Spyware / Malware / Virus Removal

[Resolved] Perhaps spyware, found by Spybot

12 min read

Looking for the outcome? Ask AI

Tom_q2356 Topic Starter

Post #1May 15, 2010, 7:00 PM UTC

Hi,

Spybot found this "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride" in my computer. Every time I deleted it, the next time it will be there again. I always have ZoneAlarm and AVG running; however, recently my computer every now and then reports that there is either missing firewall or antivirus program. I need help on this. Thanks!

Tom

martix

Post #2May 16, 2010, 9:16 AM UTC

Hi Tom

I'm martix and I'll be glad to assist you and look over your PC problems.

Before we proceed please read carefully the following guidelines:

Malware removal process takes time so be patient and stick with the thread until I’ve given you the “All clean". Absence of symptoms does not mean your machine is clean!
Do not run any scans or install/uninstall any applications without being directed to do so.
Follow my instructions carefully and in the order they are posted.
If you do not understand any step(s) provided, please do not hesitate to ask before continuing.
If you do not reply within 5 days after my last response the topic will be closed.

Now we can proceed. Please follow the instructions:

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

NEXT

Please download DDS by sUBs from one of the following links and save it to your desktop.

- DDS.scr
- DDS.pif
Disable any script blocking protection (How to Disable your Security Programs)
Double click DDS icon to run the tool (may take up to 3 minutes to run)
When done, DDS.txt will open.
After a few moments, attach.txt will open in a second window.
Save both reports to your desktop.

—————————————————

Post the contents of the DDS.txt and Attach.txt report in your next reply

In your next reply I will need:

1. GMER log
2. DDS log

martix

Post #3May 19, 2010, 4:04 PM UTC

Do you still need an assistance? Please reply within 48hours or this topic will be closed.

Tom_q2356

Post #4May 20, 2010, 1:22 PM UTC

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-05-20 03:17:17
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\fwtirpog.sys

—- System - GMER 1.0.15 —-

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwConnectPort [0xA90938D0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateFile [0xA90906E0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateKey [0xA909D490]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreatePort [0xA9093E90]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateProcess [0xA909AC80]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateProcessEx [0xA909AE90]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateSection [0xA909ED50]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateWaitablePort [0xA9093F80]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDeleteFile [0xA9090C70]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDeleteKey [0xA909DD10]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDeleteValueKey [0xA909DAC0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDuplicateObject [0xA909A600]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwLoadDriver [0xA908D3B0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwLoadKey [0xA909E230]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwLoadKey2 [0xA909E2B0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwMapViewOfSection [0xA909EFD0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwOpenFile [0xA9090AD0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwOpenProcess [0xA909C4F0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwOpenThread [0xA909C2B0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwRenameKey [0xA909E970]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwReplaceKey [0xA909E3D0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwRequestWaitReplyPort [0xA90934F0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwRestoreKey [0xA909E7C0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSecureConnectPort [0xA9093AA0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSetInformationFile [0xA9090EA0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSetSystemInformation [0xA908D190]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSetValueKey [0xA909D800]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSystemDebugControl [0xA909B580]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwTerminateProcess [0xA909B400]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwUnloadDriver [0xA908D5D0]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[284] [0xA8D4C2C0]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[285] [0xA8D4C320]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[286] [0xA8D4C370]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[287] [0xA8D4C3C0]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[288] [0xA8D4C410]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[289] [0xA8D4C460]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[290] [0xA8D4C4A0]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[291] [0xA8D4C4E0]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[292] [0xA8D4C530]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[293] [0xA8D4C580]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[294] [0xA8D4C5E0]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[295] [0xA8D4C630]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[296] [0xA8D4C680]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[297] [0xA8D4C6D0]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[298] [0xA8D4C710]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[299] [0xA8D4C770]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[300] [0xA8D4C7C0]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[301] [0xA8D4C810]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[302] [0xA8D4C850]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[303] [0xA8D4C890]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[304] [0xA8D4C8D0]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[305] [0xA8D4C940]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[306] [0xA8D4C990]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[307] [0xA8D4C9D0]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[308] [0xA8D4CA10]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[309] [0xA8D4CA80]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[310] [0xA8D4CAD0]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[311] [0xA8D4CB20]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[312] [0xA8D4CB80]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[313] [0xA8D4CBE0]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[314] [0xA8D4CC20]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[315] [0xA8D4CC70]
SSDT \??\C:\WINDOWS\system32\Drivers\KAVSafe.sys (Kingsoft Antivirus Defend Engine Safe Module/Kingsoft Corporation) SSDT[316] [0xA8D4CCC0]

INT 0x20 srescan.sys BA603C80

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwCallbackReturn + 266C 80501EA4 8 Bytes JMP 6420C7B2
? srescan.sys The system cannot find the file specified. !

—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\System32\bcmwltry.exe[672] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 0143AEE0 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\WINDOWS\System32\bcmwltry.exe[672] ole32.dll!CoRegisterClassObject 77517E90 5 Bytes JMP 0143B220 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\WINDOWS\System32\bcmwltry.exe[672] ole32.dll!CoRevokeClassObject 7752A2F3 5 Bytes JMP 0143BE20 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\WINDOWS\System32\bcmwltry.exe[672] SHELL32.dll!ShellExecuteExW 7CA0996B 5 Bytes JMP 0143AC60 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\Maxthon2\Modules\MxKWS\KSWebShield.exe[804] SHELL32.dll!ShellExecuteExW 7CA0996B 5 Bytes JMP 01B1AC60 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\Maxthon2\Modules\MxKWS\KSWebShield.exe[804] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 01B1AEE0 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\Maxthon2\Modules\MxKWS\KSWebShield.exe[804] ole32.dll!CoRegisterClassObject 77517E90 5 Bytes JMP 01B1B220 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\Maxthon2\Modules\MxKWS\KSWebShield.exe[804] ole32.dll!CoRevokeClassObject 7752A2F3 5 Bytes JMP 01B1BE20 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Documents and Settings\Administrator\Desktop\gmer\gmer.exe[888] USER32.dll!CloseClipboard 7E430265 5 Bytes JMP 00F71042 C:\Program Files\Kingsoft\PowerWord PE\CBSelectText.dll (Kingsoft PowerWord PE/Kingsoft Corporation)
.text C:\Documents and Settings\Administrator\Desktop\gmer\gmer.exe[888] USER32.dll!OpenClipboard 7E430277 5 Bytes JMP 00F71000 C:\Program Files\Kingsoft\PowerWord PE\CBSelectText.dll (Kingsoft PowerWord PE/Kingsoft Corporation)
.text C:\Documents and Settings\Administrator\Desktop\gmer\gmer.exe[888] USER32.dll!EmptyClipboard 7E430D96 5 Bytes JMP 00F71021 C:\Program Files\Kingsoft\PowerWord PE\CBSelectText.dll (Kingsoft PowerWord PE/Kingsoft Corporation)
.text C:\Documents and Settings\Administrator\Desktop\gmer\gmer.exe[888] USER32.dll!SetClipboardData 7E430F9E 5 Bytes JMP 00F7106D C:\Program Files\Kingsoft\PowerWord PE\CBSelectText.dll (Kingsoft PowerWord PE/Kingsoft Corporation)
.text C:\Documents and Settings\Administrator\Desktop\gmer\gmer.exe[888] SHELL32.dll!ShellExecuteExW 7CA0996B 5 Bytes JMP 00E0AC60 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Documents and Settings\Administrator\Desktop\gmer\gmer.exe[888] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 00E0AEE0 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Documents and Settings\Administrator\Desktop\gmer\gmer.exe[888] ole32.dll!CoRegisterClassObject 77517E90 5 Bytes JMP 00E0B220 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Documents and Settings\Administrator\Desktop\gmer\gmer.exe[888] ole32.dll!CoRevokeClassObject 7752A2F3 5 Bytes JMP 00E0BE20 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[952] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 0143AEE0 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[952] ole32.dll!CoRegisterClassObject 77517E90 5 Bytes JMP 0143B220 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[952] ole32.dll!CoRevokeClassObject 7752A2F3 5 Bytes JMP 0143BE20 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[952] SHELL32.dll!ShellExecuteExW 7CA0996B 5 Bytes JMP 0143AC60 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\WINDOWS\system32\ZoneLabs\vsmon.exe[1696] ntdll.dll!KiFastSystemCall + 2 7C90E512 2 Bytes [CD, 20] {INT 0x20}
.text C:\WINDOWS\system32\ZoneLabs\vsmon.exe[1696] SHELL32.dll!ShellExecuteExW 7CA0996B 5 Bytes JMP 0466AC60 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\WINDOWS\system32\ZoneLabs\vsmon.exe[1696] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 0466AEE0 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\WINDOWS\system32\ZoneLabs\vsmon.exe[1696] ole32.dll!CoRegisterClassObject 77517E90 5 Bytes JMP 0466B220 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\WINDOWS\system32\ZoneLabs\vsmon.exe[1696] ole32.dll!CoRevokeClassObject 7752A2F3 5 Bytes JMP 0466BE20 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\WINDOWS\system32\conime.exe[2548] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 00B1AEE0 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\WINDOWS\system32\conime.exe[2548] ole32.dll!CoRegisterClassObject 77517E90 5 Bytes JMP 00B1B220 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\WINDOWS\system32\conime.exe[2548] ole32.dll!CoRevokeClassObject 7752A2F3 5 Bytes JMP 00B1BE20 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\WINDOWS\system32\conime.exe[2548] SHELL32.dll!ShellExecuteExW 7CA0996B 5 Bytes JMP 00B1AC60 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\AVG\AVG9\avgui.exe[2620] USER32.dll!CloseClipboard 7E430265 5 Bytes JMP 036E1042 C:\Program Files\Kingsoft\PowerWord PE\CBSelectText.dll (Kingsoft PowerWord PE/Kingsoft Corporation)
.text C:\Program Files\AVG\AVG9\avgui.exe[2620] USER32.dll!OpenClipboard 7E430277 5 Bytes JMP 036E1000 C:\Program Files\Kingsoft\PowerWord PE\CBSelectText.dll (Kingsoft PowerWord PE/Kingsoft Corporation)
.text C:\Program Files\AVG\AVG9\avgui.exe[2620] USER32.dll!EmptyClipboard 7E430D96 5 Bytes JMP 036E1021 C:\Program Files\Kingsoft\PowerWord PE\CBSelectText.dll (Kingsoft PowerWord PE/Kingsoft Corporation)
.text C:\Program Files\AVG\AVG9\avgui.exe[2620] USER32.dll!SetClipboardData 7E430F9E 5 Bytes JMP 036E106D C:\Program Files\Kingsoft\PowerWord PE\CBSelectText.dll (Kingsoft PowerWord PE/Kingsoft Corporation)
.text C:\Program Files\AVG\AVG9\avgui.exe[2620] SHELL32.dll!ShellExecuteExW 7CA0996B 5 Bytes JMP 015EAC60 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\AVG\AVG9\avgui.exe[2620] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 015EAEE0 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\AVG\AVG9\avgui.exe[2620] ole32.dll!CoRegisterClassObject 77517E90 5 Bytes JMP 015EB220 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\AVG\AVG9\avgui.exe[2620] ole32.dll!CoRevokeClassObject 7752A2F3 5 Bytes JMP 015EBE20 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\WINDOWS\Explorer.EXE[2624] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 01389160 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\WINDOWS\Explorer.EXE[2624] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 0137AEE0 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\WINDOWS\Explorer.EXE[2624] ole32.dll!CoRegisterClassObject 77517E90 5 Bytes JMP 0137B220 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\WINDOWS\Explorer.EXE[2624] ole32.dll!CoRevokeClassObject 7752A2F3 5 Bytes JMP 0137BE20 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\WINDOWS\Explorer.EXE[2624] SHELL32.dll!ShellExecuteExW 7CA0996B 5 Bytes JMP 0137AC60 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe[2648] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 00E1AEE0 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe[2648] ole32.dll!CoRegisterClassObject 77517E90 5 Bytes JMP 00E1B220 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe[2648] ole32.dll!CoRevokeClassObject 7752A2F3 5 Bytes JMP 00E1BE20 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe[2648] SHELL32.dll!ShellExecuteExW 7CA0996B 5 Bytes JMP 00E1AC60 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe[2864] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 0160AEE0 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe[2864] ole32.dll!CoRegisterClassObject 77517E90 5 Bytes JMP 0160B220 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe[2864] ole32.dll!CoRevokeClassObject 7752A2F3 5 Bytes JMP 0160BE20 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe[2864] SHELL32.dll!ShellExecuteExW 7CA0996B 5 Bytes JMP 0160AC60 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\Startup Faster 2004\SFAgent.exe[2912] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 00F0AEE0 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\Startup Faster 2004\SFAgent.exe[2912] ole32.dll!CoRegisterClassObject 77517E90 5 Bytes JMP 00F0B220 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\Startup Faster 2004\SFAgent.exe[2912] ole32.dll!CoRevokeClassObject 7752A2F3 5 Bytes JMP 00F0BE20 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\Startup Faster 2004\SFAgent.exe[2912] shell32.dll!ShellExecuteExW 7CA0996B 5 Bytes JMP 00F0AC60 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe[3024] SHELL32.dll!ShellExecuteExW 7CA0996B 5 Bytes JMP 034AAC60 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe[3024] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 034AAEE0 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe[3024] ole32.dll!CoRegisterClassObject 77517E90 5 Bytes JMP 034AB220 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe[3024] ole32.dll!CoRevokeClassObject 7752A2F3 5 Bytes JMP 034ABE20 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\PROGRA~1\AVG\AVG9\avgtray.exe[3092] SHELL32.dll!ShellExecuteExW 7CA0996B 5 Bytes JMP 019EAC60 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\PROGRA~1\AVG\AVG9\avgtray.exe[3092] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 019EAEE0 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\PROGRA~1\AVG\AVG9\avgtray.exe[3092] ole32.dll!CoRegisterClassObject 77517E90 5 Bytes JMP 019EB220 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\PROGRA~1\AVG\AVG9\avgtray.exe[3092] ole32.dll!CoRevokeClassObject 7752A2F3 5 Bytes JMP 019EBE20 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\StartupFaster\akeys.exe[3180] SHELL32.dll!ShellExecuteExW 7CA0996B 5 Bytes JMP 00C6AC60 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\StartupFaster\akeys.exe[3180] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 00C6AEE0 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\StartupFaster\akeys.exe[3180] ole32.dll!CoRegisterClassObject 77517E90 5 Bytes JMP 00C6B220 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\StartupFaster\akeys.exe[3180] ole32.dll!CoRevokeClassObject 7752A2F3 5 Bytes JMP 00C6BE20 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\WINDOWS\system32\igfxpers.exe[3252] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 013DAEE0 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\WINDOWS\system32\igfxpers.exe[3252] ole32.dll!CoRegisterClassObject 77517E90 5 Bytes JMP 013DB220 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\WINDOWS\system32\igfxpers.exe[3252] ole32.dll!CoRevokeClassObject 7752A2F3 5 Bytes JMP 013DBE20 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\WINDOWS\system32\igfxpers.exe[3252] SHELL32.dll!ShellExecuteExW 7CA0996B 5 Bytes JMP 013DAC60 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\WINDOWS\system32\igfxsrvc.exe[3268] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 0131AEE0 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\WINDOWS\system32\igfxsrvc.exe[3268] ole32.dll!CoRegisterClassObject 77517E90 5 Bytes JMP 0131B220 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\WINDOWS\system32\igfxsrvc.exe[3268] ole32.dll!CoRevokeClassObject 7752A2F3 5 Bytes JMP 0131BE20 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\WINDOWS\system32\igfxsrvc.exe[3268] SHELL32.dll!ShellExecuteExW 7CA0996B 5 Bytes JMP 0131AC60 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe[3444] SHELL32.dll!ShellExecuteExW 7CA0996B 5 Bytes JMP 0152AC60 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe[3444] OLE32.DLL!CoCreateInstance 7750057E 5 Bytes JMP 0152AEE0 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe[3444] OLE32.DLL!CoRegisterClassObject 77517E90 5 Bytes JMP 0152B220 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe[3444] OLE32.DLL!CoRevokeClassObject 7752A2F3 5 Bytes JMP 0152BE20 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\WinPatrol\winpatrol.exe[3528] SHELL32.dll!ShellExecuteExW 7CA0996B 5 Bytes JMP 00D2AC60 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\WinPatrol\winpatrol.exe[3528] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 00D2AEE0 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\WinPatrol\winpatrol.exe[3528] ole32.dll!CoRegisterClassObject 77517E90 5 Bytes JMP 00D2B220 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\WinPatrol\winpatrol.exe[3528] ole32.dll!CoRevokeClassObject 7752A2F3 5 Bytes JMP 00D2BE20 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[3780] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 0159AEE0 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[3780] ole32.dll!CoRegisterClassObject 77517E90 5 Bytes JMP 0159B220 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[3780] ole32.dll!CoRevokeClassObject 7752A2F3 5 Bytes JMP 0159BE20 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe[3780] SHELL32.dll!ShellExecuteExW 7CA0996B 5 Bytes JMP 0159AC60 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe[4012] SHELL32.dll!ShellExecuteExW 7CA0996B 5 Bytes JMP 00DEAC60 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe[4012] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 00DEAEE0 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe[4012] ole32.dll!CoRegisterClassObject 77517E90 5 Bytes JMP 00DEB220 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe[4012] ole32.dll!CoRevokeClassObject 7752A2F3 5 Bytes JMP 00DEBE20 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\Kingsoft\PowerWord PE\CBTray.exe[4044] USER32.dll!CloseClipboard 7E430265 5 Bytes JMP 03921042 C:\Program Files\Kingsoft\PowerWord PE\CBSelectText.dll (Kingsoft PowerWord PE/Kingsoft Corporation)
.text C:\Program Files\Kingsoft\PowerWord PE\CBTray.exe[4044] USER32.dll!OpenClipboard 7E430277 5 Bytes JMP 03921000 C:\Program Files\Kingsoft\PowerWord PE\CBSelectText.dll (Kingsoft PowerWord PE/Kingsoft Corporation)
.text C:\Program Files\Kingsoft\PowerWord PE\CBTray.exe[4044] USER32.dll!EmptyClipboard 7E430D96 5 Bytes JMP 03921021 C:\Program Files\Kingsoft\PowerWord PE\CBSelectText.dll (Kingsoft PowerWord PE/Kingsoft Corporation)
.text C:\Program Files\Kingsoft\PowerWord PE\CBTray.exe[4044] USER32.dll!SetClipboardData 7E430F9E 5 Bytes JMP 0392106D C:\Program Files\Kingsoft\PowerWord PE\CBSelectText.dll (Kingsoft PowerWord PE/Kingsoft Corporation)
.text C:\Program Files\Kingsoft\PowerWord PE\CBTray.exe[4044] SHELL32.dll!ShellExecuteExW 7CA0996B 5 Bytes JMP 0262AC60 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\Kingsoft\PowerWord PE\CBTray.exe[4044] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 0262AEE0 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\Kingsoft\PowerWord PE\CBTray.exe[4044] ole32.dll!CoRegisterClassObject 77517E90 5 Bytes JMP 0262B220 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)
.text C:\Program Files\Kingsoft\PowerWord PE\CBTray.exe[4044] ole32.dll!CoRevokeClassObject 7752A2F3 5 Bytes JMP 0262BE20 C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (金山网盾/Kingsoft Corporation)

—- Devices - GMER 1.0.15 —-

Device \Driver\Tcpip \Device\Ip vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\Tcpip \Device\Tcp vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB)

Device \Driver\Tcpip \Device\Udp vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp Lbd.sys (Boot Driver/Lavasoft AB)

Device \Driver\Tcpip \Device\RawIp vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp Lbd.sys (Boot Driver/Lavasoft AB)

Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SOFTWARE\Classes\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\Indeo?video 5.10 Compression Filter
Reg HKLM\SOFTWARE\Classes\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\Indeo?video 5.10 Compression Filter@FriendlyName Indeo? video 5.10 Compression Filter
Reg HKLM\SOFTWARE\Classes\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\Indeo?video 5.10 Compression Filter@CLSID {1F73E9B1-8C3A-11D0-A3BE-00A0C9244436}
Reg HKLM\SOFTWARE\Classes\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\Indeo?video 5.10 Compression Filter@FilterData 0x02 0x00 0x00 0x00 …
Reg HKLM\SOFTWARE\Classes\CLSID\{33D9A760-90C8-11d0-BD43-00A0C911CE86}\Instance\Indeo?video 5.10 Compression Filter@EncoderType 1

—- EOF - GMER 1.0.15 —-

Tom_q2356

Post #5May 20, 2010, 1:33 PM UTC

DDS (Ver_10-03-17.01) - NTFSx86 Run by [removed] at 3:25:40.70 on 05/20/2010 Thu Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20 Microsoft Windows XP Professional 5.1.2600.3.936.86.1033.18.2039.1272 [GMT -7:00] AV: AVG Anti-Virus *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} FW: ZoneAlarm Pro Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe C:\Program Files\AVG\AVG9\avgchsvx.exe C:\Program Files\AVG\AVG9\avgrsx.exe svchost.exe C:\Program Files\AVG\AVG9\avgcsrvx.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\Program Files\Maxthon2\Modules\MxKWS\KSWebShield.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\AVG\AVG9\avgwdsvc.exe C:\WINDOWS\system32\svchost.exe -k hpdevmgmt C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\AVG\AVG9\avgam.exe C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe C:\Program Files\AVG\AVG9\avgnsx.exe C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe C:\WINDOWS\Installer\MSI14.tmp C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\AVG\AVG9\avgemc.exe C:\Program Files\AVG\AVG9\avgcsrvx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Startup Faster 2004\SFAgent.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\PROGRA~1\AVG\AVG9\avgtray.exe C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\StartupFaster\akeys.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\WinPatrol\winpatrol.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe C:\Program Files\Kingsoft\PowerWord PE\CBTray.exe C:\Program Files\AVG\AVG9\avgcsrvx.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe C:\Program Files\Kingsoft\PowerWord PE\ksdsvc.exe C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe C:\WINDOWS\system32\conime.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\AVG\AVG9\avgui.exe C:\Documents and Settings\Administrator\Desktop\dds.scr ============== Pseudo HJT Report =============== uSearch Page = hxxp://www.baidu.com/index.php?tn=avantcn_dg uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll BHO: IE2EMBHO Class: {0a0ddbd3-6641-40b9-873f-bbdd26d6c14e} - c:\program files\easymule\modules\IE2EM.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll BHO: RoboForm: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: 谷歌金山词霸for IE: {a28581a7-e2a8-4b6c-9cc9-4a4cc1efd55a} - c:\program files\kingsoft\powerword pe\SelectForIE.dll BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll BHO: ICBC Anti-Phishing class: {bb4491a2-d11a-4c6b-91c0-b53246a3122b} - c:\program files\icbcebanktools\icbcantiphishing\Icbc_AntiPhishing.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: DAPIELoader Class: {ff6c3cf0-4b15-11d1-abed-709549c10000} - c:\progra~1\dap\DAPIEL~1.DLL BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll dRun: [KingSoft PowerWord PE] c:\program files\kingsoft\powerword pe\CBTray.exe -AUTORUN StartupFolder: c:\documents and settings\administrator\start menu\programs\startup\startupfaster\akeys.exe StartupFolder: c:\documents and settings\administrator\start menu\programs\startup\startupfaster\StartupFaster.ini StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\startu~1\hp digital imaging monitor.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe StartupFolder: c:\documents and settings\all users\start menu\programs\startup\startupfaster\StartupFaster.ini mPolicies-explorer: NoResolveTrack = 1 (0x1) IE: &Clean Traces - c:\program files\dap\privacy package\dapcleanerie.htm IE: &Download with &DAP - c:\program files\dap\dapextie.htm IE: Customize Menu - file://c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html IE: Download &all with DAP - c:\program files\dap\dapextie2.htm IE: Download by easyMule - c:\program files\easymule\IE2EM.htm IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.html IE: Logoff - file://c:\program files\siber systems\ai roboform\RoboFormComLogoff.html IE: RoboForm Toolbar - file://c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html IE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.html IE: 使用光影编辑和美化 - c:\program files\neo imaging\NeoOpenNeo.htm IE: 导出到 Microsoft Office Excel(&X) - c:\progra~1\micros~3\office11\EXCEL.EXE/3000 IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\RoboFormComFillForms.html IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\RoboFormComSavePass.html IE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL IE: {9D5CCDC3-545F-4418-8AEC-9CD2773B4861} - {48B4D816-8BE7-4F32-85C9-F2E912C02311} - c:\program files\kingsoft\powerword pe\SelectForIE.dll IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll DPF: {3AA9CF07-DF20-48FF-98BE-DED276E40146} - hxxps://mybank.icbc.com.cn/icbc/GDReadPub.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} - hxxps://mybank.icbc.com.cn/icbc/newperbank/AxSafeControls.cab DPF: {B1FBC1AD-5644-4084-882A-0F8BA85E7506} - hxxps://mybank.icbc.com.cn/icbc/ICBC_NetSign.dll DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll Notify: avgrsstarter - avgrsstx.dll Notify: igfxcui - igfxdev.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL Hosts: 127.0.0.1 www.spywareinfo.com ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\qukg6nqh.default\ FF - component: c:\program files\siber systems\ai roboform\firefox\components\rfproxy_31.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} —- FIREFOX POLICIES —- FF - user.js: yahoo.homepage.dontask - truec:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2010-4-24 52872] R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-4-24 64288] R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-4-24 216200] R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-4-24 29512] R1 AvgTdiX;AVG Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-4-24 242896] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-2-17 68168] R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2010-5-2 353680] R2 avg9emc;AVG E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2010-4-24 916760] R2 avg9wd;AVG WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-4-24 308064] R2 KAVSafe;KAVSafe;c:\windows\system32\drivers\KAVSafe.sys [2010-4-25 60008] R2 Kingsoft Antivirus WebShield Service;Kingsoft Antivirus WebShield Service;c:\program files\maxthon2\modules\mxkws\KSWebShield.exe [2010-4-24 202136] R2 KSDSVC;Kingsoft Common Content Service;c:\program files\kingsoft\powerword pe\ksdsvc.exe [2009-10-29 25240] R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-4-26 304464] R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\common files\pc tools\smonitor\StartManSvc.exe [2010-4-24 583640] R2 SCPDFReadSpool;SolidConverterPDFReadSpool;c:\windows\installer\MSI14.tmp [2010-4-28 189696] R2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service –> c:\windows\system32\zonelabs\vsmon.exe -service [?] R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [2010-4-24 87936] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2010-4-26 20952] S2 ICBC Daemon Service;ICBC Daemon Service;c:\program files\icbcebanktools\icbcantiphishing\IcbcDaemon.exe [2009-10-14 397184] S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-2-4 1314704] S3 DfSdkS;Defragmentation-Service;c:\program files\ashampoo\ashampoo winoptimizer 6\DfSdkS.exe [2010-4-24 406016] S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2010-2-17 12872] =============== Created Last 30 ================ 2010-05-19 03:54:08 0 d—–w- c:\docume~1\admini~1\applic~1\UnitConverter 2010-05-15 03:21:39 0 d—–w- c:\program files\Trend Micro 2010-05-12 17:09:52 0 d—–w- c:\program files\Moffsoft FreeCalc 2010-05-11 23:18:31 0 d—–w- c:\program files\ICBCEbankTools 2010-05-08 04:56:52 0 d—–w- c:\program files\common files\rplsp 2010-05-08 00:09:22 116 —-a-w- c:\windows\system32\msjmslo1041.ini 2010-05-08 00:01:35 0 d—–w- c:\windows\speech 2010-05-07 23:57:37 466944 —-a-w- c:\windows\system32\iviaudio.ax 2010-05-07 23:57:31 0 d—–w- c:\program files\WinMPG VideoConvert 2010-05-07 23:51:08 0 d—–w- c:\program files\calc450 2010-05-07 23:32:55 0 d—–w- c:\docume~1\admini~1\applic~1\Design Science 2010-05-07 23:22:23 0 d—–w- c:\program files\MathType 2010-05-07 14:11:25 0 d—–w- c:\docume~1\admini~1\applic~1\Thinstall 2010-05-07 14:06:25 0 d—–w- c:\program files\图片无损放大.PhotoZoomPro2.3.4中文绿色单文件版 2010-05-06 22:23:40 0 d—–w- c:\program files\foxit_reader 2010-05-06 19:46:45 0 d—–w- c:\docume~1\admini~1\applic~1\Foxit Software 2010-05-04 05:33:32 0 d—–w- c:\program files\3dhome40 2010-05-03 16:19:30 5632 —-a-w- c:\windows\system32\ptpusb.dll 2010-05-03 16:19:29 159232 —-a-w- c:\windows\system32\ptpusd.dll 2010-05-03 16:19:28 15104 -c–a-w- c:\windows\system32\dllcache\usbscan.sys 2010-05-03 16:19:28 15104 —-a-w- c:\windows\system32\drivers\usbscan.sys 2010-05-03 06:48:52 0 d—–w- c:\docume~1\admini~1\applic~1\WinPatrol 2010-05-03 06:47:59 0 d—–w- c:\program files\WinPatrol 2010-05-02 17:51:34 1221008 —-a-w- c:\windows\system32\zpeng25.dll 2010-05-02 17:51:33 0 d—–w- c:\windows\system32\ZoneLabs 2010-05-02 17:51:33 0 d—–w- c:\program files\Zone Labs 2010-05-02 17:51:31 352606 —-a-w- c:\windows\system32\vsconfig.xml 2010-05-02 17:50:12 0 d—–w- c:\windows\Internet Logs 2010-05-02 08:04:35 14048 ——w- c:\windows\system32\spmsg2.dll 2010-05-02 08:04:06 0 d—–w- c:\windows\system32\zh-CN 2010-05-02 08:01:19 0 d—–w- c:\windows\system32\XPSViewer 2010-05-02 08:00:57 216 —-a-w- c:\windows\system32\spupdsvc.inf 2010-05-02 08:00:21 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2010-05-02 08:00:21 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2010-05-02 08:00:21 117760 ——w- c:\windows\system32\prntvpt.dll 2010-05-02 08:00:20 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll 2010-05-02 08:00:20 575488 ——w- c:\windows\system32\xpsshhdr.dll 2010-05-02 08:00:20 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll 2010-05-02 08:00:20 1676288 ——w- c:\windows\system32\xpssvcs.dll 2010-05-02 08:00:20 0 d—–w- C:\3b402a29296d391eef78226f 2010-05-02 07:02:46 0 d—–w- c:\docume~1\admini~1\applic~1\CheckPoint 2010-04-30 20:22:55 0 d—–w- c:\program files\Hard Drive Inspector Professional v3.70.337 2010-04-30 20:20:35 0 d—–w- c:\docume~1\alluse~1\applic~1\AltrixSoft 2010-04-29 04:17:08 72 —-a-w- c:\windows\ConverterCore.INI 2010-04-29 04:13:32 0 d—–w- c:\docume~1\admini~1\applic~1\SolidDocuments 2010-04-29 04:11:42 21248 —-a-w- c:\windows\system32\solidlocalmon.dll 2010-04-29 04:11:42 13568 —-a-w- c:\windows\system32\solidlocalui.dll 2010-04-29 04:11:33 0 d—–w- c:\program files\SolidDocuments 2010-04-29 04:11:14 0 d—–w- c:\docume~1\alluse~1\applic~1\SolidDocuments 2010-04-28 01:23:04 0 d—–w- c:\docume~1\admini~1\applic~1\Tencent 2010-04-28 01:07:52 0 d—–w- c:\docume~1\alluse~1\applic~1\Tencent 2010-04-28 01:02:28 0 d—–w- c:\program files\腾讯游戏 2010-04-27 08:01:01 0 d—–w- c:\program files\StormII 2010-04-27 07:08:52 0 d—–w- c:\program files\Conew 2010-04-27 07:07:37 0 d—–w- c:\docume~1\admini~1\applic~1\Meitu 2010-04-27 07:07:09 0 d—–w- c:\program files\Meitu 2010-04-27 07:05:45 20 —-a-w- c:\windows\system32\pub_store.dat 2010-04-27 07:04:18 0 d—–w- c:\program files\nEO iMAGING 2010-04-27 06:11:42 0 d–h–w- C:\$AVG 2010-04-26 20:46:14 0 d—–w- c:\program files\easyMule 2010-04-26 19:13:45 0 d—–w- c:\docume~1\alluse~1\applic~1\WEBREG 2010-04-26 19:09:47 0 d—–w- c:\program files\common files\HP 2010-04-26 19:08:47 271704 —-a-r- c:\windows\system32\hpzids01.dll 2010-04-26 19:08:45 117760 —-a-w- c:\windows\system32\hpzll5mu.dll 2010-04-26 19:06:32 0 d—–w- c:\program files\HP 2010-04-26 19:06:24 25856 -c–a-w- c:\windows\system32\dllcache\usbprint.sys 2010-04-26 19:06:24 25856 —-a-w- c:\windows\system32\drivers\usbprint.sys 2010-04-26 18:59:48 168980 —-a-w- c:\windows\hphins27.dat 2010-04-26 18:59:47 787 ——w- c:\windows\hphmdl27.dat 2010-04-26 13:40:17 0 d—–w- c:\docume~1\admini~1\applic~1\SogouExplorer 2010-04-26 13:39:46 0 d—–w- c:\program files\SogouExtension 2010-04-26 13:28:34 0 d—–w- c:\docume~1\admini~1\applic~1\Malwarebytes 2010-04-26 13:28:21 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-04-26 13:28:19 0 d—–w- c:\docume~1\alluse~1\applic~1\Malwarebytes 2010-04-26 13:28:18 20952 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-04-26 13:28:18 0 d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-04-25 19:35:26 0 d—–w- c:\program files\Startup Faster 2004 2010-04-25 15:58:06 60008 —-a-w- c:\windows\system32\drivers\KAVSafe.sys 2010-04-25 15:37:02 274288 —-a-w- c:\windows\system32\mucltui.dll 2010-04-25 15:37:02 215920 —-a-w- c:\windows\system32\muweb.dll 2010-04-25 15:37:02 16736 —-a-w- c:\windows\system32\mucltui.dll.mui 2010-04-25 06:45:17 73728 —-a-w- c:\windows\system32\javacpl.cpl 2010-04-25 06:45:17 411368 —-a-w- c:\windows\system32\deployJava1.dll 2010-04-25 06:09:30 0 d—–w- c:\docume~1\admini~1\applic~1\URSoft 2010-04-25 06:05:01 73 —-a-w- c:\windows\EurekaLog.ini 2010-04-25 06:00:01 0 d—–w- c:\program files\StartupFaster 2010-04-25 05:47:49 0 d—–w- c:\program files\Wisdom-soft ScreenHunter 5 Free 2010-04-25 05:28:44 0 d—–w- c:\program files\Raxco 2010-04-25 01:28:43 0 d—–w- c:\program files\YourWare Solutions 2010-04-25 01:18:37 0 d—–w- c:\docume~1\admini~1\applic~1\Registry Mechanic 2010-04-25 01:12:53 376 —-a-w- c:\windows\ODBC.INI 2010-04-25 01:12:08 0 d—–w- c:\program files\Microsoft ActiveSync 2010-04-25 01:11:53 0 d—–w- c:\windows\SHELLNEW 2010-04-25 01:06:06 15880 —-a-w- c:\windows\system32\lsdelete.exe 2010-04-25 00:30:45 0 d—–w- c:\program files\Siber Systems 2010-04-25 00:16:46 0 d—–w- c:\windows\pss 2010-04-24 23:05:50 0 d—–w- c:\program files\CursorXP 2010-04-24 23:00:40 0 d—–w- c:\docume~1\admini~1\applic~1\kingsoft 2010-04-24 23:00:24 0 d—–w- c:\program files\Kingsoft 2010-04-24 22:50:12 0 d—–w- c:\docume~1\admini~1\applic~1\SogouPY.users 2010-04-24 22:49:48 0 d—–w- c:\program files\SogouInput 2010-04-24 22:49:48 0 d—–w- c:\docume~1\admini~1\applic~1\SogouPY 2010-04-24 22:34:37 0 d—–w- c:\docume~1\alluse~1\applic~1\kingsoft 2010-04-24 22:34:27 0 d—–w- c:\program files\Maxthon2 2010-04-24 22:02:05 0 d—–w- c:\windows\system32\LogFiles 2010-04-24 22:00:37 8704 -c—-w- c:\windows\system32\dllcache\tsbyuv.dll 2010-04-24 22:00:36 48128 -c—-w- c:\windows\system32\dllcache\iyuv_32.dll 2010-04-24 21:58:48 2560 ——w- c:\windows\system32\xpsp4res.dll 2010-04-24 21:58:20 26144 —-a-w- c:\windows\system32\spupdsvc.exe 2010-04-24 21:58:20 0 d—–w- c:\windows\system32\PreInstall 2010-04-24 21:58:18 0 d–h–w- c:\windows\$hf_mig$ 2010-04-24 21:53:03 12464 —-a-w- c:\windows\system32\avgrsstx.dll 2010-04-24 21:48:48 0 d—–w- c:\windows\system32\SoftwareDistribution 2010-04-24 21:47:18 10165 —-a-w- c:\windows\ePrompter.ini 2010-04-24 21:47:12 0 d—–w- c:\program files\ePrompter 2010-04-24 21:39:57 135168 —-a-w- c:\windows\system32\igfxres.dll 2010-04-24 21:39:22 0 d—–w- c:\documents and settings\administrator\Tracing 2010-04-24 21:38:18 0 d—–w- c:\program files\Microsoft 2010-04-24 21:38:00 0 d—–w- c:\program files\Windows Live SkyDrive 2010-04-24 21:34:49 192512 ——w- c:\windows\system32\AegisI5.exe 2010-04-24 21:33:50 87936 —-a-r- c:\windows\system32\drivers\gtipci21.sys 2010-04-24 21:33:50 28672 —-a-r- c:\windows\cttib1.dll 2010-04-24 21:33:34 0 d—–w- c:\windows\tiinst 2010-04-24 21:25:45 0 d—–w- c:\program files\common files\Windows Live 2010-04-24 21:23:08 0 d—–w- c:\docume~1\alluse~1\applic~1\Fetion 2010-04-24 21:22:45 0 d—–w- c:\docume~1\admini~1\applic~1\Fetion 2010-04-24 21:22:03 0 d—–w- c:\program files\China Mobile 2010-04-24 21:10:50 0 d—–w- c:\docume~1\admini~1\applic~1\Avant Profiles 2010-04-24 21:10:33 0 d—–w- c:\program files\Avant Browser 2010-04-24 20:57:29 56 —ha-w- c:\windows\system32\ezsidmv.dat 2010-04-24 20:55:42 0 d—–r- c:\program files\Skype 2010-04-24 20:51:22 0 d—–w- c:\docume~1\admini~1\applic~1\TeamViewer 2010-04-24 20:51:11 0 d—–w- c:\program files\TeamViewer 2010-04-24 20:41:50 0 d—–w- c:\docume~1\admini~1\applic~1\Trillian 2010-04-24 20:38:01 0 d—–w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com 2010-04-24 20:37:51 0 d—–w- c:\program files\SUPERAntiSpyware 2010-04-24 20:37:51 0 d—–w- c:\docume~1\admini~1\applic~1\SUPERAntiSpyware.com 2010-04-24 20:37:36 0 d—–w- c:\program files\common files\Wise Installation Wizard 2010-04-24 20:32:04 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys 2010-04-24 20:31:44 95024 —-a-w- c:\windows\system32\drivers\SBREDrv.sys 2010-04-24 20:23:48 0 dc-h–w- c:\docume~1\alluse~1\applic~1\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6} 2010-04-24 20:23:33 0 d—–w- c:\program files\Lavasoft 2010-04-24 20:17:59 0 d—–w- c:\program files\Spybot - Search & Destroy 2010-04-24 20:17:59 0 d—–w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy 2010-04-24 20:14:26 118784 —-a-w- c:\windows\system32\MSSTDFMT.DLL 2010-04-24 20:14:26 0 d—–w- c:\program files\SpywareBlaster 2010-04-24 20:13:43 0 d—–w- c:\program files\CCleaner 2010-04-24 20:09:43 0 d—–w- c:\docume~1\alluse~1\applic~1\SpeedBit 2010-04-24 20:09:30 172032 —-a-w- c:\windows\system32\AniGIF.ocx 2010-04-24 20:09:29 0 d—–w- c:\program files\DAP 2010-04-24 20:03:56 0 d-sh–w- c:\documents and settings\administrator\IECompatCache 2010-04-24 20:03:01 0 d-sh–w- c:\documents and settings\administrator\PrivacIE 2010-04-24 19:57:44 0 d—–w- c:\program files\Idailydiary 2010-04-24 19:53:59 70144 -c–a-w- c:\windows\system32\dllcache\pintlphr.exe 2010-04-24 19:50:00 0 d—–w- c:\docume~1\admini~1\applic~1\Softarium.com 2010-04-24 19:49:50 0 d—–w- c:\program files\reliz 2010-04-24 19:48:04 0 d—–w- c:\program files\Allok RM RMVB to AVI MPEG DVD Converter 2010-04-24 19:44:36 880640 —-a-w- c:\windows\system32\UniBox10.ocx 2010-04-24 19:44:36 212992 —-a-w- c:\windows\system32\UniBoxVB12.ocx 2010-04-24 19:44:36 1101824 —-a-w- c:\windows\system32\UniBox210.ocx 2010-04-24 19:44:35 1071088 —-a-w- c:\windows\system32\MSCOMCTL.OCX 2010-04-24 19:44:34 0 d—–w- c:\program files\common files\PC Tools 2010-04-24 19:40:46 0 d-sh–w- c:\documents and settings\administrator\IETldCache 2010-04-24 19:39:19 28160 —-a-w- c:\windows\system32\DfSdkBt.exe 2010-04-24 19:35:10 0 d—–w- c:\program files\Ashampoo 2010-04-24 19:34:41 0 d–h–w- c:\windows\PIF 2010-04-24 19:31:55 594432 -c—-w- c:\windows\system32\dllcache\msfeeds.dll 2010-04-24 19:31:55 55296 -c—-w- c:\windows\system32\dllcache\msfeedsbs.dll 2010-04-24 19:31:55 247808 -c—-w- c:\windows\system32\dllcache\ieproxy.dll 2010-04-24 19:31:55 1985536 -c—-w- c:\windows\system32\dllcache\iertutil.dll 2010-04-24 19:31:55 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll 2010-04-24 19:31:55 11070976 -c—-w- c:\windows\system32\dllcache\ieframe.dll 2010-04-24 19:31:51 0 d—–w- c:\windows\ie8updates 2010-04-24 19:31:48 64000 -c—-w- c:\windows\system32\dllcache\iecompat.dll 2010-04-24 19:30:33 0 dc-h–w- c:\windows\ie8 2010-04-24 19:17:12 272128 -c—-w- c:\windows\system32\dllcache\bthport.sys 2010-04-24 19:17:12 272128 ——w- c:\windows\system32\drivers\bthport.sys 2010-04-24 19:15:48 455680 -c—-w- c:\windows\system32\dllcache\mrxsmb.sys 2010-04-24 19:09:50 2146304 -c—-w- c:\windows\system32\dllcache\ntkrnlmp.exe 2010-04-24 19:09:49 2189952 -c—-w- c:\windows\system32\dllcache\ntoskrnl.exe 2010-04-24 19:09:48 2024448 -c—-w- c:\windows\system32\dllcache\ntkrpamp.exe 2010-04-24 19:04:24 0 d—–w- c:\program files\Windows Media Connect 2 2010-04-24 18:26:20 0 d—–w- c:\program files\Broadcom 2010-04-24 18:21:09 5 —-a-w- c:\windows\system32\drivers\DELL_LAT_D610.MRK 2010-04-24 18:21:09 5 —-a-w- c:\windows\system32\drivers\1028_DELL_LAT_D610.MRK 2010-04-24 18:21:04 666 —-a-w- c:\windows\speed.reg 2010-04-24 18:15:13 0 d—–w- c:\windows\system32\ReinstallBackups 2010-04-24 18:14:19 0 d—–w- c:\program files\Dell 2010-04-24 18:14:19 0 d—–w- c:\program files\common files\Zeepe Framework 7 2010-04-24 18:14:19 0 d—–w- c:\docume~1\alluse~1\applic~1\Novatel Wireless 2010-04-24 18:09:57 7552 -c–a-w- c:\windows\system32\dllcache\mskssrv.sys 2010-04-24 18:09:38 0 d—–w- c:\program files\SigmaTel 2010-04-24 18:07:01 0 d—–w- c:\docume~1\admini~1\applic~1\AVG9 2010-04-24 18:05:40 52872 —-a-w- c:\windows\system32\drivers\avgrkx86.sys 2010-04-24 18:05:40 242896 —-a-w- c:\windows\system32\drivers\avgtdix.sys 2010-04-24 18:05:39 216200 —-a-w- c:\windows\system32\drivers\avgldx86.sys 2010-04-24 18:05:39 0 d—–w- c:\windows\system32\drivers\Avg 2010-04-24 18:05:35 0 d—–w- c:\docume~1\alluse~1\applic~1\AVG Security Toolbar 2010-04-24 18:05:28 0 d—–w- c:\program files\AVG 2010-04-24 18:05:27 0 d—–w- c:\docume~1\alluse~1\applic~1\avg9 2010-04-24 17:40:44 0 d-sh–w- c:\documents and settings\all users\DRM 2010-04-24 17:40:22 0 d–h–w- c:\program files\WindowsUpdate 2010-04-24 17:39:41 0 d—–w- c:\program files\common files\MSSoap 2010-04-24 17:37:57 0 d—–w- c:\program files\Online Services 2010-04-24 17:37:50 0 d—–w- c:\program files\Messenger 2010-04-24 17:37:46 0 d—–w- c:\program files\MSN Gaming Zone 2010-04-24 17:37:06 0 d—–w- c:\program files\Windows NT 2010-04-23 22:31:00 0 d—–w- c:\program files\common files\ODBC 2010-04-23 22:30:56 0 d—–w- c:\program files\common files\SpeechEngines 2010-04-23 22:30:31 0 d—–r- c:\documents and settings\all users\Documents ==================== Find3M ==================== 2010-05-19 15:06:23 4212 —ha-w- c:\windows\system32\zllictbl.dat 2010-04-24 17:38:22 21640 —-a-w- c:\windows\system32\emptyregdb.dat 2010-03-10 06:15:52 420352 —-a-w- c:\windows\system32\vbscript.dll 2010-02-25 06:24:37 916480 —-a-w- c:\windows\system32\wininet.dll ============= FINISH: 3:26:35.46 ===============

Tom_q2356

Post #6May 20, 2010, 1:34 PM UTC last edited May 20, 2010, 1:37 PM UTC

"UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_10-03-17.01)" I will post this when you say so. Thanks for your help!

martix

Post #7May 21, 2010, 11:38 PM UTC

Hi Tom,

The notification you get from Spybot could be an info for the usage of more than one Security programs. You must use one AV and one Firewall. I see you have also remanants of Kingsoft and SuperAntispyware. I would advise you to uninstall them.
For more information you can see this.

However I would like to look a bit deeper for possible problems so please:

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in
netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
mv61xx.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

Tom_q2356

Post #8May 22, 2010, 5:26 AM UTC

OTL logfile created on: 5/21/2010 6:53:31 PM - Run 1
OTL by OldTimer - Version 3.2.5.0 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 65.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 211.54 Gb Free Space | 90.84% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: TomCLINIC
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\WINDOWS\Installer\MSI14.tmp (Solid Documents, LLC)
PRC - C:\Program Files\Maxthon2\Modules\MxKWS\KSWebShield.exe (Kingsoft Corporation)
PRC - C:\Program Files\AVG\AVG9\avgui.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgam.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe (Raxco Software, Inc.)
PRC - C:\Program Files\Kingsoft\PowerWord PE\ksdsvc.exe (Kingsoft Corporation)
PRC - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe (PC Tools)
PRC - C:\Program Files\WinPatrol\WinPatrol.exe (BillP Studios)
PRC - C:\Program Files\Idailydiary\iDD.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\conime.exe (Microsoft Corporation)
PRC - C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe (YourWare Solutions ™)
PRC - C:\Program Files\Startup Faster 2004\SFAgent.exe (URSoft,Inc)
PRC - C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\StartupFaster\akeys.exe (Softarium.com)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Maxthon2\Modules\MxKWS\kwsui.dll (Kingsoft Corporation)
MOD - C:\Program Files\Maxthon2\Modules\MxKWS\kswebshield.dll (Kingsoft Corporation)
MOD - C:\Program Files\WinPatrol\patrolpro.dll (BillP Studios)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (Lavasoft Ad-Aware Service) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (SCPDFReadSpool) – C:\WINDOWS\Installer\MSI14.tmp (Solid Documents, LLC)
SRV - (HDDSvc) – C:\Program Files\Hard Drive Inspector Professional v3.70.337\Hard Drive Inspector Professional v3.70.337\App\HDInspector\HDDSvc.exe (AltrixSoft (http://www.altrixsoft.com/))
SRV - (Kingsoft Antivirus WebShield Service) – C:\Program Files\Maxthon2\Modules\MxKWS\KSWebShield.exe (Kingsoft Corporation)
SRV - (avg9wd) – C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg9emc) – C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (PDEngine) – C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe (Raxco Software, Inc.)
SRV - (PDAgent) – C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe (Raxco Software, Inc.)
SRV - (KSDSVC) – C:\Program Files\Kingsoft\PowerWord PE\ksdsvc.exe (Kingsoft Corporation)
SRV - (PCToolsSSDMonitorSvc) – C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe (PC Tools)
SRV - (ICBC Daemon Service) – C:\Program Files\ICBCEbankTools\ICBCAntiPhishing\IcbcDaemon.exe ()
SRV - (DfSdkS) – C:\Program Files\Ashampoo\Ashampoo WinOptimizer 6\Dfsdks.exe (mst software GmbH, Germany)
SRV - (vsmon) – C:\WINDOWS\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)

========== Driver Services (SafeList) ==========

DRV - (SASKUTIL) – File not found
DRV - (SASDIFSV) – File not found
DRV - (MBAMProtector) – C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (KAVSafe) – C:\WINDOWS\system32\drivers\KAVSafe.sys (Kingsoft Corporation)
DRV - (AvgTdiX) – C:\WINDOWS\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) – C:\WINDOWS\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgLdx86) – C:\WINDOWS\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgRkx86) – C:\WINDOWS\System32\Drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Lbd) – C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (DefragFS) – C:\WINDOWS\system32\drivers\DefragFs.sys (Raxco Software, Inc.)
DRV - (vsdatant) – C:\WINDOWS\system32\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (srescan) – C:\WINDOWS\system32\ZoneLabs\srescan.sys (Check Point Software Technologies LTD)
DRV - (FsVga) – C:\WINDOWS\system32\drivers\fsvga.sys (Microsoft Corporation)
DRV - (NWADI) – C:\WINDOWS\system32\drivers\NWADIenum.sys (Novatel Wireless Inc)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (GTIPCI21) – C:\WINDOWS\system32\drivers\gtipci21.sys (Texas Instruments)
DRV - (STAC97) – C:\WINDOWS\system32\drivers\STAC97.sys (SigmaTel, Inc.)
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.baidu.com/index.php?tn=avantcn_dg
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:[removed]
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.9
FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170634FE}:3.3.3
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20100503
FF - prefs.js..extensions.enabledItems: {ada4b710-8346-4b82-8199-5de2b400a6ae}:[removed]
FF - prefs.js..extensions.enabledItems: {1018e4d6-728f-4b20-ad56-37578a4de76b}:4.0.5
FF - prefs.js..extensions.enabledItems: {22119944-ED35-4ab1-910B-E619EA06A115}:6.9.98
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655
FF - prefs.js..extensions.enabledItems: {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}:1.3
FF - prefs.js..extensions.enabledItems: [removed]:4.1.3
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.7.3
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6

FF - HKLM\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files\Siber Systems\AI RoboForm\Firefox [2010/04/24 17:31:19 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/24 14:13:52 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/05/06 15:12:51 | 000,000,000 | —D | M]

[2010/04/24 14:13:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2010/05/21 18:44:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\qukg6nqh.default\extensions
[2010/05/07 13:51:07 | 000,000,000 | —D | M] (Flagfox) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\qukg6nqh.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2010/05/18 19:22:10 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\qukg6nqh.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/05/18 19:22:11 | 000,000,000 | —D | M] (NoScript) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\qukg6nqh.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010/04/24 14:18:06 | 000,000,000 | —D | M] (ImTranslator) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\qukg6nqh.default\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}
[2010/05/13 01:09:05 | 000,000,000 | —D | M] (WOT) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\qukg6nqh.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010/04/24 14:21:26 | 000,000,000 | —D | M] (ReminderFox) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\qukg6nqh.default\extensions\{ada4b710-8346-4b82-8199-5de2b400a6ae}
[2010/05/06 08:44:25 | 000,000,000 | —D | M] (DownloadHelper) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\qukg6nqh.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010/04/30 18:18:06 | 000,000,000 | —D | M] (Adblock Plus) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\qukg6nqh.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/04/24 14:18:06 | 000,000,000 | —D | M] (DownThemAll!) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\qukg6nqh.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2010/05/06 08:55:14 | 000,000,000 | —D | M] (Greasemonkey) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\qukg6nqh.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010/05/06 08:39:53 | 000,000,000 | —D | M] (FoxTab) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\qukg6nqh.default\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}
[2010/05/13 01:08:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\qukg6nqh.default\extensions\[removed]
[2010/05/21 18:44:31 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/04/24 23:45:27 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/04/24 23:45:04 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2010/05/19 22:22:28 | 000,395,292 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 13652 more lines…
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
O2 - BHO: (IE2EMBHO Class) - {0A0DDBD3-6641-40B9-873F-BBDD26D6C14E} - C:\Program Files\easyMule\modules\IE2EM.dll (VeryCD.com)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (谷歌金山词霸for IE) - {A28581A7-E2A8-4b6c-9CC9-4A4CC1EFD55A} - C:\Program Files\Kingsoft\PowerWord PE\SelectForIE.dll (Kingsoft Corporation)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (ICBC Anti-Phishing class) - {BB4491A2-D11A-4c6b-91C0-B53246A3122B} - C:\Program Files\ICBCEbankTools\ICBCAntiPhishing\Icbc_AntiPhishing.dll (中国工商银行)
O2 - BHO: (DAPIELoader Class) - {FF6C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\DAP\dapieloader.dll (SpeedBit Ltd.)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (&RoboForm;) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm;) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O4 - HKLM..\RunOnce: [kwsuninstalldel] File not found
O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\StartupFaster [2010/04/26 20:45:24 | 000,000,000 | -H-D | M]
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\StartupFaster [2010/04/26 12:25:49 | 000,000,000 | -H-D | M]
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Clean; Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm ()
O8 - Extra context menu item: &Download; with &DAP; - C:\Program Files\DAP\dapextie.htm ()
O8 - Extra context menu item: Customize Menu - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: Download &all; with DAP - C:\Program Files\DAP\dapextie2.htm ()
O8 - Extra context menu item: Download by easyMule - C:\Program Files\easyMule\IE2EM.htm ()
O8 - Extra context menu item: Fill Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: Logoff - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComLogoff.html ()
O8 - Extra context menu item: RoboForm Toolbar - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8 - Extra context menu item: 使用光影编辑和美化 - C:\Program Files\nEO iMAGING\NeoOpenNeo.htm ()
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: 金山词霸 - {9D5CCDC3-545F-4418-8AEC-9CD2773B4861} - C:\Program Files\Kingsoft\PowerWord PE\SelectForIE.dll (Kingsoft Corporation)
O9 - Extra Button: HP 智能选择 - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O15 - HKCU\..Trusted Domains: internet ([]about in Internet)
O16 - DPF: {3AA9CF07-DF20-48FF-98BE-DED276E40146} https://mybank.icbc.com.cn/icbc/GDReadPub.cab (GDGetTokenInfo Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} https://mybank.icbc.com.cn/icbc/newperbank/…afeControls.cab (AxSubmitControl Class)
O16 - DPF: {B1FBC1AD-5644-4084-882A-0F8BA85E7506} https://mybank.icbc.com.cn/icbc/ICBC_NetSign.dll (InfoSecICBCNetSign Class)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx2.hotmail.com/mail/w4/pr01/photo…ol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/04/24 10:41:41 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (PDBoot.exe) - C:\WINDOWS\System32\PDBoot.exe (Raxco Software, Inc.)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2010/04/23 15:23:25 | 000,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

========== Files/Folders - Created Within 30 Days ==========

[2010/05/21 18:50:18 | 000,571,904 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2010/05/21 18:43:16 | 000,000,000 | —D | C] – C:\WINDOWS\System32\E749F017-C09C-4139-8AAA-ECBD5E22F695
[2010/05/21 08:35:06 | 000,000,000 | —D | C] – C:\Program Files\ElcomSoft
[2010/05/20 03:38:59 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator\Recent
[2010/05/20 03:08:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\gmer
[2010/05/18 20:54:08 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\UnitConverter
[2010/05/18 20:52:54 | 000,258,560 | —- | C] (Quad-Lock) – C:\Documents and Settings\Administrator\Desktop\UnitConverter.exe
[2010/05/18 08:54:06 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\SogouPY
[2010/05/18 08:54:01 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\SogouPY.users
[2010/05/14 20:21:39 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/05/14 19:19:59 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\hap_advancedrarrepair120full_ng
[2010/05/12 10:09:52 | 000,000,000 | —D | C] – C:\Program Files\Moffsoft FreeCalc
[2010/05/11 16:18:31 | 000,000,000 | —D | C] – C:\Program Files\ICBCEbankTools
[2010/05/08 10:12:07 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Macromedia
[2010/05/08 10:12:07 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/05/08 10:09:58 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\kingsoft
[2010/05/07 23:35:51 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\AltrixSoft
[2010/05/07 21:56:52 | 000,000,000 | —D | C] – C:\Program Files\Common Files\rplsp
[2010/05/07 17:01:35 | 000,000,000 | —D | C] – C:\WINDOWS\speech
[2010/05/07 16:57:37 | 000,466,944 | —- | C] (InterVideo Inc.) – C:\WINDOWS\System32\iviaudio.ax
[2010/05/07 16:57:31 | 000,000,000 | —D | C] – C:\Program Files\WinMPG VideoConvert
[2010/05/07 16:51:08 | 000,000,000 | —D | C] – C:\Program Files\calc450
[2010/05/07 16:32:55 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Design Science
[2010/05/07 16:22:23 | 000,000,000 | —D | C] – C:\Program Files\MathType
[2010/05/07 09:03:50 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\真的!日语1个人学就够了
[2010/05/07 07:18:56 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\[硬盘数据恢复软件].Ontrack.EasyRecovery.Professional.v6.21.retail-FOSI
[2010/05/07 07:11:25 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\Thinstall
[2010/05/07 07:11:25 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Thinstall
[2010/05/07 07:06:25 | 000,000,000 | —D | C] – C:\Program Files\图片无损放大.PhotoZoomPro2.3.4中文绿色单文件版
[2010/05/06 15:23:40 | 000,000,000 | —D | C] – C:\Program Files\foxit_reader
[2010/05/06 12:46:45 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Foxit Software
[2010/05/06 12:42:27 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Foxit Software
[2010/05/05 11:42:42 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\registration for summer
[2010/05/03 22:58:57 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\友谊碧波
[2010/05/03 22:58:18 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\Classes
[2010/05/03 22:33:32 | 000,000,000 | —D | C] – C:\Program Files\3dhome40
[2010/05/03 09:19:30 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ptpusb.dll
[2010/05/03 09:19:29 | 000,159,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ptpusd.dll
[2010/05/03 09:19:28 | 000,015,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbscan.sys
[2010/05/02 23:48:52 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\WinPatrol
[2010/05/02 23:47:59 | 000,000,000 | —D | C] – C:\Program Files\WinPatrol
[2010/05/02 11:14:26 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\RingTones
[2010/05/02 11:09:02 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\ICAOM
[2010/05/02 10:51:45 | 000,058,768 | —- | C] (Check Point Software Technologies LTD) – C:\WINDOWS\System32\vsregexp.dll
[2010/05/02 10:51:41 | 000,106,384 | —- | C] (Check Point Software Technologies LTD) – C:\WINDOWS\System32\zlcommdb.dll
[2010/05/02 10:51:41 | 000,069,008 | —- | C] (Check Point Software Technologies LTD) – C:\WINDOWS\System32\zlcomm.dll
[2010/05/02 10:51:36 | 000,030,096 | —- | C] (Check Point Software Technologies LTD) – C:\WINDOWS\System32\vswmi.dll
[2010/05/02 10:51:34 | 001,221,008 | —- | C] (Check Point Software Technologies LTD) – C:\WINDOWS\System32\zpeng25.dll
[2010/05/02 10:51:33 | 000,310,160 | —- | C] (Check Point Software Technologies LTD) – C:\WINDOWS\System32\vspubapi.dll
[2010/05/02 10:51:33 | 000,110,480 | —- | C] (Check Point Software Technologies LTD) – C:\WINDOWS\System32\vsxml.dll
[2010/05/02 10:51:33 | 000,107,408 | —- | C] (Check Point Software Technologies LTD) – C:\WINDOWS\System32\vsmonapi.dll
[2010/05/02 10:51:33 | 000,000,000 | —D | C] – C:\WINDOWS\System32\ZoneLabs
[2010/05/02 10:51:33 | 000,000,000 | —D | C] – C:\Program Files\Zone Labs
[2010/05/02 10:51:31 | 000,353,680 | —- | C] (Check Point Software Technologies LTD) – C:\WINDOWS\System32\vsdatant.sys
[2010/05/02 10:50:55 | 000,475,536 | —- | C] (Check Point Software Technologies LTD) – C:\WINDOWS\System32\vsutil.dll
[2010/05/02 10:50:55 | 000,216,464 | —- | C] (Check Point Software Technologies LTD) – C:\WINDOWS\System32\vsinit.dll
[2010/05/02 10:50:55 | 000,107,408 | —- | C] (Check Point Software Technologies LTD) – C:\WINDOWS\System32\vsdata.dll
[2010/05/02 10:50:12 | 000,000,000 | —D | C] – C:\WINDOWS\Internet Logs
[2010/05/02 01:15:29 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\Deployment
[2010/05/02 01:04:35 | 000,014,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spmsg2.dll
[2010/05/02 01:04:06 | 000,000,000 | —D | C] – C:\WINDOWS\System32\zh-CN
[2010/05/02 01:01:19 | 000,000,000 | —D | C] – C:\WINDOWS\System32\XPSViewer
[2010/05/02 01:01:16 | 000,000,000 | —D | C] – C:\Program Files\MSBuild
[2010/05/02 01:01:10 | 000,000,000 | —D | C] – C:\Program Files\Reference Assemblies
[2010/05/02 01:00:21 | 000,597,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\printfilterpipelinesvc.exe
[2010/05/02 01:00:21 | 000,117,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\prntvpt.dll
[2010/05/02 01:00:21 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\filterpipelineprintproc.dll
[2010/05/02 01:00:20 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpssvcs.dll
[2010/05/02 01:00:20 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpssvcs.dll
[2010/05/02 01:00:20 | 000,575,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpsshhdr.dll
[2010/05/02 01:00:20 | 000,000,000 | —D | C] – C:\3b402a29296d391eef78226f
[2010/05/02 00:59:21 | 000,000,000 | R-SD | C] – C:\WINDOWS\assembly
[2010/05/02 00:58:52 | 000,000,000 | —D | C] – C:\WINDOWS\Microsoft.NET
[2010/05/02 00:02:46 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\My Documents\ForceField Shared Files
[2010/05/02 00:02:46 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\CheckPoint
[2010/05/01 16:22:51 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\Opera
[2010/05/01 16:22:51 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Opera
[2010/05/01 16:22:37 | 000,000,000 | —D | C] – C:\Program Files\Opera
[2010/04/30 13:22:55 | 000,000,000 | —D | C] – C:\Program Files\Hard Drive Inspector Professional v3.70.337
[2010/04/30 13:20:35 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AltrixSoft
[2010/04/28 21:13:32 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\SolidDocuments
[2010/04/28 21:11:33 | 000,000,000 | —D | C] – C:\Program Files\SolidDocuments
[2010/04/28 21:11:14 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SolidDocuments
[2010/04/28 17:02:05 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\My Documents\AdreamSoft PDF to Word
[2010/04/27 18:23:04 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Tencent
[2010/04/27 18:07:52 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Tencent
[2010/04/27 18:02:28 | 000,000,000 | —D | C] – C:\Program Files\腾讯游戏
[2010/04/27 01:01:25 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Storm
[2010/04/27 01:01:01 | 000,000,000 | —D | C] – C:\Program Files\StormII
[2010/04/27 00:10:36 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\2Keep
[2010/04/27 00:08:56 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\My Documents\可牛闪图
[2010/04/27 00:08:52 | 000,000,000 | —D | C] – C:\Program Files\Conew
[2010/04/27 00:07:47 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\My Documents\美图图库
[2010/04/27 00:07:37 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Meitu
[2010/04/27 00:07:09 | 000,000,000 | —D | C] – C:\Program Files\Meitu
[2010/04/27 00:04:18 | 000,000,000 | —D | C] – C:\Program Files\nEO iMAGING
[2010/04/26 23:11:42 | 000,000,000 | -H-D | C] – C:\$AVG
[2010/04/26 13:46:14 | 000,000,000 | —D | C] – C:\Program Files\easyMule
[2010/04/26 13:20:18 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\WinZip
[2010/04/26 13:19:45 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\WinZip
[2010/04/26 13:19:35 | 000,000,000 | —D | C] – C:\Program Files\WinZip
[2010/04/26 12:16:38 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\HP
[2010/04/26 12:15:01 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\HP
[2010/04/26 12:13:45 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\WEBREG
[2010/04/26 12:10:17 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\HP Product Assistant
[2010/04/26 12:10:17 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\HP
[2010/04/26 12:09:47 | 000,000,000 | —D | C] – C:\Program Files\Common Files\HP
[2010/04/26 12:08:59 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Hewlett-Packard
[2010/04/26 12:08:47 | 000,271,704 | R— | C] (Hewlett-Packard) – C:\WINDOWS\System32\hpzids01.dll
[2010/04/26 12:08:45 | 000,117,760 | —- | C] (Hewlett-Packard Company) – C:\WINDOWS\System32\hpzll5mu.dll
[2010/04/26 12:06:32 | 000,000,000 | —D | C] – C:\Program Files\HP
[2010/04/26 12:06:24 | 000,025,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbprint.sys
[2010/04/26 12:06:06 | 000,000,000 | -H-D | C] – C:\Config.Msi
[2010/04/26 11:24:23 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\Identities
[2010/04/26 06:40:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\SogouExplorer
[2010/04/26 06:39:46 | 000,000,000 | —D | C] – C:\Program Files\SogouExtension
[2010/04/26 06:28:34 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Malwarebytes
[2010/04/26 06:28:21 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/04/26 06:28:19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/04/26 06:28:18 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/04/26 06:28:18 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/04/25 19:26:34 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\My Documents\My Received Files
[2010/04/25 18:58:35 | 000,005,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mstee.sys
[2010/04/25 18:58:31 | 000,010,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ndisip.sys
[2010/04/25 18:58:28 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ipsink.ax
[2010/04/25 18:58:28 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ipsink.ax
[2010/04/25 18:58:28 | 000,015,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\streamip.sys
[2010/04/25 18:58:25 | 000,011,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\slip.sys
[2010/04/25 18:58:22 | 000,019,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wstcodec.sys
[2010/04/25 18:58:19 | 000,085,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nabtsfec.sys
[2010/04/25 18:58:16 | 000,017,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ccdecode.sys
[2010/04/25 18:58:11 | 000,091,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kswdmcap.ax
[2010/04/25 18:58:11 | 000,091,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kswdmcap.ax
[2010/04/25 18:58:11 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vidcap.ax
[2010/04/25 18:58:11 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vidcap.ax
[2010/04/25 18:58:10 | 000,121,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbvideo.sys
[2010/04/25 18:58:10 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kstvtune.ax
[2010/04/25 18:58:10 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kstvtune.ax
[2010/04/25 18:58:10 | 000,053,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vfwwdm32.dll
[2010/04/25 18:58:10 | 000,053,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vfwwdm32.dll
[2010/04/25 18:58:10 | 000,020,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dshowext.ax
[2010/04/25 18:58:10 | 000,020,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dshowext.ax
[2010/04/25 18:58:09 | 000,043,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ksxbar.ax
[2010/04/25 18:58:09 | 000,043,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ksxbar.ax
[2010/04/25 18:58:05 | 000,032,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbccgp.sys
[2010/04/25 14:54:19 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator\My Documents\My Videos
[2010/04/25 14:52:13 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\DengLiJun
[2010/04/25 14:49:57 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\PingPong
[2010/04/25 12:35:26 | 000,000,000 | —D | C] – C:\Program Files\Startup Faster 2004
[2010/04/25 08:59:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
[2010/04/25 08:58:06 | 000,060,008 | —- | C] (Kingsoft Corporation) – C:\WINDOWS\System32\drivers\KAVSafe.sys
[2010/04/25 08:53:29 | 000,000,000 | —D | C] – C:\WINDOWS\System32\zh-TW
[2010/04/25 08:53:29 | 000,000,000 | —D | C] – C:\WINDOWS\System32\zh-HK
[2010/04/25 08:53:29 | 000,000,000 | —D | C] – C:\WINDOWS\System32\tr-TR
[2010/04/25 08:53:29 | 000,000,000 | —D | C] – C:\WINDOWS\System32\sv-SE
[2010/04/25 08:53:29 | 000,000,000 | —D | C] – C:\WINDOWS\System32\pt-BR
[2010/04/25 08:53:29 | 000,000,000 | —D | C] – C:\WINDOWS\System32\nl-NL
[2010/04/25 08:53:29 | 000,000,000 | —D | C] – C:\WINDOWS\System32\nb-NO
[2010/04/25 08:53:29 | 000,000,000 | —D | C] – C:\WINDOWS\System32\ko-KR
[2010/04/25 08:53:29 | 000,000,000 | —D | C] – C:\WINDOWS\System32\it-IT
[2010/04/25 08:53:29 | 000,000,000 | —D | C] – C:\WINDOWS\System32\he-IL
[2010/04/25 08:53:29 | 000,000,000 | —D | C] – C:\WINDOWS\System32\fr-FR
[2010/04/25 08:53:29 | 000,000,000 | —D | C] – C:\WINDOWS\System32\fi-FI
[2010/04/25 08:53:29 | 000,000,000 | —D | C] – C:\WINDOWS\System32\es-ES
[2010/04/25 08:53:29 | 000,000,000 | —D | C] – C:\WINDOWS\System32\el-GR
[2010/04/25 08:53:29 | 000,000,000 | —D | C] – C:\WINDOWS\System32\de-DE
[2010/04/25 08:53:29 | 000,000,000 | —D | C] – C:\WINDOWS\System32\da-DK
[2010/04/25 08:53:29 | 000,000,000 | —D | C] – C:\WINDOWS\System32\ar-SA
[2010/04/25 08:37:02 | 000,274,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll
[2010/04/25 08:37:02 | 000,016,736 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll.mui
[2010/04/24 23:45:17 | 000,411,368 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2010/04/24 23:45:17 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/04/24 23:45:17 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/04/24 23:45:17 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/04/24 23:45:17 | 000,073,728 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2010/04/24 23:45:01 | 000,000,000 | —D | C] – C:\Program Files\Java
[2010/04/24 23:09:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\URSoft
[2010/04/24 23:05:50 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\StartupFaster
[2010/04/24 23:05:43 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\StartupFaster
[2010/04/24 23:03:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2010/04/24 23:03:05 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/04/24 23:01:37 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Sun
[2010/04/24 23:00:01 | 000,000,000 | —D | C] – C:\Program Files\StartupFaster
[2010/04/24 22:47:49 | 000,000,000 | —D | C] – C:\Program Files\Wisdom-soft ScreenHunter 5 Free
[2010/04/24 22:29:33 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Raxco
[2010/04/24 22:28:44 | 000,000,000 | —D | C] – C:\Program Files\Raxco
[2010/04/24 18:28:43 | 000,000,000 | —D | C] – C:\Program Files\YourWare Solutions
[2010/04/24 18:18:37 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Registry Mechanic
[2010/04/24 18:12:12 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2010/04/24 18:12:08 | 000,000,000 | —D | C] – C:\Program Files\Microsoft ActiveSync
[2010/04/24 18:12:05 | 000,000,000 | —D | C] – C:\Program Files\Common Files\DESIGNER
[2010/04/24 18:11:55 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Visual Studio
[2010/04/24 18:11:53 | 000,000,000 | —D | C] – C:\WINDOWS\SHELLNEW
[2010/04/24 18:11:49 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Office
[2010/04/24 17:31:22 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\RoboForm
[2010/04/24 17:30:50 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\My Documents\My RoboForm Data
[2010/04/24 17:30:45 | 000,000,000 | —D | C] – C:\Program Files\Siber Systems
[2010/04/24 17:26:42 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\U3
[2010/04/24 17:25:00 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\My Documents\Downloads
[2010/04/24 17:16:46 | 000,000,000 | —D | C] – C:\WINDOWS\pss
[2010/04/24 16:06:06 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\Stardock
[2010/04/24 16:05:50 | 000,000,000 | —D | C] – C:\Program Files\CursorXP
[2010/04/24 16:00:43 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\My Documents\KSDStore
[2010/04/24 16:00:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\kingsoft
[2010/04/24 16:00:24 | 000,000,000 | —D | C] – C:\Program Files\Kingsoft
[2010/04/24 15:50:12 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\SogouPY.users
[2010/04/24 15:49:48 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\SogouPY
[2010/04/24 15:49:48 | 000,000,000 | —D | C] – C:\Program Files\SogouInput
[2010/04/24 15:34:37 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\kingsoft
[2010/04/24 15:34:27 | 000,000,000 | —D | C] – C:\Program Files\Maxthon2
[2010/04/24 15:02:05 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\UMDF
[2010/04/24 15:02:05 | 000,000,000 | —D | C] – C:\WINDOWS\System32\LogFiles
[2010/04/24 15:00:37 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tsbyuv.dll
[2010/04/24 15:00:36 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iyuv_32.dll
[2010/04/24 14:58:36 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Macromedia
[2010/04/24 14:58:36 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Adobe
[2010/04/24 14:58:20 | 000,026,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spupdsvc.exe
[2010/04/24 14:58:20 | 000,000,000 | —D | C] – C:\WINDOWS\System32\PreInstall
[2010/04/24 14:58:18 | 000,000,000 | -H-D | C] – C:\WINDOWS\$hf_mig$
[2010/04/24 14:53:03 | 000,012,464 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\avgrsstx.dll
[2010/04/24 14:48:48 | 000,000,000 | —D | C] – C:\WINDOWS\System32\SoftwareDistribution
[2010/04/24 14:47:12 | 000,000,000 | —D | C] – C:\Program Files\ePrompter
[2010/04/24 14:39:57 | 000,135,168 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxres.dll
[2010/04/24 14:39:22 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Tracing
[2010/04/24 14:38:18 | 000,000,000 | —D | C] – C:\Program Files\Microsoft
[2010/04/24 14:38:08 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Documents\microsoft
[2010/04/24 14:38:00 | 000,000,000 | —D | C] – C:\Program Files\Windows Live SkyDrive
[2010/04/24 14:37:37 | 000,000,000 | —D | C] – C:\Program Files\Windows Live
[2010/04/24 14:37:07 | 002,310,144 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\iglicd32.dll
[2010/04/24 14:37:07 | 000,524,288 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igldev32.dll
[2010/04/24 14:37:07 | 000,151,552 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrnld.lrc
[2010/04/24 14:37:07 | 000,151,552 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrita.lrc
[2010/04/24 14:37:07 | 000,147,456 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrhun.lrc
[2010/04/24 14:37:07 | 000,147,456 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrfra.lrc
[2010/04/24 14:37:07 | 000,143,360 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrrus.lrc
[2010/04/24 14:37:07 | 000,143,360 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrptg.lrc
[2010/04/24 14:37:07 | 000,143,360 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrptb.lrc
[2010/04/24 14:37:07 | 000,143,360 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrplk.lrc
[2010/04/24 14:37:07 | 000,139,264 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrtrk.lrc
[2010/04/24 14:37:07 | 000,139,264 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrsve.lrc
[2010/04/24 14:37:07 | 000,139,264 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrnor.lrc
[2010/04/24 14:37:07 | 000,139,264 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrfin.lrc
[2010/04/24 14:37:07 | 000,126,976 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrtha.lrc
[2010/04/24 14:37:07 | 000,122,880 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrheb.lrc
[2010/04/24 14:37:07 | 000,114,688 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxzoom.exe
[2010/04/24 14:37:07 | 000,098,304 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrkor.lrc
[2010/04/24 14:37:07 | 000,098,304 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrjpn.lrc
[2010/04/24 14:37:07 | 000,057,344 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxsrvc.dll
[2010/04/24 14:37:07 | 000,053,248 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\oemdspif.dll
[2010/04/24 14:37:06 | 001,503,232 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxress.dll
[2010/04/24 14:37:06 | 000,446,464 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxcfg.exe
[2010/04/24 14:37:06 | 000,155,648 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrell.lrc
[2010/04/24 14:37:06 | 000,155,648 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrdeu.lrc
[2010/04/24 14:37:06 | 000,151,552 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxresp.lrc
[2010/04/24 14:37:06 | 000,147,456 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxpph.dll
[2010/04/24 14:37:06 | 000,139,264 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrdan.lrc
[2010/04/24 14:37:06 | 000,139,264 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrcsy.lrc
[2010/04/24 14:37:06 | 000,135,168 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrenu.lrc
[2010/04/24 14:37:06 | 000,135,168 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxdev.dll
[2010/04/24 14:37:06 | 000,122,880 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrara.lrc
[2010/04/24 14:37:06 | 000,114,688 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmudlg.exe
[2010/04/24 14:37:06 | 000,094,208 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxext.exe
[2010/04/24 14:37:06 | 000,086,016 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxdo.dll
[2010/04/24 14:37:06 | 000,081,920 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrcht.lrc
[2010/04/24 14:37:06 | 000,081,920 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxrchs.lrc
[2010/04/24 14:37:06 | 000,077,824 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxcpl.cpl
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuTRK.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuTHA.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuSVE.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuRUS.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuPTG.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuPTB.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuPLK.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuNOR.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuNLD.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuKOR.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuJPN.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuITA.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuHUN.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuHEB.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuFRC.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuFRA.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuFIN.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuESP.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuENG.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuELL.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuDEU.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuDAN.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuCSY.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuCHT.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuCHS.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuARB.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\ialmuARA.dll
[2010/04/24 14:37:06 | 000,040,960 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\igfxexps.dll
[2010/04/24 14:37:05 | 000,900,218 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\ialmdd5.dll
[2010/04/24 14:37:05 | 000,213,274 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\ialmdev5.dll
[2010/04/24 14:37:05 | 000,118,395 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\ialmdnt5.dll
[2010/04/24 14:37:05 | 000,073,728 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\hccutils.dll
[2010/04/24 14:37:05 | 000,061,440 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\iAlmCoIn_v4396.dll
[2010/04/24 14:37:05 | 000,049,152 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\ialmrem.dll
[2010/04/24 14:37:05 | 000,036,990 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\ialmrnt5.dll
[2010/04/24 14:33:50 | 000,087,936 | R— | C] (Texas Instruments) – C:\WINDOWS\System32\drivers\gtipci21.sys
[2010/04/24 14:33:50 | 000,028,672 | R— | C] (Gemplus) – C:\WINDOWS\cttib1.dll
[2010/04/24 14:33:34 | 000,000,000 | —D | C] – C:\WINDOWS\tiinst
[2010/04/24 14:25:45 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Windows Live
[2010/04/24 14:23:08 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Fetion
[2010/04/24 14:22:45 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Fetion
[2010/04/24 14:22:03 | 000,000,000 | —D | C] – C:\Program Files\China Mobile
[2010/04/24 14:13:49 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla
[2010/04/24 14:13:49 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Mozilla
[2010/04/24 14:13:42 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2010/04/24 14:10:50 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Avant Profiles
[2010/04/24 14:10:33 | 000,000,000 | —D | C] – C:\Program Files\Avant Browser
[2010/04/24 13:57:28 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\skypePM
[2010/04/24 13:56:28 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Skype
[2010/04/24 13:55:44 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Skype
[2010/04/24 13:55:42 | 000,000,000 | R–D | C] – C:\Program Files\Skype
[2010/04/24 13:55:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Skype
[2010/04/24 13:51:22 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\TeamViewer
[2010/04/24 13:51:11 | 000,000,000 | —D | C] – C:\Program Files\TeamViewer
[2010/04/24 13:41:50 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Trillian
[2010/04/24 13:41:09 | 000,000,000 | —D | C] – C:\Program Files\Trillian
[2010/04/24 13:38:01 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2010/04/24 13:37:51 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2010/04/24 13:32:04 | 000,064,288 | —- | C] (Lavasoft AB) – C:\WINDOWS\System32\drivers\Lbd.sys
[2010/04/24 13:32:03 | 000,000,000 | —D | C] – C:\WINDOWS\System32\DRVSTORE
[2010/04/24 13:31:44 | 000,095,024 | —- | C] (Sunbelt Software) – C:\WINDOWS\System32\drivers\SBREDrv.sys
[2010/04/24 13:23:48 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
[2010/04/24 13:23:33 | 000,000,000 | —D | C] – C:\Program Files\Lavasoft
[2010/04/24 13:23:33 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Lavasoft
[2010/04/24 13:17:59 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2010/04/24 13:17:59 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2010/04/24 13:14:26 | 000,118,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MSSTDFMT.DLL
[2010/04/24 13:14:26 | 000,000,000 | —D | C] – C:\Program Files\SpywareBlaster
[2010/04/24 13:13:43 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2010/04/24 13:09:50 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\My Documents\My DAP Downloads
[2010/04/24 13:09:43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SpeedBit
[2010/04/24 13:09:30 | 000,172,032 | —- | C] (Jin Hui E-mail: [removed] Web: http://www.jcomsoft.com) – C:\WINDOWS\System32\AniGIF.ocx
[2010/04/24 13:09:29 | 000,000,000 | —D | C] – C:\Program Files\DAP
[2010/04/24 13:03:56 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator\IECompatCache
[2010/04/24 13:03:01 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator\PrivacIE
[2010/04/24 12:57:44 | 000,000,000 | —D | C] – C:\Program Files\Idailydiary
[2010/04/24 12:54:48 | 001,677,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chsbrkr.dll
[2010/04/24 12:54:48 | 001,677,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\chsbrkr.dll
[2010/04/24 12:54:48 | 000,838,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chtbrkr.dll
[2010/04/24 12:54:48 | 000,838,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\chtbrkr.dll
[2010/04/24 12:54:47 | 001,875,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msir3jp.lex
[2010/04/24 12:54:47 | 001,875,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msir3jp.lex
[2010/04/24 12:54:47 | 000,098,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msir3jp.dll
[2010/04/24 12:54:47 | 000,098,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msir3jp.dll
[2010/04/24 12:54:47 | 000,070,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\korwbrkr.dll
[2010/04/24 12:54:47 | 000,070,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\korwbrkr.dll
[2010/04/24 12:54:43 | 010,096,640 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hwxcht.dll
[2010/04/24 12:54:33 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\padrs412.dll
[2010/04/24 12:54:33 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbd101a.dll
[2010/04/24 12:54:33 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbd101a.dll
[2010/04/24 12:54:31 | 010,129,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hwxkor.dll
[2010/04/24 12:54:30 | 000,059,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imkrinst.exe
[2010/04/24 12:54:30 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imekrmig.exe
[2010/04/24 12:54:30 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hanjadic.dll
[2010/04/24 12:54:25 | 000,311,359 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imepadsv.exe
[2010/04/24 12:54:25 | 000,102,463 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imepadsm.dll
[2010/04/24 12:54:25 | 000,036,927 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\padrs411.dll
[2010/04/24 12:54:25 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdnecAT.dll
[2010/04/24 12:54:25 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdnecat.dll
[2010/04/24 12:54:25 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdnec95.dll
[2010/04/24 12:54:25 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdnec95.dll
[2010/04/24 12:54:24 | 000,471,102 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imskdic.dll
[2010/04/24 12:54:24 | 000,229,439 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\multibox.dll
[2010/04/24 12:54:24 | 000,143,422 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\softkey.dll
[2010/04/24 12:54:24 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdnecNT.dll
[2010/04/24 12:54:24 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdnecnt.dll
[2010/04/24 12:54:12 | 000,057,398 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpdadm.exe
[2010/04/24 12:54:12 | 000,045,109 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpuex.exe
[2010/04/24 12:54:08 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\c_is2022.dll
[2010/04/24 12:54:08 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\c_is2022.dll
[2010/04/24 12:54:07 | 000,480,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cintsetp.exe
[2010/04/24 12:54:07 | 000,198,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cintime.dll
[2010/04/24 12:54:07 | 000,056,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chtskdic.dll
[2010/04/24 12:54:07 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cintlgnt.ime
[2010/04/24 12:54:07 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\CINTLGNT.IME
[2010/04/24 12:54:07 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0404.dll
[2010/04/24 12:54:07 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\padrs404.dll
[2010/04/24 12:54:06 | 000,571,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\TINTLGNT.IME
[2010/04/24 12:54:06 | 000,571,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tintlgnt.ime
[2010/04/24 12:54:06 | 000,455,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tintsetp.exe
[2010/04/24 12:54:06 | 000,097,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chtmbx.dll
[2010/04/24 12:54:06 | 000,079,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\winar30.ime
[2010/04/24 12:54:06 | 000,079,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winar30.ime
[2010/04/24 12:54:06 | 000,077,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\quick.ime
[2010/04/24 12:54:06 | 000,077,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\quick.ime
[2010/04/24 12:54:06 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tintlphr.exe
[2010/04/24 12:54:06 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\miniime.tpl
[2010/04/24 12:54:06 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tmigrate.dll
[2010/04/24 12:54:05 | 000,079,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\phon.ime
[2010/04/24 12:54:05 | 000,079,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\phon.ime
[2010/04/24 12:54:05 | 000,078,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dayi.ime
[2010/04/24 12:54:05 | 000,078,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dayi.ime
[2010/04/24 12:54:05 | 000,078,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chajei.ime
[2010/04/24 12:54:05 | 000,078,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\chajei.ime
[2010/04/24 12:54:05 | 000,076,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\uniime.dll
[2010/04/24 12:54:05 | 000,076,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\uniime.dll
[2010/04/24 12:54:05 | 000,065,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\winime.ime
[2010/04/24 12:54:05 | 000,065,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winime.ime
[2010/04/24 12:54:05 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\unicdime.ime
[2010/04/24 12:54:05 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\unicdime.ime
[2010/04/24 12:54:05 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\romanime.ime
[2010/04/24 12:54:05 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\romanime.ime
[2010/04/24 12:54:04 | 000,053,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pintlcsd.dll
[2010/04/24 12:54:04 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0804.dll
[2010/04/24 12:54:04 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\padrs804.dll
[2010/04/24 12:53:59 | 000,482,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\PINTLGNT.IME
[2010/04/24 12:53:59 | 000,482,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pintlgnt.ime
[2010/04/24 12:53:59 | 000,070,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pintlphr.exe
[2010/04/24 12:53:59 | 000,067,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pmigrate.dll
[2010/04/24 12:53:57 | 000,218,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\c_g18030.dll
[2010/04/24 12:53:57 | 000,218,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\c_g18030.dll
[2010/04/24 12:53:57 | 000,156,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\WINZM.IME
[2010/04/24 12:53:57 | 000,156,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winzm.ime
[2010/04/24 12:53:57 | 000,156,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\WINSP.IME
[2010/04/24 12:53:57 | 000,156,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winsp.ime
[2010/04/24 12:53:57 | 000,156,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\WINPY.IME
[2010/04/24 12:53:57 | 000,156,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winpy.ime
[2010/04/24 12:53:57 | 000,072,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\WINGB.IME
[2010/04/24 12:53:57 | 000,072,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wingb.ime
[2010/04/24 12:53:56 | 000,106,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imekrcic.dll
[2010/04/24 12:53:56 | 000,094,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imekr61.ime
[2010/04/24 12:53:56 | 000,086,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imekrmbx.dll
[2010/04/24 12:53:56 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0412.dll
[2010/04/24 12:53:56 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0411.dll
[2010/04/24 12:53:55 | 000,102,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imlang.dll
[2010/04/24 12:53:55 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdibm02.dll
[2010/04/24 12:53:55 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdibm02.dll
[2010/04/24 12:53:55 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\f3ahvoas.dll
[2010/04/24 12:53:55 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\f3ahvoas.dll
[2010/04/24 12:53:55 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdlk41a.dll
[2010/04/24 12:53:55 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdlk41a.dll
[2010/04/24 12:53:55 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdlk41j.dll
[2010/04/24 12:53:55 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdlk41j.dll
[2010/04/24 12:53:54 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdax2.dll
[2010/04/24 12:53:54 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdax2.dll
[2010/04/24 12:53:54 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbd106n.dll
[2010/04/24 12:53:54 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbd106n.dll
[2010/04/24 12:53:54 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbd101.dll
[2010/04/24 12:53:54 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbd101.dll
[2010/04/24 12:53:53 | 000,811,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\imjp81k.dll
[2010/04/24 12:53:53 | 000,811,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjp81k.dll
[2010/04/24 12:53:53 | 000,426,041 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\voicepad.dll
[2010/04/24 12:53:53 | 000,340,023 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\imjp81.ime
[2010/04/24 12:53:53 | 000,340,023 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjp81.ime
[2010/04/24 12:53:53 | 000,315,455 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imskf.dll
[2010/04/24 12:53:53 | 000,086,073 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\voicesub.dll
[2010/04/24 12:53:50 | 000,208,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpmig.exe
[2010/04/24 12:53:50 | 000,155,705 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpdsvr.exe
[2010/04/24 12:53:49 | 000,716,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpcus.dll
[2010/04/24 12:53:49 | 000,368,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpcic.dll
[2010/04/24 12:53:49 | 000,307,257 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpdct.exe
[2010/04/24 12:53:49 | 000,274,489 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjputyc.dll
[2010/04/24 12:53:49 | 000,262,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjputy.exe
[2010/04/24 12:53:49 | 000,233,527 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjprw.exe
[2010/04/24 12:53:49 | 000,081,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\imjpdct.dll
[2010/04/24 12:53:48 | 000,057,399 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cplexe.exe
[2010/04/24 12:53:17 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdjpn.dll
[2010/04/24 12:53:17 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdjpn.dll
[2010/04/24 12:53:17 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdkor.dll
[2010/04/24 12:53:17 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdkor.dll
[2010/04/24 12:53:17 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbd101c.dll
[2010/04/24 12:53:17 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbd101c.dll
[2010/04/24 12:53:17 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbd103.dll
[2010/04/24 12:53:17 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbd103.dll
[2010/04/24 12:53:14 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbd101b.dll
[2010/04/24 12:53:14 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbd101b.dll
[2010/04/24 12:53:12 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbd106.dll
[2010/04/24 12:53:12 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbd106.dll
[2010/04/24 12:50:00 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Softarium.com
[2010/04/24 12:49:50 | 000,000,000 | —D | C] – C:\Program Files\reliz
[2010/04/24 12:48:04 | 000,000,000 | —D | C] – C:\Program Files\Allok RM RMVB to AVI MPEG DVD Converter
[2010/04/24 12:44:56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/04/24 12:44:36 | 001,101,824 | —- | C] (Woodbury Associates Limited) – C:\WINDOWS\System32\UniBox210.ocx
[2010/04/24 12:44:36 | 000,880,640 | —- | C] (Woodbury Associates Limited) – C:\WINDOWS\System32\UniBox10.ocx
[2010/04/24 12:44:36 | 000,212,992 | —- | C] (Woodbury Associates Limited) – C:\WINDOWS\System32\UniBoxVB12.ocx
[2010/04/24 12:44:35 | 001,071,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MSCOMCTL.OCX
[2010/04/24 12:44:34 | 000,000,000 | —D | C] – C:\Program Files\Common Files\PC Tools
[2010/04/24 12:44:32 | 000,000,000 | —D | C] – C:\Program Files\Registry Mechanic
[2010/04/24 12:42:28 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2010/04/24 12:40:46 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator\IETldCache
[2010/04/24 12:39:19 | 000,028,160 | —- | C] (mst software GmbH, Germany) – C:\WINDOWS\System32\DfSdkBt.exe
[2010/04/24 12:35:10 | 000,000,000 | —D | C] – C:\Program Files\Ashampoo
[2010/04/24 12:34:41 | 000,000,000 | -H-D | C] – C:\WINDOWS\PIF
[2010/04/24 12:31:55 | 011,070,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieframe.dll
[2010/04/24 12:31:55 | 001,985,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iertutil.dll
[2010/04/24 12:31:55 | 000,594,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeeds.dll
[2010/04/24 12:31:55 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeedsbs.dll
[2010/04/24 12:31:51 | 000,000,000 | —D | C] – C:\WINDOWS\ie8updates
[2010/04/24 12:31:34 | 000,000,000 | —D | C] – C:\WINDOWS\WBEM
[2010/04/24 12:30:33 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[2010/04/24 12:21:08 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\WinRAR
[2010/04/24 12:20:09 | 000,000,000 | —D | C] – C:\Program Files\WinRAR
[2010/04/24 12:17:12 | 000,272,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\bthport.sys
[2010/04/24 12:15:48 | 000,455,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mrxsmb.sys
[2010/04/24 12:09:50 | 002,146,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntkrnlmp.exe
[2010/04/24 12:09:49 | 002,189,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntoskrnl.exe
[2010/04/24 12:09:48 | 002,024,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntkrpamp.exe
[2010/04/24 12:04:50 | 000,016,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spmsg.dll
[2010/04/24 12:04:24 | 000,000,000 | —D | C] – C:\Program Files\Windows Media Connect 2
[2010/04/24 11:26:20 | 000,000,000 | —D | C] – C:\Program Files\Broadcom
[2010/04/24 11:23:36 | 000,667,648 | —- | C] (Broadcom Corporation) – C:\WINDOWS\System32\BCMLogon.dll
[2010/04/24 11:23:36 | 000,424,320 | —- | C] (Broadcom Corporation) – C:\WINDOWS\System32\drivers\BCMWL5.SYS
[2010/04/24 11:23:28 | 000,253,952 | —- | C] (Dell Inc.) – C:\WINDOWS\System32\bcmwlu00.exe
[2010/04/24 11:23:27 | 000,069,632 | —- | C] (CACE Technologies) – C:\WINDOWS\System32\bcmwlpkt.dll
[2010/04/24 11:23:27 | 000,033,664 | —- | C] (CACE Technologies) – C:\WINDOWS\System32\drivers\BCMWLNPF.SYS
[2010/04/24 11:23:25 | 003,096,576 | —- | C] (Dell Inc.) – C:\WINDOWS\System32\BCMWLCPL.CPL
[2010/04/24 11:23:25 | 002,129,920 | —- | C] (BCGSoft Ltd) – C:\WINDOWS\System32\WLBCGCBPRO731.DLL
[2010/04/24 11:23:25 | 001,060,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MFC71.DLL
[2010/04/24 11:23:25 | 000,499,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MSVCP71.DLL
[2010/04/24 11:23:25 | 000,348,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MSVCR71.DLL
[2010/04/24 11:23:25 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ATL71.DLL
[2010/04/24 11:23:25 | 000,044,032 | —- | C] (Broadcom Corporation) – C:\WINDOWS\System32\wltrynt.dll
[2010/04/24 11:15:13 | 000,000,000 | —D | C] – C:\WINDOWS\System32\ReinstallBackups
[2010/04/24 11:15:11 | 000,000,000 | —D | C] – C:\Program Files\Intel
[2010/04/24 11:14:19 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Zeepe Framework 7
[2010/04/24 11:14:19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Novatel Wireless
[2010/04/24 11:14:19 | 000,000,000 | —D | C] – C:\Program Files\Dell
[2010/04/24 11:10:12 | 000,006,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\splitter.sys
[2010/04/24 11:10:10 | 000,083,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wdmaud.sys
[2010/04/24 11:10:08 | 000,052,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dmusic.sys
[2010/04/24 11:10:06 | 000,056,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\swmidi.sys
[2010/04/24 11:10:05 | 000,142,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aec.sys
[2010/04/24 11:10:03 | 000,172,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kmixer.sys
[2010/04/24 11:10:01 | 000,002,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\drmkaud.sys
[2010/04/24 11:10:00 | 000,060,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sysaudio.sys
[2010/04/24 11:09:57 | 000,007,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mskssrv.sys
[2010/04/24 11:09:56 | 000,004,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mspqm.sys
[2010/04/24 11:09:54 | 000,005,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mspclock.sys
[2010/04/24 11:09:44 | 000,146,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\portcls.sys
[2010/04/24 11:09:44 | 000,146,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\portcls.sys
[2010/04/24 11:09:44 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ksuser.dll
[2010/04/24 11:09:44 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ksuser.dll
[2010/04/24 11:09:43 | 000,129,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ksproxy.ax
[2010/04/24 11:09:43 | 000,129,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ksproxy.ax
[2010/04/24 11:09:43 | 000,060,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\drmk.sys
[2010/04/24 11:09:43 | 000,060,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\drmk.sys
[2010/04/24 11:09:38 | 000,273,168 | —- | C] (SigmaTel, Inc.) – C:\WINDOWS\System32\drivers\STAC97.sys
[2010/04/24 11:09:38 | 000,102,481 | R— | C] (SigmaTel Inc.) – C:\WINDOWS\System32\stac97.cpl
[2010/04/24 11:09:38 | 000,000,000 | -H-D | C] – C:\Program Files\InstallShield Installation Information
[2010/04/24 11:09:38 | 000,000,000 | —D | C] – C:\Program Files\SigmaTel
[2010/04/24 11:09:32 | 000,000,000 | —D | C] – C:\Program Files\Common Files\InstallShield
[2010/04/24 11:09:29 | 000,000,000 | —D | C] – C:\dell
[2010/04/24 11:09:03 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/04/24 11:07:01 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\AVG9
[2010/04/24 11:05:40 | 000,242,896 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgtdix.sys
[2010/04/24 11:05:40 | 000,052,872 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgrkx86.sys
[2010/04/24 11:05:39 | 000,216,200 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgldx86.sys
[2010/04/24 11:05:39 | 000,029,512 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgmfx86.sys
[2010/04/24 11:05:39 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\Avg
[2010/04/24 11:05:35 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2010/04/24 11:05:28 | 000,000,000 | —D | C] – C:\Program Files\AVG
[2010/04/24 11:05:27 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\avg9
[2010/04/24 10:55:29 | 000,026,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbstor.sys
[2010/04/24 10:45:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Application Data\Identities
[2010/04/24 10:45:38 | 000,000,000 | -H-D | C] – C:\Program Files\Uninstall Information
[2010/04/24 10:45:35 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator\My Documents\My Pictures
[2010/04/24 10:45:35 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator\My Documents\My Music
[2010/04/24 10:45:31 | 000,000,000 | –SD | C] – C:\Documents and Settings\Administrator\Application Data\Microsoft
[2010/04/24 10:45:31 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator\SendTo
[2010/04/24 10:45:31 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Administrator\Application Data
[2010/04/24 10:45:31 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator\Start Menu
[2010/04/24 10:45:31 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator\My Documents
[2010/04/24 10:45:31 | 000,000,000 | R–D | C] – C:\Documents and Settings\Administrator\Favorites
[2010/04/24 10:45:31 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Administrator\Cookies
[2010/04/24 10:45:31 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Administrator\Templates
[2010/04/24 10:45:31 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Administrator\PrintHood
[2010/04/24 10:45:31 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Administrator\NetHood
[2010/04/24 10:45:31 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Administrator\Local Settings
[2010/04/24 10:45:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft
[2010/04/24 10:45:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop
[2010/04/24 10:45:25 | 000,000,000 | —D | C] – C:\WINDOWS\SoftwareDistribution
[2010/04/24 10:45:24 | 000,000,000 | —D | C] – C:\WINDOWS\Prefetch
[2010/04/24 10:45:23 | 000,000,000 | –SD | C] – C:\WINDOWS\System32\Microsoft
[2010/04/24 10:45:22 | 000,000,000 | –SD | C] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[2010/04/24 10:45:22 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2010/04/24 10:44:59 | 000,000,000 | –SD | C] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2010/04/24 10:44:59 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2010/04/24 10:44:02 | 000,041,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\weitekp9.dll
[2010/04/24 10:44:02 | 000,031,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\weitekp9.sys
[2010/04/24 10:44:01 | 000,364,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\w3svc.dll
[2010/04/24 10:44:01 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wam51.dll
[2010/04/24 10:44:01 | 000,053,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wamreg51.dll
[2010/04/24 10:44:01 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wamps51.dll
[2010/04/24 10:44:00 | 000,073,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\w3ext.dll
[2010/04/24 10:44:00 | 000,048,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\w32.dll
[2010/04/24 10:44:00 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\w3svapi.dll
[2010/04/24 10:44:00 | 000,004,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\w3ctrs51.dll
[2010/04/24 10:43:57 | 000,103,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\uihelper.dll
[2010/04/24 10:43:57 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tsprof.exe
[2010/04/24 10:43:56 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tools.dll
[2010/04/24 10:43:55 | 000,185,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\thawbrkr.dll
[2010/04/24 10:43:55 | 000,021,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tdipx.sys
[2010/04/24 10:43:55 | 000,019,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tdspx.sys
[2010/04/24 10:43:55 | 000,013,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tdasync.sys
[2010/04/24 10:43:53 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\svcext51.dll
[2010/04/24 10:43:53 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sspifilt.dll
[2010/04/24 10:43:53 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\status.dll
[2010/04/24 10:43:52 | 000,101,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\srusbusd.dll
[2010/04/24 10:43:52 | 000,045,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ssinc51.dll
[2010/04/24 10:43:50 | 000,358,400 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmpincl.dll
[2010/04/24 10:43:50 | 000,259,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmpcl.dll
[2010/04/24 10:43:50 | 000,188,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmpsmir.dll
[2010/04/24 10:43:50 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmpthrd.dll
[2010/04/24 10:43:50 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmp.exe
[2010/04/24 10:43:50 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmpstup.dll
[2010/04/24 10:43:50 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmptrap.exe
[2010/04/24 10:43:50 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_snprfdll.dll
[2010/04/24 10:43:50 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\snmpmib.dll
[2010/04/24 10:43:49 | 000,456,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smtpsvc.dll
[2010/04/24 10:43:49 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_smtpctrs.dll
[2010/04/24 10:43:49 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smtpapi.dll
[2010/04/24 10:43:49 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smimsgif.dll
[2010/04/24 10:43:48 | 000,236,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smi2smir.exe
[2010/04/24 10:43:48 | 000,038,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm9aw.dll
[2010/04/24 10:43:48 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smb6w.dll
[2010/04/24 10:43:48 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sma3w.dll
[2010/04/24 10:43:48 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm93w.dll
[2010/04/24 10:43:48 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm92w.dll
[2010/04/24 10:43:48 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smierrsm.dll
[2010/04/24 10:43:48 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smierrsy.dll
[2010/04/24 10:43:47 | 000,030,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm87w.dll
[2010/04/24 10:43:47 | 000,030,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm81w.dll
[2010/04/24 10:43:47 | 000,029,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm8cw.dll
[2010/04/24 10:43:47 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm90w.dll
[2010/04/24 10:43:47 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm8dw.dll
[2010/04/24 10:43:47 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm8aw.dll
[2010/04/24 10:43:47 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm89w.dll
[2010/04/24 10:43:47 | 000,025,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sm59w.dll
[2010/04/24 10:43:46 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\simptcp.dll
[2010/04/24 10:43:44 | 000,221,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\seo.dll
[2010/04/24 10:43:44 | 000,057,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_scripto.dll
[2010/04/24 10:43:44 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_seos.dll
[2010/04/24 10:43:43 | 000,079,872 | —- | C] (Ricoh Co., Ltd.) – C:\WINDOWS\System32\dllcache\rwia330.dll
[2010/04/24 10:43:43 | 000,079,872 | —- | C] (Ricoh Co., Ltd.) – C:\WINDOWS\System32\dllcache\rwia001.dll
[2010/04/24 10:43:43 | 000,029,184 | —- | C] (Ricoh Co., Ltd.) – C:\WINDOWS\System32\dllcache\rw330ext.dll
[2010/04/24 10:43:43 | 000,027,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rw001ext.dll
[2010/04/24 10:43:43 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rwnh.dll
[2010/04/24 10:43:42 | 000,023,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_regtrace.exe
[2010/04/24 10:43:42 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\register.exe
[2010/04/24 10:43:42 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rpcref.dll
[2010/04/24 10:43:41 | 000,020,736 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ramdisk.sys
[2010/04/24 10:43:40 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\quser.exe
[2010/04/24 10:43:40 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\query.exe
[2010/04/24 10:43:39 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pwsdata.dll
[2010/04/24 10:43:38 | 000,131,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pmxviceo.dll
[2010/04/24 10:43:38 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pmxmcro.dll
[2010/04/24 10:43:38 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pmxgl.dll
[2010/04/24 10:43:36 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pagecnt.dll
[2010/04/24 10:43:36 | 000,020,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\permchk.dll
[2010/04/24 10:43:34 | 000,038,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_ntfsdrv.dll
[2010/04/24 10:43:33 | 000,053,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nextlink.dll
[2010/04/24 10:43:33 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nsepm.dll
[2010/04/24 10:43:31 | 000,119,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mtstocom.exe
[2010/04/24 10:43:28 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msiregmv.exe
[2010/04/24 10:43:23 | 000,092,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mga.sys
[2010/04/24 10:43:23 | 000,092,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mga.dll
[2010/04/24 10:43:23 | 000,085,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\metada51.dll
[2010/04/24 10:43:23 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\migregdb.exe
[2010/04/24 10:43:22 | 000,037,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\md5filt.dll
[2010/04/24 10:43:22 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mdsync.dll
[2010/04/24 10:43:21 | 000,065,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_mailmsg.dll
[2010/04/24 10:43:21 | 000,022,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lpdsvc.dll
[2010/04/24 10:43:21 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\logscrpt.dll
[2010/04/24 10:43:21 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lprmon.dll
[2010/04/24 10:43:21 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lonsint.dll
[2010/04/24 10:43:20 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lmmib2.dll
[2010/04/24 10:43:19 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdvntc.dll
[2010/04/24 10:43:18 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdth3.dll
[2010/04/24 10:43:18 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdth2.dll
[2010/04/24 10:43:18 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdusa.dll
[2010/04/24 10:43:18 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdurdu.dll
[2010/04/24 10:43:18 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdth1.dll
[2010/04/24 10:43:18 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdth0.dll
[2010/04/24 10:43:18 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdsyr2.dll
[2010/04/24 10:43:18 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdsyr1.dll
[2010/04/24 10:43:17 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinpun.dll
[2010/04/24 10:43:17 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdintel.dll
[2010/04/24 10:43:17 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdintam.dll
[2010/04/24 10:43:17 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinmar.dll
[2010/04/24 10:43:17 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinkan.dll
[2010/04/24 10:43:17 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinhin.dll
[2010/04/24 10:43:17 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinguj.dll
[2010/04/24 10:43:17 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdindev.dll
[2010/04/24 10:43:17 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdheb.dll
[2010/04/24 10:43:16 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdfa.dll
[2010/04/24 10:43:16 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbddiv2.dll
[2010/04/24 10:43:16 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbddiv1.dll
[2010/04/24 10:43:16 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbda3.dll
[2010/04/24 10:43:16 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbda2.dll
[2010/04/24 10:43:16 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbda1.dll
[2010/04/24 10:43:16 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdgeo.dll
[2010/04/24 10:43:16 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdarmw.dll
[2010/04/24 10:43:16 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdarme.dll
[2010/04/24 10:43:15 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iscomlog.dll
[2010/04/24 10:43:15 | 000,018,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\jupiw.dll
[2010/04/24 10:43:15 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iwrps.dll
[2010/04/24 10:43:15 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\isapips.dll
[2010/04/24 10:43:14 | 000,257,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\infocomm.dll
[2010/04/24 10:43:14 | 000,035,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iprip.dll
[2010/04/24 10:43:14 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\infoctrs.dll
[2010/04/24 10:43:13 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetin51.exe
[2010/04/24 10:43:09 | 000,079,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iislog51.dll
[2010/04/24 10:43:09 | 000,060,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisclex4.dll
[2010/04/24 10:43:09 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iiscrmap.dll
[2010/04/24 10:43:09 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisfecnv.dll
[2010/04/24 10:43:09 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iissync.exe
[2010/04/24 10:43:09 | 000,003,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iismui.dll
[2010/04/24 10:43:08 | 000,145,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iische51.dll
[2010/04/24 10:43:08 | 000,025,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisadmin.dll
[2010/04/24 10:42:52 | 000,268,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\httpext.dll
[2010/04/24 10:42:52 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\httpod51.dll
[2010/04/24 10:42:52 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hostmib.dll
[2010/04/24 10:42:52 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\httpmb51.dll
[2010/04/24 10:42:51 | 000,032,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\gzip.dll
[2010/04/24 10:42:50 | 000,400,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsxp32.dll
[2010/04/24 10:42:50 | 000,397,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxstiff.dll
[2010/04/24 10:42:50 | 000,192,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxswzrd.dll
[2010/04/24 10:42:50 | 000,154,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsui.dll
[2010/04/24 10:42:49 | 000,562,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsst.dll
[2010/04/24 10:42:49 | 000,267,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxssvc.exe
[2010/04/24 10:42:49 | 000,246,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxst30.dll
[2010/04/24 10:42:49 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsevent.dll
[2010/04/24 10:42:49 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsroute.dll
[2010/04/24 10:42:49 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsmon.dll
[2010/04/24 10:42:49 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsext32.dll
[2010/04/24 10:42:49 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxssend.exe
[2010/04/24 10:42:49 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsperf.dll
[2010/04/24 10:42:49 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsres.dll
[2010/04/24 10:42:48 | 000,451,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsapi.dll
[2010/04/24 10:42:48 | 000,285,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxscomex.dll
[2010/04/24 10:42:48 | 000,229,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxscover.exe
[2010/04/24 10:42:48 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsclnt.exe
[2010/04/24 10:42:48 | 000,132,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsclntr.dll
[2010/04/24 10:42:48 | 000,111,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxscfgwz.dll
[2010/04/24 10:42:48 | 000,072,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxscom.dll
[2010/04/24 10:42:48 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fxsdrv.dll
[2010/04/24 10:42:47 | 000,618,605 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4autl.dll
[2010/04/24 10:42:47 | 000,125,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ftpsv251.dll
[2010/04/24 10:42:47 | 000,024,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpadmcgi.exe
[2010/04/24 10:42:47 | 000,020,541 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpadmdll.dll
[2010/04/24 10:42:47 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ftpctrs2.dll
[2010/04/24 10:42:47 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ftpmib.dll
[2010/04/24 10:42:47 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ftlx041e.dll
[2010/04/24 10:42:46 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_fcachdll.dll
[2010/04/24 10:42:46 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\flattemp.exe
[2010/04/24 10:42:45 | 000,101,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\evntagnt.dll
[2010/04/24 10:42:45 | 000,092,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\evntwin.exe
[2010/04/24 10:42:45 | 000,057,856 | —- | C] (SEIKO EPSON CORP.) – C:\WINDOWS\System32\dllcache\esuimgd.dll
[2010/04/24 10:42:45 | 000,045,056 | —- | C] (SEIKO EPSON CORP.) – C:\WINDOWS\System32\dllcache\esunid.dll
[2010/04/24 10:42:45 | 000,025,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\et4000.sys
[2010/04/24 10:42:45 | 000,024,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\evntcmd.exe
[2010/04/24 10:42:45 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\exstrace.dll
[2010/04/24 10:42:44 | 000,514,587 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\edb500.dll
[2010/04/24 10:42:44 | 000,031,744 | —- | C] (SEIKO EPSON CORP.) – C:\WINDOWS\System32\dllcache\esucmd.dll
[2010/04/24 10:42:39 | 000,042,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\davcdata.exe
[2010/04/24 10:42:38 | 000,056,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\convlog.exe
[2010/04/24 10:42:38 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\counters.dll
[2010/04/24 10:42:38 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cprofile.exe
[2010/04/24 10:42:37 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\controt.dll
[2010/04/24 10:42:37 | 000,024,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\compfilt.dll
[2010/04/24 10:42:34 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chgport.exe
[2010/04/24 10:42:34 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chgusr.exe
[2010/04/24 10:42:34 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chglogon.exe
[2010/04/24 10:42:34 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\change.exe
[2010/04/24 10:42:33 | 000,054,528 | —- | C] (Philips Semiconductors GmbH) – C:\WINDOWS\System32\dllcache\cap7146.sys
[2010/04/24 10:42:32 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\c_iscii.dll
[2010/04/24 10:42:27 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\browscap.dll
[2010/04/24 10:42:25 | 000,029,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\asptxn.dll
[2010/04/24 10:42:25 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aspperf.dll
[2010/04/24 10:42:25 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\authfilt.dll
[2010/04/24 10:42:24 | 000,369,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\asp51.dll
[2010/04/24 10:42:24 | 000,331,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aqueue.dll
[2010/04/24 10:42:24 | 000,108,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\appconf.dll
[2010/04/24 10:42:24 | 000,045,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_aqadmin.dll
[2010/04/24 10:42:23 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt040d.dll
[2010/04/24 10:42:23 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0401.dll
[2010/04/24 10:42:22 | 000,049,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\adrot.dll
[2010/04/24 10:42:22 | 000,029,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\admexs.dll
[2010/04/24 10:42:22 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\admxprox.dll
[2010/04/24 10:42:22 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_adsiisex.dll
[2010/04/24 10:42:19 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tcptsat.dll
[2010/04/24 10:42:19 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wamregps.dll
[2010/04/24 10:42:18 | 002,134,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smtpsnap.dll
[2010/04/24 10:42:18 | 000,189,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smtpadm.dll
[2010/04/24 10:42:18 | 000,032,827 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tcptest.exe
[2010/04/24 10:42:18 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\staxmem.dll
[2010/04/24 10:42:17 | 000,020,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\shtml.dll
[2010/04/24 10:42:17 | 000,016,437 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\shtml.exe
[2010/04/24 10:42:14 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\logui.ocx
[2010/04/24 10:42:13 | 000,829,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetmgr.dll
[2010/04/24 10:42:13 | 000,169,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisui.dll
[2010/04/24 10:42:13 | 000,068,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\isatq.dll
[2010/04/24 10:42:13 | 000,019,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetsloc.dll
[2010/04/24 10:42:13 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\infoadmn.dll
[2010/04/24 10:42:13 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetmgr.exe
[2010/04/24 10:42:12 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisrtl.dll
[2010/04/24 10:42:12 | 000,068,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisext51.dll
[2010/04/24 10:42:12 | 000,064,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iismap.dll
[2010/04/24 10:42:12 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisrstas.exe
[2010/04/24 10:42:12 | 000,020,538 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpremadm.exe
[2010/04/24 10:42:12 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisreset.exe
[2010/04/24 10:42:12 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ftpsapi2.dll
[2010/04/24 10:42:12 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iisrstap.dll
[2010/04/24 10:42:11 | 000,598,071 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpmmc.dll
[2010/04/24 10:42:11 | 000,208,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpmmcsat.dll
[2010/04/24 10:42:11 | 000,188,494 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpcount.exe
[2010/04/24 10:42:11 | 000,109,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp98swin.exe
[2010/04/24 10:42:11 | 000,020,541 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fpexedll.dll
[2010/04/24 10:42:10 | 000,876,653 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4awel.dll
[2010/04/24 10:42:10 | 000,147,513 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4apws.dll
[2010/04/24 10:42:10 | 000,102,509 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4atxt.dll
[2010/04/24 10:42:10 | 000,049,212 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4awebs.dll
[2010/04/24 10:42:10 | 000,049,210 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4areg.dll
[2010/04/24 10:42:10 | 000,041,020 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4avnb.dll
[2010/04/24 10:42:10 | 000,032,826 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4avss.dll
[2010/04/24 10:42:10 | 000,014,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp98sadm.exe
[2010/04/24 10:42:09 | 000,184,435 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4amsft.dll
[2010/04/24 10:42:09 | 000,082,035 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fp4anscp.dll
[2010/04/24 10:42:09 | 000,076,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cnfgprts.ocx
[2010/04/24 10:42:09 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\coadmin.dll
[2010/04/24 10:42:08 | 000,275,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\certwiz.ocx
[2010/04/24 10:42:08 | 000,188,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cfgwiz.exe
[2010/04/24 10:42:08 | 000,094,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\certmap.ocx
[2010/04/24 10:42:08 | 000,020,540 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\author.dll
[2010/04/24 10:42:08 | 000,016,439 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\author.exe
[2010/04/24 10:42:07 | 000,290,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\adsiis51.dll
[2010/04/24 10:42:07 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\admwprox.dll
[2010/04/24 10:42:07 | 000,016,439 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\admin.exe
[2010/04/24 10:42:06 | 000,020,540 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\admin.dll
[2010/04/24 10:42:00 | 000,000,000 | —D | C] – C:\WINDOWS\System32\xircom
[2010/04/24 10:42:00 | 000,000,000 | —D | C] – C:\Program Files\xerox
[2010/04/24 10:42:00 | 000,000,000 | —D | C] – C:\Program Files\microsoft frontpage
[2010/04/24 10:41:22 | 000,112,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mapi32.dll
[2010/04/24 10:40:44 | 000,000,000 | -HSD | C] – C:\Documents and Settings\All Users\DRM
[2010/04/24 10:40:33 | 000,000,000 | –SD | C] – C:\WINDOWS\Downloaded Program Files
[2010/04/24 10:40:33 | 000,000,000 | R–D | C] – C:\WINDOWS\Offline Web Pages
[2010/04/24 10:40:22 | 000,000,000 | -H-D | C] – C:\Program Files\WindowsUpdate
[2010/04/24 10:40:02 | 000,000,000 | —D | C] – C:\WINDOWS\System32\DirectX
[2010/04/24 10:39:56 | 000,099,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\helphost.exe
[2010/04/24 10:39:56 | 000,035,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\notiflag.exe
[2010/04/24 10:39:56 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\brpinfo.dll
[2010/04/24 10:39:56 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\atrace.dll
[2010/04/24 10:39:56 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\atrace.dll
[2010/04/24 10:39:56 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hcappres.dll
[2010/04/24 10:39:47 | 000,047,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\srdiag.exe
[2010/04/24 10:39:47 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\nmevtmsg.dll
[2010/04/24 10:39:47 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nmevtmsg.dll
[2010/04/24 10:39:46 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msinfo32.exe
[2010/04/24 10:39:46 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wb32.exe
[2010/04/24 10:39:46 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cb32.exe
[2010/04/24 10:39:45 | 000,064,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\acctres.dll
[2010/04/24 10:39:45 | 000,064,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\acctres.dll
[2010/04/24 10:39:45 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Services
[2010/04/24 10:39:42 | 000,073,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icwtutor.exe
[2010/04/24 10:39:42 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icwres.dll
[2010/04/24 10:39:42 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\trialoc.dll
[2010/04/24 10:39:42 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mssoapr.dll
[2010/04/24 10:39:42 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\isignup.exe
[2010/04/24 10:39:42 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\icfgnt5.dll
[2010/04/24 10:39:42 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icfgnt5.dll
[2010/04/24 10:39:42 | 000,000,000 | –SD | C] – C:\WINDOWS\Tasks
[2010/04/24 10:39:41 | 000,235,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mssoap1.dll
[2010/04/24 10:39:41 | 000,025,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wisc10.dll
[2010/04/24 10:39:41 | 000,000,000 | —D | C] – C:\Program Files\Common Files\MSSoap
[2010/04/24 10:39:40 | 000,093,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieinfo5.ocx
[2010/04/24 10:39:38 | 000,726,078 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\srchui.dll
[2010/04/24 10:39:38 | 000,058,434 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\srchctls.dll
[2010/04/24 10:39:37 | 003,166,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msgr3en.dll
[2010/04/24 10:39:37 | 000,000,000 | —D | C] – C:\WINDOWS\srchasst
[2010/04/24 10:39:36 | 000,759,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\VGX.dll
[2010/04/24 10:39:36 | 000,000,000 | —D | C] – C:\WINDOWS\System32\Macromed
[2010/04/24 10:39:35 | 001,669,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\setup_wm.exe
[2010/04/24 10:39:35 | 000,243,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mpvis.dll
[2010/04/24 10:39:35 | 000,221,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmpns.dll
[2010/04/24 10:39:35 | 000,096,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmpband.dll
[2010/04/24 10:39:34 | 000,786,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\migrate.exe
[2010/04/24 10:39:34 | 000,364,544 | —- | C] (Microsoft Corporation (written by Digital Renaissance Inc.)) – C:\WINDOWS\System32\dllcache\npdsplay.dll
[2010/04/24 10:39:34 | 000,226,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\npdrmv2.dll
[2010/04/24 10:39:34 | 000,064,000 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmplayer.exe
[2010/04/24 10:39:34 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\custsat.dll
[2010/04/24 10:39:34 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\npwmsdrm.dll
[2010/04/24 10:39:33 | 000,327,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wucltui.dll
[2010/04/24 10:39:33 | 000,327,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wucltui.dll
[2010/04/24 10:39:33 | 000,209,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wuweb.dll
[2010/04/24 10:39:33 | 000,183,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wuaueng1.dll
[2010/04/24 10:39:33 | 000,183,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wuaueng1.dll
[2010/04/24 10:39:33 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wuauserv.dll
[2010/04/24 10:39:33 | 000,004,639 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mplayer2.exe
[2010/04/24 10:39:32 | 001,929,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wuaueng.dll
[2010/04/24 10:39:32 | 000,575,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wuapi.dll
[2010/04/24 10:39:32 | 000,575,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wuapi.dll
[2010/04/24 10:39:32 | 000,217,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wuaucpl.cpl
[2010/04/24 10:39:32 | 000,165,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wuauclt1.exe
[2010/04/24 10:39:32 | 000,165,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wuauclt1.exe
[2010/04/24 10:39:32 | 000,053,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wuauclt.exe
[2010/04/24 10:39:32 | 000,035,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wups.dll
[2010/04/24 10:39:32 | 000,035,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wups.dll
[2010/04/24 10:39:32 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\bitsprx2.dll
[2010/04/24 10:39:32 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\bitsprx2.dll
[2010/04/24 10:39:32 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\bitsprx4.dll
[2010/04/24 10:39:32 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\bitsprx4.dll
[2010/04/24 10:39:32 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\bitsprx3.dll
[2010/04/24 10:39:32 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\bitsprx3.dll
[2010/04/24 10:39:31 | 000,409,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\qmgr.dll
[2010/04/24 10:39:31 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\qmgrprxy.dll
[2010/04/24 10:39:31 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\qmgrprxy.dll
[2010/04/24 10:39:30 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmm2res2.dll
[2010/04/24 10:39:30 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmm2eres.dll
[2010/04/24 10:39:29 | 004,256,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmm2res.dll
[2010/04/24 10:39:29 | 000,325,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmm2fxb.dll
[2010/04/24 10:39:28 | 000,502,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmm2fxa.dll
[2010/04/24 10:39:28 | 000,402,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmm2filt.dll
[2010/04/24 10:39:28 | 000,167,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmm2ae.dll
[2010/04/24 10:39:28 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmm2ext.dll
[2010/04/24 10:39:27 | 003,558,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\moviemk.exe
[2010/04/24 10:39:27 | 000,000,000 | —D | C] – C:\Program Files\Movie Maker
[2010/04/24 10:39:13 | 000,565,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msobmain.dll
[2010/04/24 10:39:13 | 000,122,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msobcomm.dll
[2010/04/24 10:39:13 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msobshel.dll
[2010/04/24 10:39:13 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msobdl.dll
[2010/04/24 10:39:12 | 000,051,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\oobebaln.exe
[2010/04/24 10:39:12 | 000,029,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msoobe.exe
[2010/04/24 10:39:12 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msobweb.dll
[2010/04/24 10:39:10 | 000,150,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\uploadm.exe
[2010/04/24 10:39:09 | 000,102,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pchshell.dll
[2010/04/24 10:39:09 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\safrslv.dll
[2010/04/24 10:39:09 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\safrslv.dll
[2010/04/24 10:39:09 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\safrcdlg.dll
[2010/04/24 10:39:09 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\safrcdlg.dll
[2010/04/24 10:39:09 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\racpldlg.dll
[2010/04/24 10:39:09 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\racpldlg.dll
[2010/04/24 10:39:09 | 000,038,400 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pchsvc.dll
[2010/04/24 10:39:09 | 000,029,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\safrdm.dll
[2010/04/24 10:39:09 | 000,029,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\safrdm.dll
[2010/04/24 10:39:06 | 000,769,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\helpctr.exe
[2010/04/24 10:39:06 | 000,744,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\helpsvc.exe
[2010/04/24 10:39:06 | 000,169,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msconfig.exe
[2010/04/24 10:39:06 | 000,018,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hscupd.exe
[2010/04/24 10:39:05 | 000,380,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rstrui.exe
[2010/04/24 10:39:05 | 000,239,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\srrstr.dll
[2010/04/24 10:39:05 | 000,239,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\srrstr.dll
[2010/04/24 10:39:05 | 000,171,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\srsvc.dll
[2010/04/24 10:39:05 | 000,129,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fltmgr.sys
[2010/04/24 10:39:05 | 000,023,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\fltMc.exe
[2010/04/24 10:39:05 | 000,023,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fltmc.exe
[2010/04/24 10:39:05 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fltlib.dll
[2010/04/24 10:39:05 | 000,000,000 | —D | C] – C:\WINDOWS\System32\Restore
[2010/04/24 10:39:04 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ils.dll
[2010/04/24 10:39:04 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ils.dll
[2010/04/24 10:39:04 | 000,073,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sr.sys
[2010/04/24 10:39:04 | 000,067,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\srclient.dll
[2010/04/24 10:39:04 | 000,034,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mnmdd.dll
[2010/04/24 10:39:04 | 000,034,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mnmdd.dll
[2010/04/24 10:39:04 | 000,032,768 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\isrdbg32.dll
[2010/04/24 10:39:04 | 000,032,768 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\isrdbg32.dll
[2010/04/24 10:39:03 | 000,229,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nmas.dll
[2010/04/24 10:39:03 | 000,069,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msconf.dll
[2010/04/24 10:39:03 | 000,069,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msconf.dll
[2010/04/24 10:39:03 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dcap32.dll
[2010/04/24 10:39:03 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mnmsrvc.exe
[2010/04/24 10:39:03 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\nmmkcert.dll
[2010/04/24 10:39:03 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nmmkcert.dll
[2010/04/24 10:39:03 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nmasnt.dll
[2010/04/24 10:39:02 | 000,385,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\callcont.dll
[2010/04/24 10:39:02 | 000,221,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nac.dll
[2010/04/24 10:39:02 | 000,077,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nmcom.dll
[2010/04/24 10:39:02 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rrcm.dll
[2010/04/24 10:39:02 | 000,057,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mst123.dll
[2010/04/24 10:39:02 | 000,057,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\h323cc.dll
[2010/04/24 10:39:02 | 000,045,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\confmrsl.dll
[2010/04/24 10:39:01 | 001,032,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\conf.exe
[2010/04/24 10:39:01 | 000,274,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mst120.dll
[2010/04/24 10:39:01 | 000,188,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nmwb.dll
[2010/04/24 10:39:01 | 000,172,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nmoldwb.dll
[2010/04/24 10:39:01 | 000,151,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nmft.dll
[2010/04/24 10:39:01 | 000,105,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msoert2.dll
[2010/04/24 10:39:01 | 000,105,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msoert2.dll
[2010/04/24 10:39:01 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nmchat.dll
[2010/04/24 10:39:01 | 000,000,000 | —D | C] – C:\Program Files\NetMeeting
[2010/04/24 10:39:00 | 000,510,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wab32.dll
[2010/04/24 10:39:00 | 000,252,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msoeacct.dll
[2010/04/24 10:39:00 | 000,252,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msoeacct.dll
[2010/04/24 10:39:00 | 000,249,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wab32res.dll
[2010/04/24 10:39:00 | 000,085,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wabimp.dll
[2010/04/24 10:39:00 | 000,046,080 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wab.exe
[2010/04/24 10:39:00 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wabfind.dll
[2010/04/24 10:39:00 | 000,030,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wabmig.exe
[2010/04/24 10:38:59 | 000,691,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetcomm.dll
[2010/04/24 10:38:59 | 000,104,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\oeimport.dll
[2010/04/24 10:38:59 | 000,086,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\directdb.dll
[2010/04/24 10:38:59 | 000,060,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msimn.exe
[2010/04/24 10:38:59 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\inetres.dll
[2010/04/24 10:38:59 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetres.dll
[2010/04/24 10:38:58 | 002,479,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msoeres.dll
[2010/04/24 10:38:57 | 000,274,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mstask.dll
[2010/04/24 10:38:57 | 000,192,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\schedsvc.dll
[2010/04/24 10:38:57 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\setup50.exe
[2010/04/24 10:38:57 | 000,060,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\oemig50.exe
[2010/04/24 10:38:57 | 000,035,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\oemiglib.dll
[2010/04/24 10:38:57 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mstinit.exe
[2010/04/24 10:38:57 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mstinit.exe
[2010/04/24 10:38:57 | 000,000,000 | —D | C] – C:\Program Files\Outlook Express
[2010/04/24 10:38:56 | 000,274,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\inetcfg.dll
[2010/04/24 10:38:56 | 000,274,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetcfg.dll
[2010/04/24 10:38:56 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\isign32.dll
[2010/04/24 10:38:56 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\isign32.dll
[2010/04/24 10:38:56 | 000,073,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\icwdial.dll
[2010/04/24 10:38:56 | 000,073,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icwdial.dll
[2010/04/24 10:38:56 | 000,065,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\icwphbk.dll
[2010/04/24 10:38:56 | 000,065,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icwphbk.dll
[2010/04/24 10:38:55 | 000,554,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dao360.dll
[2010/04/24 10:38:55 | 000,214,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icwconn1.exe
[2010/04/24 10:38:55 | 000,172,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icwhelp.dll
[2010/04/24 10:38:55 | 000,086,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icwconn2.exe
[2010/04/24 10:38:55 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icwconn.dll
[2010/04/24 10:38:55 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icwutil.dll
[2010/04/24 10:38:55 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icwdl.dll
[2010/04/24 10:38:55 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icwrmind.exe
[2010/04/24 10:38:55 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetwiz.exe
[2010/04/24 10:38:54 | 000,487,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\oledb32.dll
[2010/04/24 10:38:54 | 000,217,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sqlxmlx.dll
[2010/04/24 10:38:54 | 000,204,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdaps.dll
[2010/04/24 10:38:54 | 000,094,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdatl3.dll
[2010/04/24 10:38:54 | 000,077,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdaosp.dll
[2010/04/24 10:38:54 | 000,065,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\oledb32r.dll
[2010/04/24 10:38:53 | 000,315,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdasql.dll
[2010/04/24 10:38:53 | 000,233,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdaora.dll
[2010/04/24 10:38:53 | 000,200,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadox.dll
[2010/04/24 10:38:53 | 000,180,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadomd.dll
[2010/04/24 10:38:53 | 000,102,400 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msjro.dll
[2010/04/24 10:38:53 | 000,057,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadrh15.dll
[2010/04/24 10:38:53 | 000,057,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msador15.dll
[2010/04/24 10:38:53 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msxactps.dll
[2010/04/24 10:38:53 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdatt.dll
[2010/04/24 10:38:53 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdasqlr.dll
[2010/04/24 10:38:53 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdaorar.dll
[2010/04/24 10:38:53 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdaurl.dll
[2010/04/24 10:38:53 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdasc.dll
[2010/04/24 10:38:53 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdaer.dll
[2010/04/24 10:38:53 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdaenum.dll
[2010/04/24 10:38:53 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdadc.dll
[2010/04/24 10:38:52 | 000,536,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msado15.dll
[2010/04/24 10:38:52 | 000,200,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdaprst.dll
[2010/04/24 10:38:52 | 000,118,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdarem.dll
[2010/04/24 10:38:52 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msado27.tlb
[2010/04/24 10:38:52 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msado26.tlb
[2010/04/24 10:38:52 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msado25.tlb
[2010/04/24 10:38:52 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msado21.tlb
[2010/04/24 10:38:52 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msado20.tlb
[2010/04/24 10:38:52 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdfmap.dll
[2010/04/24 10:38:52 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msader15.dll
[2010/04/24 10:38:52 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdaremr.dll
[2010/04/24 10:38:52 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdaprsr.dll
[2010/04/24 10:38:51 | 000,331,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadce.dll
[2010/04/24 10:38:51 | 000,155,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadds.dll
[2010/04/24 10:38:51 | 000,143,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadco.dll
[2010/04/24 10:38:51 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadcf.dll
[2010/04/24 10:38:51 | 000,053,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadcs.dll
[2010/04/24 10:38:51 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msaddsr.dll
[2010/04/24 10:38:51 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadcer.dll
[2010/04/24 10:38:51 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadcor.dll
[2010/04/24 10:38:51 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadcfr.dll
[2010/04/24 10:38:51 | 000,000,000 | —D | C] – C:\Program Files\Common Files\System
[2010/04/24 10:38:50 | 000,638,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iexplore.exe
[2010/04/24 10:38:50 | 000,068,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hmmapi.dll
[2010/04/24 10:38:50 | 000,018,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedw.exe
[2010/04/24 10:38:45 | 000,000,000 | —D | C] – C:\Program Files\Internet Explorer
[2010/04/24 10:38:44 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Documents\My Pictures
[2010/04/24 10:38:12 | 000,000,000 | —D | C] – C:\Program Files\ComPlus Applications
[2010/04/24 10:38:05 | 000,000,000 | —D | C] – C:\WINDOWS\Registration
[2010/04/24 10:37:57 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Documents\My Music
[2010/04/24 10:37:57 | 000,000,000 | —D | C] – C:\Program Files\Windows Media Player
[2010/04/24 10:37:57 | 000,000,000 | —D | C] – C:\Program Files\Online Services
[2010/04/24 10:37:50 | 000,000,000 | —D | C] – C:\Program Files\Messenger
[2010/04/24 10:37:49 | 001,817,687 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\bckgres.dll
[2010/04/24 10:37:49 | 000,753,236 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rvseres.dll
[2010/04/24 10:37:49 | 000,082,501 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\bckg.dll
[2010/04/24 10:37:49 | 000,048,706 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rvse.dll
[2010/04/24 10:37:49 | 000,042,577 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\bckgzm.exe
[2010/04/24 10:37:49 | 000,042,574 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rvsezm.exe
[2010/04/24 10:37:48 | 002,178,131 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\shvlres.dll
[2010/04/24 10:37:48 | 001,175,635 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hrtzres.dll
[2010/04/24 10:37:48 | 000,780,885 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chkrres.dll
[2010/04/24 10:37:48 | 000,066,113 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\shvl.dll
[2010/04/24 10:37:48 | 000,057,409 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hrtz.dll
[2010/04/24 10:37:48 | 000,042,575 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chkrzm.exe
[2010/04/24 10:37:48 | 000,042,573 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\shvlzm.exe
[2010/04/24 10:37:48 | 000,042,573 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hrtzzm.exe
[2010/04/24 10:37:48 | 000,040,515 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chkr.dll
[2010/04/24 10:37:48 | 000,032,339 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\uniansi.dll
[2010/04/24 10:37:48 | 000,004,677 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\zeeverm.dll
[2010/04/24 10:37:47 | 001,039,955 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cmnresm.dll
[2010/04/24 10:37:47 | 000,113,222 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\zoneclim.dll
[2010/04/24 10:37:47 | 000,041,029 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\zcorem.dll
[2010/04/24 10:37:47 | 000,013,894 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\zonelibm.dll
[2010/04/24 10:37:46 | 000,217,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cmnclim.dll
[2010/04/24 10:37:46 | 000,036,937 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\zclientm.exe
[2010/04/24 10:37:46 | 000,029,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\znetm.dll
[2010/04/24 10:37:46 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\write.exe
[2010/04/24 10:37:46 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\write.exe
[2010/04/24 10:37:46 | 000,000,000 | —D | C] – C:\Program Files\MSN Gaming Zone
[2010/04/24 10:37:37 | 000,138,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sndvol32.exe
[2010/04/24 10:37:37 | 000,138,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sndvol32.exe
[2010/04/24 10:37:37 | 000,044,544 | —- | C] (Hilgraeve, Inc.) – C:\WINDOWS\System32\hticons.dll
[2010/04/24 10:37:37 | 000,013,312 | —- | C] (Hilgraeve, Inc.) – C:\WINDOWS\System32\dllcache\htrn_jis.dll
[2010/04/24 10:37:36 | 000,227,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\avtapi.dll
[2010/04/24 10:37:36 | 000,227,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\avtapi.dll
[2010/04/24 10:37:36 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\avwav.dll
[2010/04/24 10:37:36 | 000,073,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\avwav.dll
[2010/04/24 10:37:36 | 000,035,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\winchat.exe
[2010/04/24 10:37:36 | 000,035,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winchat.exe
[2010/04/24 10:37:36 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\avmeter.dll
[2010/04/24 10:37:36 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\avmeter.dll
[2010/04/24 10:37:30 | 000,605,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\getuname.dll
[2010/04/24 10:37:30 | 000,605,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\getuname.dll
[2010/04/24 10:37:29 | 000,119,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\winmine.exe
[2010/04/24 10:37:29 | 000,119,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winmine.exe
[2010/04/24 10:37:29 | 000,114,688 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\calc.exe
[2010/04/24 10:37:29 | 000,114,688 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\calc.exe
[2010/04/24 10:37:29 | 000,080,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\charmap.exe
[2010/04/24 10:37:29 | 000,080,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\charmap.exe
[2010/04/24 10:37:29 | 000,056,832 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sol.exe
[2010/04/24 10:37:29 | 000,056,832 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sol.exe
[2010/04/24 10:37:28 | 000,126,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mshearts.exe
[2010/04/24 10:37:28 | 000,126,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mshearts.exe
[2010/04/24 10:37:28 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\freecell.exe
[2010/04/24 10:37:28 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\freecell.exe
[2010/04/24 10:37:28 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tsshutdn.exe
[2010/04/24 10:37:28 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tsshutdn.exe
[2010/04/24 10:37:28 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tskill.exe
[2010/04/24 10:37:28 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tskill.exe
[2010/04/24 10:37:28 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tsdiscon.exe
[2010/04/24 10:37:28 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tsdiscon.exe
[2010/04/24 10:37:28 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tscon.exe
[2010/04/24 10:37:28 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tscon.exe
[2010/04/24 10:37:28 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\reset.exe
[2010/04/24 10:37:28 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\reset.exe
[2010/04/24 10:37:27 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\regini.exe
[2010/04/24 10:37:27 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\regini.exe
[2010/04/24 10:37:27 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\qwinsta.exe
[2010/04/24 10:37:27 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\qwinsta.exe
[2010/04/24 10:37:27 | 000,020,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msg.exe
[2010/04/24 10:37:27 | 000,020,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msg.exe
[2010/04/24 10:37:27 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\qappsrv.exe
[2010/04/24 10:37:27 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\qappsrv.exe
[2010/04/24 10:37:27 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rwinsta.exe
[2010/04/24 10:37:27 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rwinsta.exe
[2010/04/24 10:37:27 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cdmodem.dll
[2010/04/24 10:37:27 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cdmodem.dll
[2010/04/24 10:37:27 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\logoff.exe
[2010/04/24 10:37:27 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\logoff.exe
[2010/04/24 10:37:27 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\shadow.exe
[2010/04/24 10:37:27 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\shadow.exe
[2010/04/24 10:37:27 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rdpcfgex.dll
[2010/04/24 10:37:27 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rdpcfgex.dll
[2010/04/24 10:37:26 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmi2xml.dll
[2010/04/24 10:37:26 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mtsadmin.tlb
[2010/04/24 10:37:23 | 000,075,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmipicmp.dll
[2010/04/24 10:37:23 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmimsg.dll
[2010/04/24 10:37:23 | 000,052,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmitimep.dll
[2010/04/24 10:37:23 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winmgmtr.dll
[2010/04/24 10:37:23 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winmgmt.exe
[2010/04/24 10:37:22 | 000,273,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msiprov.dll
[2010/04/24 10:37:22 | 000,116,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\updprov.dll
[2010/04/24 10:37:22 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tmplprov.dll
[2010/04/24 10:37:22 | 000,059,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemdisp.tlb
[2010/04/24 10:37:22 | 000,059,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\trnsprov.dll
[2010/04/24 10:37:22 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smtpcons.dll
[2010/04/24 10:37:22 | 000,031,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemads.tlb
[2010/04/24 10:37:22 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\unsecapp.exe
[2010/04/24 10:37:22 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemads.dll
[2010/04/24 10:37:21 | 000,120,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dsprov.dll
[2010/04/24 10:37:21 | 000,053,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fwdprov.dll
[2010/04/24 10:37:08 | 000,000,000 | —D | C] – C:\Program Files\MSN
[2010/04/24 10:37:07 | 000,281,088 | —- | C] (Cinematronics) – C:\WINDOWS\System32\dllcache\pinball.exe
[2010/04/24 10:37:07 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\accwiz.exe
[2010/04/24 10:37:07 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\accwiz.exe
[2010/04/24 10:37:07 | 000,068,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\access.cpl
[2010/04/24 10:37:07 | 000,068,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\access.cpl
[2010/04/24 10:37:06 | 000,539,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dialer.exe
[2010/04/24 10:37:06 | 000,347,136 | —- | C] (Hilgraeve, Inc.) – C:\WINDOWS\System32\hypertrm.dll
[2010/04/24 10:37:06 | 000,131,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sndrec32.exe
[2010/04/24 10:37:06 | 000,131,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sndrec32.exe
[2010/04/24 10:37:06 | 000,123,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mplay32.exe
[2010/04/24 10:37:06 | 000,123,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mplay32.exe
[2010/04/24 10:37:06 | 000,000,000 | —D | C] – C:\Program Files\Windows NT
[2010/04/24 10:37:05 | 000,538,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spider.exe
[2010/04/24 10:37:05 | 000,538,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\spider.exe
[2010/04/24 10:37:05 | 000,343,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mspaint.exe
[2010/04/24 10:37:05 | 000,343,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mspaint.exe
[2010/04/24 10:37:05 | 000,102,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\clipbrd.exe
[2010/04/24 10:37:05 | 000,102,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\clipbrd.exe
[2010/04/24 10:37:04 | 000,139,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rdpwd.sys
[2010/04/24 10:37:04 | 000,093,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tscfgwmi.dll
[2010/04/24 10:37:04 | 000,093,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tscfgwmi.dll
[2010/04/24 10:37:04 | 000,053,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tsgqec.dll
[2010/04/24 10:37:04 | 000,053,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tsgqec.dll
[2010/04/24 10:37:04 | 000,021,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tdtcp.sys
[2010/04/24 10:37:04 | 000,012,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tdpipe.sys
[2010/04/24 10:37:04 | 000,000,000 | —D | C] – C:\WINDOWS\System32\en-US
[2010/04/24 10:37:03 | 002,061,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lhmstscx.dll
[2010/04/24 10:37:03 | 000,290,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rhttpaa.dll
[2010/04/24 10:37:03 | 000,290,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rhttpaa.dll
[2010/04/24 10:37:03 | 000,136,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aaclient.dll
[2010/04/24 10:37:03 | 000,136,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\aaclient.dll
[2010/04/24 10:37:02 | 000,677,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lhmstsc.exe
[2010/04/24 10:37:02 | 000,147,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rdchost.dll
[2010/04/24 10:37:02 | 000,147,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rdchost.dll
[2010/04/24 10:37:02 | 000,141,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sessmgr.exe
[2010/04/24 10:37:02 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rdshost.exe
[2010/04/24 10:37:02 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rdshost.exe
[2010/04/24 10:37:02 | 000,060,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\remotepg.dll
[2010/04/24 10:37:02 | 000,013,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rdsaddin.exe
[2010/04/24 10:37:02 | 000,013,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rdsaddin.exe
[2010/04/24 10:37:01 | 000,295,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\termsrv.dll
[2010/04/24 10:37:01 | 000,161,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msdtcuiu.dll
[2010/04/24 10:37:01 | 000,161,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdtcuiu.dll
[2010/04/24 10:37:01 | 000,091,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mtxoci.dll
[2010/04/24 10:37:01 | 000,091,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mtxoci.dll
[2010/04/24 10:37:01 | 000,087,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rdpwsx.dll
[2010/04/24 10:37:01 | 000,087,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rdpwsx.dll
[2010/04/24 10:37:01 | 000,062,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rdpclip.exe
[2010/04/24 10:37:01 | 000,062,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rdpclip.exe
[2010/04/24 10:37:01 | 000,038,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cfgbkend.dll
[2010/04/24 10:37:01 | 000,038,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cfgbkend.dll
[2010/04/24 10:37:01 | 000,019,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rdpsnd.dll
[2010/04/24 10:37:01 | 000,019,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rdpsnd.dll
[2010/04/24 10:37:01 | 000,019,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\qprocess.exe
[2010/04/24 10:37:01 | 000,019,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\qprocess.exe
[2010/04/24 10:37:01 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\icaapi.dll
[2010/04/24 10:37:01 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icaapi.dll
[2010/04/24 10:37:01 | 000,000,000 | —D | C] – C:\WINDOWS\System32\MsDtc
[2010/04/24 10:37:00 | 000,956,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msdtctm.dll
[2010/04/24 10:37:00 | 000,956,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdtctm.dll
[2010/04/24 10:37:00 | 000,428,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msdtcprx.dll
[2010/04/24 10:37:00 | 000,428,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdtcprx.dll
[2010/04/24 10:37:00 | 000,058,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msdtclog.dll
[2010/04/24 10:37:00 | 000,058,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdtclog.dll
[2010/04/24 10:37:00 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xolehlp.dll
[2010/04/24 10:37:00 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xolehlp.dll
[2010/04/24 10:37:00 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msdtc.exe
[2010/04/24 10:36:59 | 000,195,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comadmin.dll
[2010/04/24 10:36:59 | 000,034,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mtxlegih.dll
[2010/04/24 10:36:59 | 000,034,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mtxlegih.dll
[2010/04/24 10:36:59 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mtxdm.dll
[2010/04/24 10:36:59 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mtxdm.dll
[2010/04/24 10:36:59 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comrepl.exe
[2010/04/24 10:36:59 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dcomcnfg.exe
[2010/04/24 10:36:59 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dcomcnfg.exe
[2010/04/24 10:36:59 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comrereg.exe
[2010/04/24 10:36:59 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mtxex.dll
[2010/04/24 10:36:59 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mtxex.dll
[2010/04/24 10:36:58 | 000,625,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\catsrvut.dll
[2010/04/24 10:36:58 | 000,625,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\catsrvut.dll
[2010/04/24 10:36:58 | 000,226,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\catsrv.dll
[2010/04/24 10:36:58 | 000,226,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\catsrv.dll
[2010/04/24 10:36:58 | 000,110,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\clbcatex.dll
[2010/04/24 10:36:58 | 000,110,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\clbcatex.dll
[2010/04/24 10:36:58 | 000,097,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comrepl.dll
[2010/04/24 10:36:58 | 000,097,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\comrepl.dll
[2010/04/24 10:36:58 | 000,085,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\catsrvps.dll
[2010/04/24 10:36:58 | 000,085,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\catsrvps.dll
[2010/04/24 10:36:58 | 000,060,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\colbact.dll
[2010/04/24 10:36:58 | 000,060,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\colbact.dll
[2010/04/24 10:36:58 | 000,059,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\stclient.dll
[2010/04/24 10:36:58 | 000,059,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\stclient.dll
[2010/04/24 10:36:58 | 000,028,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comaddin.dll
[2010/04/24 10:36:58 | 000,028,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\comaddin.dll
[2010/04/24 10:36:58 | 000,000,000 | —D | C] – C:\WINDOWS\System32\Com
[2010/04/24 10:36:57 | 001,267,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comsvcs.dll
[2010/04/24 10:36:57 | 001,267,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\comsvcs.dll
[2010/04/24 10:36:57 | 000,539,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comuid.dll
[2010/04/24 10:36:57 | 000,539,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\comuid.dll
[2010/04/24 10:36:57 | 000,167,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comsnap.dll
[2010/04/24 10:36:57 | 000,167,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\comsnap.dll
[2010/04/24 10:36:56 | 000,498,688 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\clbcatq.dll
[2010/04/24 10:36:55 | 000,144,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmisvc.dll
[2010/04/24 10:36:55 | 000,144,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiprov.dll
[2010/04/24 10:36:55 | 000,095,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiutils.dll
[2010/04/24 10:36:55 | 000,062,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmipjobj.dll
[2010/04/24 10:36:55 | 000,041,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmipsess.dll
[2010/04/24 10:36:54 | 000,358,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmic.exe
[2010/04/24 10:36:54 | 000,273,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemess.dll
[2010/04/24 10:36:54 | 000,197,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemupgd.dll
[2010/04/24 10:36:54 | 000,196,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiadap.exe
[2010/04/24 10:36:54 | 000,178,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemdisp.dll
[2010/04/24 10:36:54 | 000,156,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmipcima.dll
[2010/04/24 10:36:54 | 000,140,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmidcprv.dll
[2010/04/24 10:36:54 | 000,132,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmipdskq.dll
[2010/04/24 10:36:54 | 000,126,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiapsrv.exe
[2010/04/24 10:36:54 | 000,116,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemtest.exe
[2010/04/24 10:36:54 | 000,088,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiaprpl.dll
[2010/04/24 10:36:54 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmipiprt.dll
[2010/04/24 10:36:54 | 000,060,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmicookr.dll
[2010/04/24 10:36:54 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemsvc.dll
[2010/04/24 10:36:54 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemprox.dll
[2010/04/24 10:36:54 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiapres.dll
[2010/04/24 10:36:53 | 000,531,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemcore.dll
[2010/04/24 10:36:53 | 000,214,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemcomn.dll
[2010/04/24 10:36:53 | 000,196,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemcntl.dll
[2010/04/24 10:36:53 | 000,178,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\repdrvfs.dll
[2010/04/24 10:36:53 | 000,131,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\viewprov.dll
[2010/04/24 10:36:53 | 000,086,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\stdprov.dll
[2010/04/24 10:36:53 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wbemcons.dll
[2010/04/24 10:36:53 | 000,036,352 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\scrcons.exe
[2010/04/24 10:36:52 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\provthrd.dll
[2010/04/24 10:36:52 | 000,212,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntevt.dll
[2010/04/24 10:36:52 | 000,123,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mofd.dll
[2010/04/24 10:36:52 | 000,092,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\policman.dll
[2010/04/24 10:36:52 | 000,047,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ncprov.dll
[2010/04/24 10:36:52 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\krnlprov.dll
[2010/04/24 10:36:52 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mofcomp.exe
[2010/04/24 10:36:51 | 001,358,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cimwin32.dll
[2010/04/24 10:36:51 | 000,247,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\esscli.dll
[2010/04/24 10:36:51 | 000,185,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\framedyn.dll
[2010/04/24 10:36:50 | 000,185,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cmprops.dll
[2010/04/24 10:36:50 | 000,185,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cmprops.dll
[2010/04/24 10:36:50 | 000,058,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\licwmi.dll
[2010/04/24 10:36:50 | 000,058,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\licwmi.dll
[2010/04/24 10:36:50 | 000,056,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\servdeps.dll
[2010/04/24 10:36:50 | 000,056,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\servdeps.dll
[2010/04/24 10:36:50 | 000,017,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mmfutil.dll
[2010/04/24 10:36:50 | 000,017,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mmfutil.dll
[2010/04/24 10:36:43 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Documents\My Videos
[2010/04/23 15:32:04 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\usbui.dll
[2010/04/23 15:32:04 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbui.dll
[2010/04/23 15:31:54 | 000,014,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\battc.sys
[2010/04/23 15:31:00 | 000,000,000 | -HSD | C] – C:\WINDOWS\Installer
[2010/04/23 15:31:00 | 000,000,000 | —D | C] – C:\Program Files\Common Files\ODBC
[2010/04/23 15:30:58 | 000,077,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\spcommon.dll
[2010/04/23 15:30:58 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\spcplui.dll
[2010/04/23 15:30:57 | 000,774,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\spttseng.dll
[2010/04/23 15:30:56 | 000,741,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sapi.dll
[2010/04/23 15:30:56 | 000,155,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sapi.cpl
[2010/04/23 15:30:56 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sapisvr.exe
[2010/04/23 15:30:56 | 000,000,000 | —D | C] – C:\Program Files\Common Files\SpeechEngines
[2010/04/23 15:30:55 | 000,000,000 | R–D | C] – C:\Program Files
[2010/04/23 15:30:55 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Microsoft Shared
[2010/04/23 15:30:55 | 000,000,000 | —D | C] – C:\Program Files\Common Files
[2010/04/23 15:30:54 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0408.dll
[2010/04/23 15:30:54 | 000,019,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt040e.dll
[2010/04/23 15:30:54 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt041f.dll
[2010/04/23 15:30:54 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0419.dll
[2010/04/23 15:30:54 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0415.dll
[2010/04/23 15:30:54 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agt0405.dll
[2010/04/23 15:30:52 | 000,006,144 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdtuq.dll
[2010/04/23 15:30:52 | 000,006,144 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdtuf.dll
[2010/04/23 15:30:52 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdtuq.dll
[2010/04/23 15:30:52 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdtuf.dll
[2010/04/23 15:30:52 | 000,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdazel.dll
[2010/04/23 15:30:52 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdazel.dll
[2010/04/23 15:30:51 | 000,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdycc.dll
[2010/04/23 15:30:51 | 000,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbduzb.dll
[2010/04/23 15:30:51 | 000,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdur.dll
[2010/04/23 15:30:51 | 000,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdtat.dll
[2010/04/23 15:30:51 | 000,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdru1.dll
[2010/04/23 15:30:51 | 000,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdru.dll
[2010/04/23 15:30:51 | 000,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdmon.dll
[2010/04/23 15:30:51 | 000,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdkyr.dll
[2010/04/23 15:30:51 | 000,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdkaz.dll
[2010/04/23 15:30:51 | 000,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdaze.dll
[2010/04/23 15:30:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdycc.dll
[2010/04/23 15:30:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbduzb.dll
[2010/04/23 15:30:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdur.dll
[2010/04/23 15:30:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdtat.dll
[2010/04/23 15:30:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdru1.dll
[2010/04/23 15:30:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdru.dll
[2010/04/23 15:30:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdmon.dll
[2010/04/23 15:30:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdkyr.dll
[2010/04/23 15:30:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdkaz.dll
[2010/04/23 15:30:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdaze.dll
[2010/04/23 15:30:50 | 000,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdbu.dll
[2010/04/23 15:30:50 | 000,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdblr.dll
[2010/04/23 15:30:50 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdbu.dll
[2010/04/23 15:30:50 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdblr.dll
[2010/04/23 15:30:49 | 000,008,192 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdhept.dll
[2010/04/23 15:30:49 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhept.dll
[2010/04/23 15:30:49 | 000,006,656 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdhela3.dll
[2010/04/23 15:30:49 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhela3.dll
[2010/04/23 15:30:49 | 000,006,144 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdhela2.dll
[2010/04/23 15:30:49 | 000,006,144 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdgkl.dll
[2010/04/23 15:30:49 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhela2.dll
[2010/04/23 15:30:49 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdgkl.dll
[2010/04/23 15:30:49 | 000,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdhe319.dll
[2010/04/23 15:30:49 | 000,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdhe220.dll
[2010/04/23 15:30:49 | 000,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdhe.dll
[2010/04/23 15:30:49 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhe319.dll
[2010/04/23 15:30:49 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhe220.dll
[2010/04/23 15:30:49 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhe.dll
[2010/04/23 15:30:47 | 000,006,144 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdlv1.dll
[2010/04/23 15:30:47 | 000,006,144 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdlv.dll
[2010/04/23 15:30:47 | 000,006,144 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdest.dll
[2010/04/23 15:30:47 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdlv1.dll
[2010/04/23 15:30:47 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdlv.dll
[2010/04/23 15:30:47 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdest.dll
[2010/04/23 15:30:47 | 000,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdlt1.dll
[2010/04/23 15:30:47 | 000,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdlt.dll
[2010/04/23 15:30:47 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdlt1.dll
[2010/04/23 15:30:47 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdlt.dll
[2010/04/23 15:30:46 | 000,007,168 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdcz.dll
[2010/04/23 15:30:46 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdcz.dll
[2010/04/23 15:30:46 | 000,006,656 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdycl.dll
[2010/04/23 15:30:46 | 000,006,656 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdsl1.dll
[2010/04/23 15:30:46 | 000,006,656 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdsl.dll
[2010/04/23 15:30:46 | 000,006,656 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdpl.dll
[2010/04/23 15:30:46 | 000,006,656 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdhu.dll
[2010/04/23 15:30:46 | 000,006,656 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdcz2.dll
[2010/04/23 15:30:46 | 000,006,656 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdcz1.dll
[2010/04/23 15:30:46 | 000,006,656 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdcr.dll
[2010/04/23 15:30:46 | 000,006,656 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\KBDAL.DLL
[2010/04/23 15:30:46 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdycl.dll
[2010/04/23 15:30:46 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdsl1.dll
[2010/04/23 15:30:46 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdsl.dll
[2010/04/23 15:30:46 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdpl.dll
[2010/04/23 15:30:46 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhu.dll
[2010/04/23 15:30:46 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdcz2.dll
[2010/04/23 15:30:46 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdcz1.dll
[2010/04/23 15:30:46 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdcr.dll
[2010/04/23 15:30:46 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdal.dll
[2010/04/23 15:30:46 | 000,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdro.dll
[2010/04/23 15:30:46 | 000,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdpl1.dll
[2010/04/23 15:30:46 | 000,005,632 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdhu1.dll
[2010/04/23 15:30:46 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdro.dll
[2010/04/23 15:30:46 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdpl1.dll
[2010/04/23 15:30:46 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhu1.dll
[2010/04/23 15:30:43 | 000,176,157 | —- | C] (Digi International, Inc.) – C:\WINDOWS\System32\dllcache\dgrpsetu.dll
[2010/04/23 15:30:43 | 000,176,157 | —- | C] (Digi International, Inc.) – C:\WINDOWS\System32\dgrpsetu.dll
[2010/04/23 15:30:43 | 000,103,424 | —- | C] (Equinox Systems Inc.) – C:\WINDOWS\System32\EqnClass.Dll
[2010/04/23 15:30:43 | 000,103,424 | —- | C] (Equinox Systems Inc.) – C:\WINDOWS\System32\dllcache\eqnclass.dll
[2010/04/23 15:30:43 | 000,085,020 | —- | C] (Digi International) – C:\WINDOWS\System32\dllcache\dgsetup.dll
[2010/04/23 15:30:43 | 000,085,020 | —- | C] (Digi International) – C:\WINDOWS\System32\dgsetup.dll
[2010/04/23 15:30:43 | 000,024,661 | —- | C] (Perle Systems Ltd.) – C:\WINDOWS\System32\spxcoins.dll
[2010/04/23 15:30:43 | 000,024,661 | —- | C] (Perle Systems Ltd.) – C:\WINDOWS\System32\dllcache\spxcoins.dll
[2010/04/23 15:30:43 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\irclass.dll
[2010/04/23 15:30:43 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\irclass.dll
[2010/04/23 15:30:42 | 000,126,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\MSVIDEO.DLL
[2010/04/23 15:30:42 | 000,082,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\OLECLI.DLL
[2010/04/23 15:30:42 | 000,024,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\OLESVR.DLL
[2010/04/23 15:30:42 | 000,019,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\TAPI.DLL
[2010/04/23 15:30:42 | 000,013,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\WFWNET.DRV
[2010/04/23 15:30:42 | 000,009,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\VER.DLL
[2010/04/23 15:30:42 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\SHELL.DLL
[2010/04/23 15:30:42 | 000,004,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\TIMER.DRV
[2010/04/23 15:30:42 | 000,003,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\SYSTEM.DRV
[2010/04/23 15:30:42 | 000,002,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\VGA.DRV
[2010/04/23 15:30:42 | 000,002,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\MOUSE.DRV
[2010/04/23 15:30:42 | 000,001,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\SOUND.DRV
[2010/04/23 15:30:42 | 000,001,152 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\MMTASK.TSK
[2010/04/23 15:30:41 | 000,109,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\AVIFILE.DLL
[2010/04/23 15:30:41 | 000,073,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\MCIAVI.DRV
[2010/04/23 15:30:41 | 000,069,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\AVICAP.DLL
[2010/04/23 15:30:41 | 000,032,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\COMMDLG.DLL
[2010/04/23 15:30:41 | 000,028,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\MCIWAVE.DRV
[2010/04/23 15:30:41 | 000,025,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\MCISEQ.DRV
[2010/04/23 15:30:41 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\TASKMAN.EXE
[2010/04/23 15:30:41 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\taskman.exe
[2010/04/23 15:30:41 | 000,009,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\LZEXPAND.DLL
[2010/04/23 15:30:41 | 000,002,000 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\KEYBOARD.DRV
[2010/04/23 15:30:40 | 000,146,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\WINSPOOL.DRV
[2010/04/23 15:30:40 | 000,068,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\MMSYSTEM.DLL
[2010/04/23 15:30:40 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\irenum.sys
[2010/04/23 15:30:40 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\batt.dll
[2010/04/23 15:30:40 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\batt.dll
[2010/04/23 15:30:39 | 000,074,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\storprop.dll
[2010/04/23 15:30:31 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Start Menu
[2010/04/23 15:30:31 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Documents
[2010/04/23 15:30:31 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Templates
[2010/04/23 15:30:31 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Favorites
[2010/04/23 15:30:31 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Desktop
[2010/04/23 15:30:17 | 000,000,000 | —D | C] – C:\WINDOWS\System32\CatRoot2
[2010/04/23 15:30:17 | 000,000,000 | —D | C] – C:\WINDOWS\System32\CatRoot
[2010/04/23 15:30:11 | 000,000,000 | –SD | C] – C:\Documents and Settings\All Users\Application Data\Microsoft
[2010/04/23 15:30:11 | 000,000,000 | RH-D | C] – C:\Documents and Settings\All Users\Application Data
[2010/04/23 15:29:47 | 000,000,000 | —D | C] – C:\Documents and Settings
[2010/04/23 15:29:46 | 000,000,000 | -HSD | C] – C:\System Volume Information
[2010/04/23 15:22:18 | 000,000,000 | R-SD | C] – C:\WINDOWS\Fonts
[2010/04/23 15:22:18 | 000,000,000 | RHSD | C] – C:\WINDOWS\System32\dllcache
[2010/04/23 15:22:18 | 000,000,000 | R–D | C] – C:\WINDOWS\Web
[2010/04/23 15:22:18 | 000,000,000 | -H-D | C] – C:\WINDOWS\inf
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\WinSxS
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\wins
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\wbem
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\usmt
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\twain_32
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\Temp
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\system32
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\system
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\spool
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\ShellExt
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\Setup
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\security
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\scripting
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\Resources
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\repair
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\ras
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\Provisioning
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\PeerNet
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\pchealth
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\oobe
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\npp
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\Network Diagnostic
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\mui
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\mui
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\msapps
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\msagent
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\Media
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\L2Schemas
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\java
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\inetsrv
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\IME
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\ime
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\icsxml
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\ias
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\Help
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\export
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\etc
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\en
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\ehome
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\Driver Cache
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\disdn
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\dhcp
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\Debug
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\Cursors
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\Connection Wizard
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\config
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\Config
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\AppPatch
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\addins
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\3com_dmi
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\3076
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\2052
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\1054
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\1042
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\1041
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\1037
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\1033
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\1031
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\1028
[2010/04/23 15:22:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\1025
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/05/21 18:50:25 | 000,571,904 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2010/05/21 18:33:45 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/05/21 18:30:27 | 060,246,260 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/05/21 18:27:57 | 000,352,606 | —- | M] () – C:\WINDOWS\System32\vsconfig.xml
[2010/05/21 18:26:44 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/05/21 18:26:04 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/05/21 18:25:37 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/05/21 09:30:36 | 007,077,888 | -H– | M] () – C:\Documents and Settings\Administrator\NTUSER.DAT
[2010/05/21 09:30:07 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Administrator\ntuser.ini
[2010/05/21 08:48:58 | 000,001,002 | —- | M] () – C:\WINDOWS\ARPR.INI
[2010/05/20 16:00:21 | 000,000,368 | —- | M] () – C:\WINDOWS\tasks\SogouImeMgr.job
[2010/05/20 02:59:10 | 000,508,956 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/05/20 02:59:10 | 000,432,690 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/05/20 02:59:10 | 000,067,646 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/05/19 22:22:28 | 000,395,292 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/05/19 15:32:56 | 000,009,728 | —- | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/05/19 08:06:23 | 000,004,212 | -H– | M] () – C:\WINDOWS\System32\zllictbl.dat
[2010/05/18 23:21:39 | 000,000,009 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\pwpe_wiki_ini.conf
[2010/05/18 20:52:54 | 000,258,560 | —- | M] (Quad-Lock) – C:\Documents and Settings\Administrator\Desktop\UnitConverter.exe
[2010/05/12 13:22:08 | 000,395,194 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100519-222228.backup
[2010/05/08 11:55:35 | 005,184,204 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\ppstreamsetup.exe
[2010/05/07 23:44:23 | 000,138,848 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/05/07 20:14:48 | 000,000,116 | —- | M] () – C:\WINDOWS\System32\msjmslo1041.ini
[2010/05/07 16:32:57 | 000,030,296 | —- | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/05/06 09:58:48 | 000,393,062 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100512-132208.backup
[2010/05/02 09:49:49 | 000,393,062 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100506-095848.backup
[2010/05/02 01:00:57 | 000,000,216 | —- | M] () – C:\WINDOWS\System32\spupdsvc.inf
[2010/04/29 12:19:24 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/04/29 12:19:14 | 000,020,952 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/04/29 09:09:42 | 000,000,507 | —- | M] () – C:\WINDOWS\win.ini
[2010/04/29 09:09:42 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/04/29 09:09:42 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2010/04/28 21:17:08 | 000,000,072 | —- | M] () – C:\WINDOWS\ConverterCore.INI
[2010/04/28 19:32:25 | 000,010,165 | —- | M] () – C:\WINDOWS\ePrompter.ini
[2010/04/28 17:21:01 | 000,036,864 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Acupuncture New Patient.doc
[2010/04/28 11:54:42 | 000,393,062 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100502-094949.backup
[2010/04/27 08:16:34 | 000,015,880 | —- | M] () – C:\WINDOWS\System32\lsdelete.exe
[2010/04/27 00:08:56 | 000,001,416 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\可牛闪图.lnk
[2010/04/27 00:05:45 | 000,000,020 | —- | M] () – C:\WINDOWS\System32\pub_store.dat
[2010/04/26 12:13:39 | 000,168,980 | —- | M] () – C:\WINDOWS\hphins27.dat
[2010/04/26 11:01:14 | 000,392,702 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100428-115442.backup
[2010/04/25 16:13:44 | 000,036,864 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Checking2009.xls
[2010/04/25 16:02:10 | 000,018,944 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Savings2009.xls
[2010/04/25 08:44:40 | 000,060,008 | —- | M] (Kingsoft Corporation) – C:\WINDOWS\System32\drivers\KAVSafe.sys
[2010/04/24 23:45:04 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2010/04/24 23:45:04 | 000,153,376 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/04/24 23:45:04 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/04/24 23:45:04 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/04/24 23:45:04 | 000,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2010/04/24 23:05:01 | 000,000,073 | —- | M] () – C:\WINDOWS\EurekaLog.ini
[2010/04/24 18:12:53 | 000,000,376 | —- | M] () – C:\WINDOWS\ODBC.INI
[2010/04/24 17:17:55 | 005,889,078 | -H– | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db
[2010/04/24 15:02:07 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2010/04/24 14:53:05 | 000,242,896 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgtdix.sys
[2010/04/24 14:53:03 | 000,029,512 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgmfx86.sys
[2010/04/24 14:53:03 | 000,012,464 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\avgrsstx.dll
[2010/04/24 14:52:52 | 000,216,200 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgldx86.sys
[2010/04/24 14:52:51 | 000,142,495 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2010/04/24 14:52:50 | 000,052,872 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgrkx86.sys
[2010/04/24 13:57:29 | 000,000,056 | -H– | M] () – C:\WINDOWS\System32\ezsidmv.dat
[2010/04/24 13:31:42 | 000,095,024 | —- | M] (Sunbelt Software) – C:\WINDOWS\System32\drivers\SBREDrv.sys
[2010/04/24 13:22:15 | 000,392,702 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100426-110114.backup
[2010/04/24 13:21:59 | 000,392,702 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100424-132215.backup
[2010/04/24 13:09:30 | 000,172,032 | —- | M] (Jin Hui E-mail: [removed] Web: http://www.jcomsoft.com) – C:\WINDOWS\System32\AniGIF.ocx
[2010/04/24 12:04:37 | 000,023,392 | —- | M] () – C:\WINDOWS\System32\nscompat.tlb
[2010/04/24 12:04:37 | 000,016,832 | —- | M] () – C:\WINDOWS\System32\amcompat.tlb
[2010/04/24 11:05:42 | 000,113,461 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\iavichjw.avm
[2010/04/24 11:05:39 | 006,061,540 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\avi7.avg
[2010/04/24 11:05:39 | 000,492,629 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\miniavi.avg
[2010/04/24 10:44:24 | 000,000,261 | —- | M] () – C:\WINDOWS\System32\$winnt$.inf
[2010/04/24 10:41:41 | 000,002,577 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2010/04/24 10:41:41 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2010/04/24 10:41:41 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/04/24 10:41:41 | 000,000,000 | —- | M] () – C:\WINDOWS\control.ini
[2010/04/24 10:41:41 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2010/04/24 10:41:41 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2010/04/24 10:41:33 | 000,316,640 | —- | M] () – C:\WINDOWS\WMSysPr9.prx
[2010/04/24 10:41:22 | 000,004,161 | —- | M] () – C:\WINDOWS\ODBCINST.INI
[2010/04/24 10:40:33 | 000,000,488 | RH– | M] () – C:\WINDOWS\System32\WindowsLogon.manifest
[2010/04/24 10:40:33 | 000,000,488 | RH– | M] () – C:\WINDOWS\System32\logonui.exe.manifest
[2010/04/24 10:40:27 | 000,000,749 | RH– | M] () – C:\WINDOWS\System32\wuaucpl.cpl.manifest
[2010/04/24 10:40:27 | 000,000,749 | RH– | M] () – C:\WINDOWS\WindowsShell.Manifest
[2010/04/24 10:40:27 | 000,000,749 | RH– | M] () – C:\WINDOWS\System32\sapi.cpl.manifest
[2010/04/24 10:40:27 | 000,000,749 | RH– | M] () – C:\WINDOWS\System32\nwc.cpl.manifest
[2010/04/24 10:40:27 | 000,000,749 | RH– | M] () – C:\WINDOWS\System32\ncpa.cpl.manifest
[2010/04/24 10:40:27 | 000,000,749 | RH– | M] () – C:\WINDOWS\System32\cdplayer.exe.manifest
[2010/04/24 10:38:22 | 000,021,640 | —- | M] () – C:\WINDOWS\System32\emptyregdb.dat
[2010/04/24 10:38:10 | 000,000,037 | —- | M] () – C:\WINDOWS\vbaddin.ini
[2010/04/24 10:38:10 | 000,000,036 | —- | M] () – C:\WINDOWS\vb.ini
[2010/04/23 15:34:13 | 000,004,444 | —- | M] () – C:\WINDOWS\System32\pid.PNF
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/05/21 08:36:21 | 000,001,002 | —- | C] () – C:\WINDOWS\ARPR.INI
[2010/05/19 22:22:28 | 000,395,194 | R— | C] () – C:\WINDOWS\System32\drivers\etc\hosts.20100519-222228.backup
[2010/05/14 09:22:06 | 000,000,210 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\ICBCAntiPhishing_2010_05_14.log
[2010/05/12 13:22:08 | 000,393,062 | R— | C] () – C:\WINDOWS\System32\drivers\etc\hosts.20100512-132208.backup
[2010/05/08 12:30:49 | 000,000,009 | —- | C] () – C:\Documents and Settings\LocalService\Application Data\pwpe_wiki_ini.conf
[2010/05/08 11:55:35 | 005,184,204 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\ppstreamsetup.exe
[2010/05/07 17:09:22 | 000,000,116 | —- | C] () – C:\WINDOWS\System32\msjmslo1041.ini
[2010/05/06 09:58:48 | 000,393,062 | R— | C] () – C:\WINDOWS\System32\drivers\etc\hosts.20100506-095848.backup
[2010/05/02 10:51:31 | 000,352,606 | —- | C] () – C:\WINDOWS\System32\vsconfig.xml
[2010/05/02 09:49:49 | 000,393,062 | R— | C] () – C:\WINDOWS\System32\drivers\etc\hosts.20100502-094949.backup
[2010/05/02 01:00:57 | 000,000,216 | —- | C] () – C:\WINDOWS\System32\spupdsvc.inf
[2010/04/28 21:17:08 | 000,000,072 | —- | C] () – C:\WINDOWS\ConverterCore.INI
[2010/04/28 21:11:42 | 000,021,248 | —- | C] () – C:\WINDOWS\System32\solidlocalmon.dll
[2010/04/28 21:11:42 | 000,013,568 | —- | C] () – C:\WINDOWS\System32\solidlocalui.dll
[2010/04/28 17:15:04 | 000,036,864 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Acupuncture New Patient.doc
[2010/04/28 11:54:42 | 000,392,702 | R— | C] () – C:\WINDOWS\System32\drivers\etc\hosts.20100428-115442.backup
[2010/04/27 00:08:56 | 000,001,416 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\可牛闪图.lnk
[2010/04/27 00:05:45 | 000,000,020 | —- | C] () – C:\WINDOWS\System32\pub_store.dat
[2010/04/26 11:59:48 | 000,168,980 | —- | C] () – C:\WINDOWS\hphins27.dat
[2010/04/26 11:59:48 | 000,000,735 | —- | C] () – C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2010/04/26 11:59:47 | 000,000,787 | —- | C] () – C:\WINDOWS\hphmdl27.dat
[2010/04/26 11:01:14 | 000,392,702 | R— | C] () – C:\WINDOWS\System32\drivers\etc\hosts.20100426-110114.backup
[2010/04/25 16:02:54 | 000,036,864 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Checking2009.xls
[2010/04/25 16:01:22 | 000,018,944 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Savings2009.xls
[2010/04/25 14:50:12 | 000,009,728 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/24 23:05:01 | 000,000,073 | —- | C] () – C:\WINDOWS\EurekaLog.ini
[2010/04/24 18:12:53 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2010/04/24 18:06:06 | 000,015,880 | —- | C] () – C:\WINDOWS\System32\lsdelete.exe
[2010/04/24 16:05:25 | 000,000,009 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\pwpe_wiki_ini.conf
[2010/04/24 15:50:15 | 000,000,368 | —- | C] () – C:\WINDOWS\tasks\SogouImeMgr.job
[2010/04/24 15:02:07 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2010/04/24 14:47:18 | 000,010,165 | —- | C] () – C:\WINDOWS\ePrompter.ini
[2010/04/24 14:37:07 | 000,524,850 | —- | C] () – C:\WINDOWS\System32\igxpxa32.cpa
[2010/04/24 14:37:07 | 000,058,704 | —- | C] () – C:\WINDOWS\System32\igxpxk32.vp
[2010/04/24 14:37:07 | 000,024,736 | —- | C] () – C:\WINDOWS\System32\igxpxs32.vp
[2010/04/24 14:37:07 | 000,000,929 | —- | C] () – C:\WINDOWS\System32\igxpxa32.vp
[2010/04/24 14:34:49 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\AegisI5.exe
[2010/04/24 13:57:29 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2010/04/24 13:33:29 | 000,000,472 | —- | C] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/04/24 13:22:15 | 000,392,702 | R— | C] () – C:\WINDOWS\System32\drivers\etc\hosts.20100424-132215.backup
[2010/04/24 13:21:59 | 000,000,734 | —- | C] () – C:\WINDOWS\System32\drivers\etc\hosts.20100424-132159.backup
[2010/04/24 12:54:48 | 000,001,486 | —- | C] () – C:\WINDOWS\System32\noise.kor
[2010/04/24 12:54:47 | 001,158,818 | —- | C] () – C:\WINDOWS\System32\korwbrkr.lex
[2010/04/24 12:54:47 | 001,158,818 | —- | C] () – C:\WINDOWS\System32\dllcache\korwbrkr.lex
[2010/04/24 12:54:47 | 000,002,060 | —- | C] () – C:\WINDOWS\System32\noise.jpn
[2010/04/24 12:54:39 | 000,211,938 | —- | C] () – C:\WINDOWS\System32\lcphrase.tbl
[2010/04/24 12:54:39 | 000,146,126 | —- | C] () – C:\WINDOWS\System32\array30.tab
[2010/04/24 12:54:39 | 000,110,566 | —- | C] () – C:\WINDOWS\System32\arphr.tbl
[2010/04/24 12:54:39 | 000,043,242 | —- | C] () – C:\WINDOWS\System32\phoncode.tbl
[2010/04/24 12:54:39 | 000,024,114 | —- | C] () – C:\WINDOWS\System32\lcptr.tbl
[2010/04/24 12:54:39 | 000,018,600 | —- | C] () – C:\WINDOWS\System32\arrayhw.tab
[2010/04/24 12:54:39 | 000,016,312 | —- | C] () – C:\WINDOWS\System32\arptr.tbl
[2010/04/24 12:54:39 | 000,004,071 | —- | C] () – C:\WINDOWS\System32\phon.tbl
[2010/04/24 12:54:39 | 000,002,714 | —- | C] () – C:\WINDOWS\System32\phonptr.tbl
[2010/04/24 12:54:39 | 000,000,520 | —- | C] () – C:\WINDOWS\System32\dayiphr.tbl
[2010/04/24 12:54:38 | 000,195,618 | —- | C] () – C:\WINDOWS\System32\dllcache\c_10002.nls
[2010/04/24 12:54:38 | 000,195,618 | —- | C] () – C:\WINDOWS\System32\c_10002.nls
[2010/04/24 12:54:38 | 000,116,285 | —- | C] () – C:\WINDOWS\System32\msdayi.tbl
[2010/04/24 12:54:38 | 000,082,172 | —- | C] () – C:\WINDOWS\System32\dllcache\bopomofo.nls
[2010/04/24 12:54:38 | 000,082,172 | —- | C] () – C:\WINDOWS\System32\bopomofo.nls
[2010/04/24 12:54:38 | 000,044,370 | —- | C] () – C:\WINDOWS\System32\acode.tbl
[2010/04/24 12:54:38 | 000,044,370 | —- | C] () – C:\WINDOWS\System32\a234.tbl
[2010/04/24 12:54:38 | 000,001,460 | —- | C] () – C:\WINDOWS\System32\a15.tbl
[2010/04/24 12:54:38 | 000,000,700 | —- | C] () – C:\WINDOWS\System32\dayiptr.tbl
[2010/04/24 12:54:37 | 000,066,728 | —- | C] () – C:\WINDOWS\System32\dllcache\big5.nls
[2010/04/24 12:54:37 | 000,066,728 | —- | C] () – C:\WINDOWS\System32\big5.nls
[2010/04/24 12:54:37 | 000,016,254 | —- | C] () – C:\WINDOWS\System32\PINTLPAE.HLP
[2010/04/24 12:54:37 | 000,014,821 | —- | C] () – C:\WINDOWS\System32\PINTLPAD.HLP
[2010/04/24 12:54:34 | 001,783,864 | —- | C] () – C:\WINDOWS\System32\WINPY.MB
[2010/04/24 12:54:34 | 001,564,868 | —- | C] () – C:\WINDOWS\System32\WINSP.MB
[2010/04/24 12:54:34 | 001,223,500 | —- | C] () – C:\WINDOWS\System32\WINZM.MB
[2010/04/24 12:54:34 | 000,173,602 | —- | C] () – C:\WINDOWS\System32\dllcache\c_10008.nls
[2010/04/24 12:54:34 | 000,173,602 | —- | C] () – C:\WINDOWS\System32\c_10008.nls
[2010/04/24 12:54:34 | 000,083,748 | —- | C] () – C:\WINDOWS\System32\prcp.nls
[2010/04/24 12:54:34 | 000,083,748 | —- | C] () – C:\WINDOWS\System32\dllcache\prcp.nls
[2010/04/24 12:54:34 | 000,083,748 | —- | C] () – C:\WINDOWS\System32\prc.nls
[2010/04/24 12:54:34 | 000,083,748 | —- | C] () – C:\WINDOWS\System32\dllcache\prc.nls
[2010/04/24 12:54:31 | 000,134,339 | —- | C] () – C:\WINDOWS\System32\dllcache\imekr.lex
[2010/04/24 12:54:30 | 000,108,827 | —- | C] () – C:\WINDOWS\System32\dllcache\hanja.lex
[2010/04/24 12:54:25 | 000,189,986 | —- | C] () – C:\WINDOWS\System32\dllcache\c_1361.nls
[2010/04/24 12:54:25 | 000,189,986 | —- | C] () – C:\WINDOWS\System32\c_1361.nls
[2010/04/24 12:54:25 | 000,177,698 | —- | C] () – C:\WINDOWS\System32\dllcache\c_10003.nls
[2010/04/24 12:54:25 | 000,177,698 | —- | C] () – C:\WINDOWS\System32\c_10003.nls
[2010/04/24 12:54:25 | 000,047,066 | —- | C] () – C:\WINDOWS\System32\ksc.nls
[2010/04/24 12:54:25 | 000,047,066 | —- | C] () – C:\WINDOWS\System32\dllcache\ksc.nls
[2010/04/24 12:54:08 | 000,180,770 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20932.nls
[2010/04/24 12:54:08 | 000,180,770 | —- | C] () – C:\WINDOWS\System32\c_20932.nls
[2010/04/24 12:54:08 | 000,180,258 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20000.nls
[2010/04/24 12:54:08 | 000,180,258 | —- | C] () – C:\WINDOWS\System32\c_20000.nls
[2010/04/24 12:54:08 | 000,177,698 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20949.nls
[2010/04/24 12:54:08 | 000,177,698 | —- | C] () – C:\WINDOWS\System32\c_20949.nls
[2010/04/24 12:54:08 | 000,173,602 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20936.nls
[2010/04/24 12:54:08 | 000,173,602 | —- | C] () – C:\WINDOWS\System32\c_20936.nls
[2010/04/24 12:54:08 | 000,162,850 | —- | C] () – C:\WINDOWS\System32\dllcache\c_10001.nls
[2010/04/24 12:54:08 | 000,162,850 | —- | C] () – C:\WINDOWS\System32\c_10001.nls
[2010/04/24 12:54:08 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_21027.nls
[2010/04/24 12:54:08 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\c_21027.nls
[2010/04/24 12:54:08 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20290.nls
[2010/04/24 12:54:08 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\c_20290.nls
[2010/04/24 12:54:08 | 000,028,288 | —- | C] () – C:\WINDOWS\System32\xjis.nls
[2010/04/24 12:54:08 | 000,028,288 | —- | C] () – C:\WINDOWS\System32\dllcache\xjis.nls
[2010/04/24 12:54:07 | 000,173,568 | —- | C] () – C:\WINDOWS\System32\dllcache\chtskf.dll
[2010/04/24 12:54:04 | 000,175,104 | —- | C] () – C:\WINDOWS\System32\dllcache\pintlcsa.dll
[2010/04/24 12:53:59 | 000,059,392 | —- | C] () – C:\WINDOWS\System32\dllcache\imscinst.exe
[2010/04/24 12:53:50 | 013,463,552 | —- | C] () – C:\WINDOWS\System32\dllcache\hwxjpn.dll
[2010/04/24 12:53:50 | 000,196,665 | —- | C] () – C:\WINDOWS\System32\dllcache\imjpinst.exe
[2010/04/24 11:23:25 | 000,757,760 | —- | C] () – C:\WINDOWS\System32\bcm1xsup.dll
[2010/04/24 11:23:25 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\preflib.dll
[2010/04/24 11:23:25 | 000,018,944 | —- | C] () – C:\WINDOWS\System32\WLTRYSVC.EXE
[2010/04/24 11:21:09 | 000,000,005 | —- | C] () – C:\WINDOWS\System32\drivers\DELL_LAT_D610.MRK
[2010/04/24 11:21:09 | 000,000,005 | —- | C] () – C:\WINDOWS\System32\drivers\1028_DELL_LAT_D610.MRK
[2010/04/24 11:21:04 | 000,000,666 | —- | C] () – C:\WINDOWS\speed.reg
[2010/04/24 11:09:38 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\stac97co.dll
[2010/04/24 11:05:42 | 000,113,461 | —- | C] () – C:\WINDOWS\System32\drivers\Avg\iavichjw.avm
[2010/04/24 11:05:41 | 060,246,260 | —- | C] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/04/24 11:05:41 | 000,142,495 | —- | C] () – C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2010/04/24 11:05:39 | 006,061,540 | —- | C] () – C:\WINDOWS\System32\drivers\Avg\avi7.avg
[2010/04/24 11:05:39 | 000,492,629 | —- | C] () – C:\WINDOWS\System32\drivers\Avg\miniavi.avg
[2010/04/24 10:57:39 | 000,004,212 | -H– | C] () – C:\WINDOWS\System32\zllictbl.dat
[2010/04/24 10:45:33 | 000,000,178 | -HS- | C] () – C:\Documents and Settings\Administrator\ntuser.ini
[2010/04/24 10:45:32 | 000,032,768 | -H– | C] () – C:\Documents and Settings\Administrator\ntuser.dat.LOG
[2010/04/24 10:45:31 | 007,077,888 | -H– | C] () – C:\Documents and Settings\Administrator\NTUSER.DAT
[2010/04/24 10:44:24 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2010/04/24 10:42:47 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\dllcache\fpencode.dll
[2010/04/24 10:42:32 | 000,066,594 | —- | C] () – C:\WINDOWS\System32\dllcache\c_864.nls
[2010/04/24 10:42:32 | 000,066,594 | —- | C] () – C:\WINDOWS\System32\dllcache\c_862.nls
[2010/04/24 10:42:32 | 000,066,594 | —- | C] () – C:\WINDOWS\System32\dllcache\c_858.nls
[2010/04/24 10:42:32 | 000,066,594 | —- | C] () – C:\WINDOWS\System32\dllcache\c_720.nls
[2010/04/24 10:42:32 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_870.nls
[2010/04/24 10:42:32 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_708.nls
[2010/04/24 10:42:31 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_28596.nls
[2010/04/24 10:42:31 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_21025.nls
[2010/04/24 10:42:31 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20924.nls
[2010/04/24 10:42:31 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20880.nls
[2010/04/24 10:42:31 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20871.nls
[2010/04/24 10:42:31 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20838.nls
[2010/04/24 10:42:31 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20833.nls
[2010/04/24 10:42:30 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20424.nls
[2010/04/24 10:42:30 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20423.nls
[2010/04/24 10:42:30 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20420.nls
[2010/04/24 10:42:30 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20297.nls
[2010/04/24 10:42:30 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20285.nls
[2010/04/24 10:42:30 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20284.nls
[2010/04/24 10:42:30 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20280.nls
[2010/04/24 10:42:30 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20278.nls
[2010/04/24 10:42:30 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20277.nls
[2010/04/24 10:42:30 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20273.nls
[2010/04/24 10:42:30 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20269.nls
[2010/04/24 10:42:30 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20108.nls
[2010/04/24 10:42:29 | 000,187,938 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20005.nls
[2010/04/24 10:42:29 | 000,186,402 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20001.nls
[2010/04/24 10:42:29 | 000,185,378 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20003.nls
[2010/04/24 10:42:29 | 000,180,258 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20004.nls
[2010/04/24 10:42:29 | 000,173,602 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20002.nls
[2010/04/24 10:42:29 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20107.nls
[2010/04/24 10:42:29 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20106.nls
[2010/04/24 10:42:29 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20105.nls
[2010/04/24 10:42:28 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_1149.nls
[2010/04/24 10:42:28 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_1148.nls
[2010/04/24 10:42:28 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_1147.nls
[2010/04/24 10:42:28 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_1146.nls
[2010/04/24 10:42:28 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_1145.nls
[2010/04/24 10:42:28 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_1144.nls
[2010/04/24 10:42:28 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_1143.nls
[2010/04/24 10:42:28 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_1142.nls
[2010/04/24 10:42:28 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_1141.nls
[2010/04/24 10:42:28 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_1140.nls
[2010/04/24 10:42:28 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_1047.nls
[2010/04/24 10:42:27 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_10021.nls
[2010/04/24 10:42:27 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_10005.nls
[2010/04/24 10:42:27 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_10004.nls
[2010/04/24 10:41:41 | 000,002,577 | —- | C] () – C:\WINDOWS\System32\CONFIG.NT
[2010/04/24 10:41:41 | 000,000,000 | RHS- | C] () – C:\MSDOS.SYS
[2010/04/24 10:41:41 | 000,000,000 | RHS- | C] () – C:\IO.SYS
[2010/04/24 10:41:41 | 000,000,000 | —- | C] () – C:\CONFIG.SYS
[2010/04/24 10:41:41 | 000,000,000 | —- | C] () – C:\AUTOEXEC.BAT
[2010/04/24 10:41:32 | 000,023,392 | —- | C] () – C:\WINDOWS\System32\nscompat.tlb
[2010/04/24 10:41:32 | 000,016,832 | —- | C] () – C:\WINDOWS\System32\amcompat.tlb
[2010/04/24 10:41:31 | 000,316,640 | —- | C] () – C:\WINDOWS\WMSysPr9.prx
[2010/04/24 10:40:33 | 000,000,488 | RH– | C] () – C:\WINDOWS\System32\WindowsLogon.manifest
[2010/04/24 10:40:33 | 000,000,488 | RH– | C] () – C:\WINDOWS\System32\logonui.exe.manifest
[2010/04/24 10:40:27 | 000,000,749 | RH– | C] () – C:\WINDOWS\System32\wuaucpl.cpl.manifest
[2010/04/24 10:40:27 | 000,000,749 | RH– | C] () – C:\WINDOWS\WindowsShell.Manifest
[2010/04/24 10:40:27 | 000,000,749 | RH– | C] () – C:\WINDOWS\System32\sapi.cpl.manifest
[2010/04/24 10:40:27 | 000,000,749 | RH– | C] () – C:\WINDOWS\System32\nwc.cpl.manifest
[2010/04/24 10:40:27 | 000,000,749 | RH– | C] () – C:\WINDOWS\System32\ncpa.cpl.manifest
[2010/04/24 10:40:27 | 000,000,749 | RH– | C] () – C:\WINDOWS\System32\cdplayer.exe.manifest
[2010/04/24 10:40:09 | 004,399,505 | —- | C] () – C:\WINDOWS\System32\dllcache\nls302en.lex
[2010/04/24 10:39:54 | 000,048,680 | -HS- | C] () – C:\WINDOWS\winnt256.bmp
[2010/04/24 10:39:54 | 000,048,680 | -HS- | C] () – C:\WINDOWS\winnt.bmp
[2010/04/24 10:39:47 | 000,000,984 | —- | C] () – C:\WINDOWS\System32\dllcache\srframe.mmf
[2010/04/24 10:39:07 | 000,376,832 | —- | C] () – C:\WINDOWS\System32\dllcache\msinfo.dll
[2010/04/24 10:38:22 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2010/04/24 10:37:31 | 000,065,978 | —- | C] () – C:\WINDOWS\Soap Bubbles.bmp
[2010/04/24 10:37:31 | 000,065,954 | —- | C] () – C:\WINDOWS\Prairie Wind.bmp
[2010/04/24 10:37:31 | 000,065,832 | —- | C] () – C:\WINDOWS\Santa Fe Stucco.bmp
[2010/04/24 10:37:31 | 000,026,680 | —- | C] () – C:\WINDOWS\River Sumida.bmp
[2010/04/24 10:37:31 | 000,026,582 | —- | C] () – C:\WINDOWS\Greenstone.bmp
[2010/04/24 10:37:31 | 000,017,362 | —- | C] () – C:\WINDOWS\Rhododendron.bmp
[2010/04/24 10:37:31 | 000,017,336 | —- | C] () – C:\WINDOWS\Gone Fishing.bmp
[2010/04/24 10:37:31 | 000,017,062 | —- | C] () – C:\WINDOWS\Coffee Bean.bmp
[2010/04/24 10:37:31 | 000,016,730 | —- | C] () – C:\WINDOWS\FeatherTexture.bmp
[2010/04/24 10:37:31 | 000,009,522 | —- | C] () – C:\WINDOWS\Zapotec.bmp
[2010/04/24 10:37:30 | 000,093,702 | —- | C] () – C:\WINDOWS\System32\subrange.uce
[2010/04/24 10:37:30 | 000,060,458 | —- | C] () – C:\WINDOWS\System32\ideograf.uce
[2010/04/24 10:37:30 | 000,024,006 | —- | C] () – C:\WINDOWS\System32\gb2312.uce
[2010/04/24 10:37:30 | 000,016,740 | —- | C] () – C:\WINDOWS\System32\shiftjis.uce
[2010/04/24 10:37:30 | 000,012,876 | —- | C] () – C:\WINDOWS\System32\korean.uce
[2010/04/24 10:37:30 | 000,008,484 | —- | C] () – C:\WINDOWS\System32\kanji_2.uce
[2010/04/24 10:37:30 | 000,006,948 | —- | C] () – C:\WINDOWS\System32\kanji_1.uce
[2010/04/24 10:37:30 | 000,001,272 | —- | C] () – C:\WINDOWS\Blue Lace 16.bmp
[2010/04/24 10:37:29 | 000,022,984 | —- | C] () – C:\WINDOWS\System32\bopomofo.uce
[2010/04/24 10:37:28 | 000,003,286 | —- | C] () – C:\WINDOWS\System32\tslabels.h
[2010/04/24 10:37:28 | 000,001,161 | —- | C] () – C:\WINDOWS\System32\usrlogon.cmd
[2010/04/24 10:37:27 | 000,000,768 | —- | C] () – C:\WINDOWS\System32\msdtcprf.h
[2010/04/24 10:37:21 | 000,063,488 | —- | C] () – C:\WINDOWS\System32\wmimgmt.msc
[2010/04/23 15:34:13 | 000,004,444 | —- | C] () – C:\WINDOWS\System32\pid.PNF
[2010/04/23 15:30:57 | 001,685,606 | —- | C] () – C:\WINDOWS\System32\dllcache\sam.spd
[2010/04/23 15:30:57 | 000,605,050 | —- | C] () – C:\WINDOWS\System32\dllcache\r1033tts.lxa
[2010/04/23 15:30:57 | 000,000,888 | —- | C] () – C:\WINDOWS\System32\dllcache\sam.sdf
[2010/04/23 15:30:56 | 000,643,717 | —- | C] () – C:\WINDOWS\System32\dllcache\ltts1033.lxa
[2010/04/23 15:30:54 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_28603.nls
[2010/04/23 15:30:54 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\c_28603.nls
[2010/04/23 15:30:52 | 000,066,594 | —- | C] () – C:\WINDOWS\System32\dllcache\c_857.nls
[2010/04/23 15:30:52 | 000,066,594 | —- | C] () – C:\WINDOWS\System32\c_857.nls
[2010/04/23 15:30:52 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_28599.nls
[2010/04/23 15:30:52 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\c_28599.nls
[2010/04/23 15:30:52 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_10081.nls
[2010/04/23 15:30:52 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\c_10081.nls
[2010/04/23 15:30:50 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_28595.nls
[2010/04/23 15:30:50 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\C_28595.NLS
[2010/04/23 15:30:50 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_10017.nls
[2010/04/23 15:30:50 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\c_10017.nls
[2010/04/23 15:30:50 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_10007.nls
[2010/04/23 15:30:50 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\c_10007.nls
[2010/04/23 15:30:49 | 000,066,594 | —- | C] () – C:\WINDOWS\System32\dllcache\c_869.nls
[2010/04/23 15:30:49 | 000,066,594 | —- | C] () – C:\WINDOWS\System32\c_869.nls
[2010/04/23 15:30:49 | 000,066,594 | —- | C] () – C:\WINDOWS\System32\dllcache\c_737.nls
[2010/04/23 15:30:49 | 000,066,594 | —- | C] () – C:\WINDOWS\System32\c_737.nls
[2010/04/23 15:30:49 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_875.nls
[2010/04/23 15:30:49 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\c_875.nls
[2010/04/23 15:30:49 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_28597.nls
[2010/04/23 15:30:49 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\C_28597.NLS
[2010/04/23 15:30:49 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_10006.nls
[2010/04/23 15:30:49 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\c_10006.nls
[2010/04/23 15:30:47 | 000,066,594 | —- | C] () – C:\WINDOWS\System32\dllcache\c_866.nls
[2010/04/23 15:30:47 | 000,066,594 | —- | C] () – C:\WINDOWS\System32\c_866.nls
[2010/04/23 15:30:47 | 000,066,594 | —- | C] () – C:\WINDOWS\System32\dllcache\c_855.nls
[2010/04/23 15:30:47 | 000,066,594 | —- | C] () – C:\WINDOWS\System32\c_855.nls
[2010/04/23 15:30:47 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_28594.nls
[2010/04/23 15:30:47 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\C_28594.NLS
[2010/04/23 15:30:45 | 000,066,594 | —- | C] () – C:\WINDOWS\System32\dllcache\c_852.nls
[2010/04/23 15:30:45 | 000,066,594 | —- | C] () – C:\WINDOWS\System32\c_852.nls
[2010/04/23 15:30:45 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_10082.nls
[2010/04/23 15:30:45 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\c_10082.nls
[2010/04/23 15:30:45 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_10029.nls
[2010/04/23 15:30:45 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\c_10029.nls
[2010/04/23 15:30:45 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_10010.nls
[2010/04/23 15:30:45 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\c_10010.nls
[2010/04/23 15:30:44 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\dllcache\c_20127.nls
[2010/04/23 15:30:44 | 000,066,082 | —- | C] () – C:\WINDOWS\System32\c_20127.nls
[2010/04/23 15:30:40 | 000,001,688 | —- | C] () – C:\WINDOWS\System32\AUTOEXEC.NT
[2010/04/23 15:30:31 | 000,144,484 | —- | C] () – C:\WINDOWS\System32\dllcache\netfx.cat
[2010/04/23 15:30:31 | 000,026,991 | —- | C] () – C:\WINDOWS\System32\dllcache\msn7.cat
[2010/04/23 15:30:31 | 000,014,433 | —- | C] () – C:\WINDOWS\System32\dllcache\msn9.cat
[2010/04/23 15:30:30 | 001,296,669 | —- | C] () – C:\WINDOWS\System32\dllcache\SP3.CAT
[2010/04/23 15:30:30 | 000,797,189 | —- | C] () – C:\WINDOWS\System32\dllcache\NT5IIS.CAT
[2010/04/23 15:30:30 | 000,399,645 | —- | C] () – C:\WINDOWS\System32\dllcache\MAPIMIG.CAT
[2010/04/23 15:30:30 | 000,112,918 | —- | C] () – C:\WINDOWS\System32\dllcache\tabletpc.cat
[2010/04/23 15:30:30 | 000,037,484 | —- | C] () – C:\WINDOWS\System32\dllcache\MW770.CAT
[2010/04/23 15:30:30 | 000,034,747 | —- | C] () – C:\WINDOWS\System32\dllcache\mediactr.cat
[2010/04/23 15:30:30 | 000,034,063 | —- | C] () – C:\WINDOWS\System32\dllcache\FP4.CAT
[2010/04/23 15:30:30 | 000,016,535 | —- | C] () – C:\WINDOWS\System32\dllcache\IMS.CAT
[2010/04/23 15:30:30 | 000,013,472 | —- | C] () – C:\WINDOWS\System32\dllcache\HPCRDP.CAT
[2010/04/23 15:30:30 | 000,012,363 | —- | C] () – C:\WINDOWS\System32\dllcache\MSMSGS.CAT
[2010/04/23 15:30:30 | 000,010,027 | —- | C] () – C:\WINDOWS\System32\dllcache\MSTSWEB.CAT
[2010/04/23 15:30:30 | 000,008,574 | —- | C] () – C:\WINDOWS\System32\dllcache\IASNT4.CAT
[2010/04/23 15:30:30 | 000,007,382 | —- | C] () – C:\WINDOWS\System32\dllcache\OEMBIOS.CAT
[2010/04/23 15:30:30 | 000,007,334 | —- | C] () – C:\WINDOWS\System32\dllcache\wmerrenu.cat
[2010/04/23 15:30:29 | 002,144,487 | —- | C] () – C:\WINDOWS\System32\dllcache\NT5.CAT
[2010/04/23 15:30:29 | 000,522,220 | —- | C] () – C:\WINDOWS\System32\dllcache\NT5INF.CAT
[2010/04/23 15:29:46 | 000,138,848 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/04/23 15:29:04 | 000,000,211 | -HS- | C] () – C:\boot.ini
[2010/04/23 15:29:00 | 000,000,261 | —- | C] () – C:\WINDOWS\System32\$winnt$.inf
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2007/09/12 22:02:38 | 000,061,440 | —- | C] () – C:\WINDOWS\System32\GDReadPub.dll

========== LOP Check ==========

[2010/05/07 23:35:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\AltrixSoft
[2010/04/24 11:07:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\AVG9
[2010/05/02 00:02:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\CheckPoint
[2010/05/07 16:32:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Design Science
[2010/04/24 14:24:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Fetion
[2010/05/06 15:11:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Foxit Software
[2010/05/08 12:54:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\kingsoft
[2010/04/27 00:07:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Meitu
[2010/05/01 16:22:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Opera
[2010/04/24 18:18:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Registry Mechanic
[2010/04/24 12:50:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Softarium.com
[2010/04/26 06:48:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\SogouExplorer
[2010/05/04 23:16:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\SogouPY
[2010/04/24 15:53:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\SogouPY.users
[2010/05/06 12:53:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\SolidDocuments
[2010/05/14 20:30:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\TeamViewer
[2010/04/27 18:23:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Tencent
[2010/05/07 07:11:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Thinstall
[2010/04/24 13:44:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Trillian
[2010/05/18 20:54:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\UnitConverter
[2010/04/24 23:09:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\URSoft
[2010/05/02 23:48:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\WinPatrol
[2010/04/30 13:20:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AltrixSoft
[2010/04/24 13:02:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2010/04/24 11:05:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2010/04/24 14:23:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Fetion
[2010/04/24 23:42:25 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\kingsoft
[2010/04/24 11:14:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Novatel Wireless
[2010/04/24 18:18:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\RoboForm
[2010/04/28 21:11:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SolidDocuments
[2010/04/24 13:09:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SpeedBit
[2010/05/20 22:56:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Storm
[2010/05/19 22:24:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/04/27 18:07:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Tencent
[2010/04/26 13:22:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2010/04/24 13:23:49 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
[2010/05/21 18:33:45 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2010/05/20 16:00:21 | 000,000,368 | —- | M] () – C:\WINDOWS\Tasks\SogouImeMgr.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2008/04/14 05:00:00 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/04/14 05:00:00 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/04/14 00:10:32 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\dllcache\atapi.sys
[2008/04/14 00:10:32 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2008/04/14 05:00:00 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\ReinstallBackups\0003\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 05:00:00 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\dllcache\eventlog.dll
[2008/04/14 05:00:00 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/14 05:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\dllcache\netlogon.dll
[2008/04/14 05:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2008/04/14 05:00:00 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\dllcache\scecli.dll
[2008/04/14 05:00:00 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2010/04/23 15:29:03 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2010/04/23 15:29:03 | 001,089,536 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2010/04/23 15:29:03 | 000,909,312 | —- | M] () – C:\WINDOWS\system32\config\system.sav

========== Alternate Data Streams ==========

@Alternate Data Stream - 150 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5F7539FF
@Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
< End of report >

Tom_q2356

Post #9May 22, 2010, 5:27 AM UTC

OTL Extras logfile created on: 5/21/2010 6:53:31 PM - Run 1
OTL by OldTimer - Version 3.2.5.0 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 65.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 211.54 Gb Free Space | 90.84% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: TomCLINIC
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = htmlfile] – C:\Program Files\Avant Browser\avant.exe (Avant Force)
.url [@ = InternetShortcut] – C:\Program Files\Maxthon2\Maxthon.exe (Maxthon International ltd.)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] – "C:\Program Files\Avant Browser\avant.exe" %1 (Avant Force)
htmlfile [opennew] – "C:\Program Files\Avant Browser\avant.exe" %1 (Avant Force)
htmlfile [print] – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] – "C:\Program Files\Avant Browser\avant.exe" %1 (Avant Force)
https [open] – "C:\Program Files\Avant Browser\avant.exe" %1 (Avant Force)
InternetShortcut [open] – "C:\Program Files\Maxthon2\Maxthon.exe" "%1" (Maxthon International ltd.)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AVG\AVG9\avgam.exe" = C:\Program Files\AVG\AVG9\avgam.exe:*:Enabled:avgam.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgdiagex.exe" = C:\Program Files\AVG\AVG9\avgdiagex.exe:*:Enabled:avgdiagex.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgnsx.exe" = C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgemc.exe" = C:\Program Files\AVG\AVG9\avgemc.exe:*:Enabled:avgemc.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgupd.exe" = C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\TeamViewer\Version5\TeamViewer.exe" = C:\Program Files\TeamViewer\Version5\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application – (TeamViewer GmbH)
"C:\Program Files\China Mobile\Fetion\VMDotNet\v2.0.50727\FetionVM.exe" = C:\Program Files\China Mobile\Fetion\VMDotNet\v2.0.50727\FetionVM.exe:*:Enabled:FetionVM – (China Mobile)
"C:\Program Files\China Mobile\Fetion\FetionFx.exe" = C:\Program Files\China Mobile\Fetion\FetionFx.exe:*:Enabled:Fetion – (China Mobile)
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call – (Microsoft Corporation)
"C:\Program Files\SogouInput\5.0.0.3888\PinyinUp.exe" = C:\Program Files\SogouInput\5.0.0.3888\PinyinUp.exe:*:Enabled:Sogou Pinyin Service – (Sogou.com Inc.)
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe – (Hewlett-Packard Co.)
"C:\Program Files\Meitu\KanKan\KanKan.exe" = C:\Program Files\Meitu\KanKan\KanKan.exe:*:Enabled:KanKan – ()
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser – (Opera Software)
"C:\Program Files\nEO iMAGING\nEOiMAGING.exe" = C:\Program Files\nEO iMAGING\nEOiMAGING.exe:*:Enabled:Neoimaging – (nEO Software)
"C:\Program Files\nEO iMAGING\LiveUpdate\ThunderLiveUD.exe" = C:\Program Files\nEO iMAGING\LiveUpdate\ThunderLiveUD.exe:*:Enabled:NeoLiveUpdate – (Thunder Networking Technologies,LTD)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07620C4F-0964-4086-A872-C9C12E418E52}" = DJ_SF_03_D4300_Software
"{0F7C2E47-089E-4d23-B9F7-39BE00100776}" = Toolbox
"{11B83AD3-7A46-4C2E-A568-9505981D4C6F}" = HP Update
"{18669FF9-C8FE-407a-9F70-E674896B1DB4}" = GPBaseService
"{1A0D2EFC-C4FC-446A-8BC3-57A54CE5EADD}" = Opera 10.53
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{24EFA94F-F3D6-4386-8824-B54712C9DC88}" = D4300_Help
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 20
"{338F08AB-C262-42C7-B000-34DE1A475273}" = Ad-Aware Email Scanner for Outlook
"{34BFB099-07B2-4E95-A673-7362D60866A2}" = PSSWCORE
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{36FDBE6E-6684-462b-AE98-9A39A1B200CC}" = HPProductAssistant
"{387D9916-BD27-480f-8CF0-3228832BBAA2}" = HP Deskjet D4300 Printer Driver Software 10.0 Rel .3
"{38B122B2-3257-4E43-BD51-327599ECBA46}" = 中国工商银行防钓鱼软件
"{42C7C4D8-033E-44F9-BF34-43808A0686CC}" = D4300
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5109C064-813E-4e87-B0DE-C8AF7B5BC02B}" = SmartWebPrintingOC
"{52A69E11-7CEB-4a7d-9607-68BA4F39A89B}" = DeviceDiscovery
"{54E51672-DC3D-3204-BBF9-3AAF25CFF8AE}" = Microsoft .NET Framework 3.5 Language Pack SP1 - chs
"{56BFAA6E-2BCC-4AED-9233-84731E66B205}" = Solid Converter PDF
"{5ACE69F0-A3E8-44eb-88C1-0A841E700180}" = TrayApp
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{687FEF8A-8597-40b4-832C-297EA3F35817}" = BufferChm
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{7B738CD9-D107-48C7-8E65-2E6639A39C8D}" = PerfectDisk 10 Professional
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver for Mobile
"{8A85DEAD-7C1F-4368-881C-72AC74CB2E91}" = UnloadSupport
"{8B0A7592-2AE0-48EA-A327-6EB7DAB25E4A}" = DJ_SF_03_D4300_Software_Min
"{90110804-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Lite Edition 2003 By YlmF
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{A040AC77-C1AA-4CC9-8931-9F648AF178F6}" = VC 9.0 Runtime
"{A0B9F8DF-C949-45ed-9808-7DC5C0C19C81}" = Status
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A4526249-944F-4108-B686-A435B4A62BA5}" = TI_Inst
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = C-Major Audio
"{A5AB9D5E-52E2-440e-A3ED-9512E253C81A}" = SolutionCenter
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B8DBED1E-8BC3-4d08-B94A-F9D7D88E9BBF}" = HPSSupply
"{BAD0FA60-09CF-4411-AE6A-C2844C8812FA}" = HP Photosmart Essential 2.5
"{BE6890C7-31EF-478C-812E-1E2899ABFCA9}" = Broadcom Gigabit Integrated Controller
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CCB9B81A-167F-4832-B305-D2A0430840B3}" = WebReg
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240BD}" = WinZip 14.5
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D2E0F0CC-6BE0-490b-B08B-9267083E34C9}" = MarketResearch
"{D96DB0AB-87D0-11D6-AF24-F7A021CEBF7F}" = SimpChinese Speech Package
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{DF62D775-BB7C-4AFA-9CA4-DDA1C4855F28}" = Dell Mobile Broadband Card Utility
"{E08DC77E-D09A-4e36-8067-D6DBBCC5F8DC}" = VideoToolkit01
"{E60A3FF1-856E-4DD2-BFC6-FD9B976FE1C5}" = DJ_SF_03_D4300_ProductContext
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{EF489873-07F8-373D-A9CB-9AC688ADA964}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - CHS
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{FED06F73-84FD-38CA-ACCC-5A8380437993}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - CHS
"Ad-Aware" = Ad-Aware
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AI RoboForm" = AI RoboForm (All Users)
"Ashampoo WinOptimizer 6_is1" = Ashampoo WinOptimizer 6.60
"AvantBrowser" = Avant Browser (remove only)
"AVG9Uninstall" = AVG 9.0
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card
"CCleaner" = CCleaner
"CursorXP" = CursorXP
"Download Accelerator Plus (DAP)" = Download Accelerator Plus (DAP)
"easyMule" = easyMule
"ePrompter" = ePrompter
"Fetion" = Fetion 2010
"HijackThis" = HijackThis 2.0.2
"HP Imaging Device Functions" = HP Imaging Device Functions 10.0
"HP Photosmart Essential" = HP Photosmart Essential 2.5
"HP Smart Web Printing" = HP Smart Web Printing
"HP Solution Center & Imaging Support Tools" = HP Solution Center 10.0
"HPExtendedCapabilities" = HP Customer Participation Program 10.0
"ie8" = Windows Internet Explorer 8
"InstallShield_{A4526249-944F-4108-B686-A435B4A62BA5}" = Texas Instruments PCIxx21/x515 drivers.
"InstallShield_{BE6890C7-31EF-478C-812E-1E2899ABFCA9}" = Broadcom Gigabit Integrated Controller
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Maxthon2" = Maxthon2
"Microsoft .NET Framework 3.5 Language Pack SP1 - chs" = Microsoft .NET Framework 3.5 SP1 语言包 - 简体中文
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MoffFreeCalc_is1" = Moffsoft FreeCalc
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"PowerWord PE" = 金山词霸2010 Beta版
"QQ游戏" = QQ游戏
"Registry Mechanic_is1" = Registry Mechanic 9.0
"Shop for HP Supplies" = Shop for HP Supplies
"Sogou Input" = 搜狗拼音输入法 5.0正式版
"SpywareBlaster_is1" = SpywareBlaster 4.3
"TeamViewer 5" = TeamViewer 5
"Trillian" = Trillian
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"Wisdom-soft ScreenHunter 5.1 Free" = Wisdom-soft ScreenHunter 5.1 Free
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"ZoneAlarm Pro" = ZoneAlarm Pro
"光影魔术手_is1" = 光影魔术手 [removed]
"可牛影像" = 可牛影像 2.4 正式版
"美图拍拍" = 美图拍拍 1.1.0
"美图秀秀" = 美图秀秀 2.2.4 华军专版
"视频转换大师_is1" = 视频转换大师 9.1.1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"f031ef6ac137efc5" = Dell Driver Download Manager
"美图看看" = 美图看看 1.2.7

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 5/7/2010 11:10:40 PM | Computer Name = TomCLINIC | Source = MsiInstaller | ID = 11311
Description = Product: VoiceText-TTS-NeoSpeech-Japanese-Voice-Misaki – Error 1311.Source
file not found(cabinet): C:\Documents and Settings\Administrator\Desktop\Neospeech.Japanese.Misaki\Data1.cab.
Verify that the file exists and that you can access it.

Error - 5/7/2010 11:10:40 PM | Computer Name = TomCLINIC | Source = MsiInstaller | ID = 11311
Description = Product: VoiceText-TTS-NeoSpeech-Japanese-Voice-Misaki – Error 1311.Source
file not found(cabinet): C:\Documents and Settings\Administrator\Desktop\Neospeech.Japanese.Misaki\Data1.cab.
Verify that the file exists and that you can access it.

Error - 5/7/2010 11:10:40 PM | Computer Name = TomCLINIC | Source = MsiInstaller | ID = 11311
Description = Product: VoiceText-TTS-NeoSpeech-Japanese-Voice-Misaki – Error 1311.Source
file not found(cabinet): C:\Documents and Settings\Administrator\Desktop\Neospeech.Japanese.Misaki\Data1.cab.
Verify that the file exists and that you can access it.

Error - 5/7/2010 11:10:40 PM | Computer Name = TomCLINIC | Source = MsiInstaller | ID = 11311
Description = Product: VoiceText-TTS-NeoSpeech-Japanese-Voice-Misaki – Error 1311.Source
file not found(cabinet): C:\Documents and Settings\Administrator\Desktop\Neospeech.Japanese.Misaki\Data1.cab.
Verify that the file exists and that you can access it.

Error - 5/7/2010 11:10:41 PM | Computer Name = TomCLINIC | Source = MsiInstaller | ID = 11311
Description = Product: VoiceText-TTS-NeoSpeech-Japanese-Voice-Misaki – Error 1311.Source
file not found(cabinet): C:\Documents and Settings\Administrator\Desktop\Neospeech.Japanese.Misaki\Data1.cab.
Verify that the file exists and that you can access it.

Error - 5/7/2010 11:10:41 PM | Computer Name = TomCLINIC | Source = MsiInstaller | ID = 11311
Description = Product: VoiceText-TTS-NeoSpeech-Japanese-Voice-Misaki – Error 1311.Source
file not found(cabinet): C:\Documents and Settings\Administrator\Desktop\Neospeech.Japanese.Misaki\Data1.cab.
Verify that the file exists and that you can access it.

Error - 5/7/2010 11:10:41 PM | Computer Name = TomCLINIC | Source = MsiInstaller | ID = 11311
Description = Product: VoiceText-TTS-NeoSpeech-Japanese-Voice-Misaki – Error 1311.Source
file not found(cabinet): C:\Documents and Settings\Administrator\Desktop\Neospeech.Japanese.Misaki\Data1.cab.
Verify that the file exists and that you can access it.

Error - 5/7/2010 11:10:41 PM | Computer Name = TomCLINIC | Source = MsiInstaller | ID = 11311
Description = Product: VoiceText-TTS-NeoSpeech-Japanese-Voice-Misaki – Error 1311.Source
file not found(cabinet): C:\Documents and Settings\Administrator\Desktop\Neospeech.Japanese.Misaki\Data1.cab.
Verify that the file exists and that you can access it.

Error - 5/7/2010 11:10:42 PM | Computer Name = TomCLINIC | Source = MsiInstaller | ID = 11311
Description = Product: VoiceText-TTS-NeoSpeech-Japanese-Voice-Misaki – Error 1311.Source
file not found(cabinet): C:\Documents and Settings\Administrator\Desktop\Neospeech.Japanese.Misaki\Data1.cab.
Verify that the file exists and that you can access it.

Error - 5/7/2010 11:10:43 PM | Computer Name = TomCLINIC | Source = MsiInstaller | ID = 11311
Description = Product: VoiceText-TTS-NeoSpeech-Japanese-Voice-Misaki – Error 1311.Source
file not found(cabinet): C:\Documents and Settings\Administrator\Desktop\Neospeech.Japanese.Misaki\Data1.cab.
Verify that the file exists and that you can access it.

[ System Events ]
Error - 5/2/2010 1:47:54 PM | Computer Name = TomCLINIC | Source = Service Control Manager | ID = 7022
Description = The HP CUE DeviceDiscovery 服务 service hung on starting.

Error - 5/2/2010 1:57:08 PM | Computer Name = TomCLINIC | Source = Service Control Manager | ID = 7022
Description = The HP CUE DeviceDiscovery 服务 service hung on starting.

Error - 5/3/2010 12:17:02 AM | Computer Name = TomCLINIC | Source = Service Control Manager | ID = 7022
Description = The HP CUE DeviceDiscovery 服务 service hung on starting.

Error - 5/3/2010 11:50:14 AM | Computer Name = TomCLINIC | Source = Service Control Manager | ID = 7022
Description = The HP CUE DeviceDiscovery 服务 service hung on starting.

Error - 5/4/2010 12:11:54 AM | Computer Name = TomCLINIC | Source = Service Control Manager | ID = 7022
Description = The HP CUE DeviceDiscovery 服务 service hung on starting.

Error - 5/4/2010 11:13:25 AM | Computer Name = TomCLINIC | Source = Service Control Manager | ID = 7022
Description = The HP CUE DeviceDiscovery 服务 service hung on starting.

Error - 5/4/2010 12:44:47 PM | Computer Name = TomCLINIC | Source = DCOM | ID = 10010
Description = The server {657C7A59-4FEC-4C06-A354-607B1EB184FB} did not register
with DCOM within the required timeout.

Error - 5/4/2010 6:00:34 PM | Computer Name = TomCLINIC | Source = Service Control Manager | ID = 7022
Description = The HP CUE DeviceDiscovery 服务 service hung on starting.

Error - 5/5/2010 11:10:18 AM | Computer Name = TomCLINIC | Source = Service Control Manager | ID = 7022
Description = The HP CUE DeviceDiscovery 服务 service hung on starting.

Error - 5/5/2010 10:33:28 PM | Computer Name = TomCLINIC | Source = Service Control Manager | ID = 7022
Description = The HP CUE DeviceDiscovery 服务 service hung on starting.

< End of report >

Tom_q2356

Post #10May 22, 2010, 5:31 AM UTC

Hi Martix,

Thanks very much for your help.

Firstly, I have just uninstalled both Kingsoft and Superantispyware without a restart. My question is that, why superantispyware? Is it considered to be a firewall?

Thanks again?

Tom_q2356

Post #11May 22, 2010, 11:06 AM UTC

Horrible experience, Martix,

I am just lucky to be back here so quickly this time. Well, to make a long story short, this is my second time I got a message like this "Windows could not start because of a file missing or corrupted: windows/ststem32/config/system…" after following instruction given by you guys here (I am not saying that you guys cause the problems; in fact, you guys have been helping me out a lot and thanks for your continuing help). So basically, I had to reinstall Windows XP and programs in order to use my computer again. I do not know exactly what happened; however, Windows shut down on me all of a sudden or not long after I posted my last thread prior to this one.

The last time I had this kind of problem while following instruction given by someone else in this forum, I actually ended up going to The Best Buy to pay someone there to replace my old hard drive with a new one and it was just couple months ago. And this is the second time, kind of in the middle of following the instruction, I think I was trying to reboot after removing both superantispyware and Kingsoft.

As a matter of fact, I did a reinstallation of Windows XP only after trying out to repair several times unsuccessfully. So after reinstallation, I realized that superantispyware is now back into my program files. Some other program files are still working as before and some are already dead. I am also kind of wondering now if it has to do with that Combofix at all? Could I use some other software to give you new information about my computer? Thanks!

ken545

Post #12May 22, 2010, 6:13 PM UTC

Hello Tom Sorry your having problems. Any of the instructions for running scans where just that, just to gather info as to a possible infection, nothing was removed by these scans. Uninstalling the programs that Martix suggested would not have caused this either. You mentioned Combofix, did you run this on your own prior to the no start issue ?

Tom_q2356

Post #13May 23, 2010, 2:55 AM UTC

Nope. I would never do that kind of fix on my own. I just could not figure how that config/system got damaged.

Tom_q2356

Post #14May 23, 2010, 8:57 AM UTC

Hi, my computer still has some problems; could you tell me what to do next? Please. Thanks!

ken545

Post #15May 23, 2010, 8:58 AM UTC

Good Morning Tom,

I am also kind of wondering now if it has to do with that Combofix at all? <–It appears to me that you ran it, if not than its another problem, if you did it could have damaged your system. We have warnings in place about not being responsible if CF is run on your own. Its a very powerful tool and can do damage if not run properly

Your original post was on May 15th, and since than all we have ran where GMER, DDS and OTL, and like I mentioned before these are just scanners to gather info about your system, they don't alter or delete any files or registry entries.

I am wondering what kind of re install of windows you did, looks like a repair install, if you formatted and reinstalled windows fresh you would not have any of your old programs showing up

http://forums.spybot.info/forumdisplay.php?f=4
As far as the message that you originally posted for, that can be disabled so it wont show again, you can post in the above forum and the people that write Spybot Search and Destroy can help you configure it properly and also prevent that entry from showing up again on the scans.

Martix had you uninstall Superantispyware, you have Malwarebytes installed and its the better one and you dont need them both.

He also had you uninstall Kingsoft as you have AVG installed and having more than 1 antivirus program can cause issues

Uninstalling both the above programs properly through Add Remove Programs will not leave your system non bootable, so as to how that file got corrupted, its nothing that has been done with any of the instructions that where given by Martix.

You can run this other program and post the logs, and if no infections are detected than your good to go

Random System Information Tool

Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open. Please post the contents of both log.txt (<info.txt (<

Ken

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Perhaps spyware, found by Spybot

✨ Ask AI

Ask AI