () – C:\WINDOWS\System32\c_852.nls
[2009/07/16 14:01:56 | 00,066,082 | —- | C] () – C:\WINDOWS\System32\c_10082.nls
[2009/07/16 14:01:56 | 00,066,082 | —- | C] () – C:\WINDOWS\System32\c_10029.nls
[2009/07/16 14:01:56 | 00,066,082 | —- | C] () – C:\WINDOWS\System32\c_10010.nls
[2009/07/16 14:01:56 | 00,007,168 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdcz.dll
[2009/07/16 14:01:56 | 00,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdcz.dll
[2009/07/16 14:01:56 | 00,006,656 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdycl.dll
[2009/07/16 14:01:56 | 00,006,656 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdsl1.dll
[2009/07/16 14:01:56 | 00,006,656 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdsl.dll
[2009/07/16 14:01:56 | 00,006,656 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdpl.dll
[2009/07/16 14:01:56 | 00,006,656 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdhu.dll
[2009/07/16 14:01:56 | 00,006,656 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdcz2.dll
[2009/07/16 14:01:56 | 00,006,656 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdcz1.dll
[2009/07/16 14:01:56 | 00,006,656 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdcr.dll
[2009/07/16 14:01:56 | 00,006,656 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\KBDAL.DLL
[2009/07/16 14:01:56 | 00,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdycl.dll
[2009/07/16 14:01:56 | 00,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdsl1.dll
[2009/07/16 14:01:56 | 00,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdsl.dll
[2009/07/16 14:01:56 | 00,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdpl.dll
[2009/07/16 14:01:56 | 00,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhu.dll
[2009/07/16 14:01:56 | 00,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdcz2.dll
[2009/07/16 14:01:56 | 00,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdcz1.dll
[2009/07/16 14:01:56 | 00,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdcr.dll
[2009/07/16 14:01:56 | 00,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdal.dll
[2009/07/16 14:01:56 | 00,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdro.dll
[2009/07/16 14:01:56 | 00,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdpl1.dll
[2009/07/16 14:01:56 | 00,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdhu1.dll
[2009/07/16 14:01:56 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdro.dll
[2009/07/16 14:01:56 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdpl1.dll
[2009/07/16 14:01:56 | 00,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhu1.dll
[2009/07/16 14:01:54 | 00,176,157 | —- | C] (Digi International, Inc.) – C:\WINDOWS\System32\dllcache\dgrpsetu.dll
[2009/07/16 14:01:54 | 00,176,157 | —- | C] (Digi International, Inc.) – C:\WINDOWS\System32\dgrpsetu.dll
[2009/07/16 14:01:54 | 00,066,082 | —- | C] () – C:\WINDOWS\System32\c_20127.nls
[2009/07/16 14:01:54 | 00,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\irclass.dll
[2009/07/16 14:01:54 | 00,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\irclass.dll
[2009/07/16 14:01:54 | 00,010,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\irenum.sys
[2009/07/16 14:01:54 | 00,010,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\irenum.sys
[2009/07/16 14:01:53 | 00,103,424 | —- | C] (Equinox Systems Inc.) – C:\WINDOWS\System32\EqnClass.Dll
[2009/07/16 14:01:53 | 00,103,424 | —- | C] (Equinox Systems Inc.) – C:\WINDOWS\System32\dllcache\eqnclass.dll
[2009/07/16 14:01:53 | 00,085,020 | —- | C] (Digi International) – C:\WINDOWS\System32\dllcache\dgsetup.dll
[2009/07/16 14:01:53 | 00,085,020 | —- | C] (Digi International) – C:\WINDOWS\System32\dgsetup.dll
[2009/07/16 14:01:53 | 00,082,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\olecli.dll
[2009/07/16 14:01:53 | 00,082,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\OLECLI.DLL
[2009/07/16 14:01:53 | 00,024,661 | —- | C] (Perle Systems Ltd.) – C:\WINDOWS\System32\spxcoins.dll
[2009/07/16 14:01:53 | 00,024,661 | —- | C] (Perle Systems Ltd.) – C:\WINDOWS\System32\dllcache\spxcoins.dll
[2009/07/16 14:01:53 | 00,024,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\olesvr.dll
[2009/07/16 14:01:53 | 00,024,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\OLESVR.DLL
[2009/07/16 14:01:53 | 00,019,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tapi.dll
[2009/07/16 14:01:53 | 00,019,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\TAPI.DLL
[2009/07/16 14:01:53 | 00,013,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wfwnet.drv
[2009/07/16 14:01:53 | 00,013,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\WFWNET.DRV
[2009/07/16 14:01:53 | 00,009,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ver.dll
[2009/07/16 14:01:53 | 00,009,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\VER.DLL
[2009/07/16 14:01:53 | 00,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\shell.dll
[2009/07/16 14:01:53 | 00,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\SHELL.DLL
[2009/07/16 14:01:53 | 00,004,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\timer.drv
[2009/07/16 14:01:53 | 00,004,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\TIMER.DRV
[2009/07/16 14:01:53 | 00,003,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\system.drv
[2009/07/16 14:01:53 | 00,003,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\SYSTEM.DRV
[2009/07/16 14:01:53 | 00,002,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vga.drv
[2009/07/16 14:01:53 | 00,002,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\VGA.DRV
[2009/07/16 14:01:53 | 00,001,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sound.drv
[2009/07/16 14:01:53 | 00,001,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\SOUND.DRV
[2009/07/16 14:01:52 | 00,126,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msvideo.dll
[2009/07/16 14:01:52 | 00,126,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\MSVIDEO.DLL
[2009/07/16 14:01:52 | 00,109,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\avifile.dll
[2009/07/16 14:01:52 | 00,109,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\AVIFILE.DLL
[2009/07/16 14:01:52 | 00,073,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mciavi.drv
[2009/07/16 14:01:52 | 00,073,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\MCIAVI.DRV
[2009/07/16 14:01:52 | 00,069,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\avicap.dll
[2009/07/16 14:01:52 | 00,069,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\AVICAP.DLL
[2009/07/16 14:01:52 | 00,068,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mmsystem.dll
[2009/07/16 14:01:52 | 00,068,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\MMSYSTEM.DLL
[2009/07/16 14:01:52 | 00,066,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\notepad.exe
[2009/07/16 14:01:52 | 00,066,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\NOTEPAD.EXE
[2009/07/16 14:01:52 | 00,032,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\commdlg.dll
[2009/07/16 14:01:52 | 00,032,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\COMMDLG.DLL
[2009/07/16 14:01:52 | 00,028,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mciwave.drv
[2009/07/16 14:01:52 | 00,028,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\MCIWAVE.DRV
[2009/07/16 14:01:52 | 00,025,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mciseq.drv
[2009/07/16 14:01:52 | 00,025,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\MCISEQ.DRV
[2009/07/16 14:01:52 | 00,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\TASKMAN.EXE
[2009/07/16 14:01:52 | 00,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\taskman.exe
[2009/07/16 14:01:52 | 00,009,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lzexpand.dll
[2009/07/16 14:01:52 | 00,009,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\LZEXPAND.DLL
[2009/07/16 14:01:52 | 00,002,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mouse.drv
[2009/07/16 14:01:52 | 00,002,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\MOUSE.DRV
[2009/07/16 14:01:52 | 00,002,000 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\keyboard.drv
[2009/07/16 14:01:52 | 00,002,000 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\KEYBOARD.DRV
[2009/07/16 14:01:52 | 00,001,152 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mmtask.tsk
[2009/07/16 14:01:52 | 00,001,152 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\MMTASK.TSK
[2009/07/16 14:01:51 | 00,132,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\WINSPOOL.DRV
[2009/07/16 14:01:51 | 00,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\batt.dll
[2009/07/16 14:01:51 | 00,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\batt.dll
[2009/07/16 14:01:51 | 00,001,688 | —- | C] () – C:\WINDOWS\System32\AUTOEXEC.NT
[2009/07/16 14:01:50 | 00,071,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\storprop.dll
[2009/07/16 14:01:11 | 00,657,548 | —- | C] () – C:\WINDOWS\System32\dllcache\CLASSES.CAT
[2009/07/16 14:01:11 | 00,399,645 | —- | C] () – C:\WINDOWS\System32\dllcache\MAPIMIG.CAT
[2009/07/16 14:01:11 | 00,390,168 | —- | C] () – C:\WINDOWS\System32\dllcache\WFC.CAT
[2009/07/16 14:01:11 | 00,056,081 | —- | C] () – C:\WINDOWS\System32\dllcache\DAJAVAC.CAT
[2009/07/16 14:01:11 | 00,052,311 | —- | C] () – C:\WINDOWS\System32\dllcache\DX3.CAT
[2009/07/16 14:01:11 | 00,037,484 | —- | C] () – C:\WINDOWS\System32\dllcache\MW770.CAT
[2009/07/16 14:01:11 | 00,031,405 | —- | C] () – C:\WINDOWS\System32\dllcache\FP4.CAT
[2009/07/16 14:01:11 | 00,022,151 | —- | C] () – C:\WINDOWS\System32\dllcache\TCLASSES.CAT
[2009/07/16 14:01:11 | 00,021,281 | —- | C] () – C:\WINDOWS\System32\dllcache\XMLDSOC.CAT
[2009/07/16 14:01:11 | 00,014,031 | —- | C] () – C:\WINDOWS\System32\dllcache\MSJDBC.CAT
[2009/07/16 14:01:11 | 00,013,608 | —- | C] () – C:\WINDOWS\System32\dllcache\IMS.CAT
[2009/07/16 14:01:11 | 00,013,472 | —- | C] () – C:\WINDOWS\System32\dllcache\HPCRDP.CAT
[2009/07/16 14:01:11 | 00,010,881 | —- | C] () – C:\WINDOWS\System32\dllcache\MSMSGS.CAT
[2009/07/16 14:01:11 | 00,008,574 | —- | C] () – C:\WINDOWS\System32\dllcache\IASNT4.CAT
[2009/07/16 14:01:11 | 00,007,369 | —- | C] () – C:\WINDOWS\System32\dllcache\MSTSWEB.CAT
[2009/07/16 14:01:11 | 00,007,046 | —- | C] () – C:\WINDOWS\System32\dllcache\OEMBIOS.CAT
[2009/07/16 14:01:10 | 02,049,999 | —- | C] () – C:\WINDOWS\System32\dllcache\NT5.CAT
[2009/07/16 14:01:10 | 01,086,182 | —- | C] () – C:\WINDOWS\System32\dllcache\NTPRINT.CAT
[2009/07/16 14:01:10 | 00,797,189 | —- | C] () – C:\WINDOWS\System32\dllcache\NT5IIS.CAT
[2009/07/16 14:01:10 | 00,342,618 | —- | C] () – C:\WINDOWS\System32\dllcache\NT5INF.CAT
[2009/07/16 14:01:00 | 00,000,000 | —D | C] – C:\WINDOWS\System32\CatRoot2
[2009/07/16 14:01:00 | 00,000,000 | —D | C] – C:\WINDOWS\System32\CatRoot
[2009/07/16 14:00:54 | 00,000,000 | –SD | C] – C:\Documents and Settings\All Users\Application Data\Microsoft
[2009/07/16 14:00:33 | 00,000,000 | —D | C] – C:\Documents and Settings
[2009/07/16 14:00:32 | 00,090,296 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2009/07/16 13:59:12 | 00,000,264 | RHS- | C] () – C:\boot.ini
[2009/07/16 13:59:09 | 00,000,266 | —- | C] () – C:\WINDOWS\System32\$winnt$.inf
[2009/07/16 13:56:37 | 00,000,000 | R-SD | C] – C:\WINDOWS\Fonts
[2009/07/16 13:56:37 | 00,000,000 | RHSD | C] – C:\WINDOWS\System32\dllcache
[2009/07/16 13:56:37 | 00,000,000 | R–D | C] – C:\WINDOWS\Web
[2009/07/16 13:56:37 | 00,000,000 | -H-D | C] – C:\WINDOWS\inf
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\WinSxS
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\twain_32
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\wins
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\wbem
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\usmt
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\spool
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\ShellExt
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\Setup
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\ras
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\oobe
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\npp
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\mui
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\inetsrv
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\IME
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\icsxml
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\ias
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\export
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\drivers\etc
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\drivers\disdn
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\drivers
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\dhcp
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\config
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\3com_dmi
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\3076
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\2052
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\1054
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\1042
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\1041
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\1037
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\1033
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\1031
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\1028
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\System32\1025
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\system32
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\system
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\security
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\Resources
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\repair
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\mui
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\msapps
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\msagent
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\Media
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\java
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\ime
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\Help
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\Driver Cache
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\Debug
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\Cursors
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\Connection Wizard
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\Config
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\AppPatch
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS\addins
[2009/07/16 13:56:37 | 00,000,000 | —D | C] – C:\WINDOWS
[2009/04/21 18:26:56 | 00,031,088 | —- | C] () – C:\WINDOWS\System32\wrLZMA.dll
[2002/09/03 09:00:00 | 00,168,371 | RHS- | C] () – C:\WINDOWS\System32\rwwcheh.dll
[2002/09/03 09:00:00 | 00,027,440 | —- | C] () – C:\WINDOWS\System32\drivers\secdrv.sys
[2002/09/03 09:00:00 | 00,000,599 | —- | C] () – C:\WINDOWS\win.ini
[2002/09/03 09:00:00 | 00,000,227 | —- | C] () – C:\WINDOWS\system.ini

========== Files - Modified Within 30 Days ==========

[2009/07/21 16:44:05 | 00,513,536 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Cody Rhoads\Desktop\OTL.exe
[2009/07/21 15:42:16 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/07/21 15:42:15 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/07/20 22:30:13 | 02,688,574 | -H– | M] () – C:\Documents and Settings\Cody Rhoads\Local Settings\Application Data\IconCache.db
[2009/07/20 19:55:37 | 00,407,552 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Cody Rhoads\Desktop\OTM.exe
[2009/07/19 18:58:14 | 00,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2009/07/19 18:57:39 | 00,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\HOSTS
[2009/07/19 18:26:18 | 03,147,475 | R— | M] () – C:\Documents and Settings\Cody Rhoads\Desktop\ComboFix.exe
[2009/07/19 18:24:29 | 00,000,534 | —- | M] () – C:\Documents and Settings\Cody Rhoads\My Documents\Shortcut to CFScript.lnk
[2009/07/18 15:50:33 | 00,311,604 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2009/07/18 15:50:33 | 00,039,992 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2009/07/18 15:50:32 | 00,356,120 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2009/07/18 15:40:56 | 00,000,264 | RHS- | M] () – C:\boot.ini
[2009/07/17 19:58:21 | 00,001,734 | —- | M] () – C:\Documents and Settings\Cody Rhoads\Desktop\HijackThis.lnk
[2009/07/17 19:58:10 | 00,812,344 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Cody Rhoads\Desktop\HJTInstall.exe
[2009/07/17 19:20:35 | 00,000,599 | —- | M] () – C:\WINDOWS\win.ini
[2009/07/17 19:20:34 | 00,001,669 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Webroot AntiVirus.lnk
[2009/07/17 19:15:49 | 00,000,164 | —- | M] () – C:\WINDOWS\install.dat
[2009/07/17 19:14:38 | 40,584,608 | —- | M] (Webroot Software, Inc. ) – C:\Documents and Settings\Cody Rhoads\Desktop\SpySweeperSNRSetup8200_EN.exe
[2009/07/17 17:45:12 | 73,290,9568 | —- | M] () – C:\Documents and Settings\Cody Rhoads\Desktop\ubuntu-9.04-desktop-i386.iso
[2009/07/17 17:29:14 | 00,122,368 | —- | M] () – C:\WINDOWS\System32\urdvxc.exe
[2009/07/16 20:30:26 | 00,000,448 | -H– | M] () – C:\IPH.PH
[2009/07/16 20:30:10 | 00,001,634 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AIM 6.lnk
[2009/07/16 20:29:36 | 14,518,208 | —- | M] (AOL LLC.) – C:\Documents and Settings\Cody Rhoads\Desktop\Install_AIM.exe
[2009/07/16 20:27:15 | 00,570,024 | —- | M] (Google Inc.) – C:\Documents and Settings\Cody Rhoads\Desktop\ChromeSetup.exe
[2009/07/16 20:25:12 | 17,259,504 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Cody Rhoads\Desktop\IE8-Setup-Full.exe
[2009/07/16 20:16:43 | 00,316,640 | —- | M] () – C:\WINDOWS\WMSysPr9.prx
[2009/07/16 20:11:31 | 00,000,882 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Acrobat Reader 5.0.lnk
[2009/07/16 19:28:32 | 00,057,344 | —- | M] (LANovation) – C:\WINDOWS\System32\PCTKRNT.SYS
[2009/07/16 19:27:50 | 00,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/07/16 19:25:55 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\drivers\GATEWAY__101.MRK
[2009/07/16 19:24:49 | 00,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2009/07/16 19:15:33 | 00,720,896 | —- | M] (Sensaura Ltd) – C:\WINDOWS\System32\a3d.dll
[2009/07/16 19:15:33 | 00,542,976 | —- | M] (Analog Devices, Inc.) – C:\WINDOWS\System32\drivers\smwdm.sys
[2009/07/16 19:15:33 | 00,003,744 | —- | M] (Analog Devices, Inc.) – C:\WINDOWS\System32\drivers\smsens.sys
[2009/07/16 19:15:32 | 00,102,400 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\drivers\ianswxp.sys
[2009/07/16 19:15:32 | 00,004,816 | —- | M] (Andrea Electronics Corporation) – C:\WINDOWS\System32\drivers\aeaudio.sys
[2009/07/16 19:15:26 | 00,145,408 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\drivers\e100b325.sys
[2009/07/16 19:15:26 | 00,145,408 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\dllcache\e100b325.sys
[2009/07/16 19:15:26 | 00,118,784 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\Prounstl.exe
[2009/07/16 19:15:26 | 00,024,064 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\IntelNic.dll
[2009/07/16 19:15:26 | 00,012,288 | —- | M] () – C:\WINDOWS\System32\e100bmsg.dll
[2009/07/16 19:15:26 | 00,005,110 | —- | M] () – C:\WINDOWS\System32\e100b325.din
[2009/07/16 19:15:25 | 01,107,680 | —- | M] (GTW) – C:\WINDOWS\System32\drivers\GWMDM.sys
[2009/07/16 19:15:25 | 00,098,304 | —- | M] (GTW) – C:\WINDOWS\GWMDMU.exe
[2009/07/16 19:15:25 | 00,090,112 | —- | M] (GTW) – C:\WINDOWS\GWMDMMSG.exe
[2009/07/16 19:15:25 | 00,069,632 | —- | M] (GTW) – C:\WINDOWS\GWMDMD2K.exe
[2009/07/16 19:15:25 | 00,053,248 | —- | M] (GTW) – C:\WINDOWS\System32\GWMDM168.dll
[2009/07/16 19:15:25 | 00,053,248 | —- | M] () – C:\WINDOWS\GWMDMpi.exe
[2009/07/16 19:15:25 | 00,032,823 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\drivers\wa301b.sys
[2009/07/16 19:15:25 | 00,032,823 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\drivers\wa301a.sys
[2009/07/16 19:15:24 | 00,159,744 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrptg.lrc
[2009/07/16 19:15:24 | 00,159,744 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrptb.lrc
[2009/07/16 19:15:24 | 00,159,744 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrplk.lrc
[2009/07/16 19:15:24 | 00,159,744 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrnld.lrc
[2009/07/16 19:15:24 | 00,159,744 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrita.lrc
[2009/07/16 19:15:24 | 00,159,744 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrhun.lrc
[2009/07/16 19:15:24 | 00,159,744 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrfrc.lrc
[2009/07/16 19:15:24 | 00,159,744 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrfra.lrc
[2009/07/16 19:15:24 | 00,155,648 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxtray.exe
[2009/07/16 19:15:24 | 00,155,648 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrtrk.lrc
[2009/07/16 19:15:24 | 00,155,648 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrtha.lrc
[2009/07/16 19:15:24 | 00,155,648 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrsve.lrc
[2009/07/16 19:15:24 | 00,155,648 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrrus.lrc
[2009/07/16 19:15:24 | 00,155,648 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrnor.lrc
[2009/07/16 19:15:24 | 00,155,648 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrkor.lrc
[2009/07/16 19:15:24 | 00,155,648 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrjpn.lrc
[2009/07/16 19:15:24 | 00,155,648 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrheb.lrc
[2009/07/16 19:15:23 | 00,503,808 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxress.dll
[2009/07/16 19:15:23 | 00,204,800 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxpph.dll
[2009/07/16 19:15:23 | 00,163,840 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrell.lrc
[2009/07/16 19:15:23 | 00,159,744 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxresp.lrc
[2009/07/16 19:15:23 | 00,155,648 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrfin.lrc
[2009/07/16 19:15:23 | 00,155,648 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxres.dll
[2009/07/16 19:15:23 | 00,155,648 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrenu.lrc
[2009/07/16 19:15:23 | 00,155,648 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxreng.lrc
[2009/07/16 19:15:23 | 00,155,648 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrdeu.lrc
[2009/07/16 19:15:23 | 00,155,648 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrdan.lrc
[2009/07/16 19:15:23 | 00,155,648 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrcsy.lrc
[2009/07/16 19:15:23 | 00,155,648 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrcht.lrc
[2009/07/16 19:15:23 | 00,155,648 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrchs.lrc
[2009/07/16 19:15:23 | 00,155,648 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrarb.lrc
[2009/07/16 19:15:23 | 00,155,648 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxrara.lrc
[2009/07/16 19:15:23 | 00,060,996 | —- | M] () – C:\WINDOWS\System32\igfxhtha.lhp
[2009/07/16 19:15:23 | 00,059,819 | —- | M] () – C:\WINDOWS\System32\igfxhrus.lhp
[2009/07/16 19:15:23 | 00,058,528 | —- | M] () – C:\WINDOWS\System32\igfxhtrk.lhp
[2009/07/16 19:15:23 | 00,058,024 | —- | M] () – C:\WINDOWS\System32\igfxhsve.lhp
[2009/07/16 19:15:22 | 00,221,184 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxeud.dll
[2009/07/16 19:15:22 | 00,151,552 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxdiag.exe
[2009/07/16 19:15:22 | 00,090,112 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxext.exe
[2009/07/16 19:15:22 | 00,086,016 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxdo.dll
[2009/07/16 19:15:22 | 00,062,970 | —- | M] () – C:\WINDOWS\System32\igfxhkor.lhp
[2009/07/16 19:15:22 | 00,060,988 | —- | M] () – C:\WINDOWS\System32\igfxhhun.lhp
[2009/07/16 19:15:22 | 00,060,894 | —- | M] () – C:\WINDOWS\System32\igfxhdeu.lhp
[2009/07/16 19:15:22 | 00,060,400 | —- | M] () – C:\WINDOWS\System32\igfxhfrc.lhp
[2009/07/16 19:15:22 | 00,060,392 | —- | M] () – C:\WINDOWS\System32\igfxhheb.lhp
[2009/07/16 19:15:22 | 00,060,099 | —- | M] () – C:\WINDOWS\System32\igfxhfra.lhp
[2009/07/16 19:15:22 | 00,060,037 | —- | M] () – C:\WINDOWS\System32\igfxhplk.lhp
[2009/07/16 19:15:22 | 00,060,025 | —- | M] () – C:\WINDOWS\System32\igfxhell.lhp
[2009/07/16 19:15:22 | 00,059,052 | —- | M] () – C:\WINDOWS\System32\igfxhcht.lhp
[2009/07/16 19:15:22 | 00,058,967 | —- | M] () – C:\WINDOWS\System32\igfxhjpn.lhp
[2009/07/16 19:15:22 | 00,058,889 | —- | M] () – C:\WINDOWS\System32\igfxhfin.lhp
[2009/07/16 19:15:22 | 00,058,738 | —- | M] () – C:\WINDOWS\System32\igfxhnld.lhp
[2009/07/16 19:15:22 | 00,058,647 | —- | M] () – C:\WINDOWS\System32\igfxhcsy.lhp
[2009/07/16 19:15:22 | 00,058,026 | —- | M] () – C:\WINDOWS\System32\igfxhdan.lhp
[2009/07/16 19:15:22 | 00,058,021 | —- | M] () – C:\WINDOWS\System32\igfxhnor.lhp
[2009/07/16 19:15:22 | 00,058,010 | —- | M] () – C:\WINDOWS\System32\igfxhesp.lhp
[2009/07/16 19:15:22 | 00,057,965 | —- | M] () – C:\WINDOWS\System32\igfxhptg.lhp
[2009/07/16 19:15:22 | 00,057,891 | —- | M] () – C:\WINDOWS\System32\igfxhita.lhp
[2009/07/16 19:15:22 | 00,057,434 | —- | M] () – C:\WINDOWS\System32\igfxhptb.lhp
[2009/07/16 19:15:22 | 00,056,845 | —- | M] () – C:\WINDOWS\System32\igfxharb.lhp
[2009/07/16 19:15:22 | 00,056,845 | —- | M] () – C:\WINDOWS\System32\igfxhara.lhp
[2009/07/16 19:15:22 | 00,056,835 | —- | M] () – C:\WINDOWS\System32\igfxhchs.lhp
[2009/07/16 19:15:22 | 00,056,580 | —- | M] () – C:\WINDOWS\System32\igfxheng.lhp
[2009/07/16 19:15:22 | 00,055,002 | —- | M] () – C:\WINDOWS\System32\igfxhenu.lhp
[2009/07/16 19:15:22 | 00,045,056 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxdgps.dll
[2009/07/16 19:15:22 | 00,032,768 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxexps.dll
[2009/07/16 19:15:21 | 01,859,584 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\ialmgicd.dll
[2009/07/16 19:15:21 | 00,487,424 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxcfg.exe
[2009/07/16 19:15:21 | 00,188,416 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\ialmgdev.dll
[2009/07/16 19:15:21 | 00,112,288 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\drivers\ialmsbw.sys
[2009/07/16 19:15:21 | 00,094,208 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxcpl.cpl
[2009/07/16 19:15:21 | 00,090,395 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\drivers\ialmnt5.sys
[2009/07/16 19:15:21 | 00,078,496 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\drivers\ialmkchw.sys
[2009/07/16 19:15:20 | 00,046,647 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\drivers\a304.sys
[2009/07/16 19:15:20 | 00,035,383 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\drivers\a313.sys
[2009/07/16 19:15:20 | 00,033,335 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\drivers\a310.sys
[2009/07/16 19:15:20 | 00,031,287 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\drivers\a311.sys
[2009/07/16 19:15:20 | 00,027,703 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\drivers\a303.sys
[2009/07/16 19:15:20 | 00,025,655 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\drivers\a309.sys
[2009/07/16 19:15:20 | 00,020,535 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\drivers\a307.sys
[2009/07/16 19:15:20 | 00,016,439 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\drivers\a306.sys
[2009/07/16 19:15:20 | 00,011,831 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\drivers\a305.sys
[2009/07/16 19:15:20 | 00,011,319 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\drivers\a302.sys
[2009/07/16 19:15:20 | 00,010,807 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\drivers\a314.sys
[2009/07/16 19:15:20 | 00,010,807 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\drivers\a312.sys
[2009/07/16 19:15:20 | 00,010,807 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\drivers\a308.sys
[2009/07/16 19:15:19 | 00,020,021 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\drivers\vch.sys
[2009/07/16 18:50:23 | 00,315,392 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxsrvc.dll
[2009/07/16 18:50:21 | 00,147,456 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxdev.dll
[2009/07/16 18:50:21 | 00,118,784 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\igfxhk.dll
[2009/07/16 18:50:20 | 00,460,866 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\ialmdd5.dll
[2009/07/16 18:50:20 | 00,194,427 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\ialmdev5.dll
[2009/07/16 18:50:20 | 00,114,748 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\ialmdnt5.dll
[2009/07/16 18:50:20 | 00,033,792 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\ialmrnt5.dll
[2009/07/16 18:50:19 | 00,118,784 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\hccutils.dll
[2009/07/16 18:50:19 | 00,114,688 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\hkcmd.exe
[2009/07/16 18:50:19 | 00,065,536 | —- | M] (Intel Corporation) – C:\WINDOWS\System32\iAlmCoIn_v13.dll
[2009/07/16 18:23:12 | 00,025,065 | —- | M] () – C:\WINDOWS\System32\wmpscheme.xml
[2009/07/16 18:16:09 | 00,008,192 | —- | M] () – C:\WINDOWS\REGLOCS.OLD
[2009/07/16 18:15:58 | 00,090,296 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2009/07/16 18:14:59 | 00,000,266 | —- | M] () – C:\WINDOWS\System32\$winnt$.inf
[2009/07/16 18:12:14 | 00,002,577 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2009/07/16 18:12:14 | 00,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2009/07/16 18:12:14 | 00,000,000 | RHS- | M] () – C:\IO.SYS
[2009/07/16 18:12:14 | 00,000,000 | —- | M] () – C:\WINDOWS\control.ini
[2009/07/16 18:12:14 | 00,000,000 | —- | M] () – C:\CONFIG.SYS
[2009/07/16 18:12:14 | 00,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2009/07/16 18:12:12 | 00,023,392 | —- | M] () – C:\WINDOWS\System32\nscompat.tlb
[2009/07/16 18:12:12 | 00,016,832 | —- | M] () – C:\WINDOWS\System32\amcompat.tlb
[2009/07/16 18:12:11 | 00,299,552 | —- | M] () – C:\WINDOWS\WMSysPrx.prx
[2009/07/16 18:11:58 | 00,004,161 | —- | M] () – C:\WINDOWS\ODBCINST.INI
[2009/07/16 18:10:55 | 00,000,488 | RH– | M] () – C:\WINDOWS\System32\WindowsLogon.manifest
[2009/07/16 18:10:55 | 00,000,488 | RH– | M] () – C:\WINDOWS\System32\logonui.exe.manifest
[2009/07/16 18:10:49 | 00,000,749 | RH– | M] () – C:\WINDOWS\WindowsShell.Manifest
[2009/07/16 18:10:49 | 00,000,749 | RH– | M] () – C:\WINDOWS\System32\wuaucpl.cpl.manifest
[2009/07/16 18:10:49 | 00,000,749 | RH– | M] () – C:\WINDOWS\System32\sapi.cpl.manifest
[2009/07/16 18:10:49 | 00,000,749 | RH– | M] () – C:\WINDOWS\System32\nwc.cpl.manifest
[2009/07/16 18:10:49 | 00,000,749 | RH– | M] () – C:\WINDOWS\System32\ncpa.cpl.manifest
[2009/07/16 18:10:49 | 00,000,749 | RH– | M] () – C:\WINDOWS\System32\cdplayer.exe.manifest
[2009/07/16 18:09:26 | 00,021,640 | —- | M] () – C:\WINDOWS\System32\emptyregdb.dat
[2009/07/16 18:09:11 | 00,000,037 | —- | M] () – C:\WINDOWS\vbaddin.ini
[2009/07/16 18:09:11 | 00,000,036 | —- | M] () – C:\WINDOWS\vb.ini
[2009/07/16 18:06:57 | 00,000,194 | —- | M] () – C:\Boot.bak
[2009/07/13 05:48:54 | 00,219,648 | —- | M] () – C:\WINDOWS\PEV.exe

========== LOP Check ==========

[2009/07/17 19:17:51 | 00,000,000 | RH-D | M] – C:\Documents and Settings\All Users\Application Data
[2009/07/16 20:30:11 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\acccore
[2009/07/16 20:30:17 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AIM Toolbar
[2009/07/16 20:30:12 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/07/16 20:59:00 | 00,000,000 | RH-D | M] – C:\Documents and Settings\Cody Rhoads\Application Data
[2009/07/16 20:30:55 | 00,000,000 | —D | M] – C:\Documents and Settings\Cody Rhoads\Application Data\acccore
[2009/07/16 20:11:26 | 00,000,000 | —D | M] – C:\Documents and Settings\Cody Rhoads\Application Data\InterTrust
[2002/09/03 09:00:00 | 00,000,065 | RH– | M] () – C:\WINDOWS\Tasks\desktop.ini
[2009/07/21 15:42:16 | 00,000,006 | -H– | M] () – C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========

< End of report >

codyrhoads

Post #15July 21, 2009, 8:50 PM UTC

OTL Extras logfile created on: 7/21/2009 4:44:54 PM - Run 1
OTL by OldTimer - Version 3.0.9.2 Folder = C:\Documents and Settings\Cody Rhoads\Desktop
Windows XP Home Edition Service Pack 1 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2800.1106)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

238.73 Mb Total Physical Memory | 115.70 Mb Available Physical Memory | 48.46% Memory free
586.10 Mb Paging File | 275.88 Mb Available in Paging File | 47.07% Paging File free
Paging file location(s): C:\pagefile.sys 360 720 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 76.32 Gb Total Space | 73.06 Gb Free Space | 95.73% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: CODY
Current User Name: Cody Rhoads
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1F7CCFA3-D926-4882-B2A5-A0217ED25597}" = PC-Doctor for Windows
"{22E9CF2B-4063-4dab-A251-93FA46F7DECC}_is1" = Webroot AntiVirus with AntiSpyware
"{32343DB6-9A52-40C9-87E4-5E7C79791C87}" = MSXML 4.0 SP2 and SOAP Toolkit 3.0
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3F5B6210-0903-4DC6-8034-8F488AA3A782}" = Spy Sweeper Core
"{A790BEB1-BCCF-4EC6-807B-5708B36E8A79}" = Intel® PROSet
"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
"{D2B7C41F-C63D-4935-B323-B60673724D63}" = Do More 7.0
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"AIM Search" = AIM Search
"AIM Toolbar" = AIM Toolbar
"AIM_6" = AIM 6
"Gateway Desktop Manager" = Gateway Desktop Manager
"Gateway Drivers and Applications Recovery" = Gateway Drivers and Applications Recovery
"Gateway IE Customizations" = Gateway IE Customizations
"Gateway Power Management" = Gateway Power Management
"GTW V.92 Voicemodem" = GTW V.92 Voicemodem
"HijackThis" = HijackThis 2.0.2
"PROSet" = Intel® PRO Network Adapters and Drivers
"PX: {20BBF229-A337-40AD-9FEB-2C98CDA53D1C}" = Gateway Rhapsody
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"ViewpointMediaPlayer" = Viewpoint Media Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/19/2009 8:08:16 PM | Computer Name = CODY | Source = Application Hang | ID = 1002
Description = Hanging application IEXPLORE.EXE, version 6.0.2800.1106, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 7/19/2009 9:17:17 PM | Computer Name = CODY | Source = Application Hang | ID = 1002
Description = Hanging application IEXPLORE.EXE, version 6.0.2800.1106, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 7/19/2009 9:17:19 PM | Computer Name = CODY | Source = Application Hang | ID = 1002
Description = Hanging application IEXPLORE.EXE, version 6.0.2800.1106, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 7/19/2009 9:55:17 PM | Computer Name = CODY | Source = Application Hang | ID = 1002
Description = Hanging application IEXPLORE.EXE, version 6.0.2800.1106, hang module
mshtml.dll, version 6.0.2800.1106, hang address 0x00096ae8.

Error - 7/19/2009 10:05:16 PM | Computer Name = CODY | Source = Application Hang | ID = 1002
Description = Hanging application IEXPLORE.EXE, version 6.0.2800.1106, hang module
jscript.dll, version 5.6.0.6626, hang address 0x0000700b.

Error - 7/20/2009 8:49:50 PM | Computer Name = CODY | Source = Application Hang | ID = 1002
Description = Hanging application IEXPLORE.EXE, version 6.0.2800.1106, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 7/20/2009 8:54:22 PM | Computer Name = CODY | Source = Application Hang | ID = 1002
Description = Hanging application IEXPLORE.EXE, version 6.0.2800.1106, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 7/21/2009 4:15:53 PM | Computer Name = CODY | Source = Application Hang | ID = 1002
Description = Hanging application IEXPLORE.EXE, version 6.0.2800.1106, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 7/21/2009 4:15:58 PM | Computer Name = CODY | Source = Application Hang | ID = 1002
Description = Hanging application IEXPLORE.EXE, version 6.0.2800.1106, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 7/21/2009 4:42:35 PM | Computer Name = CODY | Source = Application Hang | ID = 1002
Description = Hanging application IEXPLORE.EXE, version 6.0.2800.1106, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 7/20/2009 7:57:39 PM | Computer Name = CODY | Source = Service Control Manager | ID = 7034
Description = The Webroot Client Service service terminated unexpectedly. It has
done this 1 time(s).

Error - 7/20/2009 7:57:39 PM | Computer Name = CODY | Source = Service Control Manager | ID = 7034
Description = The PrismXL service terminated unexpectedly. It has done this 1 time(s).

Error - 7/20/2009 7:57:39 PM | Computer Name = CODY | Source = Service Control Manager | ID = 7034
Description = The Viewpoint Manager Service service terminated unexpectedly. It
has done this 1 time(s).

Error - 7/20/2009 8:35:39 PM | Computer Name = CODY | Source = ssidrv | ID = 131098
Description = Failed to set monitor event rule.

Error - 7/20/2009 8:39:03 PM | Computer Name = CODY | Source = Service Control Manager | ID = 7023
Description = The Center Security service terminated with the following error: %%1114

Error - 7/20/2009 8:39:03 PM | Computer Name = CODY | Source = Service Control Manager | ID = 7000
Description = The wscsvc service failed to start due to the following error: %%1083

Error - 7/20/2009 8:39:03 PM | Computer Name = CODY | Source = Service Control Manager | ID = 7000
Description = The wscsvc service failed to start due to the following error: %%1083

Error - 7/21/2009 3:44:10 PM | Computer Name = CODY | Source = Service Control Manager | ID = 7023
Description = The Center Security service terminated with the following error: %%1114

Error - 7/21/2009 3:44:10 PM | Computer Name = CODY | Source = Service Control Manager | ID = 7000
Description = The wscsvc service failed to start due to the following error: %%1083

Error - 7/21/2009 3:44:10 PM | Computer Name = CODY | Source = Service Control Manager | ID = 7000
Description = The wscsvc service failed to start due to the following error: %%1083

< End of report >

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Closed] Possible Malware/Virus

✨ Ask AI

Ask AI