Spyware / Malware / Virus Removal

Trojan/malware infection - now have .dll files missing

37 min read

Looking for the outcome? Ask AI

say-no-2-trojans

Post #16October 19, 2010, 10:28 AM UTC

Nothing there. When the computer rebooted I did click on the ComboFix icon, but did not run it - could this be the fault? If so, sorry!

oldman960

Post #17October 19, 2010, 10:32 AM UTC last edited October 19, 2010, 10:33 AM UTC

Hi say-no-2-trojans Yep that may have done it. Rerun combofix as before but do not mouse click any thing. Let the tools finish it's job. Make sure you disable your security programs such as antivirus, antispayware and firewall first.

say-no-2-trojans

Post #18October 19, 2010, 10:58 AM UTC

Did it to the letter this time, but these 2 files are not in those locations!

oldman960

Post #19October 19, 2010, 11:03 AM UTC

Hi say-no-2-trojans

Something is preventing Combofix from completing the log.

Let's get a new OTL log and go from there.

Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
UNCheck the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

Please post the OTL.txt

say-no-2-trojans

Post #20October 19, 2010, 11:30 AM UTC

OTL logfile created on: 19/10/2010 12:23:08 - Run 3
OTL by OldTimer - Version 3.2.15.2 Folder = C:\Documents and Settings\Dave\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,023.00 Mb Total Physical Memory | 381.00 Mb Available Physical Memory | 37.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 228.49 Gb Total Space | 156.20 Gb Free Space | 68.36% Space Free | Partition Type: NTFS
Drive D: | 451.83 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: DAVEMOSS | User Name: Dave | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Dave\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)
PRC - C:\WINDOWS\system32\FsUsbExService.Exe (Teruten)
PRC - C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe (Sony Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Program Files\Analog Devices\SoundMAX\SMax4.exe (Analog Devices, Inc.)
PRC - C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
PRC - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe (Cyberlink)
PRC - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe (Cyberlink)
PRC - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe ()
PRC - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe ()
PRC - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe ()
PRC - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe (SEIKO EPSON CORPORATION)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Dave\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\asOEHook.dll (Symantec Corporation)
MOD - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\Microsoft.VC90.CRT\msvcr90.dll (Microsoft Corporation)
MOD - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\Microsoft.VC90.CRT\msvcp90.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (NIS) – C:\Program Files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe (Symantec Corporation)
SRV - (FsUsbExService) – C:\WINDOWS\system32\FsUsbExService.Exe (Teruten)
SRV - (CyberLink Media Library Service) – C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe (Cyberlink)
SRV - (CLSched) CyberLink Task Scheduler (CTS) – C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe ()
SRV - (CLCapSvc) CyberLink Background Capture Service (CBCS) – C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe ()
SRV - (EPSONStatusAgent2) – C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe (SEIKO EPSON CORPORATION)

========== Driver Services (SafeList) ==========

DRV - (catchme) – C:\DOCUME~1\Dave\LOCALS~1\Temp\catchme.sys File not found
DRV - (bfastfao) – C:\DOCUME~1\Dave\LOCALS~1\Temp\bfastfao.sys File not found
DRV - (IDSxpx86) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20101015.005\IDSXpx86.sys (Symantec Corporation)
DRV - (NAVEX15) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20101018.054\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20101018.054\NAVENG.SYS (Symantec Corporation)
DRV - (SymEvent) – C:\WINDOWS\system32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (BHDrvx86) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20101001.001\BHDrvx86.sys (Symantec Corporation)
DRV - (SymEFA) – C:\WINDOWS\system32\drivers\NIS\1201000.025\SYMEFA.SYS (Symantec Corporation)
DRV - (SRTSP) – C:\WINDOWS\system32\drivers\NIS\1201000.025\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\WINDOWS\system32\drivers\NIS\1201000.025\SRTSPX.SYS (Symantec Corporation)
DRV - (SYMTDI) – C:\WINDOWS\system32\drivers\NIS\1201000.025\SYMTDI.SYS (Symantec Corporation)
DRV - (SymIRON) – C:\WINDOWS\system32\drivers\NIS\1201000.025\Ironx86.SYS (Symantec Corporation)
DRV - (SymDS) – C:\WINDOWS\system32\drivers\NIS\1201000.025\SYMDS.SYS (Symantec Corporation)
DRV - (FsUsbExDisk) – C:\WINDOWS\system32\FsUsbExDisk.Sys ()
DRV - (WinDriver6) – C:\WINDOWS\system32\drivers\windrvr6.sys (Jungo)
DRV - (MPE) – C:\WINDOWS\system32\drivers\mpe.sys (Microsoft Corporation)
DRV - (IrBus) – C:\WINDOWS\system32\drivers\irbus.sys (Microsoft Corporation)
DRV - (amdagp) – C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) – C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (sscdmdm) – C:\WINDOWS\system32\drivers\sscdmdm.sys (MCCI Corporation)
DRV - (sscdmdfl) – C:\WINDOWS\system32\drivers\sscdmdfl.sys (MCCI Corporation)
DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) – C:\WINDOWS\system32\drivers\sscdbus.sys (MCCI Corporation)
DRV - (U2KG54L) – C:\WINDOWS\system32\drivers\U2KG54L.SYS (ZyDAS Technology Corporation)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (AtcL001) – C:\WINDOWS\system32\drivers\atl01_xp.sys (Attansic Technology corporation.)
DRV - (HCW88TSE) – C:\WINDOWS\system32\drivers\hcw88tse.sys (Hauppauge Computer Works, Inc)
DRV - (HCW88BDA) – C:\WINDOWS\system32\drivers\hcw88bda.sys (Hauppauge Computer Works, Inc)
DRV - (HCW88AUD) – C:\WINDOWS\system32\drivers\hcw88aud.sys (Hauppauge Computer Works, Inc)
DRV - (ADIHdAudAddService) – C:\WINDOWS\system32\drivers\ADIHdAud.sys (Analog Devices, Inc.)
DRV - (BTKRNL) – C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.)
DRV - (btaudio) – C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.)
DRV - (BTSERIAL) – C:\WINDOWS\system32\drivers\btserial.sys (Broadcom Corporation.)
DRV - (BTSLBCSP) – C:\WINDOWS\system32\drivers\btslbcsp.sys (Broadcom Corporation.)
DRV - (BTDriver) – C:\WINDOWS\system32\drivers\btport.sys (Broadcom Corporation.)
DRV - (BTWUSB) – C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.)
DRV - (BTWDNDIS) – C:\WINDOWS\system32\drivers\btwdndis.sys (Broadcom Corporation.)
DRV - (SenFiltService) – C:\WINDOWS\system32\drivers\senfilt.sys (Sensaura)
DRV - (m5287) – C:\WINDOWS\system32\DRIVERS\m5287.sys (ULi Electronics Inc.)
DRV - (m5289) – C:\WINDOWS\system32\DRIVERS\m5289.sys (ULi Electronics Inc.)
DRV - (HdAudAddService) – C:\WINDOWS\system32\drivers\Hdaudio.sys (Windows ® Server 2003 DDK provider)
DRV - (BrScnUsb) – C:\WINDOWS\system32\drivers\BrScnUsb.sys (Brother Industries Ltd.)
DRV - (MTsensor) – C:\WINDOWS\system32\drivers\ASACPI.sys ()
DRV - (iaStor) – C:\WINDOWS\system32\DRIVERS\iaStor.sys (Intel Corporation)
DRV - (fasttx2k) – C:\WINDOWS\system32\DRIVERS\fasttx2k.sys (Promise Technology, Inc.)
DRV - (ADILOADER) General Purpose USB Driver (adildr.sys) – C:\WINDOWS\system32\drivers\adildr.sys (Analog Deivces)
DRV - (adiusbaw) – C:\WINDOWS\system32\drivers\adiusbaw.sys (Analog Devices Inc.)
DRV - (Sparrow) – C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) – C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) – C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) – C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) – C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (ultra) – C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) – C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) – C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) – C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) – C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) – C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) – C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) – C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) – C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (CmdIde) – C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com/?p=us
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\ [2010/09/08 22:28:07 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn\ [2010/09/08 22:26:25 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{300CF2AA-2C59-4504-AD4C-3C0581014983}: C:\Documents and Settings\Dave\Local Settings\Application Data\{300CF2AA-2C59-4504-AD4C-3C0581014983} [2010/10/17 22:41:50 | 000,000,000 | —D | M]

O1 HOSTS File: ([2004/08/10 20:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\IPSBHO.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\CoIEPlg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.1.0.37\CoIEPlg.dll (Symantec Corporation)
O4 - HKLM..\Run: [adiras] File not found
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\HdAShCut.exe (Windows ® Server 2003 DDK provider)
O4 - HKLM..\Run: [HitmanPro35] C:\Program Files\Hitman Pro 3.5\HitmanPro35.exe (SurfRight B.V.)
O4 - HKLM..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [NPSStartup] File not found
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PPort11reminder] C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [Ptipbmf] C:\WINDOWS\System32\ptipbmf.dll (Promise Technology, Inc.)
O4 - HKLM..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.)
O4 - HKCU..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKCU..\Run: [PowerBar] File not found
O4 - HKCU..\Run: [RegistryBooster] C:\Program Files\Uniblue\RegistryBooster\launcher.exe File not found
O4 - HKCU..\Run: [Rpodabexobed] C:\WINDOWS\exvpsvev.DLL (Progressive Networks)
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\WINDOWS\System32\Adobe\Shockwave 11\SwHelper_1150595.exe -Update -1150595 -Mozilla\4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Mozilla\4.0 ( File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe ()
O4 - Startup: C:\Documents and Settings\Dave\Start Menu\Programs\Startup\PMB Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe (Sony Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} https://support.microsoft.com/OAS/ActiveX/MSDcode.cab (Microsoft Data Collection Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} https://webdl.symantec.com/activex/symdlmgr.cab (Symantec Download Manager)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Dave\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Dave\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/12/02 09:47:56 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2002/08/27 19:59:36 | 000,000,073 | R— | M] () - D:\AUTORUN.INF – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2019/03/07 18:57:21 | 000,472,960 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\drivers\iaStor.sys
[2019/03/07 18:57:21 | 000,159,744 | —- | C] (Promise Technology, Inc.) – C:\WINDOWS\System32\drivers\Fasttx2k.sys
[2019/03/07 18:57:21 | 000,118,784 | —- | C] (Promise Technology, Inc.) – C:\WINDOWS\System32\ptipbmf.dll
[2019/03/07 18:57:18 | 010,841,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmp.dll
[2019/03/07 18:57:18 | 002,462,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\WMVCore.dll
[2019/03/07 18:57:18 | 002,462,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\WMVCore.dll
[2019/03/07 18:57:18 | 001,329,152 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\WMSPDMOE.dll
[2019/03/07 18:57:18 | 001,329,152 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\WMSPDMOE.dll
[2019/03/07 18:57:18 | 000,604,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmspdmod.dll
[2019/03/07 18:57:18 | 000,604,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmspdmod.dll
[2019/03/07 18:57:18 | 000,303,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmstream.dll
[2019/03/07 18:57:18 | 000,303,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmstream.dll
[2019/03/07 18:57:18 | 000,286,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmpdxm.dll
[2019/03/07 18:57:18 | 000,278,559 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmv8ds32.ax
[2019/03/07 18:57:18 | 000,278,559 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmv8ds32.ax
[2019/03/07 18:57:18 | 000,258,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmvds32.ax
[2019/03/07 18:57:18 | 000,258,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmvds32.ax
[2019/03/07 18:57:18 | 000,242,688 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmpasf.dll
[2019/03/07 18:57:18 | 000,242,688 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmpasf.dll
[2019/03/07 18:57:18 | 000,115,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmsdmoe.dll
[2019/03/07 18:57:18 | 000,115,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmsdmoe.dll
[2019/03/07 18:57:18 | 000,099,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmpshell.dll
[2019/03/07 18:57:18 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\blastcln.exe
[2019/03/07 18:57:18 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmpui.dll
[2019/03/07 18:57:18 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmpui.dll
[2019/03/07 18:57:18 | 000,017,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\winshfhc.dll
[2019/03/07 18:57:18 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmvdmoe2.dll
[2019/03/07 18:57:18 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmvdmoe2.dll
[2019/03/07 18:57:18 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmvdmod.dll
[2019/03/07 18:57:18 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmvdmod.dll
[2019/03/07 18:57:18 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmsdmoe2.dll
[2019/03/07 18:57:18 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmsdmoe2.dll
[2019/03/07 18:57:18 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmsdmod.dll
[2019/03/07 18:57:18 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmsdmod.dll
[2019/03/07 18:57:17 | 008,231,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmploc.dll
[2019/03/07 18:57:17 | 008,231,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmploc.dll
[2019/03/07 18:57:17 | 000,938,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\WMNetmgr.dll
[2019/03/07 18:57:17 | 000,938,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\WMNetmgr.dll
[2019/03/07 18:57:17 | 000,227,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmerror.dll
[2019/03/07 18:57:17 | 000,227,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmerror.dll
[2019/03/07 18:57:17 | 000,157,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmidx.dll
[2019/03/07 18:57:17 | 000,157,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmidx.dll
[2019/03/07 18:57:17 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmdmps.dll
[2019/03/07 18:57:17 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmdmps.dll
[2019/03/07 18:57:17 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmdmlog.dll
[2019/03/07 18:57:17 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmdmlog.dll
[2019/03/07 18:57:17 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmpcore.dll
[2019/03/07 18:57:17 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmpcore.dll
[2019/03/07 18:57:17 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmpcd.dll
[2019/03/07 18:57:17 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmpcd.dll
[2019/03/07 18:57:17 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmp.ocx
[2019/03/07 18:57:17 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmp.ocx
[2019/03/07 18:57:16 | 001,117,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\WMADMOE.dll
[2019/03/07 18:57:16 | 001,117,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\WMADMOE.dll
[2019/03/07 18:57:16 | 000,991,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drmv2clt.dll
[2019/03/07 18:57:16 | 000,991,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\drmv2clt.dll
[2019/03/07 18:57:16 | 000,757,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\WMADMOD.dll
[2019/03/07 18:57:16 | 000,757,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\WMADMOD.dll
[2019/03/07 18:57:16 | 000,542,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\blackbox.dll
[2019/03/07 18:57:16 | 000,542,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\blackbox.dll
[2019/03/07 18:57:16 | 000,414,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msscp.dll
[2019/03/07 18:57:16 | 000,414,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msscp.dll
[2019/03/07 18:57:16 | 000,321,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mswmdm.dll
[2019/03/07 18:57:16 | 000,321,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mswmdm.dll
[2019/03/07 18:57:16 | 000,317,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\unregmp2.exe
[2019/03/07 18:57:16 | 000,307,260 | —- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) – C:\WINDOWS\System32\l3codeca.acm
[2019/03/07 18:57:16 | 000,262,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mpg4ds32.ax
[2019/03/07 18:57:16 | 000,262,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mpg4ds32.ax
[2019/03/07 18:57:16 | 000,258,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drmclien.dll
[2019/03/07 18:57:16 | 000,258,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\drmclien.dll
[2019/03/07 18:57:16 | 000,247,326 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\strmdll.dll
[2019/03/07 18:57:16 | 000,247,326 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\strmdll.dll
[2019/03/07 18:57:16 | 000,229,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cewmdm.dll
[2019/03/07 18:57:16 | 000,229,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cewmdm.dll
[2019/03/07 18:57:16 | 000,222,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmasf.dll
[2019/03/07 18:57:16 | 000,222,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmasf.dll
[2019/03/07 18:57:16 | 000,221,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msadds32.ax
[2019/03/07 18:57:16 | 000,221,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msadds32.ax
[2019/03/07 18:57:16 | 000,179,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msnetobj.dll
[2019/03/07 18:57:16 | 000,179,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msnetobj.dll
[2019/03/07 18:57:16 | 000,175,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mspmsp.dll
[2019/03/07 18:57:16 | 000,175,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mspmsp.dll
[2019/03/07 18:57:16 | 000,152,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\shmedia.dll
[2019/03/07 18:57:16 | 000,143,422 | —- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) – C:\WINDOWS\System32\l3codecx.ax
[2019/03/07 18:57:16 | 000,100,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\logagent.exe
[2019/03/07 18:57:16 | 000,100,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\logagent.exe
[2019/03/07 18:57:16 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drmstor.dll
[2019/03/07 18:57:16 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\drmstor.dll
[2019/03/07 18:57:16 | 000,086,016 | —- | C] (Sipro Lab Telecom Inc.) – C:\WINDOWS\System32\sl_anet.acm
[2019/03/07 18:57:16 | 000,069,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msscds32.ax
[2019/03/07 18:57:16 | 000,069,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msscds32.ax
[2019/03/07 18:57:16 | 000,061,952 | —- | C] (Sipro Lab Telecom Inc.) – C:\WINDOWS\System32\acelpdec.ax
[2019/03/07 18:57:16 | 000,027,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mspmsnsv.dll
[2019/03/07 18:57:16 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\LAPRXY.dll
[2019/03/07 18:57:16 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\LAPRXY.dll
[2019/03/07 18:57:16 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\asferror.dll
[2019/03/07 18:57:16 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\asferror.dll
[2019/03/07 18:57:16 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MPG4DMOD.dll
[2019/03/07 18:57:16 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\MPG4DMOD.dll
[2019/03/07 18:57:16 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MP4SDMOD.dll
[2019/03/07 18:57:16 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\MP4SDMOD.dll
[2019/03/07 18:57:16 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MP43DMOD.dll
[2019/03/07 18:57:16 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\MP43DMOD.dll
[2019/03/07 18:57:13 | 003,374,640 | —- | C] (Macromedia, Inc.) – C:\WINDOWS\System32\dllcache\tourW.exe
[2019/03/07 18:57:13 | 000,848,384 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\ir41_32.ax
[2019/03/07 18:57:13 | 000,755,200 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\ir50_32.dll
[2019/03/07 18:57:13 | 000,559,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msrepl40.dll
[2019/03/07 18:57:13 | 000,559,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msrepl40.dll
[2019/03/07 18:57:13 | 000,518,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msexch40.dll
[2019/03/07 18:57:13 | 000,518,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msexch40.dll
[2019/03/07 18:57:13 | 000,432,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msrd2x40.dll
[2019/03/07 18:57:13 | 000,432,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msrd2x40.dll
[2019/03/07 18:57:13 | 000,355,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msxbde40.dll
[2019/03/07 18:57:13 | 000,355,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msxbde40.dll
[2019/03/07 18:57:13 | 000,355,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mspbde40.dll
[2019/03/07 18:57:13 | 000,355,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mspbde40.dll
[2019/03/07 18:57:13 | 000,338,432 | —- | C] (Intel Corporation.) – C:\WINDOWS\System32\ir41_qcx.dll
[2019/03/07 18:57:13 | 000,326,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msexcl40.dll
[2019/03/07 18:57:13 | 000,326,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msexcl40.dll
[2019/03/07 18:57:13 | 000,264,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mstext40.dll
[2019/03/07 18:57:13 | 000,264,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mstext40.dll
[2019/03/07 18:57:13 | 000,253,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msvcrt20.dll
[2019/03/07 18:57:13 | 000,253,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msvcrt20.dll
[2019/03/07 18:57:13 | 000,236,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\migwiz_a.exe
[2019/03/07 18:57:13 | 000,219,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msltus40.dll
[2019/03/07 18:57:13 | 000,219,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msltus40.dll
[2019/03/07 18:57:13 | 000,200,192 | —- | C] (Intel Corporation.) – C:\WINDOWS\System32\ir50_qc.dll
[2019/03/07 18:57:13 | 000,192,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\migism_a.dll
[2019/03/07 18:57:13 | 000,188,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\script_a.dll
[2019/03/07 18:57:13 | 000,183,808 | —- | C] (Intel Corporation.) – C:\WINDOWS\System32\ir50_qcx.dll
[2019/03/07 18:57:13 | 000,155,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sysmod_a.dll
[2019/03/07 18:57:13 | 000,154,624 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\ivfsrc.ax
[2019/03/07 18:57:13 | 000,120,320 | —- | C] (Intel Corporation.) – C:\WINDOWS\System32\ir41_qc.dll
[2019/03/07 18:57:13 | 000,092,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\krnl386.exe
[2019/03/07 18:57:13 | 000,092,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\krnl386.exe
[2019/03/07 18:57:13 | 000,081,920 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\proctexe.ocx
[2019/03/07 18:57:13 | 000,073,802 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msrclr40.dll
[2019/03/07 18:57:13 | 000,069,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msr2c.dll
[2019/03/07 18:57:13 | 000,069,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msr2c.dll
[2019/03/07 18:57:13 | 000,051,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\migpwd.exe
[2019/03/07 18:57:13 | 000,051,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vga256.dll
[2019/03/07 18:57:13 | 000,051,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vga256.dll
[2019/03/07 18:57:13 | 000,040,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\osuninst.exe
[2019/03/07 18:57:13 | 000,040,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\osuninst.exe
[2019/03/07 18:57:13 | 000,034,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\migisol.exe
[2019/03/07 18:57:13 | 000,028,746 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msrecr40.dll
[2019/03/07 18:57:13 | 000,025,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\lnkstub.exe
[2019/03/07 18:57:13 | 000,025,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lnkstub.exe
[2019/03/07 18:57:13 | 000,020,511 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\odtext32.dll
[2019/03/07 18:57:13 | 000,020,511 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\oddbse32.dll
[2019/03/07 18:57:13 | 000,020,510 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\odpdx32.dll
[2019/03/07 18:57:13 | 000,020,510 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\odfox32.dll
[2019/03/07 18:57:13 | 000,020,510 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\odexl32.dll
[2019/03/07 18:57:13 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\vmmreg32.dll
[2019/03/07 18:57:13 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vmmreg32.dll
[2019/03/07 18:57:13 | 000,018,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vga64k.dll
[2019/03/07 18:57:13 | 000,018,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vga64k.dll
[2019/03/07 18:57:13 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\pentnt.exe
[2019/03/07 18:57:13 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pentnt.exe
[2019/03/07 18:57:13 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spnpinst.exe
[2019/03/07 18:57:13 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msr2cenu.dll
[2019/03/07 18:57:13 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msr2cenu.dll
[2019/03/07 18:57:13 | 000,004,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mnmdd.sys
[2019/03/07 18:57:12 | 000,590,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\d3dramp.dll
[2019/03/07 18:57:12 | 000,590,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dramp.dll
[2019/03/07 18:57:12 | 000,199,680 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\iac25_32.ax
[2019/03/07 18:57:12 | 000,108,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\guitrn_a.dll
[2019/03/07 18:57:12 | 000,051,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmerrenu.dll
[2019/03/07 18:57:12 | 000,051,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmerrenu.dll
[2019/03/07 18:57:12 | 000,027,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ctl3d32.dll
[2019/03/07 18:57:12 | 000,027,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ctl3d32.dll
[2019/03/07 18:57:12 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fsconins.dll
[2019/03/07 18:57:12 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbda3.dll
[2019/03/07 18:57:12 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbda2.dll
[2019/03/07 18:57:12 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbda1.dll
[2019/03/07 18:57:11 | 002,897,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpsp2res.dll
[2019/03/07 18:57:11 | 000,438,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpob2res.dll
[2019/03/07 18:57:11 | 000,187,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpsp1res.dll
[2019/03/07 18:57:11 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdycl.dll
[2019/03/07 18:57:11 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdycl.dll
[2019/03/07 18:57:11 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdsl1.dll
[2019/03/07 18:57:11 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdsl1.dll
[2019/03/07 18:57:11 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdsl.dll
[2019/03/07 18:57:11 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdsl.dll
[2019/03/07 18:57:11 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdtuq.dll
[2019/03/07 18:57:11 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdtuq.dll
[2019/03/07 18:57:11 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdtuf.dll
[2019/03/07 18:57:11 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdtuf.dll
[2019/03/07 18:57:11 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdycc.dll
[2019/03/07 18:57:11 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdycc.dll
[2019/03/07 18:57:11 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdvntc.dll
[2019/03/07 18:57:11 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbduzb.dll
[2019/03/07 18:57:11 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbduzb.dll
[2019/03/07 18:57:11 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdtat.dll
[2019/03/07 18:57:11 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdtat.dll
[2019/03/07 18:57:11 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdru1.dll
[2019/03/07 18:57:11 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdru1.dll
[2019/03/07 18:57:11 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdru.dll
[2019/03/07 18:57:11 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdru.dll
[2019/03/07 18:57:11 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdro.dll
[2019/03/07 18:57:11 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdro.dll
[2019/03/07 18:57:11 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdheb.dll
[2019/03/07 18:57:03 | 000,025,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\medctroc.dll
[2019/03/07 18:57:01 | 000,195,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msutb.dll
[2019/03/07 18:57:01 | 000,159,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msimtf.dll
[2019/03/07 18:57:01 | 000,068,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msctfp.dll
[2019/03/07 18:57:00 | 000,604,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wsecedit.dll
[2019/03/07 18:57:00 | 000,383,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wzcdlg.dll
[2019/03/07 18:57:00 | 000,264,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wow32.dll
[2019/03/07 18:57:00 | 000,174,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xenroll.dll
[2019/03/07 18:57:00 | 000,174,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xenroll.dll
[2019/03/07 18:57:00 | 000,148,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wscui.cpl
[2019/03/07 18:57:00 | 000,135,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wshom.ocx
[2019/03/07 18:57:00 | 000,091,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactsrv.dll
[2019/03/07 18:57:00 | 000,050,688 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wstdecod.dll
[2019/03/07 18:57:00 | 000,050,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xmlprovi.dll
[2019/03/07 18:57:00 | 000,041,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wsnmp32.dll
[2019/03/07 18:57:00 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wshcon.dll
[2019/03/07 18:57:00 | 000,032,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wupdmgr.exe
[2019/03/07 18:57:00 | 000,032,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wupdmgr.exe
[2019/03/07 18:57:00 | 000,032,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wpabaln.exe
[2019/03/07 18:57:00 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xcopy.exe
[2019/03/07 18:57:00 | 000,022,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wsock32.dll
[2019/03/07 18:57:00 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wshtcpip.dll
[2019/03/07 18:57:00 | 000,018,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wtsapi32.dll
[2019/03/07 18:57:00 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wship6.dll
[2019/03/07 18:57:00 | 000,012,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ws2ifsl.sys
[2019/03/07 18:57:00 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wshisn.dll
[2019/03/07 18:57:00 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wshisn.dll
[2019/03/07 18:57:00 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wshrm.dll
[2019/03/07 18:57:00 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wpnpinst.exe
[2019/03/07 18:57:00 | 000,010,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wowexec.exe
[2019/03/07 18:57:00 | 000,010,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wowexec.exe
[2019/03/07 18:57:00 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wshatm.dll
[2019/03/07 18:57:00 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wshatm.dll
[2019/03/07 18:57:00 | 000,008,261 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\zoneoc.dll
[2019/03/07 18:57:00 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wshnetbs.dll
[2019/03/07 18:57:00 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wshnetbs.dll
[2019/03/07 18:57:00 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdinmal.dll
[2019/03/07 18:57:00 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdth3.dll
[2019/03/07 18:57:00 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdth2.dll
[2019/03/07 18:57:00 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinpun.dll
[2019/03/07 18:57:00 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdinben.dll
[2019/03/07 18:57:00 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdinbe1.dll
[2019/03/07 18:57:00 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdurdu.dll
[2019/03/07 18:57:00 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdth1.dll
[2019/03/07 18:57:00 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdth0.dll
[2019/03/07 18:57:00 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdsyr2.dll
[2019/03/07 18:57:00 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdsyr1.dll
[2019/03/07 18:57:00 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdintel.dll
[2019/03/07 18:57:00 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdintam.dll
[2019/03/07 18:57:00 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinmar.dll
[2019/03/07 18:57:00 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinkan.dll
[2019/03/07 18:57:00 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinhin.dll
[2019/03/07 18:57:00 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdinguj.dll
[2019/03/07 18:57:00 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdindev.dll
[2019/03/07 18:57:00 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdfa.dll
[2019/03/07 18:57:00 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbddiv2.dll
[2019/03/07 18:57:00 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbddiv1.dll
[2019/03/07 18:57:00 | 000,002,736 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wowdeb.exe
[2019/03/07 18:57:00 | 000,002,736 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wowdeb.exe
[2019/03/07 18:56:59 | 001,852,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\win32k.sys
[2019/03/07 18:56:59 | 001,647,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\winbrand.dll
[2019/03/07 18:56:59 | 000,756,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\winntbbu.dll
[2019/03/07 18:56:59 | 000,507,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winlogon.exe
[2019/03/07 18:56:59 | 000,463,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wiadefui.dll
[2019/03/07 18:56:59 | 000,433,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wiaacmgr.exe
[2019/03/07 18:56:59 | 000,293,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\winsrv.dll
[2019/03/07 18:56:59 | 000,283,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\winhlp32.exe
[2019/03/07 18:56:59 | 000,256,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\winhelp.exe
[2019/03/07 18:56:59 | 000,256,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winhelp.exe
[2019/03/07 18:56:59 | 000,145,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wiavusd.dll
[2019/03/07 18:56:59 | 000,145,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wiavusd.dll
[2019/03/07 18:56:59 | 000,135,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\webvw.dll
[2019/03/07 18:56:59 | 000,124,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wiadss.dll
[2019/03/07 18:56:59 | 000,111,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wiavideo.dll
[2019/03/07 18:56:59 | 000,104,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\win32spl.dll
[2019/03/07 18:56:59 | 000,099,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\winscard.dll
[2019/03/07 18:56:59 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wextract.exe
[2019/03/07 18:56:59 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmiscmgr.dll
[2019/03/07 18:56:59 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiscmgr.dll
[2019/03/07 18:56:59 | 000,053,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\winsta.dll
[2019/03/07 18:56:59 | 000,040,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\webhits.dll
[2019/03/07 18:56:59 | 000,040,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\webhits.dll
[2019/03/07 18:56:59 | 000,032,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\winipsec.dll
[2019/03/07 18:56:59 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmiprop.dll
[2019/03/07 18:56:59 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmiprop.dll
[2019/03/07 18:56:59 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\winstrm.dll
[2019/03/07 18:56:59 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winstrm.dll
[2019/03/07 18:56:59 | 000,018,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\win.com
[2019/03/07 18:56:59 | 000,013,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wfwnet.drv
[2019/03/07 18:56:59 | 000,013,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wfwnet.drv
[2019/03/07 18:56:59 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\winmsd.exe
[2019/03/07 18:56:59 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winmsd.exe
[2019/03/07 18:56:59 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\winfax.dll
[2019/03/07 18:56:59 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winfax.dll
[2019/03/07 18:56:59 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wifeman.dll
[2019/03/07 18:56:59 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wifeman.dll
[2019/03/07 18:56:59 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winhstb.exe
[2019/03/07 18:56:59 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmi.dll
[2019/03/07 18:56:59 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\winver.exe
[2019/03/07 18:56:59 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\winnls.dll
[2019/03/07 18:56:59 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winnls.dll
[2019/03/07 18:56:59 | 000,004,352 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\wmilib.sys
[2019/03/07 18:56:59 | 000,004,352 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wmilib.sys
[2019/03/07 18:56:59 | 000,002,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winsock.dll
[2019/03/07 18:56:59 | 000,002,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\winspool.exe
[2019/03/07 18:56:59 | 000,002,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winspool.exe
[2019/03/07 18:56:59 | 000,002,080 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\winoldap.mod
[2019/03/07 18:56:58 | 000,990,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\syssetup.dll
[2019/03/07 18:56:58 | 000,858,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tapi3.dll
[2019/03/07 18:56:58 | 000,713,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sxs.dll
[2019/03/07 18:56:58 | 000,704,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ss3dfo.scr
[2019/03/07 18:56:58 | 000,679,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sstext3d.scr
[2019/03/07 18:56:58 | 000,610,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sspipes.scr
[2019/03/07 18:56:58 | 000,420,352 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vbscript.dll
[2019/03/07 18:56:58 | 000,393,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ssflwbox.scr
[2019/03/07 18:56:58 | 000,358,400 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\termmgr.dll
[2019/03/07 18:56:58 | 000,316,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\untfs.dll
[2019/03/07 18:56:58 | 000,275,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ulib.dll
[2019/03/07 18:56:58 | 000,259,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tracerpt.exe
[2019/03/07 18:56:58 | 000,226,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\tcpip6.sys
[2019/03/07 18:56:58 | 000,218,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sysmon.ocx
[2019/03/07 18:56:58 | 000,215,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wavemsp.dll
[2019/03/07 18:56:58 | 000,206,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\unimdm.tsp
[2019/03/07 18:56:58 | 000,181,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tapi32.dll
[2019/03/07 18:56:58 | 000,177,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\typelib.dll
[2019/03/07 18:56:58 | 000,177,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\typelib.dll
[2019/03/07 18:56:58 | 000,138,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\swprv.dll
[2019/03/07 18:56:58 | 000,136,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sti_ci.dll
[2019/03/07 18:56:58 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\upnp.dll
[2019/03/07 18:56:58 | 000,119,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\t2embed.dll
[2019/03/07 18:56:58 | 000,106,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sysocmgr.exe
[2019/03/07 18:56:58 | 000,105,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\url.dll
[2019/03/07 18:56:58 | 000,101,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\txflog.dll
[2019/03/07 18:56:58 | 000,098,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\verifier.exe
[2019/03/07 18:56:58 | 000,098,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\verifier.exe
[2019/03/07 18:56:58 | 000,094,784 | —- | C] (Twain Working Group) – C:\WINDOWS\twain.dll
[2019/03/07 18:56:58 | 000,094,784 | —- | C] (Twain Working Group) – C:\WINDOWS\System32\dllcache\twain.dll
[2019/03/07 18:56:58 | 000,094,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\timedate.cpl
[2019/03/07 18:56:58 | 000,082,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ufat.dll
[2019/03/07 18:56:58 | 000,082,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ufat.dll
[2019/03/07 18:56:58 | 000,081,920 | —- | C] (Progressive Networks) – C:\WINDOWS\exvpsvev.dll
[2019/03/07 18:56:58 | 000,081,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\videoprt.sys
[2019/03/07 18:56:58 | 000,080,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tlntsess.exe
[2019/03/07 18:56:58 | 000,078,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tapiui.dll
[2019/03/07 18:56:58 | 000,078,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tapiui.dll
[2019/03/07 18:56:58 | 000,077,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tasklist.exe
[2019/03/07 18:56:58 | 000,076,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\telnet.exe
[2019/03/07 18:56:58 | 000,076,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\taskkill.exe
[2019/03/07 18:56:58 | 000,075,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\strmfilt.dll
[2019/03/07 18:56:58 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\unimdmat.dll
[2019/03/07 18:56:58 | 000,068,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sti.dll
[2019/03/07 18:56:58 | 000,067,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\osuninst.dll
[2019/03/07 18:56:58 | 000,066,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tdc.ocx
[2019/03/07 18:56:58 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tlntadmn.exe
[2019/03/07 18:56:58 | 000,057,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\synceng.dll
[2019/03/07 18:56:58 | 000,052,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tsappcmp.dll
[2019/03/07 18:56:58 | 000,052,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tsappcmp.dll
[2019/03/07 18:56:58 | 000,051,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vdmredir.dll
[2019/03/07 18:56:58 | 000,051,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\syncapp.exe
[2019/03/07 18:56:58 | 000,051,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\syncapp.exe
[2019/03/07 18:56:58 | 000,050,688 | —- | C] (Twain Working Group) – C:\WINDOWS\twain_32.dll
[2019/03/07 18:56:58 | 000,050,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\utilman.exe
[2019/03/07 18:56:58 | 000,049,680 | —- | C] (Twain Working Group) – C:\WINDOWS\twunk_16.exe
[2019/03/07 18:56:58 | 000,049,680 | —- | C] (Twain Working Group) – C:\WINDOWS\System32\dllcache\twunk_16.exe
[2019/03/07 18:56:58 | 000,049,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\w32tm.exe
[2019/03/07 18:56:58 | 000,049,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\w32tm.exe
[2019/03/07 18:56:58 | 000,047,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\user.exe
[2019/03/07 18:56:58 | 000,047,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\user.exe
[2019/03/07 18:56:58 | 000,047,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ssmypics.scr
[2019/03/07 18:56:58 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tcpmonui.dll
[2019/03/07 18:56:58 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tcpmon.dll
[2019/03/07 18:56:58 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\syskey.exe
[2019/03/07 18:56:58 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\syskey.exe
[2019/03/07 18:56:58 | 000,036,352 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\typeperf.exe
[2019/03/07 18:56:58 | 000,036,352 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\typeperf.exe
[2019/03/07 18:56:58 | 000,035,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\umandlg.dll
[2019/03/07 18:56:58 | 000,034,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ssdpapi.dll
[2019/03/07 18:56:58 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vssadmin.exe
[2019/03/07 18:56:58 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vssadmin.exe
[2019/03/07 18:56:58 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tracert6.exe
[2019/03/07 18:56:58 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tracert6.exe
[2019/03/07 18:56:58 | 000,031,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\traffic.dll
[2019/03/07 18:56:58 | 000,031,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\traffic.dll
[2019/03/07 18:56:58 | 000,030,749 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vbajet32.dll
[2019/03/07 18:56:58 | 000,030,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vbisurf.ax
[2019/03/07 18:56:58 | 000,028,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\telephon.cpl
[2019/03/07 18:56:58 | 000,028,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\telephon.cpl
[2019/03/07 18:56:58 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\verifier.dll
[2019/03/07 18:56:58 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\udhisapi.dll
[2019/03/07 18:56:58 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vdmdbg.dll
[2019/03/07 18:56:58 | 000,025,600 | —- | C] (Twain Working Group) – C:\WINDOWS\twunk_32.exe
[2019/03/07 18:56:58 | 000,025,600 | —- | C] (Twain Working Group) – C:\WINDOWS\System32\dllcache\twunk_32.exe
[2019/03/07 18:56:58 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\utildll.dll
[2019/03/07 18:56:58 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\utildll.dll
[2019/03/07 18:56:58 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\w32topl.dll
[2019/03/07 18:56:58 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\w32topl.dll
[2019/03/07 18:56:58 | 000,020,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ssmarque.scr
[2019/03/07 18:56:58 | 000,020,535 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vfpodbc.dll
[2019/03/07 18:56:58 | 000,019,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ssbezier.scr
[2019/03/07 18:56:58 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vwipxspx.dll
[2019/03/07 18:56:58 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vwipxspx.dll
[2019/03/07 18:56:58 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tcpsvcs.exe
[2019/03/07 18:56:58 | 000,019,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tapi.dll
[2019/03/07 18:56:58 | 000,019,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tapi.dll
[2019/03/07 18:56:58 | 000,019,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\tdi.sys
[2019/03/07 18:56:58 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ssmyst.scr
[2019/03/07 18:56:58 | 000,018,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sysedit.exe
[2019/03/07 18:56:58 | 000,018,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sysedit.exe
[2019/03/07 18:56:58 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ureg.dll
[2019/03/07 18:56:58 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ureg.dll
[2019/03/07 18:56:58 | 000,017,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\watchdog.sys
[2019/03/07 18:56:58 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vss_ps.dll
[2019/03/07 18:56:58 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vss_ps.dll
[2019/03/07 18:56:58 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\usbmon.dll
[2019/03/07 18:56:58 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\upnpcont.exe
[2019/03/07 18:56:58 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tftp.exe
[2019/03/07 18:56:58 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tftp.exe
[2019/03/07 18:56:58 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\stdole2.tlb
[2019/03/07 18:56:58 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sysinv.dll
[2019/03/07 18:56:58 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sysinv.dll
[2019/03/07 18:56:58 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\taskman.exe
[2019/03/07 18:56:58 | 000,014,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\tape.sys
[2019/03/07 18:56:58 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tcpmib.dll
[2019/03/07 18:56:58 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\stimon.exe
[2019/03/07 18:56:58 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ssstars.scr
[2019/03/07 18:56:58 | 000,013,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\toolhelp.dll
[2019/03/07 18:56:58 | 000,013,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\toolhelp.dll
[2019/03/07 18:56:58 | 000,013,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\uniplat.dll
[2019/03/07 18:56:58 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\umdmxfrm.dll
[2019/03/07 18:56:58 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\umdmxfrm.dll
[2019/03/07 18:56:58 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\usb8023.sys
[2019/03/07 18:56:58 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tree.com
[2019/03/07 18:56:58 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tracert.exe
[2019/03/07 18:56:58 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tcmsetup.exe
[2019/03/07 18:56:58 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tcmsetup.exe
[2019/03/07 18:56:58 | 000,012,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tsddd.dll
[2019/03/07 18:56:58 | 000,009,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vga.dll
[2019/03/07 18:56:58 | 000,009,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vga.dll
[2019/03/07 18:56:58 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\subst.exe
[2019/03/07 18:56:58 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\subst.exe
[2019/03/07 18:56:58 | 000,009,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ver.dll
[2019/03/07 18:56:58 | 000,009,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ver.dll
[2019/03/07 18:56:58 | 000,008,192 | —- | C] (DSP GROUP, INC.) – C:\WINDOWS\System32\tssoft32.acm
[2019/03/07 18:56:58 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vcdex.dll
[2019/03/07 18:56:58 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vcdex.dll
[2019/03/07 18:56:58 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tlntsvrp.dll
[2019/03/07 18:56:58 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\stdole32.tlb
[2019/03/07 18:56:58 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\stdole32.tlb
[2019/03/07 18:56:58 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\svcpack.dll
[2019/03/07 18:56:58 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\svcpack.dll
[2019/03/07 18:56:58 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tapiperf.dll
[2019/03/07 18:56:58 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tapiperf.dll
[2019/03/07 18:56:58 | 000,005,532 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\stdole.tlb
[2019/03/07 18:56:58 | 000,005,532 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System\stdole.tlb
[2019/03/07 18:56:58 | 000,005,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vgaoem.fon
[2019/03/07 18:56:58 | 000,004,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vjoy.dll
[2019/03/07 18:56:58 | 000,004,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vjoy.dll
[2019/03/07 18:56:58 | 000,004,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\storage.dll
[2019/03/07 18:56:58 | 000,004,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\storage.dll
[2019/03/07 18:56:58 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\unlodctr.exe
[2019/03/07 18:56:58 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\unlodctr.exe
[2019/03/07 18:56:58 | 000,004,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\timer.drv
[2019/03/07 18:56:58 | 000,004,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\timer.drv
[2019/03/07 18:56:58 | 000,003,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\system.drv
[2019/03/07 18:56:58 | 000,003,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\system.drv
[2019/03/07 18:56:58 | 000,003,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\systray.exe
[2019/03/07 18:56:58 | 000,003,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\systray.exe
[2019/03/07 18:56:58 | 000,002,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\vga.drv
[2019/03/07 18:56:58 | 000,002,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\vga.drv
[2019/03/07 18:56:57 | 000,442,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sqlsrv32.dll
[2019/03/07 18:56:57 | 000,362,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\smlogcfg.dll
[2019/03/07 18:56:57 | 000,182,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\snmpsnap.dll
[2019/03/07 18:56:57 | 000,180,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sqlunirl.dll
[2019/03/07 18:56:57 | 000,090,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sqlsrv32.rll
[2019/03/07 18:56:57 | 000,075,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spoolss.dll
[2019/03/07 18:56:57 | 000,058,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\spoolsv.exe
[2019/03/07 18:56:57 | 000,049,179 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sqlwoa.dll
[2019/03/07 18:56:57 | 000,024,603 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sqlwid.dll
[2019/03/07 18:56:57 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sort.exe
[2019/03/07 18:56:57 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\snmpapi.dll
[2019/03/07 18:56:57 | 000,014,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\smclib.sys
[2019/03/07 18:56:57 | 000,014,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\smclib.sys
[2019/03/07 18:56:57 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spiisupd.exe
[2019/03/07 18:56:57 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sprestrt.exe
[2019/03/07 18:56:57 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sprestrt.exe
[2019/03/07 18:56:57 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\softpub.dll
[2019/03/07 18:56:57 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\softpub.dll
[2019/03/07 18:56:57 | 000,001,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sound.drv
[2019/03/07 18:56:57 | 000,001,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sound.drv
[2019/03/07 18:56:56 | 001,614,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sfcfiles.dll
[2019/03/07 18:56:56 | 001,435,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\query.dll
[2019/03/07 18:56:56 | 000,658,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rasdlg.dll
[2019/03/07 18:56:56 | 000,549,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\shdoclc.dll
[2019/03/07 18:56:56 | 000,539,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msftedit.dll
[2019/03/07 18:56:56 | 000,433,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\riched20.dll
[2019/03/07 18:56:56 | 000,415,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\samsrv.dll
[2019/03/07 18:56:56 | 000,414,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\setupdll.dll
[2019/03/07 18:56:56 | 000,414,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\setupdll.dll
[2019/03/07 18:56:56 | 000,397,824 | —- | C] (Microsoft) – C:\WINDOWS\System32\regwizc.dll
[2019/03/07 18:56:56 | 000,314,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\scesrv.dll
[2019/03/07 18:56:56 | 000,306,176 | —- | C] (Schlumberger Technology Corporation) – C:\WINDOWS\System32\slbcsp.dll
[2019/03/07 18:56:56 | 000,306,176 | —- | C] (Schlumberger Technology Corporation) – C:\WINDOWS\System32\dllcache\slbcsp.dll
[2019/03/07 18:56:56 | 000,237,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rasapi32.dll
[2019/03/07 18:56:56 | 000,211,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\qasf.dll
[2019/03/07 18:56:56 | 000,211,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\qasf.dll
[2019/03/07 18:56:56 | 000,210,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rasppp.dll
[2019/03/07 18:56:56 | 000,208,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rsaenh.dll
[2019/03/07 18:56:56 | 000,203,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\rmcast.sys
[2019/03/07 18:56:56 | 000,181,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\scecli.dll
[2019/03/07 18:56:56 | 000,180,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\scrobj.dll
[2019/03/07 18:56:56 | 000,171,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sccsccp.dll
[2019/03/07 18:56:56 | 000,169,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sccbase.dll
[2019/03/07 18:56:56 | 000,169,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sccbase.dll
[2019/03/07 18:56:56 | 000,159,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sbeio.dll
[2019/03/07 18:56:56 | 000,149,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rastls.dll
[2019/03/07 18:56:56 | 000,143,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rasmontr.dll
[2019/03/07 18:56:56 | 000,143,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rasmontr.dll
[2019/03/07 18:56:56 | 000,132,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rsvp.exe
[2019/03/07 18:56:56 | 000,130,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sdpblb.dll
[2019/03/07 18:56:56 | 000,130,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sdpblb.dll
[2019/03/07 18:56:56 | 000,121,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\schtasks.exe
[2019/03/07 18:56:56 | 000,118,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\scardssp.dll
[2019/03/07 18:56:56 | 000,118,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\scardssp.dll
[2019/03/07 18:56:56 | 000,114,688 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\powercfg.cpl
[2019/03/07 18:56:56 | 000,109,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\progman.exe
[2019/03/07 18:56:56 | 000,107,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rsnotify.exe
[2019/03/07 18:56:56 | 000,107,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rend.dll
[2019/03/07 18:56:56 | 000,107,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rend.dll
[2019/03/07 18:56:56 | 000,105,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\polstore.dll
[2019/03/07 18:56:56 | 000,102,400 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rcbdyctl.dll
[2019/03/07 18:56:56 | 000,098,304 | —- | C] (Schlumberger Technology Corporation) – C:\WINDOWS\System32\slbiop.dll
[2019/03/07 18:56:56 | 000,098,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rtm.dll
[2019/03/07 18:56:56 | 000,098,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rtm.dll
[2019/03/07 18:56:56 | 000,096,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\psbase.dll
[2019/03/07 18:56:56 | 000,079,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\raschap.dll
[2019/03/07 18:56:56 | 000,077,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\shrpubw.exe
[2019/03/07 18:56:56 | 000,077,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sdbinst.exe
[2019/03/07 18:56:56 | 000,077,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rtcshare.exe
[2019/03/07 18:56:56 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\remotesp.tsp
[2019/03/07 18:56:56 | 000,070,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sigverif.exe
[2019/03/07 18:56:56 | 000,069,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\scarddlg.dll
[2019/03/07 18:56:56 | 000,068,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\shgina.dll
[2019/03/07 18:56:56 | 000,062,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rsopprov.exe
[2019/03/07 18:56:56 | 000,062,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rsopprov.exe
[2019/03/07 18:56:56 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rasman.dll
[2019/03/07 18:56:56 | 000,058,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\resutils.dll
[2019/03/07 18:56:56 | 000,058,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rastapi.dll
[2019/03/07 18:56:56 | 000,057,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\gpupdate.exe
[2019/03/07 18:56:56 | 000,057,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\gpupdate.exe
[2019/03/07 18:56:56 | 000,056,832 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rasphone.exe
[2019/03/07 18:56:56 | 000,050,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\reg.exe
[2019/03/07 18:56:56 | 000,050,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\proquota.exe
[2019/03/07 18:56:56 | 000,049,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\regapi.dll
[2019/03/07 18:56:56 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rsmui.exe
[2019/03/07 18:56:56 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rsmui.exe
[2019/03/07 18:56:56 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\powercfg.exe
[2019/03/07 18:56:56 | 000,049,152 | —- | C] (Microsoft Corp) – C:\WINDOWS\System32\rsm.exe
[2019/03/07 18:56:56 | 000,049,152 | —- | C] (Microsoft Corp) – C:\WINDOWS\System32\dllcache\rsm.exe
[2019/03/07 18:56:56 | 000,045,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\shmgrate.exe
[2019/03/07 18:56:56 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rtutils.dll
[2019/03/07 18:56:56 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\pstorec.dll
[2019/03/07 18:56:56 | 000,035,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rcimlby.exe
[2019/03/07 18:56:56 | 000,035,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sc.exe
[2019/03/07 18:56:56 | 000,034,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\rawwan.sys
[2019/03/07 18:56:56 | 000,034,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rawwan.sys
[2019/03/07 18:56:56 | 000,034,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\pstorsvc.dll
[2019/03/07 18:56:56 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\relog.exe
[2019/03/07 18:56:56 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\relog.exe
[2019/03/07 18:56:56 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rtipxmib.dll
[2019/03/07 18:56:56 | 000,031,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sethc.exe
[2019/03/07 18:56:56 | 000,030,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\rndismp.sys
[2019/03/07 18:56:56 | 000,029,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sendcmsg.dll
[2019/03/07 18:56:56 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rsfsaps.dll
[2019/03/07 18:56:56 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rsfsaps.dll
[2019/03/07 18:56:56 | 000,027,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\profmap.dll
[2019/03/07 18:56:56 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\scredir.dll
[2019/03/07 18:56:56 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\scredir.dll
[2019/03/07 18:56:56 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\skeys.exe
[2019/03/07 18:56:56 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\routemon.exe
[2019/03/07 18:56:56 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\routemon.exe
[2019/03/07 18:56:56 | 000,025,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\shfolder.dll
[2019/03/07 18:56:56 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rsmsink.exe
[2019/03/07 18:56:56 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rsmsink.exe
[2019/03/07 18:56:56 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sfmapi.dll
[2019/03/07 18:56:56 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sfmapi.dll
[2019/03/07 18:56:56 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rsvpmsg.dll
[2019/03/07 18:56:56 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rsvpmsg.dll
[2019/03/07 18:56:56 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rasrad.dll
[2019/03/07 18:56:56 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rasrad.dll
[2019/03/07 18:56:56 | 000,023,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\setup.exe
[2019/03/07 18:56:56 | 000,022,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rasmxs.dll
[2019/03/07 18:56:56 | 000,022,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rasmxs.dll
[2019/03/07 18:56:56 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rpcns4.dll
[2019/03/07 18:56:56 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rpcns4.dll
[2019/03/07 18:56:56 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rcp.exe
[2019/03/07 18:56:56 | 000,019,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\route.exe
[2019/03/07 18:56:56 | 000,019,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\route.exe
[2019/03/07 18:56:56 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\shutdown.exe
[2019/03/07 18:56:56 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\secedit.exe
[2019/03/07 18:56:56 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rsmps.dll
[2019/03/07 18:56:56 | 000,017,792 | —- | C] (Parallel Technologies, Inc.) – C:\WINDOWS\System32\dllcache\ptilink.sys
[2019/03/07 18:56:56 | 000,017,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\powrprof.dll
[2019/03/07 18:56:56 | 000,016,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\raspti.sys
[2019/03/07 18:56:56 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\simpdata.tlb
[2019/03/07 18:56:56 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\runas.exe
[2019/03/07 18:56:56 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\runas.exe
[2019/03/07 18:56:56 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rassapi.dll
[2019/03/07 18:56:56 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\prflbmsg.dll
[2019/03/07 18:56:56 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\prflbmsg.dll
[2019/03/07 18:56:56 | 000,014,848 | —- | C] (Schlumberger Technology Corporation) – C:\WINDOWS\System32\slbrccsp.dll
[2019/03/07 18:56:56 | 000,014,848 | —- | C] (Schlumberger Technology Corporation) – C:\WINDOWS\System32\dllcache\slbrccsp.dll
[2019/03/07 18:56:56 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\serwvdrv.dll
[2019/03/07 18:56:56 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\serwvdrv.dll
[2019/03/07 18:56:56 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rsh.exe
[2019/03/07 18:56:56 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\serialui.dll
[2019/03/07 18:56:56 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\serialui.dll
[2019/03/07 18:56:56 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\runonce.exe
[2019/03/07 18:56:56 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drprov.dll
[2019/03/07 18:56:56 | 000,013,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sisbkup.dll
[2019/03/07 18:56:56 | 000,013,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sisbkup.dll
[2019/03/07 18:56:56 | 000,013,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\senscfg.dll
[2019/03/07 18:56:56 | 000,013,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\senscfg.dll
[2019/03/07 18:56:56 | 000,013,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rexec.exe
[2019/03/07 18:56:56 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sigtab.dll
[2019/03/07 18:56:56 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\savedump.exe
[2019/03/07 18:56:56 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\replace.exe
[2019/03/07 18:56:56 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\replace.exe
[2019/03/07 18:56:56 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rasser.dll
[2019/03/07 18:56:56 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rasser.dll
[2019/03/07 18:56:56 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\script.fon
[2019/03/07 18:56:56 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\regsvr32.exe
[2019/03/07 18:56:56 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rasctrs.dll
[2019/03/07 18:56:56 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rasctrs.dll
[2019/03/07 18:56:56 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rasautou.exe
[2019/03/07 18:56:56 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rasautou.exe
[2019/03/07 18:56:56 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rasdial.exe
[2019/03/07 18:56:56 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rasdial.exe
[2019/03/07 18:56:56 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\pschdprf.dll
[2019/03/07 18:56:56 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pschdprf.dll
[2019/03/07 18:56:56 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sfc.exe
[2019/03/07 18:56:56 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\sfc.exe
[2019/03/07 18:56:56 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rsvpperf.dll
[2019/03/07 18:56:56 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rsvpperf.dll
[2019/03/07 18:56:56 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\scrnsave.scr
[2019/03/07 18:56:56 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\proxycfg.exe
[2019/03/07 18:56:56 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\print.exe
[2019/03/07 18:56:56 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\print.exe
[2019/03/07 18:56:56 | 000,008,832 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rasacd.sys
[2019/03/07 18:56:56 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\smbinst.exe
[2019/03/07 18:56:56 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\qosname.dll
[2019/03/07 18:56:56 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\qosname.dll
[2019/03/07 18:56:56 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\psnppagn.dll
[2019/03/07 18:56:56 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\psnppagn.dll
[2019/03/07 18:56:56 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rasadhlp.dll
[2019/03/07 18:56:56 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\sensapi.dll
[2019/03/07 18:56:56 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\recover.exe
[2019/03/07 18:56:56 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\recover.exe
[2019/03/07 18:56:56 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\routetab.dll
[2019/03/07 18:56:56 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\routetab.dll
[2019/03/07 18:56:56 | 000,005,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rootmdm.sys
[2019/03/07 18:56:56 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\skdll.dll
[2019/03/07 18:56:56 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\skdll.dll
[2019/03/07 18:56:56 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\security.dll
[2019/03/07 18:56:56 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\shell.dll
[2019/03/07 18:56:56 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\shell.dll
[2019/03/07 18:56:56 | 000,004,608 | —- | C] (Microsoft) – C:\WINDOWS\System32\regwiz.exe
[2019/03/07 18:56:56 | 000,004,608 | —- | C] (Microsoft) – C:\WINDOWS\System32\dllcache\regwiz.exe
[2019/03/07 18:56:56 | 000,004,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rdpcdd.sys
[2019/03/07 18:56:56 | 000,003,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\riched32.dll
[2019/03/07 18:56:56 | 000,003,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\riched32.dll
[2019/03/07 18:56:56 | 000,003,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\regedt32.exe
[2019/03/07 18:56:56 | 000,003,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\regedt32.exe
[2019/03/07 18:56:56 | 000,003,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\rnr20.dll
[2019/03/07 18:56:56 | 000,003,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rnr20.dll
[2019/03/07 18:56:55 | 001,200,640 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ntbackup.exe
[2019/03/07 18:56:55 | 000,713,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\opengl32.dll
[2019/03/07 18:56:55 | 000,488,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ntmsmgr.dll
[2019/03/07 18:56:55 | 000,420,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ntvdm.exe
[2019/03/07 18:56:55 | 000,313,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\p2pgraph.dll
[2019/03/07 18:56:55 | 000,286,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\objsel.dll
[2019/03/07 18:56:55 | 000,284,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\pdh.dll
[2019/03/07 18:56:55 | 000,278,559 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\odbcjt32.dll
[2019/03/07 18:56:55 | 000,270,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\oakley.dll
[2019/03/07 18:56:55 | 000,257,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\nusrmgr.cpl
[2019/03/07 18:56:55 | 000,249,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\odbc32.dll
[2019/03/07 18:56:55 | 000,215,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\osk.exe
[2019/03/07 18:56:55 | 000,192,000 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\offfilt.dll
[2019/03/07 18:56:55 | 000,179,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ntmsdba.dll
[2019/03/07 18:56:55 | 000,169,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ole2disp.dll
[2019/03/07 18:56:55 | 000,169,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ole2disp.dll
[2019/03/07 18:56:55 | 000,163,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\oleacc.dll
[2019/03/07 18:56:55 | 000,153,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\p2p.dll
[2019/03/07 18:56:55 | 000,153,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ole2nls.dll
[2019/03/07 18:56:55 | 000,153,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ole2nls.dll
[2019/03/07 18:56:55 | 000,147,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\odbctrac.dll
[2019/03/07 18:56:55 | 000,142,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\nwprovau.dll
[2019/03/07 18:56:55 | 000,135,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\odbcconf.dll
[2019/03/07 18:56:55 | 000,126,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\nwscript.exe
[2019/03/07 18:56:55 | 000,126,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nwscript.exe
[2019/03/07 18:56:55 | 000,122,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\oledlg.dll
[2019/03/07 18:56:55 | 000,115,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\p2pnetsh.dll
[2019/03/07 18:56:55 | 000,107,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\oleprn.dll
[2019/03/07 18:56:55 | 000,106,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\odbccp32.dll
[2019/03/07 18:56:55 | 000,105,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\p2pgasvc.dll
[2019/03/07 18:56:55 | 000,094,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\odbcint.dll
[2019/03/07 18:56:55 | 000,091,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ntprint.dll
[2019/03/07 18:56:55 | 000,088,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\nwlnkipx.sys
[2019/03/07 18:56:55 | 000,082,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\olecli.dll
[2019/03/07 18:56:55 | 000,082,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\olecli.dll
[2019/03/07 18:56:55 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\nslookup.exe
[2019/03/07 18:56:55 | 000,074,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\olecli32.dll
[2019/03/07 18:56:55 | 000,069,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\odbcconf.exe
[2019/03/07 18:56:55 | 000,069,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\olethk32.dll
[2019/03/07 18:56:55 | 000,069,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\olethk32.dll
[2019/03/07 18:56:55 | 000,067,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\pautoenr.dll
[2019/03/07 18:56:55 | 000,067,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ocmanage.dll
[2019/03/07 18:56:55 | 000,065,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\odbccu32.dll
[2019/03/07 18:56:55 | 000,065,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\odbccr32.dll
[2019/03/07 18:56:55 | 000,064,000 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\nwapi32.dll
[2019/03/07 18:56:55 | 000,063,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\nwlnknb.sys
[2019/03/07 18:56:55 | 000,063,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nwlnknb.sys
[2019/03/07 18:56:55 | 000,058,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\packager.exe
[2019/03/07 18:56:55 | 000,057,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ntlanui.dll
[2019/03/07 18:56:55 | 000,057,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntlanui.dll
[2019/03/07 18:56:55 | 000,055,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\nwlnkspx.sys
[2019/03/07 18:56:55 | 000,055,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nwlnkspx.sys
[2019/03/07 18:56:55 | 000,054,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\npptools.dll
[2019/03/07 18:56:55 | 000,053,279 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\odbcji32.dll
[2019/03/07 18:56:55 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\pngfilt.dll
[2019/03/07 18:56:55 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\pmspl.dll
[2019/03/07 18:56:55 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pmspl.dll
[2019/03/07 18:56:55 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ntlanman.dll
[2019/03/07 18:56:55 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ntmsapi.dll
[2019/03/07 18:56:55 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\perfctrs.dll
[2019/03/07 18:56:55 | 000,039,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ole2.dll
[2019/03/07 18:56:55 | 000,039,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ole2.dll
[2019/03/07 18:56:55 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\olecnv32.dll
[2019/03/07 18:56:55 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\nwc.cpl
[2019/03/07 18:56:55 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nwc.cpl
[2019/03/07 18:56:55 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ntsdexts.dll
[2019/03/07 18:56:55 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntsdexts.dll
[2019/03/07 18:56:55 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ntmsevt.dll
[2019/03/07 18:56:55 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntmsevt.dll
[2019/03/07 18:56:55 | 000,035,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\pifmgr.dll
[2019/03/07 18:56:55 | 000,035,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pifmgr.dll
[2019/03/07 18:56:55 | 000,034,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\perfproc.dll
[2019/03/07 18:56:55 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ping6.exe
[2019/03/07 18:56:55 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ping6.exe
[2019/03/07 18:56:55 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\odbccp32.cpl
[2019/03/07 18:56:55 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\odbcad32.exe
[2019/03/07 18:56:55 | 000,032,512 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nwlnkfwd.sys
[2019/03/07 18:56:55 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntsd.exe
[2019/03/07 18:56:55 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\plustab.dll
[2019/03/07 18:56:55 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\plustab.dll
[2019/03/07 18:56:55 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\perfdisk.dll
[2019/03/07 18:56:55 | 000,026,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\odbc16gt.dll
[2019/03/07 18:56:55 | 000,026,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\odbc16gt.dll
[2019/03/07 18:56:55 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ntdsbcli.dll
[2019/03/07 18:56:55 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntdsbcli.dll
[2019/03/07 18:56:55 | 000,025,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\perfos.dll
[2019/03/07 18:56:55 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\odbcbcp.dll
[2019/03/07 18:56:55 | 000,024,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\pidgen.dll
[2019/03/07 18:56:55 | 000,024,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\olesvr.dll
[2019/03/07 18:56:55 | 000,024,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\olesvr.dll
[2019/03/07 18:56:55 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\olesvr32.dll
[2019/03/07 18:56:55 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\olesvr32.dll
[2019/03/07 18:56:55 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\pathping.exe
[2019/03/07 18:56:55 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pathping.exe
[2019/03/07 18:56:55 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\nwcfg.dll
[2019/03/07 18:56:55 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nwcfg.dll
[2019/03/07 18:56:55 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ping.exe
[2019/03/07 18:56:55 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\perfnet.dll
[2019/03/07 18:56:55 | 000,017,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\nwapi16.dll
[2019/03/07 18:56:55 | 000,017,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nwapi16.dll
[2019/03/07 18:56:55 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\oleaccrc.dll
[2019/03/07 18:56:55 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\oleaccrc.dll
[2019/03/07 18:56:55 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\odbc32gt.dll
[2019/03/07 18:56:55 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\perfmon.exe
[2019/03/07 18:56:55 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ntvdmd.dll
[2019/03/07 18:56:55 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntlanui2.dll
[2019/03/07 18:56:55 | 000,012,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nwlnkflt.sys
[2019/03/07 18:56:55 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\perfts.dll
[2019/03/07 18:56:55 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\perfts.dll
[2019/03/07 18:56:55 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\odbcp32r.dll
[2019/03/07 18:56:55 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\panmap.dll
[2019/03/07 18:56:55 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\panmap.dll
[2019/03/07 18:56:55 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ntlsapi.dll
[2019/03/07 18:56:55 | 000,006,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\parvdm.sys
[2019/03/07 18:56:55 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\nwevent.dll
[2019/03/07 18:56:55 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nwevent.dll
[2019/03/07 18:56:55 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\perfnw.dll
[2019/03/07 18:56:55 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\perfnw.dll
[2019/03/07 18:56:55 | 000,002,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\null.sys
[2019/03/07 18:56:54 | 001,669,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msvidctl.dll
[2019/03/07 18:56:54 | 001,384,479 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msvbvm60.dll
[2019/03/07 18:56:54 | 001,355,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msvbvm50.dll
[2019/03/07 18:56:54 | 001,172,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msxml3.dll
[2019/03/07 18:56:54 | 000,838,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mswdat10.dll
[2019/03/07 18:56:54 | 000,838,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mswdat10.dll
[2019/03/07 18:56:54 | 000,701,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msxml2.dll
[2019/03/07 18:56:54 | 000,622,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\netcfgx.dll
[2019/03/07 18:56:54 | 000,621,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mswstr10.dll
[2019/03/07 18:56:54 | 000,621,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mswstr10.dll
[2019/03/07 18:56:54 | 000,611,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mstime.dll
[2019/03/07 18:56:54 | 000,565,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msvcp50.dll
[2019/03/07 18:56:54 | 000,565,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msvcp50.dll
[2019/03/07 18:56:54 | 000,506,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msxml.dll
[2019/03/07 18:56:54 | 000,413,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msvcp60.dll
[2019/03/07 18:56:54 | 000,407,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\netlogon.dll
[2019/03/07 18:56:54 | 000,322,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msrd3x40.dll
[2019/03/07 18:56:54 | 000,322,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msrd3x40.dll
[2019/03/07 18:56:54 | 000,308,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\netui2.dll
[2019/03/07 18:56:54 | 000,308,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\netui2.dll
[2019/03/07 18:56:54 | 000,253,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\neth.dll
[2019/03/07 18:56:54 | 000,253,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\neth.dll
[2019/03/07 18:56:54 | 000,247,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\newdev.dll
[2019/03/07 18:56:54 | 000,245,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\netui1.dll
[2019/03/07 18:56:54 | 000,214,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\netevent.dll
[2019/03/07 18:56:54 | 000,214,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\netevent.dll
[2019/03/07 18:56:54 | 000,204,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mswebdvd.dll
[2019/03/07 18:56:54 | 000,193,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msrating.dll
[2019/03/07 18:56:54 | 000,171,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\netmsg.dll
[2019/03/07 18:56:54 | 000,171,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\netmsg.dll
[2019/03/07 18:56:54 | 000,143,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msorcl32.dll
[2019/03/07 18:56:54 | 000,139,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\netid.dll
[2019/03/07 18:56:54 | 000,134,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mssap.dll
[2019/03/07 18:56:54 | 000,126,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\netfxocm.dll
[2019/03/07 18:56:54 | 000,126,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msvideo.dll
[2019/03/07 18:56:54 | 000,126,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msvideo.dll
[2019/03/07 18:56:54 | 000,124,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\net1.exe
[2019/03/07 18:56:54 | 000,121,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msvfw32.dll
[2019/03/07 18:56:54 | 000,116,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mstlsapi.dll
[2019/03/07 18:56:54 | 000,110,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msscript.ocx
[2019/03/07 18:56:54 | 000,108,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\netapi.dll
[2019/03/07 18:56:54 | 000,108,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\netapi.dll
[2019/03/07 18:56:54 | 000,098,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\nlhtml.dll
[2019/03/07 18:56:54 | 000,090,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mycomput.dll
[2019/03/07 18:56:54 | 000,090,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mycomput.dll
[2019/03/07 18:56:54 | 000,086,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\netsh.exe
[2019/03/07 18:56:54 | 000,080,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\netui0.dll
[2019/03/07 18:56:54 | 000,074,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msw3prt.dll
[2019/03/07 18:56:54 | 000,066,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mtxclu.dll
[2019/03/07 18:56:54 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msvcrt40.dll
[2019/03/07 18:56:54 | 000,060,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msratelc.dll
[2019/03/07 18:56:54 | 000,060,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msratelc.dll
[2019/03/07 18:56:54 | 000,057,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msvcirt.dll
[2019/03/07 18:56:54 | 000,056,832 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ndptsp.tsp
[2019/03/07 18:56:54 | 000,053,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\narrator.exe
[2019/03/07 18:56:54 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msprivs.dll
[2019/03/07 18:56:54 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msxml3r.dll
[2019/03/07 18:56:54 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msxml3r.dll
[2019/03/07 18:56:54 | 000,042,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\net.exe
[2019/03/07 18:56:54 | 000,041,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msports.dll
[2019/03/07 18:56:54 | 000,041,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msports.dll
[2019/03/07 18:56:54 | 000,040,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\nmnt.sys
[2019/03/07 18:56:54 | 000,037,916 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msxml2r.dll
[2019/03/07 18:56:54 | 000,037,916 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msxml2r.dll
[2019/03/07 18:56:54 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\netstat.exe
[2019/03/07 18:56:54 | 000,036,352 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ncobjapi.dll
[2019/03/07 18:56:54 | 000,035,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ncpa.cpl
[2019/03/07 18:56:54 | 000,035,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ncpa.cpl
[2019/03/07 18:56:54 | 000,035,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\narrhook.dll
[2019/03/07 18:56:54 | 000,035,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\narrhook.dll
[2019/03/07 18:56:54 | 000,035,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mssign32.dll
[2019/03/07 18:56:54 | 000,035,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mssign32.dll
[2019/03/07 18:56:54 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msobjs.dll
[2019/03/07 18:56:54 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msobjs.dll
[2019/03/07 18:56:54 | 000,029,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mspatcha.dll
[2019/03/07 18:56:54 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msvidc32.dll
[2019/03/07 18:56:54 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msxmlr.dll
[2019/03/07 18:56:54 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msxmlr.dll
[2019/03/07 18:56:54 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\netsetup.cpl
[2019/03/07 18:56:54 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\nbtstat.exe
[2019/03/07 18:56:54 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\nbtstat.exe
[2019/03/07 18:56:54 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msorc32r.dll
[2019/03/07 18:56:54 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\nddenb32.dll
[2019/03/07 18:56:54 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\nddeapi.dll
[2019/03/07 18:56:54 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msswch.dll
[2019/03/07 18:56:54 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msswch.dll
[2019/03/07 18:56:54 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\netrap.dll
[2019/03/07 18:56:54 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ncxpnt.dll
[2019/03/07 18:56:54 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ncxpnt.dll
[2019/03/07 18:56:54 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msswchx.exe
[2019/03/07 18:56:54 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msswchx.exe
[2019/03/07 18:56:54 | 000,004,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mssip32.dll
[2019/03/07 18:56:54 | 000,004,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mssip32.dll
[2019/03/07 18:56:54 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\nddeapir.exe
[2019/03/07 18:56:53 | 001,872,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mmcndmgr.dll
[2019/03/07 18:56:53 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mshtml.tlb
[2019/03/07 18:56:53 | 001,516,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msjet40.dll
[2019/03/07 18:56:53 | 001,516,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msjet40.dll
[2019/03/07 18:56:53 | 001,414,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mmc.exe
[2019/03/07 18:56:53 | 000,997,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msgina.dll
[2019/03/07 18:56:53 | 000,974,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mfc42u.dll
[2019/03/07 18:56:53 | 000,974,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc42u.dll
[2019/03/07 18:56:53 | 000,974,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mfc42.dll
[2019/03/07 18:56:53 | 000,954,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mfc40.dll
[2019/03/07 18:56:53 | 000,954,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc40.dll
[2019/03/07 18:56:53 | 000,953,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mfc40u.dll
[2019/03/07 18:56:53 | 000,884,736 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msimsg.dll
[2019/03/07 18:56:53 | 000,661,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mqqm.dll
[2019/03/07 18:56:53 | 000,661,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mqqm.dll
[2019/03/07 18:56:53 | 000,586,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mlang.dll
[2019/03/07 18:56:53 | 000,517,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mqsnap.dll
[2019/03/07 18:56:53 | 000,517,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mqsnap.dll
[2019/03/07 18:56:53 | 000,471,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mqutil.dll
[2019/03/07 18:56:53 | 000,471,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mqutil.dll
[2019/03/07 18:56:53 | 000,362,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\metal_ss.dll
[2019/03/07 18:56:53 | 000,271,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msihnd.dll
[2019/03/07 18:56:53 | 000,248,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msjtes40.dll
[2019/03/07 18:56:53 | 000,248,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msjtes40.dll
[2019/03/07 18:56:53 | 000,225,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mqoa.dll
[2019/03/07 18:56:53 | 000,225,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mqoa.dll
[2019/03/07 18:56:53 | 000,216,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\moricons.dll
[2019/03/07 18:56:53 | 000,186,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mqtrig.dll
[2019/03/07 18:56:53 | 000,186,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mqtrig.dll
[2019/03/07 18:56:53 | 000,177,152 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mqrt.dll
[2019/03/07 18:56:53 | 000,177,152 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mqrt.dll
[2019/03/07 18:56:53 | 000,169,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msmqocm.dll
[2019/03/07 18:56:53 | 000,163,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mmcbase.dll
[2019/03/07 18:56:53 | 000,156,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msls31.dll
[2019/03/07 18:56:53 | 000,156,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msls31.dll
[2019/03/07 18:56:53 | 000,153,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\modemui.dll
[2019/03/07 18:56:53 | 000,151,583 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msjint40.dll
[2019/03/07 18:56:53 | 000,151,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msdart.dll
[2019/03/07 18:56:53 | 000,138,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mqad.dll
[2019/03/07 18:56:53 | 000,138,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mqad.dll
[2019/03/07 18:56:53 | 000,123,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mqrtdep.dll
[2019/03/07 18:56:53 | 000,123,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mqrtdep.dll
[2019/03/07 18:56:53 | 000,119,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mmutilse.dll
[2019/03/07 18:56:53 | 000,119,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mmutilse.dll
[2019/03/07 18:56:53 | 000,118,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msdadiag.dll
[2019/03/07 18:56:53 | 000,117,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mqtgsvc.exe
[2019/03/07 18:56:53 | 000,102,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msaatext.dll
[2019/03/07 18:56:53 | 000,102,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msaatext.dll
[2019/03/07 18:56:53 | 000,099,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mprmsg.dll
[2019/03/07 18:56:53 | 000,099,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mprmsg.dll
[2019/03/07 18:56:53 | 000,095,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mqsec.dll
[2019/03/07 18:56:53 | 000,095,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mqsec.dll
[2019/03/07 18:56:53 | 000,091,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\mqac.sys
[2019/03/07 18:56:53 | 000,091,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mqac.sys
[2019/03/07 18:56:53 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mqlogmgr.dll
[2019/03/07 18:56:53 | 000,087,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mprapi.dll
[2019/03/07 18:56:53 | 000,081,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mqoa.tlb
[2019/03/07 18:56:53 | 000,081,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mqoa.tlb
[2019/03/07 18:56:53 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mscms.dll
[2019/03/07 18:56:53 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msacm32.dll
[2019/03/07 18:56:53 | 000,069,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mprddm.dll
[2019/03/07 18:56:53 | 000,069,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mprddm.dll
[2019/03/07 18:56:53 | 000,068,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mmsystem.dll
[2019/03/07 18:56:53 | 000,068,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mmsystem.dll
[2019/03/07 18:56:53 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msaudite.dll
[2019/03/07 18:56:53 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msaudite.dll
[2019/03/07 18:56:53 | 000,061,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msacm.dll
[2019/03/07 18:56:53 | 000,061,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msacm.dll
[2019/03/07 18:56:53 | 000,060,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mqgentr.dll
[2019/03/07 18:56:53 | 000,060,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mqgentr.dll
[2019/03/07 18:56:53 | 000,060,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\miglibnt.dll
[2019/03/07 18:56:53 | 000,060,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msjter40.dll
[2019/03/07 18:56:53 | 000,060,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msjter40.dll
[2019/03/07 18:56:53 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mqoa20.tlb
[2019/03/07 18:56:53 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mqoa20.tlb
[2019/03/07 18:56:53 | 000,051,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msident.dll
[2019/03/07 18:56:53 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mqupgrd.dll
[2019/03/07 18:56:53 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mqupgrd.dll
[2019/03/07 18:56:53 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mshtmler.dll
[2019/03/07 18:56:53 | 000,047,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mqdscli.dll
[2019/03/07 18:56:53 | 000,047,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mqdscli.dll
[2019/03/07 18:56:53 | 000,047,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mprui.dll
[2019/03/07 18:56:53 | 000,047,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mprui.dll
[2019/03/07 18:56:53 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mf3216.dll
[2019/03/07 18:56:53 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mscpxl32.dll
[2019/03/07 18:56:53 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mqoa10.tlb
[2019/03/07 18:56:53 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mqoa10.tlb
[2019/03/07 18:56:53 | 000,029,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mimefilt.dll
[2019/03/07 18:56:53 | 000,022,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mfcsubs.dll
[2019/03/07 18:56:53 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mpnotify.exe
[2019/03/07 18:56:53 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mpnotify.exe
[2019/03/07 18:56:53 | 000,019,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mqbkup.exe
[2019/03/07 18:56:53 | 000,019,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mqbkup.exe
[2019/03/07 18:56:53 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mode.com
[2019/03/07 18:56:53 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mqise.dll
[2019/03/07 18:56:53 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mqise.dll
[2019/03/07 18:56:53 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\more.com
[2019/03/07 18:56:53 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msisip.dll
[2019/03/07 18:56:53 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msidntld.dll
[2019/03/07 18:56:53 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msidntld.dll
[2019/03/07 18:56:53 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mgmtapi.dll
[2019/03/07 18:56:53 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mrinfo.exe
[2019/03/07 18:56:53 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mrinfo.exe
[2019/03/07 18:56:53 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msdatsrc.tlb
[2019/03/07 18:56:53 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mscpx32r.dll
[2019/03/07 18:56:53 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mmdrv.dll
[2019/03/07 18:56:53 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mmdrv.dll
[2019/03/07 18:56:53 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mqcertui.dll
[2019/03/07 18:56:53 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mqcertui.dll
[2019/03/07 18:56:53 | 000,010,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\modex.dll
[2019/03/07 18:56:53 | 000,010,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\modex.dll
[2019/03/07 18:56:53 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\modern.fon
[2019/03/07 18:56:53 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mqperf.dll
[2019/03/07 18:56:53 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mqperf.dll
[2019/03/07 18:56:53 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mountvol.exe
[2019/03/07 18:56:53 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mountvol.exe
[2019/03/07 18:56:53 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mll_mtf.dll
[2019/03/07 18:56:53 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mll_mtf.dll
[2019/03/07 18:56:53 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mscat32.dll
[2019/03/07 18:56:53 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mscat32.dll
[2019/03/07 18:56:53 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msidle.dll
[2019/03/07 18:56:53 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mll_qic.dll
[2019/03/07 18:56:53 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mll_qic.dll
[2019/03/07 18:56:53 | 000,004,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mqsvc.exe
[2019/03/07 18:56:53 | 000,003,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\msafd.dll
[2019/03/07 18:56:53 | 000,003,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mll_hp.dll
[2019/03/07 18:56:53 | 000,003,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mll_hp.dll
[2019/03/07 18:56:53 | 000,002,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mouse.drv
[2019/03/07 18:56:53 | 000,002,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mouse.drv
[2019/03/07 18:56:53 | 000,001,152 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mmtask.tsk
[2019/03/07 18:56:53 | 000,001,152 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mmtask.tsk
[2019/03/07 18:56:52 | 000,730,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\lsasrv.dll
[2019/03/07 18:56:52 | 000,423,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\licdll.dll
[2019/03/07 18:56:52 | 000,345,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\localspl.dll
[2019/03/07 18:56:52 | 000,221,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\localsec.dll
[2019/03/07 18:56:52 | 000,221,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\lanman.drv
[2019/03/07 18:56:52 | 000,220,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\logon.scr
[2019/03/07 18:56:52 | 000,187,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\main.cpl
[2019/03/07 18:56:52 | 000,187,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\main.cpl
[2019/03/07 18:56:52 | 000,150,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\keymgr.dll
[2019/03/07 18:56:52 | 000,118,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mdminst.dll
[2019/03/07 18:56:52 | 000,112,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mapistub.dll
[2019/03/07 18:56:52 | 000,097,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\loadperf.dll
[2019/03/07 18:56:52 | 000,089,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\langwrbk.dll
[2019/03/07 18:56:52 | 000,089,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\langwrbk.dll
[2019/03/07 18:56:52 | 000,084,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mciavi32.dll
[2019/03/07 18:56:52 | 000,073,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mciavi.drv
[2019/03/07 18:56:52 | 000,073,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mciavi.drv
[2019/03/07 18:56:52 | 000,072,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\magnify.exe
[2019/03/07 18:56:52 | 000,059,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\logman.exe
[2019/03/07 18:56:52 | 000,057,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\makecab.exe
[2019/03/07 18:56:52 | 000,050,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mdhcp.dll
[2019/03/07 18:56:52 | 000,050,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mdhcp.dll
[2019/03/07 18:56:52 | 000,050,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\loghours.dll
[2019/03/07 18:56:52 | 000,050,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\loghours.dll
[2019/03/07 18:56:52 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\licmgr10.dll
[2019/03/07 18:56:52 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kmddsp.tsp
[2019/03/07 18:56:52 | 000,029,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\lights.exe
[2019/03/07 18:56:52 | 000,029,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lights.exe
[2019/03/07 18:56:52 | 000,028,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mciwave.drv
[2019/03/07 18:56:52 | 000,028,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mciwave.drv
[2019/03/07 18:56:52 | 000,025,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mciseq.drv
[2019/03/07 18:56:52 | 000,025,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mciseq.drv
[2019/03/07 18:56:52 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mciwave.dll
[2019/03/07 18:56:52 | 000,023,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mciseq.dll
[2019/03/07 18:56:52 | 000,017,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mcicda.dll
[2019/03/07 18:56:52 | 000,017,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mcicda.dll
[2019/03/07 18:56:52 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mcastmib.dll
[2019/03/07 18:56:52 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\localui.dll
[2019/03/07 18:56:52 | 000,010,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mcdsrv32.dll
[2019/03/07 18:56:52 | 000,010,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mcdsrv32.dll
[2019/03/07 18:56:52 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mcd32.dll
[2019/03/07 18:56:52 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mcd32.dll
[2019/03/07 18:56:52 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\lprhelp.dll
[2019/03/07 18:56:52 | 000,009,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\lzexpand.dll
[2019/03/07 18:56:52 | 000,009,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lzexpand.dll
[2019/03/07 18:56:52 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\label.exe
[2019/03/07 18:56:52 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\label.exe
[2019/03/07 18:56:52 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\lprmonui.dll
[2019/03/07 18:56:52 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lprmonui.dll
[2019/03/07 18:56:52 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mciole16.dll
[2019/03/07 18:56:52 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mciole16.dll
[2019/03/07 18:56:52 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mag_hook.dll
[2019/03/07 18:56:52 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mag_hook.dll
[2019/03/07 18:56:52 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\lpr.exe
[2019/03/07 18:56:52 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lpr.exe
[2019/03/07 18:56:52 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mciole32.dll
[2019/03/07 18:56:52 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mciole32.dll
[2019/03/07 18:56:52 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\mcd.sys
[2019/03/07 18:56:52 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mcd.sys
[2019/03/07 18:56:52 | 000,007,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kd1394.dll
[2019/03/07 18:56:52 | 000,007,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kdcom.dll
[2019/03/07 18:56:52 | 000,007,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kdcom.dll
[2019/03/07 18:56:52 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\lpq.exe
[2019/03/07 18:56:52 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lpq.exe
[2019/03/07 18:56:52 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\lodctr.exe
[2019/03/07 18:56:52 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lodctr.exe
[2019/03/07 18:56:52 | 000,004,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mchgrcoi.dll
[2019/03/07 18:56:52 | 000,004,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mchgrcoi.dll
[2019/03/07 18:56:52 | 000,002,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\lz32.dll
[2019/03/07 18:56:52 | 000,002,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lz32.dll
[2019/03/07 18:56:52 | 000,002,000 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\keyboard.drv
[2019/03/07 18:56:52 | 000,002,000 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\keyboard.drv
[2019/03/07 18:56:51 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\inetcpl.cpl
[2019/03/07 18:56:51 | 000,726,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\jscript.dll
[2019/03/07 18:56:51 | 000,614,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\h323msp.dll
[2019/03/07 18:56:51 | 000,545,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\hhctrl.ocx
[2019/03/07 18:56:51 | 000,450,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\infosoft.dll
[2019/03/07 18:56:51 | 000,450,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\infosoft.dll
[2019/03/07 18:56:51 | 000,387,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\iedkcs32.dll
[2019/03/07 18:56:51 | 000,385,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\html.iec
[2019/03/07 18:56:51 | 000,384,000 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ipsmsnap.dll
[2019/03/07 18:56:51 | 000,362,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\jet500.dll
[2019/03/07 18:56:51 | 000,362,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\jet500.dll
[2019/03/07 18:56:51 | 000,362,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\home_ss.dll
[2019/03/07 18:56:51 | 000,349,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ipsecsnp.dll
[2019/03/07 18:56:51 | 000,344,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\hnetcfg.dll
[2019/03/07 18:56:51 | 000,330,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ippromon.dll
[2019/03/07 18:56:51 | 000,330,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\hnetwiz.dll
[2019/03/07 18:56:51 | 000,329,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\netsetup.exe
[2019/03/07 18:56:51 | 000,265,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\h323.tsp
[2019/03/07 18:56:51 | 000,254,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\icm32.dll
[2019/03/07 18:56:51 | 000,247,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\iassdo.dll
[2019/03/07 18:56:51 | 000,247,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iassdo.dll
[2019/03/07 18:56:51 | 000,229,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ieaksie.dll
[2019/03/07 18:56:51 | 000,198,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\iuengine.dll
[2019/03/07 18:56:51 | 000,198,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iuengine.dll
[2019/03/07 18:56:51 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\iepeers.dll
[2019/03/07 18:56:51 | 000,177,152 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\iprtrmgr.dll
[2019/03/07 18:56:51 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ie4uinit.exe
[2019/03/07 18:56:51 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ieakui.dll
[2019/03/07 18:56:51 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieakui.dll
[2019/03/07 18:56:51 | 000,163,840 | —- | C] (America Online) – C:\WINDOWS\System32\jgdw400.dll
[2019/03/07 18:56:51 | 000,161,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ipmontr.dll
[2019/03/07 18:56:51 | 000,155,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\itircl.dll
[2019/03/07 18:56:51 | 000,155,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\hdwwiz.cpl
[2019/03/07 18:56:51 | 000,147,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\initpki.dll
[2019/03/07 18:56:51 | 000,144,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\hotplug.dll
[2019/03/07 18:56:51 | 000,141,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\iasrecst.dll
[2019/03/07 18:56:51 | 000,141,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iasrecst.dll
[2019/03/07 18:56:51 | 000,135,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ifmon.dll
[2019/03/07 18:56:51 | 000,129,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\intl.cpl
[2019/03/07 18:56:51 | 000,125,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ieakeng.dll
[2019/03/07 18:56:51 | 000,123,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\input.dll
[2019/03/07 18:56:51 | 000,120,832 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\idq.dll
[2019/03/07 18:56:51 | 000,119,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\iasrad.dll
[2019/03/07 18:56:51 | 000,114,688 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\iexpress.exe
[2019/03/07 18:56:51 | 000,110,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\inetcplc.dll
[2019/03/07 18:56:51 | 000,110,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetcplc.dll
[2019/03/07 18:56:51 | 000,094,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\iphlpapi.dll
[2019/03/07 18:56:51 | 000,094,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\inseng.dll
[2019/03/07 18:56:51 | 000,087,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hhctrlui.dll
[2019/03/07 18:56:51 | 000,086,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\iassam.dll
[2019/03/07 18:56:51 | 000,086,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iassam.dll
[2019/03/07 18:56:51 | 000,083,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ipxmontr.dll
[2019/03/07 18:56:51 | 000,083,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ipxmontr.dll
[2019/03/07 18:56:51 | 000,080,384 | —- | C] (Radius Inc.) – C:\WINDOWS\System32\iccvid.dll
[2019/03/07 18:56:51 | 000,075,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\inetpp.dll
[2019/03/07 18:56:51 | 000,072,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\hlink.dll
[2019/03/07 18:56:51 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\iesetup.dll
[2019/03/07 18:56:51 | 000,070,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ifsutil.dll
[2019/03/07 18:56:51 | 000,070,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ifsutil.dll
[2019/03/07 18:56:51 | 000,069,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ipxpromn.dll
[2019/03/07 18:56:51 | 000,069,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ipxpromn.dll
[2019/03/07 18:56:51 | 000,068,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\joy.cpl
[2019/03/07 18:56:51 | 000,066,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ipxsap.dll
[2019/03/07 18:56:51 | 000,065,536 | —- | C] (Johnson-Grace Company) – C:\WINDOWS\System32\jgsh400.dll
[2019/03/07 18:56:51 | 000,062,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\iasnap.dll
[2019/03/07 18:56:51 | 000,062,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iasnap.dll
[2019/03/07 18:56:51 | 000,059,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ipv6mon.dll
[2019/03/07 18:56:51 | 000,059,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\iassvcs.dll
[2019/03/07 18:56:51 | 000,059,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iassvcs.dll
[2019/03/07 18:56:51 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ipconfig.exe
[2019/03/07 18:56:51 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\iernonce.dll
[2019/03/07 18:56:51 | 000,054,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icmui.dll
[2019/03/07 18:56:51 | 000,054,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ixsso.dll
[2019/03/07 18:56:51 | 000,053,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ipv6.exe
[2019/03/07 18:56:51 | 000,047,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\jobexec.dll
[2019/03/07 18:56:51 | 000,047,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\jobexec.dll
[2019/03/07 18:56:51 | 000,045,568 | —- | C] (America Online) – C:\WINDOWS\System32\jgsd400.dll
[2019/03/07 18:56:51 | 000,044,544 | —- | C] (Johnson-Grace Company) – C:\WINDOWS\System32\jgaw400.dll
[2019/03/07 18:56:51 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ipsec6.exe
[2019/03/07 18:56:51 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ipsec6.exe
[2019/03/07 18:56:51 | 000,041,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\htui.dll
[2019/03/07 18:56:51 | 000,041,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\iasads.dll
[2019/03/07 18:56:51 | 000,041,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iasads.dll
[2019/03/07 18:56:51 | 000,041,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\hhsetup.dll
[2019/03/07 18:56:51 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ipxrtmgr.dll
[2019/03/07 18:56:51 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ipxrtmgr.dll
[2019/03/07 18:56:51 | 000,036,921 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\imeshare.dll
[2019/03/07 18:56:51 | 000,035,840 | —- | C] (Johnson-Grace Company) – C:\WINDOWS\System32\jgmd400.dll
[2019/03/07 18:56:51 | 000,034,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\imgutil.dll
[2019/03/07 18:56:51 | 000,032,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ipfltdrv.sys
[2019/03/07 18:56:51 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\inetmib1.dll
[2019/03/07 18:56:51 | 000,032,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\iashlpr.dll
[2019/03/07 18:56:51 | 000,032,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iashlpr.dll
[2019/03/07 18:56:51 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\iologmsg.dll
[2019/03/07 18:56:51 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iologmsg.dll
[2019/03/07 18:56:51 | 000,029,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\hidphone.tsp
[2019/03/07 18:56:51 | 000,027,648 | —- | C] (Johnson-Grace Company) – C:\WINDOWS\System32\jgpl400.dll
[2019/03/07 18:56:51 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\jsproxy.dll
[2019/03/07 18:56:51 | 000,025,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\httpapi.dll
[2019/03/07 18:56:51 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ipxroute.exe
[2019/03/07 18:56:51 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\iasacct.dll
[2019/03/07 18:56:51 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iasacct.dll
[2019/03/07 18:56:51 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ipxwan.dll
[2019/03/07 18:56:51 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ipxrip.dll
[2019/03/07 18:56:51 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ipxrip.dll
[2019/03/07 18:56:51 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\iaspolcy.dll
[2019/03/07 18:56:51 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iaspolcy.dll
[2019/03/07 18:56:51 | 000,017,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ipconf.tsp
[2019/03/07 18:56:51 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\inetppui.dll
[2019/03/07 18:56:51 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\help.exe
[2019/03/07 18:56:51 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\hnetmon.dll
[2019/03/07 18:56:51 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hnetmon.dll
[2019/03/07 18:56:51 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\iissuba.dll
[2019/03/07 18:56:51 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iissuba.dll
[2019/03/07 18:56:51 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdhept.dll
[2019/03/07 18:56:51 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhept.dll
[2019/03/07 18:56:51 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\igmpagnt.dll
[2019/03/07 18:56:51 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdsmsno.dll
[2019/03/07 18:56:51 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdsmsfi.dll
[2019/03/07 18:56:51 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdcan.dll
[2019/03/07 18:56:51 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdcan.dll
[2019/03/07 18:56:51 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\hostname.exe
[2019/03/07 18:56:51 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\hostname.exe
[2019/03/07 18:56:51 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdukx.dll
[2019/03/07 18:56:51 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdno1.dll
[2019/03/07 18:56:51 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdnec.dll
[2019/03/07 18:56:51 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdfi1.dll
[2019/03/07 18:56:51 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdcz.dll
[2019/03/07 18:56:51 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdcz.dll
[2019/03/07 18:56:51 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdsg.dll
[2019/03/07 18:56:51 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdsg.dll
[2019/03/07 18:56:51 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdpl.dll
[2019/03/07 18:56:51 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdpl.dll
[2019/03/07 18:56:51 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdla.dll
[2019/03/07 18:56:51 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdla.dll
[2019/03/07 18:56:51 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdhu.dll
[2019/03/07 18:56:51 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhu.dll
[2019/03/07 18:56:51 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdhela3.dll
[2019/03/07 18:56:51 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhela3.dll
[2019/03/07 18:56:51 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdcz2.dll
[2019/03/07 18:56:51 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdcz2.dll
[2019/03/07 18:56:51 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdcz1.dll
[2019/03/07 18:56:51 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdcz1.dll
[2019/03/07 18:56:51 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdcr.dll
[2019/03/07 18:56:51 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdcr.dll
[2019/03/07 18:56:51 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\KBDAL.DLL
[2019/03/07 18:56:51 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdal.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdusx.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdusx.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdusr.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdusr.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdusl.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdusl.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdsw.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdsw.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdsp.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdsp.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdsf.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdsf.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdpo.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdpo.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdno.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdno.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdne.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdne.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdmlt48.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdmlt47.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdmac.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdmac.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdlv1.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdlv1.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdlv.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdlv.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdic.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdic.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdhela2.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhela2.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdgr1.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdgr1.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdgr.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdgr.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdgkl.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdgkl.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdfr.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdfr.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdfo.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdfo.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdfi.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdfi.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdfc.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdfc.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdest.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdest.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdes.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdes.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdda.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdda.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdca.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdca.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdbr.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdbr.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdbene.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdbene.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdbe.dll
[2019/03/07 18:56:51 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdbe.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdus.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdus.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdur.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdur.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbduk.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbduk.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdpl1.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdpl1.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdmon.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdmon.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdmaori.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdlt1.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdlt1.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdlt.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdlt.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdkyr.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdkyr.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdkaz.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdkaz.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdit142.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdit142.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdit.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdit.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdir.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdir.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdhu1.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhu1.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdhe319.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhe319.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdhe220.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhe220.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdhe.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdhe.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdgae.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdgae.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdbu.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdbu.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdblr.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdblr.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdazel.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdazel.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbdaze.dll
[2019/03/07 18:56:51 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdaze.dll
[2019/03/07 18:56:51 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdgeo.dll
[2019/03/07 18:56:51 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\kbddv.dll
[2019/03/07 18:56:51 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbddv.dll
[2019/03/07 18:56:51 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdarmw.dll
[2019/03/07 18:56:51 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\kbdarme.dll
[2019/03/07 18:56:51 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\iprtprio.dll
[2019/03/07 18:56:51 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iprtprio.dll
[2019/03/07 18:56:51 | 000,003,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\iprop.dll
[2019/03/07 18:56:51 | 000,003,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iprop.dll
[2019/03/07 18:56:51 | 000,003,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\icmp.dll
[2019/03/07 18:56:50 | 002,113,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dxdiagn.dll
[2019/03/07 18:56:50 | 001,298,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dxdiag.exe
[2019/03/07 18:56:50 | 001,293,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dsound3d.dll
[2019/03/07 18:56:50 | 001,227,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dx8vb.dll
[2019/03/07 18:56:50 | 001,114,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\esent97.dll
[2019/03/07 18:56:50 | 001,114,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\esent97.dll
[2019/03/07 18:56:50 | 001,082,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\esent.dll
[2019/03/07 18:56:50 | 000,619,008 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dx7vb.dll
[2019/03/07 18:56:50 | 000,566,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\gpedit.dll
[2019/03/07 18:56:50 | 000,380,445 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\expsrv.dll
[2019/03/07 18:56:50 | 000,367,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dsound.dll
[2019/03/07 18:56:50 | 000,348,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dxtmsft.dll
[2019/03/07 18:56:50 | 000,337,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\filemgmt.dll
[2019/03/07 18:56:50 | 000,304,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\duser.dll
[2019/03/07 18:56:50 | 000,285,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\glmf32.dll
[2019/03/07 18:56:50 | 000,285,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\glmf32.dll
[2019/03/07 18:56:50 | 000,216,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dxtrans.dll
[2019/03/07 18:56:50 | 000,199,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\gptext.dll
[2019/03/07 18:56:50 | 000,193,024 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\eudcedit.exe
[2019/03/07 18:56:50 | 000,183,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\els.dll
[2019/03/07 18:56:50 | 000,181,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dsdmo.dll
[2019/03/07 18:56:50 | 000,180,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dwwin.exe
[2019/03/07 18:56:50 | 000,176,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ftsrch.dll
[2019/03/07 18:56:50 | 000,176,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ftsrch.dll
[2019/03/07 18:56:50 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dsprop.dll
[2019/03/07 18:56:50 | 000,138,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dssenh.dll
[2019/03/07 18:56:50 | 000,125,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\exts.dll
[2019/03/07 18:56:50 | 000,124,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\fde.dll
[2019/03/07 18:56:50 | 000,122,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\glu32.dll
[2019/03/07 18:56:50 | 000,120,832 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\gpresult.exe
[2019/03/07 18:56:50 | 000,101,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\gpkcsp.dll
[2019/03/07 18:56:50 | 000,101,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\gpkcsp.dll
[2019/03/07 18:56:50 | 000,092,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dskquota.dll
[2019/03/07 18:56:50 | 000,087,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\fldrclnr.dll
[2019/03/07 18:56:50 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\fontsub.dll
[2019/03/07 18:56:50 | 000,081,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\fsusd.dll
[2019/03/07 18:56:50 | 000,081,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fsusd.dll
[2019/03/07 18:56:50 | 000,080,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\firewall.cpl
[2019/03/07 18:56:50 | 000,080,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\faultrep.dll
[2019/03/07 18:56:50 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\gcdef.dll
[2019/03/07 18:56:50 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\gcdef.dll
[2019/03/07 18:56:50 | 000,073,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\fdeploy.dll
[2019/03/07 18:56:50 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dsdmoprp.dll
[2019/03/07 18:56:50 | 000,062,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dsauth.dll
[2019/03/07 18:56:50 | 000,062,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dsauth.dll
[2019/03/07 18:56:50 | 000,060,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\fwcfg.dll
[2019/03/07 18:56:50 | 000,059,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\getmac.exe
[2019/03/07 18:56:50 | 000,056,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\fsutil.exe
[2019/03/07 18:56:50 | 000,056,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fsutil.exe
[2019/03/07 18:56:50 | 000,056,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\eventlog.dll
[2019/03/07 18:56:50 | 000,055,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dwil1033.dll
[2019/03/07 18:56:50 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drwtsn32.exe
[2019/03/07 18:56:50 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\drwtsn32.exe
[2019/03/07 18:56:50 | 000,042,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ftp.exe
[2019/03/07 18:56:50 | 000,041,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\g711codc.ax
[2019/03/07 18:56:50 | 000,041,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\g711codc.ax
[2019/03/07 18:56:50 | 000,039,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\grpconv.exe
[2019/03/07 18:56:50 | 000,039,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\esentutl.exe
[2019/03/07 18:56:50 | 000,039,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\esentutl.exe
[2019/03/07 18:56:50 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\eventcls.dll
[2019/03/07 18:56:50 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\eventcls.dll
[2019/03/07 18:56:50 | 000,029,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\format.com
[2019/03/07 18:56:50 | 000,028,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drwatson.exe
[2019/03/07 18:56:50 | 000,028,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\drwatson.exe
[2019/03/07 18:56:50 | 000,027,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\findstr.exe
[2019/03/07 18:56:50 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\efsadu.dll
[2019/03/07 18:56:50 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\graftabl.com
[2019/03/07 18:56:50 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\gdi.exe
[2019/03/07 18:56:50 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\gdi.exe
[2019/03/07 18:56:50 | 000,024,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\extrac32.exe
[2019/03/07 18:56:50 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\feclient.dll
[2019/03/07 18:56:50 | 000,020,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\fontview.exe
[2019/03/07 18:56:50 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\encapi.dll
[2019/03/07 18:56:50 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dswave.dll
[2019/03/07 18:56:50 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dvdupgrd.exe
[2019/03/07 18:56:50 | 000,017,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\esentprf.dll
[2019/03/07 18:56:50 | 000,017,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\esentprf.dll
[2019/03/07 18:56:50 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\fmifs.dll
[2019/03/07 18:56:50 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fmifs.dll
[2019/03/07 18:56:50 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ds32gt.dll
[2019/03/07 18:56:50 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\expand.exe
[2019/03/07 18:56:50 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\expand.exe
[2019/03/07 18:56:50 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\fc.exe
[2019/03/07 18:56:50 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fc.exe
[2019/03/07 18:56:50 | 000,010,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\dxapi.sys
[2019/03/07 18:56:50 | 000,010,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dxapi.sys
[2019/03/07 18:56:50 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\gpkrsrc.dll
[2019/03/07 18:56:50 | 000,009,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\framebuf.dll
[2019/03/07 18:56:50 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\finger.exe
[2019/03/07 18:56:50 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\finger.exe
[2019/03/07 18:56:50 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\find.exe
[2019/03/07 18:56:50 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\find.exe
[2019/03/07 18:56:50 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\eventvwr.exe
[2019/03/07 18:56:50 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\eventvwr.exe
[2019/03/07 18:56:50 | 000,007,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fs_rec.sys
[2019/03/07 18:56:50 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\forcedos.exe
[2019/03/07 18:56:50 | 000,004,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ds16gt.dLL
[2019/03/07 18:56:50 | 000,004,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ds16gt.dll
[2019/03/07 18:56:50 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dsprpres.dll
[2019/03/07 18:56:50 | 000,003,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\dxgthk.sys
[2019/03/07 18:56:50 | 000,003,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dxgthk.sys
[2019/03/07 18:56:50 | 000,003,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\fixmapi.exe
[2019/03/07 18:56:50 | 000,003,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fixmapi.exe
[2019/03/07 18:56:47 | 002,091,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cdosys.dll
[2019/03/07 18:56:47 | 001,689,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3d9.dll
[2019/03/07 18:56:47 | 001,179,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3d8.dll
[2019/03/07 18:56:47 | 001,054,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\danim.dll
[2019/03/07 18:56:47 | 000,847,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dbgeng.dll
[2019/03/07 18:56:47 | 000,847,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dbgeng.dll
[2019/03/07 18:56:47 | 000,824,320 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dim700.dll
[2019/03/07 18:56:47 | 000,640,000 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dbghelp.dll
[2019/03/07 18:56:47 | 000,457,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\certmgr.dll
[2019/03/07 18:56:47 | 000,436,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\d3dim.dll
[2019/03/07 18:56:47 | 000,436,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dim.dll
[2019/03/07 18:56:47 | 000,435,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\shellstyle.dll
[2019/03/07 18:56:47 | 000,435,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\class_ss.dll
[2019/03/07 18:56:47 | 000,394,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\diactfrm.dll
[2019/03/07 18:56:47 | 000,394,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\diactfrm.dll
[2019/03/07 18:56:47 | 000,389,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cmd.exe
[2019/03/07 18:56:47 | 000,379,904 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dhcpmon.dll
[2019/03/07 18:56:47 | 000,375,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dpnet.dll
[2019/03/07 18:56:47 | 000,359,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cards.dll
[2019/03/07 18:56:47 | 000,359,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cards.dll
[2019/03/07 18:56:47 | 000,357,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\confmsp.dll
[2019/03/07 18:56:47 | 000,350,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\d3drm.dll
[2019/03/07 18:56:47 | 000,350,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3drm.dll
[2019/03/07 18:56:47 | 000,347,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\tourstart.exe
[2019/03/07 18:56:47 | 000,344,064 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cmdial32.dll
[2019/03/07 18:56:47 | 000,330,752 | —- | C] (Microsoft Corp., Veritas Software) – C:\WINDOWS\System32\dmconfig.dll
[2019/03/07 18:56:47 | 000,330,752 | —- | C] (Microsoft Corp., Veritas Software) – C:\WINDOWS\System32\dllcache\dmconfig.dll
[2019/03/07 18:56:47 | 000,285,184 | —- | C] (Microsoft Corp.) – C:\WINDOWS\System32\dmdlgs.dll
[2019/03/07 18:56:47 | 000,282,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\devmgr.dll
[2019/03/07 18:56:47 | 000,279,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ddraw.dll
[2019/03/07 18:56:47 | 000,229,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dplayx.dll
[2019/03/07 18:56:47 | 000,229,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\compstui.dll
[2019/03/07 18:56:47 | 000,212,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dpvoice.dll
[2019/03/07 18:56:47 | 000,200,704 | —- | C] (Microsoft Corp.) – C:\WINDOWS\System32\dmdskmgr.dll
[2019/03/07 18:56:47 | 000,194,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\certcli.dll
[2019/03/07 18:56:47 | 000,181,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dinput8.dll
[2019/03/07 18:56:47 | 000,181,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dmime.dll
[2019/03/07 18:56:47 | 000,165,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\datime.dll
[2019/03/07 18:56:47 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\diskpart.exe
[2019/03/07 18:56:47 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\credui.dll
[2019/03/07 18:56:47 | 000,163,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ciadmin.dll
[2019/03/07 18:56:47 | 000,163,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ciadmin.dll
[2019/03/07 18:56:47 | 000,158,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dinput.dll
[2019/03/07 18:56:47 | 000,153,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\daxctle.ocx
[2019/03/07 18:56:47 | 000,150,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\capesnpn.dll
[2019/03/07 18:56:47 | 000,149,019 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\crtdll.dll
[2019/03/07 18:56:47 | 000,149,019 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\crtdll.dll
[2019/03/07 18:56:47 | 000,148,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cic.dll
[2019/03/07 18:56:47 | 000,135,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\desk.cpl
[2019/03/07 18:56:47 | 000,135,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cscript.exe
[2019/03/07 18:56:47 | 000,124,416 | —- | C] (Microsoft Corp. and Executive Software International, Inc.) – C:\WINDOWS\System32\dfrgui.dll
[2019/03/07 18:56:47 | 000,118,784 | —- | C] (Microsoft Corp.) – C:\WINDOWS\System32\dmdskres.dll
[2019/03/07 18:56:47 | 000,118,784 | —- | C] (Microsoft Corp.) – C:\WINDOWS\System32\dllcache\dmdskres.dll
[2019/03/07 18:56:47 | 000,116,736 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dpvvox.dll
[2019/03/07 18:56:47 | 000,111,104 | —- | C] (Microsoft) – C:\WINDOWS\System32\dgnet.dll
[2019/03/07 18:56:47 | 000,110,592 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dbnetlib.dll
[2019/03/07 18:56:47 | 000,105,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dmstyle.dll
[2019/03/07 18:56:47 | 000,105,472 | —- | C] (Microsoft Corp. and Executive Software International, Inc.) – C:\WINDOWS\System32\dfrgntfs.exe
[2019/03/07 18:56:47 | 000,104,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dmusic.dll
[2019/03/07 18:56:47 | 000,103,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dmsynth.dll
[2019/03/07 18:56:47 | 000,102,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dpcdll.dll
[2019/03/07 18:56:47 | 000,096,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cdm.dll
[2019/03/07 18:56:47 | 000,096,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cdm.dll
[2019/03/07 18:56:47 | 000,087,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\diantz.exe
[2019/03/07 18:56:47 | 000,083,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dpvsetup.exe
[2019/03/07 18:56:47 | 000,082,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\eventtriggers.exe
[2019/03/07 18:56:47 | 000,082,944 | —- | C] (Microsoft Corp. and Executive Software International, Inc.) – C:\WINDOWS\System32\dfrgfat.exe
[2019/03/07 18:56:47 | 000,082,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dmscript.dll
[2019/03/07 18:56:47 | 000,077,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cliconfg.dll
[2019/03/07 18:56:47 | 000,074,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cryptdlg.dll
[2019/03/07 18:56:47 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dhcpsapi.dll
[2019/03/07 18:56:47 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dhcpsapi.dll
[2019/03/07 18:56:47 | 000,073,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\csseqchk.dll
[2019/03/07 18:56:47 | 000,073,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\csseqchk.dll
[2019/03/07 18:56:47 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\systeminfo.exe
[2019/03/07 18:56:47 | 000,069,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ciodm.dll
[2019/03/07 18:56:47 | 000,067,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\openfiles.exe
[2019/03/07 18:56:47 | 000,066,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\console.dll
[2019/03/07 18:56:47 | 000,066,560 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\console.dll
[2019/03/07 18:56:47 | 000,064,000 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cleanmgr.exe
[2019/03/07 18:56:47 | 000,063,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cmstp.exe
[2019/03/07 18:56:47 | 000,062,976 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\driverquery.exe
[2019/03/07 18:56:47 | 000,062,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dpnmodem.dll
[2019/03/07 18:56:47 | 000,062,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dpnmodem.dll
[2019/03/07 18:56:47 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dpnwsock.dll
[2019/03/07 18:56:47 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dpnwsock.dll
[2019/03/07 18:56:47 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dmcompos.dll
[2019/03/07 18:56:47 | 000,061,440 | —- | C] (Microsoft Corp.) – C:\WINDOWS\System32\dmview.ocx
[2019/03/07 18:56:47 | 000,061,440 | —- | C] (Microsoft Corp.) – C:\WINDOWS\System32\dllcache\dmview.ocx
[2019/03/07 18:56:47 | 000,060,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dpnhupnp.dll
[2019/03/07 18:56:47 | 000,060,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cabinet.dll
[2019/03/07 18:56:47 | 000,058,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\clusapi.dll
[2019/03/07 18:56:47 | 000,057,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dpwsockx.dll
[2019/03/07 18:56:47 | 000,056,832 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cipher.exe
[2019/03/07 18:56:47 | 000,054,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dataclen.dll
[2019/03/07 18:56:47 | 000,053,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dpserial.dll
[2019/03/07 18:56:47 | 000,053,520 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dpserial.dll
[2019/03/07 18:56:47 | 000,051,200 | —- | C] (Microsoft Corp. and Executive Software International, Inc.) – C:\WINDOWS\System32\dllcache\dfrgres.dll
[2019/03/07 18:56:47 | 000,051,200 | —- | C] (Microsoft Corp. and Executive Software International, Inc.) – C:\WINDOWS\System32\dfrgres.dll
[2019/03/07 18:56:47 | 000,050,688 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\eventcreate.exe
[2019/03/07 18:56:47 | 000,050,688 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\camocx.dll
[2019/03/07 18:56:47 | 000,049,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\classpnp.sys
[2019/03/07 18:56:47 | 000,047,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\d3dxof.dll
[2019/03/07 18:56:47 | 000,047,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dxof.dll
[2019/03/07 18:56:47 | 000,046,080 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\docprop.dll
[2019/03/07 18:56:47 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dimap.dll
[2019/03/07 18:56:47 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dimap.dll
[2019/03/07 18:56:47 | 000,042,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dpwsock.dll
[2019/03/07 18:56:47 | 000,042,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dpwsock.dll
[2019/03/07 18:56:47 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cmmon32.exe
[2019/03/07 18:56:47 | 000,039,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ddeml.dll
[2019/03/07 18:56:47 | 000,039,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ddeml.dll
[2019/03/07 18:56:47 | 000,039,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cmutil.dll
[2019/03/07 18:56:47 | 000,039,424 | —- | C] (Microsoft Corp. and Executive Software International, Inc.) – C:\WINDOWS\System32\dfrgsnap.dll
[2019/03/07 18:56:47 | 000,036,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dosapp.fon
[2019/03/07 18:56:47 | 000,035,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dmloader.dll
[2019/03/07 18:56:47 | 000,035,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dpnhpast.dll
[2019/03/07 18:56:47 | 000,034,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\d3dpmesh.dll
[2019/03/07 18:56:47 | 000,034,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dpmesh.dll
[2019/03/07 18:56:47 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\csrsrv.dll
[2019/03/07 18:56:47 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cryptdll.dll
[2019/03/07 18:56:47 | 000,033,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dplay.dll
[2019/03/07 18:56:47 | 000,033,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dplay.dll
[2019/03/07 18:56:47 | 000,032,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\commdlg.dll
[2019/03/07 18:56:47 | 000,032,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\commdlg.dll
[2019/03/07 18:56:47 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dispex.dll
[2019/03/07 18:56:47 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cnetcfg.dll
[2019/03/07 18:56:47 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cnetcfg.dll
[2019/03/07 18:56:47 | 000,030,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ddeshare.exe
[2019/03/07 18:56:47 | 000,030,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\compobj.dll
[2019/03/07 18:56:47 | 000,030,160 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\compobj.dll
[2019/03/07 18:56:47 | 000,029,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dplaysvr.exe
[2019/03/07 18:56:47 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dmband.dll
[2019/03/07 18:56:47 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dbnmpntw.dll
[2019/03/07 18:56:47 | 000,027,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\conime.exe
[2019/03/07 18:56:47 | 000,027,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ccfgnt.dll
[2019/03/07 18:56:47 | 000,027,648 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ccfgnt.dll
[2019/03/07 18:56:47 | 000,027,200 | R— | C] (Microsoft Corporation) – C:\WINDOWS\System32\ctl3dv2.dll
[2019/03/07 18:56:47 | 000,027,200 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ctl3dv2.dll
[2019/03/07 18:56:47 | 000,027,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ddrawex.dll
[2019/03/07 18:56:47 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cnvfat.dll
[2019/03/07 18:56:47 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cnvfat.dll
[2019/03/07 18:56:47 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cmdl32.exe
[2019/03/07 18:56:47 | 000,025,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\davclnt.dll
[2019/03/07 18:56:47 | 000,025,088 | —- | C] (Microsoft Corp. and Executive Software International, Inc.) – C:\WINDOWS\System32\defrag.exe
[2019/03/07 18:56:47 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dbmsrpcn.dll
[2019/03/07 18:56:47 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cliconfg.rll
[2019/03/07 18:56:47 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dpmodemx.dll
[2019/03/07 18:56:47 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dpvacm.dll
[2019/03/07 18:56:47 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cliconfg.exe
[2019/03/07 18:56:47 | 000,019,968 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cacls.exe
[2019/03/07 18:56:47 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dmocx.dll
[2019/03/07 18:56:47 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dmocx.dll
[2019/03/07 18:56:47 | 000,018,944 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\corpol.dll
[2019/03/07 18:56:47 | 000,018,432 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\deskperf.dll
[2019/03/07 18:56:47 | 000,018,432 | —- | C] (Microsoft Corp.) – C:\WINDOWS\System32\dmintf.dll
[2019/03/07 18:56:47 | 000,018,432 | —- | C] (Microsoft Corp.) – C:\WINDOWS\System32\dllcache\dmintf.dll
[2019/03/07 18:56:47 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dpnsvr.exe
[2019/03/07 18:56:47 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\diskperf.exe
[2019/03/07 18:56:47 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\diskperf.exe
[2019/03/07 18:56:47 | 000,017,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\compact.exe
[2019/03/07 18:56:47 | 000,017,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\compact.exe
[2019/03/07 18:56:47 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\deskmon.dll
[2019/03/07 18:56:47 | 000,016,896 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cfgmgr32.dll
[2019/03/07 18:56:47 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\deskadp.dll
[2019/03/07 18:56:47 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comp.exe
[2019/03/07 18:56:47 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\comp.exe
[2019/03/07 18:56:47 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cmcfg32.dll
[2019/03/07 18:56:47 | 000,015,872 | —- | C] (Microsoft Corp.) – C:\WINDOWS\System32\dmremote.exe
[2019/03/07 18:56:47 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cmpbk32.dll
[2019/03/07 18:56:47 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cmpbk32.dll
[2019/03/07 18:56:47 | 000,014,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\diskdump.sys
[2019/03/07 18:56:47 | 000,013,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\convert.exe
[2019/03/07 18:56:47 | 000,013,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\convert.exe
[2019/03/07 18:56:47 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\cmsetacl.dll
[2019/03/07 18:56:47 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chkdsk.exe
[2019/03/07 18:56:47 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\chkdsk.exe
[2019/03/07 18:56:47 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\chkntfs.exe
[2019/03/07 18:56:47 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\chkntfs.exe
[2019/03/07 18:56:47 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\doskey.exe
[2019/03/07 18:56:47 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\doskey.exe
[2019/03/07 18:56:47 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\clb.dll
[2019/03/07 18:56:47 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\clb.dll
[2019/03/07 18:56:47 | 000,010,544 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\comm.drv
[2019/03/07 18:56:47 | 000,009,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\diskcomp.com
[2019/03/07 18:56:47 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dciman32.dll
[2019/03/07 18:56:47 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3d8thk.dll
[2019/03/07 18:56:47 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\control.exe
[2019/03/07 18:56:47 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\control.exe
[2019/03/07 18:56:47 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\cidaemon.exe
[2019/03/07 18:56:47 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ckcnv.exe
[2019/03/07 18:56:47 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ckcnv.exe
[2019/03/07 18:56:47 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\chcp.com
[2019/03/07 18:56:47 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\diskcopy.com
[2019/03/07 18:56:47 | 000,005,888 | —- | C] (Microsoft Corp., Veritas Software.) – C:\WINDOWS\System32\dllcache\dmload.sys
[2019/03/07 18:56:47 | 000,004,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllhst3g.exe
[2019/03/07 18:56:47 | 000,004,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dllhst3g.exe
[2019/03/07 18:56:47 | 000,003,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comcat.dll
[2019/03/07 18:56:47 | 000,003,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\comcat.dll
[2019/03/07 18:56:47 | 000,003,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dpnlobby.dll
[2019/03/07 18:56:47 | 000,003,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dpnaddr.dll
[2019/03/07 18:56:46 | 001,661,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmpencen.dll
[2019/03/07 18:56:46 | 000,629,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wpd_ci.dll
[2019/03/07 18:56:46 | 000,602,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\autoconv.exe
[2019/03/07 18:56:46 | 000,580,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\autofmt.exe
[2019/03/07 18:56:46 | 000,429,056 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmdrmdev.dll
[2019/03/07 18:56:46 | 000,361,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\blue_ss.dll
[2019/03/07 18:56:46 | 000,356,352 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wpdsp.dll
[2019/03/07 18:56:46 | 000,352,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\atmuni.sys
[2019/03/07 18:56:46 | 000,352,256 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\atmuni.sys
[2019/03/07 18:56:46 | 000,348,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmdrmnet.dll
[2019/03/07 18:56:46 | 000,331,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wpdmtpdr.dll
[2019/03/07 18:56:46 | 000,295,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\appmgr.dll
[2019/03/07 18:56:46 | 000,285,824 | —- | C] (Adobe Systems Incorporated) – C:\WINDOWS\System32\dllcache\atmfd.dll
[2019/03/07 18:56:46 | 000,285,824 | —- | C] (Adobe Systems Incorporated) – C:\WINDOWS\System32\atmfd.dll
[2019/03/07 18:56:46 | 000,263,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\adsnt.dll
[2019/03/07 18:56:46 | 000,232,448 | —- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) – C:\WINDOWS\System32\l3codecp.acm
[2019/03/07 18:56:46 | 000,204,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wmpsrcwp.dll
[2019/03/07 18:56:46 | 000,193,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\activeds.dll
[2019/03/07 18:56:46 | 000,175,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\adsldp.dll
[2019/03/07 18:56:46 | 000,161,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\adsnds.dll
[2019/03/07 18:56:46 | 000,161,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\adsnds.dll
[2019/03/07 18:56:46 | 000,154,624 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wpdmtp.dll
[2019/03/07 18:56:46 | 000,152,576 | —- | C] (Microsoft Corporation; Microsoft Research) – C:\WINDOWS\System32\dllcache\bnts.dll
[2019/03/07 18:56:46 | 000,143,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\adsldpc.dll
[2019/03/07 18:56:46 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\bootcfg.exe
[2019/03/07 18:56:46 | 000,129,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\acledit.dll
[2019/03/07 18:56:46 | 000,129,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\acledit.dll
[2019/03/07 18:56:46 | 000,123,392 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\adsnw.dll
[2019/03/07 18:56:46 | 000,115,712 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\aclui.dll
[2019/03/07 18:56:46 | 000,114,688 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\asctrls.ocx
[2019/03/07 18:56:46 | 000,111,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\activeds.tlb
[2019/03/07 18:56:46 | 000,111,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\activeds.tlb
[2019/03/07 18:56:46 | 000,109,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\avifile.dll
[2019/03/07 18:56:46 | 000,109,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\avifile.dll
[2019/03/07 18:56:46 | 000,102,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\apcups.dll
[2019/03/07 18:56:46 | 000,102,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\apcups.dll
[2019/03/07 18:56:46 | 000,098,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\ahui.exe
[2019/03/07 18:56:46 | 000,098,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\actxprxy.dll
[2019/03/07 18:56:46 | 000,084,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\avifil32.dll
[2019/03/07 18:56:46 | 000,080,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\autodisc.dll
[2019/03/07 18:56:46 | 000,080,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\autodisc.dll
[2019/03/07 18:56:46 | 000,078,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\browsewm.dll
[2019/03/07 18:56:46 | 000,072,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\admparse.dll
[2019/03/07 18:56:46 | 000,069,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\avicap.dll
[2019/03/07 18:56:46 | 000,069,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\avicap.dll
[2019/03/07 18:56:46 | 000,068,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\adsmsext.dll
[2019/03/07 18:56:46 | 000,065,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\asycfilt.dll
[2019/03/07 18:56:46 | 000,064,000 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\avicap32.dll
[2019/03/07 18:56:46 | 000,064,000 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\avicap32.dll
[2019/03/07 18:56:46 | 000,063,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wpdmtpus.dll
[2019/03/07 18:56:46 | 000,063,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\browselc.dll
[2019/03/07 18:56:46 | 000,058,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\atl.dll
[2019/03/07 18:56:46 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\atmlane.sys
[2019/03/07 18:56:46 | 000,052,736 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\basesrv.dll
[2019/03/07 18:56:46 | 000,050,688 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\btpanui.dll
[2019/03/07 18:56:46 | 000,035,840 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wpdconns.dll
[2019/03/07 18:56:46 | 000,034,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\atmpvcno.dll
[2019/03/07 18:56:46 | 000,034,816 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\atmpvcno.dll
[2019/03/07 18:56:46 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\asr_pfu.exe
[2019/03/07 18:56:46 | 000,032,256 | —- | C] (Microsoft Corp.) – C:\WINDOWS\System32\dllcache\asr_ldm.exe
[2019/03/07 18:56:46 | 000,032,256 | —- | C] (Microsoft Corp.) – C:\WINDOWS\System32\asr_ldm.exe
[2019/03/07 18:56:46 | 000,031,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\atmepvc.sys
[2019/03/07 18:56:46 | 000,031,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\atmepvc.sys
[2019/03/07 18:56:46 | 000,030,208 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\asr_fmt.exe
[2019/03/07 18:56:46 | 000,030,208 | —- | C] (Adobe Systems) – C:\WINDOWS\System32\atmlib.dll
[2019/03/07 18:56:46 | 000,029,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\batmeter.dll
[2019/03/07 18:56:46 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\adptif.dll
[2019/03/07 18:56:46 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\adptif.dll
[2019/03/07 18:56:46 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aaaamon.dll
[2019/03/07 18:56:46 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\aaaamon.dll
[2019/03/07 18:56:46 | 000,025,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\at.exe
[2019/03/07 18:56:46 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\arp.exe
[2019/03/07 18:56:46 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\arp.exe
[2019/03/07 18:56:46 | 000,017,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\bidispl.dll
[2019/03/07 18:56:46 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\auditusr.exe
[2019/03/07 18:56:46 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\atkctrs.dll
[2019/03/07 18:56:46 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\atkctrs.dll
[2019/03/07 18:56:46 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\bootvid.dll
[2019/03/07 18:56:46 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\bootvid.dll
[2019/03/07 18:56:46 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\attrib.exe
[2019/03/07 18:56:46 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\autolfn.exe
[2019/03/07 18:56:46 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\atmadm.exe
[2019/03/07 18:56:46 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wpdtrace.dll
[2019/03/07 18:56:46 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\uwdf.exe
[2019/03/07 18:56:46 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\bootvrfy.exe
[2019/03/07 18:56:46 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\bootvrfy.exe
[2019/03/07 18:56:46 | 000,004,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\bootok.exe
[2019/03/07 18:56:46 | 000,004,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\bootok.exe
[2019/03/07 18:56:46 | 000,004,224 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\beep.sys
[2019/03/07 18:56:46 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\WMVADVE.DLL
[2019/03/07 18:56:46 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\WMVADVD.dll
[2019/03/07 18:56:46 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wdfapi.dll
[2019/03/07 18:56:46 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\actmovie.exe
[2019/03/07 18:54:21 | 000,000,000 | —D | C] – C:\i386
[2019/03/07 18:53:51 | 000,000,000 | —D | C] – C:\cmpnents
[2019/03/07 18:53:28 | 000,000,000 | -HSD | C] – C:\System Volume Information
[2010/10/19 11:35:46 | 000,000,000 | –SD | C] – C:\ComboFix
[2010/10/19 10:24:19 | 000,000,000 | RHSD | C] – C:\cmdcons
[2010/10/19 10:21:24 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/10/19 10:21:24 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/10/19 10:21:24 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/10/19 10:21:24 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2010/10/19 10:21:10 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2010/10/19 10:20:48 | 000,000,000 | —D | C] – C:\Qoobox
[2010/10/19 00:07:54 | 000,000,000 | —D | C] – C:\_OTL
[2010/10/17 22:41:50 | 000,000,000 | —D | C] – C:\Documents and Settings\Dave\Local Settings\Application Data\{300CF2AA-2C59-4504-AD4C-3C0581014983}
[2010/10/17 21:48:34 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/10/17 21:48:34 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/10/17 18:59:57 | 000,574,464 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Dave\Desktop\OTL.exe
[2010/10/17 10:55:53 | 000,000,000 | —D | C] – C:\WINDOWS\System32\Registry Patrol
[2010/10/17 10:55:43 | 000,000,000 | —D | C] – C:\Program Files\Registry Patrol
[2010/10/16 23:59:16 | 000,000,000 | —D | C] – C:\Documents and Settings\Dave\Application Data\Malwarebytes
[2010/10/16 23:55:53 | 001,033,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\explorer.exe
[2010/10/16 23:55:53 | 001,033,728 | —- | C] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
[2010/10/16 23:29:20 | 000,000,000 | —D | C] – C:\Documents and Settings\Dave\Application Data\Uniblue
[2010/10/16 23:29:13 | 000,000,000 | —D | C] – C:\Program Files\Uniblue
[2010/10/16 22:22:02 | 000,000,000 | —D | C] – C:\WINDOWS\setup.pss
[2010/10/15 19:14:13 | 000,000,000 | —D | C] – C:\Program Files\Hitman Pro 3.5
[2010/10/15 19:13:41 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Hitman Pro
[2010/10/14 21:42:15 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/10/14 21:42:14 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/10/14 21:42:14 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/10/14 21:42:14 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/10/14 20:50:36 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/10/14 10:19:38 | 000,000,000 | —D | C] – C:\sh4ldr
[2010/10/14 10:19:38 | 000,000,000 | —D | C] – C:\Program Files\Enigma Software Group
[2010/10/14 10:19:14 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Wise Installation Wizard
[2010/10/14 09:34:00 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/10/13 22:58:10 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Documents\Server
[2010/10/13 07:54:14 | 000,974,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc42.dll
[2010/10/13 07:54:14 | 000,953,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc40u.dll
[2010/10/13 07:54:06 | 000,617,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comctl32.dll
[2010/10/12 14:23:17 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Dave\Recent
[2010/10/10 20:20:50 | 000,000,000 | —D | C] – C:\Documents and Settings\Dave\Application Data\KidZui
[2010/10/10 19:45:21 | 000,000,000 | —D | C] – C:\Program Files\Kidzui
[2010/10/10 17:14:00 | 000,000,000 | —D | C] – C:\Program Files\MSECache
[2006/11/19 12:48:47 | 014,879,120 | —- | C] (Macrovision Corporation) – C:\Program Files\GoogleEarthWin.exe

========== Files - Modified Within 30 Days ==========

[2010/10/19 12:27:22 | 000,843,776 | —- | M] () – C:\WINDOWS\System32\drivers\smccs.sys
[2010/10/19 12:14:01 | 000,000,880 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/10/19 11:52:00 | 000,000,278 | -H– | M] () – C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010/10/19 11:46:11 | 000,016,968 | —- | M] () – C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2010/10/19 11:44:57 | 000,012,598 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/10/19 11:44:48 | 000,081,191 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2010/10/19 11:44:37 | 000,000,876 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/10/19 11:44:20 | 000,000,304 | -HS- | M] () – C:\WINDOWS\tasks\LMOMNCB.job
[2010/10/19 11:44:07 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/10/19 10:24:24 | 000,000,382 | RHS- | M] () – C:\boot.ini
[2010/10/19 10:17:24 | 003,880,194 | R— | M] () – C:\Documents and Settings\Dave\Desktop\ComboFix.exe
[2010/10/19 00:32:09 | 000,294,912 | —- | M] () – C:\Documents and Settings\Dave\Desktop\44h72ly0.exe
[2010/10/18 21:09:03 | 000,000,120 | —- | M] () – C:\WINDOWS\Ezajeruxilexex.dat
[2010/10/18 19:39:33 | 000,000,000 | —- | M] () – C:\WINDOWS\Dgatisadoq.bin
[2010/10/17 23:20:34 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/10/17 21:41:00 | 000,013,590 | —- | M] () – C:\WINDOWS\System32\235.js
[2010/10/17 19:39:02 | 000,000,808 | —- | M] () – C:\Documents and Settings\Dave\Desktop\Norton Installation Files.lnk
[2010/10/17 19:00:25 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Dave\Desktop\OTL.exe
[2010/10/17 11:32:24 | 000,000,394 | RHS- | M] () – C:\Documents and Settings\All Users\ntuser.pol
[2010/10/16 23:25:11 | 000,458,338 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/10/16 23:25:11 | 000,077,710 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/10/16 23:25:08 | 000,000,822 | —- | M] () – C:\Documents and Settings\Dave\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/10/16 22:22:25 | 000,000,265 | —- | M] () – C:\Boot.bak
[2010/10/16 22:16:13 | 000,004,625 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/10/16 22:06:34 | 000,000,418 | —- | M] () – C:\Documents and Settings\Dave\My Documents\cdgone.reg
[2010/10/16 22:03:30 | 000,001,936 | —- | M] () – C:\Documents and Settings\Dave\Desktop\cdgone.zip
[2010/10/16 21:14:53 | 000,000,057 | —- | M] () – C:\WINDOWS\System32\mapisvc.inf
[2010/10/15 19:19:29 | 000,507,904 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\winlogon.exe
[2010/10/15 19:14:14 | 000,001,670 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Hitman Pro 3.5.lnk
[2010/10/14 21:42:18 | 000,000,703 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/10/13 22:59:03 | 000,074,240 | RHS- | M] () – C:\WINDOWS\System32\ir41_qcxt.dll
[2010/10/13 22:58:37 | 000,000,195 | —- | M] () – C:\Documents and Settings\Dave\Application Data\jsfhjjsd.bat
[2010/10/13 22:58:36 | 000,030,000 | —- | M] () – C:\WINDOWS\System32\o91jv.dll
[2010/10/13 22:58:36 | 000,030,000 | —- | M] () – C:\WINDOWS\System32\cq85n0n.dll
[2010/10/13 15:45:58 | 000,275,760 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/10/11 21:33:23 | 000,000,460 | —- | M] () – C:\Documents and Settings\Dave\Desktop\eBay.url
[2010/10/10 19:45:22 | 000,001,529 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Kidzui Browser.lnk
[2010/10/09 20:56:36 | 000,000,204 | —- | M] () – C:\Documents and Settings\Dave\Desktop\Facebook.url
[2010/10/05 19:44:57 | 000,175,104 | —- | M] () – C:\Documents and Settings\Dave\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/10/03 14:54:48 | 006,519,808 | —- | M] () – C:\Documents and Settings\Dave\My Documents\cats.doc
[2010/09/26 08:16:51 | 000,001,922 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2010/09/19 17:24:13 | 000,041,472 | —- | M] () – C:\Documents and Settings\Dave\My Documents\Dave Moss CV.doc

========== Files Created - No Company Name ==========

[2019/03/07 18:57:37 | 000,000,382 | RHS- | C] () – C:\boot.ini
[2019/03/07 18:57:20 | 000,035,694 | —- | C] () – C:\WINDOWS\System32\OEMLOGO.BMP
[2019/03/07 18:57:20 | 000,002,679 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2019/03/07 18:57:20 | 000,000,834 | —- | C] () – C:\WINDOWS\System32\OemLink.htm
[2019/03/07 18:57:20 | 000,000,766 | —- | C] () – C:\WINDOWS\System32\OemLinkIcon.ico
[2019/03/07 18:57:19 | 000,787,510 | —- | C] () – C:\WINDOWS\MESH_SKY.BMP
[2019/03/07 18:57:16 | 000,844,314 | —- | C] () – C:\WINDOWS\System32\msdxm.ocx
[2019/03/07 18:57:16 | 000,844,314 | —- | C] () – C:\WINDOWS\System32\dllcache\msdxm.ocx
[2019/03/07 18:57:16 | 000,498,742 | —- | C] () – C:\WINDOWS\System32\dllcache\dxmasf.dll
[2019/03/07 18:57:16 | 000,004,126 | —- | C] () – C:\WINDOWS\System32\dllcache\msdxmlc.dll
[2019/03/07 18:57:13 | 000,250,048 | RHS- | C] () – C:\ntldr
[2019/03/07 18:57:13 | 000,047,564 | RHS- | C] () – C:\NTDETECT.COM
[2019/03/07 18:57:12 | 000,127,213 | —- | C] () – C:\WINDOWS\System32\ega.cpi
[2019/03/07 18:57:12 | 000,082,944 | —- | C] () – C:\WINDOWS\clock.avi
[2019/03/07 18:57:11 | 000,069,886 | —- | C] () – C:\WINDOWS\System32\edit.com
[2019/03/07 18:57:11 | 000,001,696 | —- | C] () – C:\WINDOWS\System32\noise.cht
[2019/03/07 18:57:11 | 000,001,696 | —- | C] () – C:\WINDOWS\System32\noise.chs
[2019/03/07 18:57:00 | 000,167,936 | —- | C] () – C:\WINDOWS\System32\wstpager.ax
[2019/03/07 18:57:00 | 000,167,936 | —- | C] () – C:\WINDOWS\System32\dllcache\wstpager.ax
[2019/03/07 18:57:00 | 000,012,598 | —- | C] () – C:\WINDOWS\System32\wpa.dbl
[2019/03/07 18:57:00 | 000,000,697 | —- | C] () – C:\WINDOWS\System32\noise.tha
[2019/03/07 18:56:59 | 001,326,080 | —- | C] () – C:\WINDOWS\System32\webfldrs.msi
[2019/03/07 18:56:59 | 000,040,448 | —- | C] () – C:\WINDOWS\System32\wiasf.ax
[2019/03/07 18:56:59 | 000,040,448 | —- | C] () – C:\WINDOWS\System32\dllcache\wiasf.ax
[2019/03/07 18:56:59 | 000,013,312 | —- | C] () – C:\WINDOWS\System32\dllcache\win87em.dll
[2019/03/07 18:56:58 | 001,309,184 | —- | C] () – C:\WINDOWS\System32\wbdbase.deu
[2019/03/07 18:56:58 | 001,095,680 | —- | C] () – C:\WINDOWS\System32\wbdbase.nld
[2019/03/07 18:56:58 | 000,957,440 | —- | C] () – C:\WINDOWS\System32\wbdbase.enu
[2019/03/07 18:56:58 | 000,937,984 | —- | C] () – C:\WINDOWS\System32\wbdbase.sve
[2019/03/07 18:56:58 | 000,867,840 | —- | C] () – C:\WINDOWS\System32\wbdbase.ita
[2019/03/07 18:56:58 | 000,786,944 | —- | C] () – C:\WINDOWS\System32\wbdbase.fra
[2019/03/07 18:56:58 | 000,750,080 | —- | C] () – C:\WINDOWS\System32\wbdbase.esn
[2019/03/07 18:56:58 | 000,159,744 | —- | C] () – C:\WINDOWS\System32\VBICodec.ax
[2019/03/07 18:56:58 | 000,154,112 | —- | C] () – C:\WINDOWS\System32\dllcache\vbicodec.ax
[2019/03/07 18:56:58 | 000,065,489 | —- | C] () – C:\WINDOWS\System32\wbcache.sve
[2019/03/07 18:56:58 | 000,065,489 | —- | C] () – C:\WINDOWS\System32\wbcache.nld
[2019/03/07 18:56:58 | 000,065,489 | —- | C] () – C:\WINDOWS\System32\wbcache.ita
[2019/03/07 18:56:58 | 000,065,489 | —- | C] () – C:\WINDOWS\System32\wbcache.fra
[2019/03/07 18:56:58 | 000,065,489 | —- | C] () – C:\WINDOWS\System32\wbcache.esn
[2019/03/07 18:56:58 | 000,065,489 | —- | C] () – C:\WINDOWS\System32\wbcache.enu
[2019/03/07 18:56:58 | 000,065,489 | —- | C] () – C:\WINDOWS\System32\wbcache.deu
[2019/03/07 18:56:58 | 000,018,832 | —- | C] () – C:\WINDOWS\System32\v7vga.rom
[2019/03/07 18:56:58 | 000,015,360 | —- | C] () – C:\WINDOWS\System32\dllcache\tsd32.dll
[2019/03/07 18:56:58 | 000,004,096 | —- | C] () – C:\WINDOWS\System32\wdl.trm
[2019/03/07 18:56:58 | 000,003,577 | —- | C] () – C:\WINDOWS\System32\sysprtj.sep
[2019/03/07 18:56:58 | 000,003,214 | —- | C] () – C:\WINDOWS\System32\sysprint.sep
[2019/03/07 18:56:58 | 000,001,129 | —- | C] () – C:\WINDOWS\System32\vwipxspx.exe
[2019/03/07 18:56:58 | 000,001,129 | —- | C] () – C:\WINDOWS\System32\dllcache\vwipxspx.exe
[2019/03/07 18:56:58 | 000,000,862 | —- | C] () – C:\WINDOWS\System32\termcap
[2019/03/07 18:56:57 | 000,106,147 | —- | C] () – C:\WINDOWS\System32\dllcache\SP2.CAT
[2019/03/07 18:56:57 | 000,046,133 | —- | C] () – C:\WINDOWS\System32\sqlsodbc.chm
[2019/03/07 18:56:56 | 000,291,840 | —- | C] () – C:\WINDOWS\System32\dllcache\sbe.dll
[2019/03/07 18:56:56 | 000,240,120 | —- | C] () – C:\WINDOWS\System32\setup.bmp
[2019/03/07 18:56:56 | 000,059,167 | —- | C] () – C:\WINDOWS\System\setup.inf
[2019/03/07 18:56:56 | 000,044,451 | R— | C] () – C:\WINDOWS\System32\rsop.msc
[2019/03/07 18:56:56 | 000,036,364 | —- | C] () – C:\WINDOWS\System32\secpol.msc
[2019/03/07 18:56:56 | 000,035,755 | —- | C] () – C:\WINDOWS\System32\prncnfg.vbs
[2019/03/07 18:56:56 | 000,035,755 | —- | C] () – C:\WINDOWS\System32\dllcache\prncnfg.vbs
[2019/03/07 18:56:56 | 000,033,464 | —- | C] () – C:\WINDOWS\System32\services.msc
[2019/03/07 18:56:56 | 000,032,546 | —- | C] () – C:\WINDOWS\System32\prnmngr.vbs
[2019/03/07 18:56:56 | 000,032,546 | —- | C] () – C:\WINDOWS\System32\dllcache\prnmngr.vbs
[2019/03/07 18:56:56 | 000,029,454 | —- | C] () – C:\WINDOWS\System32\prnport.vbs
[2019/03/07 18:56:56 | 000,029,454 | —- | C] () – C:\WINDOWS\System32\dllcache\prnport.vbs
[2019/03/07 18:56:56 | 000,025,415 | —- | C] () – C:\WINDOWS\System32\prndrvr.vbs
[2019/03/07 18:56:56 | 000,025,415 | —- | C] () – C:\WINDOWS\System32\dllcache\prndrvr.vbs
[2019/03/07 18:56:56 | 000,021,527 | —- | C] () – C:\WINDOWS\System32\prnjobs.vbs
[2019/03/07 18:56:56 | 000,021,527 | —- | C] () – C:\WINDOWS\System32\dllcache\prnjobs.vbs
[2019/03/07 18:56:56 | 000,015,860 | —- | C] () – C:\WINDOWS\System32\prnqctl.vbs
[2019/03/07 18:56:56 | 000,015,860 | —- | C] () – C:\WINDOWS\System32\dllcache\prnqctl.vbs
[2019/03/07 18:56:56 | 000,011,753 | —- | C] () – C:\WINDOWS\System32\setver.exe
[2019/03/07 18:56:56 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\dllcache\scriptpw.dll
[2019/03/07 18:56:56 | 000,007,208 | —- | C] () – C:\WINDOWS\System32\secupd.sig
[2019/03/07 18:56:56 | 000,007,208 | —- | C] () – C:\WINDOWS\System32\dllcache\secupd.sig
[2019/03/07 18:56:56 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2019/03/07 18:56:56 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\dllcache\secupd.dat
[2019/03/07 18:56:56 | 000,003,708 | —- | C] () – C:\WINDOWS\System32\pubprn.vbs
[2019/03/07 18:56:56 | 000,003,708 | —- | C] () – C:\WINDOWS\System32\dllcache\pubprn.vbs
[2019/03/07 18:56:56 | 000,003,338 | —- | C] () – C:\WINDOWS\System32\redir.exe
[2019/03/07 18:56:56 | 000,003,338 | —- | C] () – C:\WINDOWS\System32\dllcache\redir.exe
[2019/03/07 18:56:56 | 000,003,178 | —- | C] () – C:\WINDOWS\System32\rsvpcnts.h
[2019/03/07 18:56:56 | 000,003,167 | —- | C] () – C:\WINDOWS\System32\rsaci.rat
[2019/03/07 18:56:56 | 000,003,010 | —- | C] () – C:\WINDOWS\System32\pschdcnt.h
[2019/03/07 18:56:56 | 000,001,818 | —- | C] () – C:\WINDOWS\System32\rasctrnm.h
[2019/03/07 18:56:56 | 000,000,882 | —- | C] () – C:\WINDOWS\System32\share.exe
[2019/03/07 18:56:56 | 000,000,882 | —- | C] () – C:\WINDOWS\System32\dllcache\share.exe
[2019/03/07 18:56:56 | 000,000,051 | —- | C] () – C:\WINDOWS\System32\pscript.sep
[2019/03/07 18:56:55 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2019/03/07 18:56:55 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\dllcache\oembios.bin
[2019/03/07 18:56:55 | 000,458,338 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2019/03/07 18:56:55 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2019/03/07 18:56:55 | 000,149,848 | —- | C] () – C:\WINDOWS\System32\noise.deu
[2019/03/07 18:56:55 | 000,077,710 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2019/03/07 18:56:55 | 000,058,273 | R— | C] () – C:\WINDOWS\System32\perfmon.msc
[2019/03/07 18:56:55 | 000,049,196 | —- | C] () – C:\WINDOWS\System32\noise.fra
[2019/03/07 18:56:55 | 000,048,794 | —- | C] () – C:\WINDOWS\System32\ntimage.gif
[2019/03/07 18:56:55 | 000,035,648 | —- | C] () – C:\WINDOWS\System32\dllcache\ntio411.sys
[2019/03/07 18:56:55 | 000,035,424 | —- | C] () – C:\WINDOWS\System32\dllcache\ntio412.sys
[2019/03/07 18:56:55 | 000,034,560 | —- | C] () – C:\WINDOWS\System32\dllcache\ntio804.sys
[2019/03/07 18:56:55 | 000,034,560 | —- | C] () – C:\WINDOWS\System32\dllcache\ntio404.sys
[2019/03/07 18:56:55 | 000,033,840 | —- | C] () – C:\WINDOWS\System32\dllcache\ntio.sys
[2019/03/07 18:56:55 | 000,032,968 | —- | C] () – C:\WINDOWS\System32\ntmsoprq.msc
[2019/03/07 18:56:55 | 000,029,370 | —- | C] () – C:\WINDOWS\System32\dllcache\ntdos411.sys
[2019/03/07 18:56:55 | 000,029,274 | —- | C] () – C:\WINDOWS\System32\dllcache\ntdos412.sys
[2019/03/07 18:56:55 | 000,029,146 | —- | C] () – C:\WINDOWS\System32\dllcache\ntdos804.sys
[2019/03/07 18:56:55 | 000,029,146 | —- | C] () – C:\WINDOWS\System32\dllcache\ntdos404.sys
[2019/03/07 18:56:55 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2019/03/07 18:56:55 | 000,027,866 | —- | C] () – C:\WINDOWS\System32\dllcache\ntdos.sys
[2019/03/07 18:56:55 | 000,026,209 | —- | C] () – C:\WINDOWS\System32\ntmsmgr.msc
[2019/03/07 18:56:55 | 000,019,684 | —- | C] () – C:\WINDOWS\System32\noise.esn
[2019/03/07 18:56:55 | 000,019,618 | —- | C] () – C:\WINDOWS\System32\noise.ita
[2019/03/07 18:56:55 | 000,013,730 | —- | C] () – C:\WINDOWS\System32\noise.sve
[2019/03/07 18:56:55 | 000,013,256 | —- | C] () – C:\WINDOWS\System32\noise.nld
[2019/03/07 18:56:55 | 000,006,761 | —- | C] () – C:\WINDOWS\System32\oembios.sig
[2019/03/07 18:56:55 | 000,006,761 | —- | C] () – C:\WINDOWS\System32\dllcache\oembios.sig
[2019/03/07 18:56:55 | 000,004,461 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2019/03/07 18:56:55 | 000,004,461 | —- | C] () – C:\WINDOWS\System32\dllcache\oembios.dat
[2019/03/07 18:56:55 | 000,004,310 | —- | C] () – C:\WINDOWS\System32\odbcconf.rsp
[2019/03/07 18:56:55 | 000,003,252 | —- | C] () – C:\WINDOWS\System32\nw16.exe
[2019/03/07 18:56:55 | 000,003,252 | —- | C] () – C:\WINDOWS\System32\dllcache\nw16.exe
[2019/03/07 18:56:55 | 000,000,751 | —- | C] () – C:\WINDOWS\System32\noise.enu
[2019/03/07 18:56:55 | 000,000,751 | —- | C] () – C:\WINDOWS\System32\noise.eng
[2019/03/07 18:56:55 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2019/03/07 18:56:55 | 000,000,435 | —- | C] () – C:\WINDOWS\System32\perfwci.h
[2019/03/07 18:56:55 | 000,000,427 | —- | C] () – C:\WINDOWS\System32\perfci.h
[2019/03/07 18:56:55 | 000,000,140 | —- | C] () – C:\WINDOWS\System32\perffilt.h
[2019/03/07 18:56:55 | 000,000,114 | —- | C] () – C:\WINDOWS\System32\pcl.sep
[2019/03/07 18:56:54 | 000,007,052 | —- | C] () – C:\WINDOWS\System32\nlsfunc.exe
[2019/03/07 18:56:54 | 000,007,052 | —- | C] () – C:\WINDOWS\System32\dllcache\nlsfunc.exe
[2019/03/07 18:56:53 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2019/03/07 18:56:53 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\dllcache\mlang.dat
[2019/03/07 18:56:53 | 000,165,376 | —- | C] () – C:\WINDOWS\System32\mpg2splt.ax
[2019/03/07 18:56:53 | 000,165,376 | —- | C] () – C:\WINDOWS\System32\dllcache\mpg2splt.ax
[2019/03/07 18:56:53 | 000,062,976 | —- | C] () – C:\WINDOWS\System32\dllcache\Mpg2data.ax
[2019/03/07 18:56:53 | 000,062,976 | —- | C] () – C:\WINDOWS\System32\mpeg2data.ax
[2019/03/07 18:56:53 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2019/03/07 18:56:53 | 000,002,755 | —- | C] () – C:\WINDOWS\System32\mqprfsym.h
[2019/03/07 18:56:53 | 000,001,492 | —- | C] () – C:\WINDOWS\System32\mmdriver.inf
[2019/03/07 18:56:53 | 000,000,817 | —- | C] () – C:\WINDOWS\System32\mscdexnt.exe
[2019/03/07 18:56:53 | 000,000,817 | —- | C] () – C:\WINDOWS\System32\dllcache\mscdexnt.exe
[2019/03/07 18:56:52 | 000,042,809 | —- | C] () – C:\WINDOWS\System32\dllcache\key01.sys
[2019/03/07 18:56:52 | 000,042,537 | —- | C] () – C:\WINDOWS\System32\dllcache\keyboard.sys
[2019/03/07 18:56:52 | 000,042,166 | —- | C] () – C:\WINDOWS\System32\lusrmgr.msc
[2019/03/07 18:56:52 | 000,039,274 | —- | C] () – C:\WINDOWS\System32\mem.exe
[2019/03/07 18:56:52 | 000,039,274 | —- | C] () – C:\WINDOWS\System32\dllcache\mem.exe
[2019/03/07 18:56:52 | 000,024,124 | —- | C] () – C:\WINDOWS\System32\dllcache\marlett.ttf
[2019/03/07 18:56:52 | 000,001,131 | —- | C] () – C:\WINDOWS\System32\loadfix.com
[2019/03/07 18:56:52 | 000,000,487 | —- | C] () – C:\WINDOWS\System32\login.cmd
[2019/03/07 18:56:51 | 000,956,990 | —- | C] () – C:\WINDOWS\System32\instcat.sql
[2019/03/07 18:56:51 | 000,057,667 | —- | C] () – C:\WINDOWS\System32\ieuinit.inf
[2019/03/07 18:56:51 | 000,014,710 | —- | C] () – C:\WINDOWS\System32\kb16.com
[2019/03/07 18:56:51 | 000,004,768 | —- | C] () – C:\WINDOWS\System32\dllcache\himem.sys
[2019/03/07 18:56:51 | 000,000,929 | —- | C] () – C:\WINDOWS\System32\homepage.inf
[2019/03/07 18:56:50 | 003,440,660 | —- | C] () – C:\WINDOWS\System32\drivers\gm.dls
[2019/03/07 18:56:50 | 003,440,660 | —- | C] () – C:\WINDOWS\System32\dllcache\gm.dls
[2019/03/07 18:56:50 | 000,456,192 | —- | C] () – C:\WINDOWS\System32\dllcache\encdec.dll
[2019/03/07 18:56:50 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2019/03/07 18:56:50 | 000,152,844 | —- | C] () – C:\WINDOWS\System32\dllcache\framdit.ttf
[2019/03/07 18:56:50 | 000,135,984 | —- | C] () – C:\WINDOWS\System32\dllcache\framd.ttf
[2019/03/07 18:56:50 | 000,056,678 | —- | C] () – C:\WINDOWS\System32\eventvwr.msc
[2019/03/07 18:56:50 | 000,034,871 | —- | C] () – C:\WINDOWS\System32\gpedit.msc
[2019/03/07 18:56:50 | 000,032,760 | —- | C] () – C:\WINDOWS\System32\fsmgmt.msc
[2019/03/07 18:56:50 | 000,021,232 | —- | C] () – C:\WINDOWS\System32\graphics.pro
[2019/03/07 18:56:50 | 000,019,694 | —- | C] () – C:\WINDOWS\System32\graphics.com
[2019/03/07 18:56:50 | 000,012,642 | —- | C] () – C:\WINDOWS\System32\edlin.exe
[2019/03/07 18:56:50 | 000,012,642 | —- | C] () – C:\WINDOWS\System32\dllcache\edlin.exe
[2019/03/07 18:56:50 | 000,008,424 | —- | C] () – C:\WINDOWS\System32\exe2bin.exe
[2019/03/07 18:56:50 | 000,008,424 | —- | C] () – C:\WINDOWS\System32\dllcache\exe2bin.exe
[2019/03/07 18:56:50 | 000,006,708 | —- | C] () – C:\WINDOWS\System32\esentprf.hxx
[2019/03/07 18:56:50 | 000,000,882 | —- | C] () – C:\WINDOWS\System32\fastopen.exe
[2019/03/07 18:56:50 | 000,000,882 | —- | C] () – C:\WINDOWS\System32\dllcache\fastopen.exe
[2019/03/07 18:56:50 | 000,000,081 | —- | C] () – C:\WINDOWS\System32\dsound.vxd
[2019/03/07 18:56:50 | 000,000,080 | —- | C] () – C:\WINDOWS\explorer.scf
[2019/03/07 18:56:47 | 000,355,112 | —- | C] () – C:\WINDOWS\System32\dllcache\msjetol1.dll
[2019/03/07 18:56:47 | 000,240,640 | —- | C] () – C:\WINDOWS\System32\dllcache\wstrendr.ax
[2019/03/07 18:56:47 | 000,240,640 | —- | C] () – C:\WINDOWS\System32\wstrenderer.ax
[2019/03/07 18:56:47 | 000,167,219 | —- | C] () – C:\WINDOWS\System32\pagefileconfig.vbs
[2019/03/07 18:56:47 | 000,167,219 | —- | C] () – C:\WINDOWS\System32\dllcache\pagefile.vbs
[2019/03/07 18:56:47 | 000,097,965 | —- | C] () – C:\WINDOWS\System32\dllcache\evtquery.vbs
[2019/03/07 18:56:47 | 000,097,965 | —- | C] () – C:\WINDOWS\System32\eventquery.vbs
[2019/03/07 18:56:47 | 000,071,859 | —- | C] () – C:\WINDOWS\System32\cliconf.chm
[2019/03/07 18:56:47 | 000,053,840 | —- | C] () – C:\WINDOWS\System32\dosx.exe
[2019/03/07 18:56:47 | 000,053,840 | —- | C] () – C:\WINDOWS\System32\dllcache\dosx.exe
[2019/03/07 18:56:47 | 000,050,620 | —- | C] () – C:\WINDOWS\System32\command.com
[2019/03/07 18:56:47 | 000,042,339 | —- | C] () – C:\WINDOWS\System32\certmgr.msc
[2019/03/07 18:56:47 | 000,041,762 | —- | C] () – C:\WINDOWS\System32\ciadv.msc
[2019/03/07 18:56:47 | 000,041,397 | —- | C] () – C:\WINDOWS\System32\dfrg.msc
[2019/03/07 18:56:47 | 000,040,505 | —- | C] () – C:\WINDOWS\System32\cmdlib.wsc
[2019/03/07 18:56:47 | 000,038,302 | —- | C] () – C:\WINDOWS\System32\compmgmt.msc
[2019/03/07 18:56:47 | 000,033,673 | —- | C] () – C:\WINDOWS\System32\diskmgmt.msc
[2019/03/07 18:56:47 | 000,033,079 | —- | C] () – C:\WINDOWS\System32\devmgmt.msc
[2019/03/07 18:56:47 | 000,027,097 | —- | C] () – C:\WINDOWS\System32\dllcache\country.sys
[2019/03/07 18:56:47 | 000,020,634 | —- | C] () – C:\WINDOWS\System32\dllcache\debug.exe
[2019/03/07 18:56:47 | 000,020,634 | —- | C] () – C:\WINDOWS\System32\debug.exe
[2019/03/07 18:56:47 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2019/03/07 18:56:47 | 000,000,075 | —- | C] () – C:\WINDOWS\System32\View Channels.scf
[2019/03/07 18:56:47 | 000,000,064 | —- | C] () – C:\WINDOWS\System32\cmos.ram
[2019/03/07 18:56:46 | 000,028,420 | —- | C] () – C:\WINDOWS\System32\bios1.rom
[2019/03/07 18:56:46 | 000,012,498 | —- | C] () – C:\WINDOWS\System32\dllcache\append.exe
[2019/03/07 18:56:46 | 000,012,498 | —- | C] () – C:\WINDOWS\System32\append.exe
[2019/03/07 18:56:46 | 000,009,029 | —- | C] () – C:\WINDOWS\System32\dllcache\ansi.sys
[2019/03/07 18:56:46 | 000,008,191 | —- | C] () – C:\WINDOWS\System32\bios4.rom
[2019/03/07 18:56:46 | 000,002,233 | —- | C] () – C:\WINDOWS\System32\dllcache\12520850.cpx
[2019/03/07 18:56:46 | 000,002,233 | —- | C] () – C:\WINDOWS\System32\12520850.cpx
[2019/03/07 18:56:46 | 000,002,151 | —- | C] () – C:\WINDOWS\System32\dllcache\12520437.cpx
[2019/03/07 18:56:46 | 000,002,151 | —- | C] () – C:\WINDOWS\System32\12520437.cpx
[2019/03/07 18:56:46 | 000,000,707 | —- | C] () – C:\WINDOWS\_default.pif
[2010/10/19 10:24:21 | 000,260,272 | RHS- | C] () – C:\cmldr
[2010/10/19 10:21:24 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/10/19 10:21:24 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/10/19 10:21:24 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/10/19 10:21:24 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/10/19 10:21:24 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/10/19 10:17:24 | 003,880,194 | R— | C] () – C:\Documents and Settings\Dave\Desktop\ComboFix.exe
[2010/10/19 00:32:09 | 000,294,912 | —- | C] () – C:\Documents and Settings\Dave\Desktop\44h72ly0.exe
[2010/10/17 21:38:00 | 000,013,590 | —- | C] () – C:\WINDOWS\System32\235.js
[2010/10/17 10:27:08 | 000,000,808 | —- | C] () – C:\Documents and Settings\Dave\Desktop\Norton Installation Files.lnk
[2010/10/16 23:25:07 | 000,000,822 | —- | C] () – C:\Documents and Settings\Dave\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/10/16 22:03:28 | 000,001,936 | —- | C] () – C:\Documents and Settings\Dave\Desktop\cdgone.zip
[2010/10/16 21:00:06 | 000,000,265 | —- | C] () – C:\Boot.bak
[2010/10/15 19:14:48 | 000,016,968 | —- | C] () – C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2010/10/15 19:14:14 | 000,001,670 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Hitman Pro 3.5.lnk
[2010/10/14 21:42:18 | 000,000,703 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/10/13 23:00:23 | 000,000,120 | —- | C] () – C:\WINDOWS\Ezajeruxilexex.dat
[2010/10/13 23:00:23 | 000,000,000 | —- | C] () – C:\WINDOWS\Dgatisadoq.bin
[2010/10/13 22:59:32 | 000,000,278 | -H– | C] () – C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010/10/13 22:59:03 | 000,074,240 | RHS- | C] () – C:\WINDOWS\System32\ir41_qcxt.dll
[2010/10/13 22:59:03 | 000,000,304 | -HS- | C] () – C:\WINDOWS\tasks\LMOMNCB.job
[2010/10/13 22:58:47 | 000,843,776 | —- | C] () – C:\WINDOWS\System32\drivers\smccs.sys
[2010/10/13 22:58:37 | 000,000,195 | —- | C] () – C:\Documents and Settings\Dave\Application Data\jsfhjjsd.bat
[2010/10/13 22:58:36 | 000,030,000 | —- | C] () – C:\WINDOWS\System32\o91jv.dll
[2010/10/13 22:58:36 | 000,030,000 | —- | C] () – C:\WINDOWS\System32\cq85n0n.dll
[2010/10/10 19:45:22 | 000,001,529 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Kidzui Browser.lnk
[2010/10/03 14:54:47 | 006,519,808 | —- | C] () – C:\Documents and Settings\Dave\My Documents\cats.doc
[2010/09/26 08:16:50 | 000,001,922 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2010/03/09 20:01:21 | 000,001,734 | —- | C] () – C:\Documents and Settings\Dave\Application Data\wklnhst.dat
[2009/08/31 14:00:22 | 000,021,504 | —- | C] () – C:\WINDOWS\System32\WBCustomizer.dll
[2009/08/31 14:00:21 | 000,185,344 | —- | C] () – C:\WINDOWS\System32\MemWarp.dll
[2009/07/08 19:12:35 | 000,000,108 | —- | C] () – C:\WINDOWS\ka.ini
[2009/04/05 17:04:03 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\FsUsbExDevice.Dll
[2009/04/05 17:04:03 | 000,036,608 | —- | C] () – C:\WINDOWS\System32\FsUsbExDisk.Sys
[2009/04/05 17:03:15 | 000,002,528 | —- | C] () – C:\Documents and Settings\Dave\Application Data\$_hpcst$.hpc
[2008/04/15 23:51:07 | 000,043,520 | —- | C] () – C:\WINDOWS\System32\CmdLineExt03.dll
[2008/04/15 23:46:03 | 000,020,102 | —- | C] () – C:\Program Files\Readme.txt
[2008/04/15 23:46:03 | 000,010,960 | —- | C] () – C:\Program Files\EULA.txt
[2008/04/15 23:46:03 | 000,000,349 | —- | C] () – C:\Program Files\INSTALL.LOG
[2008/02/12 14:01:39 | 000,000,249 | —- | C] () – C:\WINDOWS\SIERRA.INI
[2008/01/20 19:39:19 | 000,000,419 | —- | C] () – C:\WINDOWS\BRWMARK.INI
[2008/01/20 19:39:19 | 000,000,027 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2008/01/20 18:42:22 | 000,031,567 | —- | C] () – C:\WINDOWS\maxlink.ini
[2007/10/25 17:26:10 | 000,005,632 | —- | C] () – C:\WINDOWS\System32\drivers\StarOpen.sys
[2007/07/28 20:53:09 | 000,003,654 | —- | C] () – C:\WINDOWS\System32\drivers\Sonyhcp.dll
[2007/03/27 08:55:48 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2007/02/17 15:01:24 | 000,000,059 | —- | C] () – C:\WINDOWS\Tiny_Run.ini
[2007/01/28 23:04:04 | 000,000,027 | —- | C] () – C:\WINDOWS\ic.ini
[2007/01/02 00:59:02 | 000,000,025 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2006/12/27 17:15:35 | 000,001,267 | —- | C] () – C:\WINDOWS\disney.ini
[2006/12/12 17:24:42 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\DivXWMPExtType.dll
[2006/10/20 11:01:40 | 000,000,154 | —- | C] () – C:\WINDOWS\adidsl.ini
[2006/10/20 11:01:40 | 000,000,021 | —- | C] () – C:\WINDOWS\Fast800.ini
[2006/10/20 11:01:35 | 000,000,342 | —- | C] () – C:\WINDOWS\adiras.ini
[2006/10/20 11:01:34 | 000,126,976 | —- | C] () – C:\WINDOWS\System32\coclassfast.dll
[2006/10/20 11:01:33 | 000,046,892 | —- | C] () – C:\WINDOWS\System32\adadix16.dll
[2006/10/14 23:48:10 | 091,254,802 | —- | C] () – C:\Program Files\411EFACA-F297-4B19-8B7C-5367779A63C1.zip
[2006/10/14 23:15:15 | 000,021,840 | —- | C] () – C:\WINDOWS\System32\SIntfNT.dll
[2006/10/14 23:15:15 | 000,017,212 | —- | C] () – C:\WINDOWS\System32\SIntf32.dll
[2006/10/14 23:15:15 | 000,012,067 | —- | C] () – C:\WINDOWS\System32\SIntf16.dll
[2006/09/27 17:38:52 | 000,175,104 | —- | C] () – C:\Documents and Settings\Dave\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/09/27 17:11:58 | 000,000,127 | —- | C] () – C:\Documents and Settings\Dave\Local Settings\Application Data\fusioncache.dat
[2006/09/21 10:16:22 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/09/21 09:11:18 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\hcwxds.dll
[2006/08/11 21:45:20 | 000,581,632 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[2006/08/11 21:43:10 | 000,196,608 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2006/08/11 21:43:00 | 001,662,976 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2006/08/11 21:43:00 | 001,470,464 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2006/08/11 21:43:00 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2006/08/11 21:43:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/08/11 21:43:00 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2005/12/02 10:23:12 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2005/12/02 09:38:58 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2005/09/19 16:50:42 | 000,090,112 | —- | C] () – C:\WINDOWS\System32\btprn2k.dll
[2005/08/05 15:01:54 | 000,235,008 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/07/13 05:49:00 | 000,003,264 | —- | C] () – C:\WINDOWS\System32\drivers\BFAIFILT.SYS
[2004/05/28 03:43:00 | 000,003,264 | —- | C] () – C:\WINDOWS\System32\drivers\AIFILT.SYS
[2003/01/07 16:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/02/07 09:28:16 | 000,005,810 | —- | C] () – C:\WINDOWS\System32\drivers\ASACPI.sys
[2001/11/14 14:56:00 | 001,802,240 | —- | C] () – C:\WINDOWS\System32\lcppn21.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 4348 bytes -> C:\WINDOWS\MESH_SKY.BMP:$Q30lsldxJoudresxAaaqpcawXc
@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8

< End of report >

oldman960

Post #21October 19, 2010, 11:53 AM UTC last edited October 19, 2010, 11:53 AM UTC

Hi say-no-2-trojans,

Let's see if we can get combofix to run in safe mode.

If combofix reboots your computer make sure you boot back into safe mode. Let it finish, save the log then boot to normal windows and post the log.

First locate combofix.exe on your desktop, right click it and select delete.

Download another copy from Link 1with these instructions and save it to your Desktop. Do not run it yet.

If you are using Firefox, make sure that your download settings are as follows:
-Tools->Options->Main tab
-Set to "Always ask me where to Save the files".
During the download, before you save it to your desktop, rename Combofix to jgh.exe

*It is important you rename Combofix during the download, but not after.*

Please then reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.

In Safe Mode, double click in jgh.exe to run combofix.

Please post the log.

say-no-2-trojans

Post #22October 19, 2010, 3:20 PM UTC

Finally worked: ComboFix 10-10-18.05 - Dave 19/10/2010 15:54:24.3.2 - x86 MINIMAL Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.1023.705 [GMT 1:00] Running from: c:\documents and settings\[removed]\Desktop\jgh.exe AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8} FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat c:\documents and settings\All Users\Documents\Server\admin.txt c:\documents and settings\All Users\Favorites\ehthumbs.db c:\documents and settings\Dave\Application Data\Ymkool c:\documents and settings\Dave\Application Data\Ymkool\uwumk.ims c:\documents and settings\Dave\Favorites\ehthumbs.db c:\documents and settings\Dave\Local Settings\Application Data\{300CF2AA-2C59-4504-AD4C-3C0581014983} c:\documents and settings\Dave\Local Settings\Application Data\{300CF2AA-2C59-4504-AD4C-3C0581014983}\chrome.manifest c:\documents and settings\Dave\Local Settings\Application Data\{300CF2AA-2C59-4504-AD4C-3C0581014983}\chrome\content\_cfg.js c:\documents and settings\Dave\Local Settings\Application Data\{300CF2AA-2C59-4504-AD4C-3C0581014983}\chrome\content\overlay.xul c:\documents and settings\Dave\Local Settings\Application Data\{300CF2AA-2C59-4504-AD4C-3C0581014983}\install.rdf c:\program files\INSTALL.LOG c:\windows\Downloaded Program Files\ODCTOOLS c:\windows\exvpsvev.dll c:\windows\system32\Cache c:\windows\system32\cq85n0n.dll c:\windows\system32\drivers\smccs.sys c:\windows\system32\images c:\windows\system32\images\3models.gif c:\windows\system32\images\but3_off.gif c:\windows\system32\images\but3_on.gif c:\windows\system32\images\main_bot.gif c:\windows\system32\images\main_mid.gif c:\windows\system32\images\main_top.gif c:\windows\system32\images\model1.gif c:\windows\system32\images\panel_bot.gif c:\windows\system32\images\panel_top.gif c:\windows\system32\images\pc.gif c:\windows\system32\images\pcw_award_cover.gif c:\windows\system32\images\pcwcover.gif c:\windows\system32\images\Thumbs.db c:\windows\system32\images\topoff.gif c:\windows\system32\images\topon.gif c:\windows\system32\images\webscreen.gif c:\windows\system32\o91jv.dll c:\windows\system32\Thumbs.db —– BITS: Possible infected sites —– hxxp://liveupdate.symantecliveupdate.com . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . ——-\Legacy_smccs ——-\Service_smccs ((((((((((((((((((((((((( Files Created from 2010-09-19 to 2010-10-19 ))))))))))))))))))))))))))))))) . 2067-05-27 14:16 . 2007-02-27 20:49 1249280 —-a-w- c:\program files\Microsoft Games\Impossible Creatures\InsectMod.dll 2067-05-21 21:35 . 2003-06-05 16:40 106496 —-a-w- c:\program files\Microsoft Games\Impossible Creatures\Filesystem.dll 2019-03-07 17:56 . 2010-10-15 18:19 507904 —-a-w- c:\windows\system32\dllcache\winlogon.exe 2019-03-07 17:53 . 2019-03-07 17:53 ——– d—–w- C:\cmpnents 2010-10-19 14:37 . 2010-10-19 14:37 ——– d—–w- c:\documents and settings\Dave\Application Data\Tific 2010-10-18 23:07 . 2010-10-18 23:07 ——– d—–w- C:\_OTL 2010-10-17 09:55 . 2010-10-17 09:55 ——– d—–w- c:\windows\system32\Registry Patrol 2010-10-17 09:55 . 2010-10-17 18:03 ——– d—–w- c:\program files\Registry Patrol 2010-10-16 22:59 . 2010-10-16 22:59 ——– d—–w- c:\documents and settings\Dave\Application Data\Malwarebytes 2010-10-16 22:55 . 2008-04-14 00:12 1033728 -c–a-w- c:\windows\system32\dllcache\explorer.exe 2010-10-16 22:55 . 2008-04-14 00:12 1033728 —-a-w- c:\windows\explorer.exe 2010-10-16 22:29 . 2010-10-16 22:29 ——– d—–w- c:\documents and settings\Dave\Application Data\Uniblue 2010-10-16 22:29 . 2010-10-16 22:29 ——– d—–w- c:\program files\Uniblue 2010-10-15 18:14 . 2010-10-19 15:10 16968 —-a-w- c:\windows\system32\drivers\hitmanpro35.sys 2010-10-15 18:14 . 2010-10-15 18:14 ——– d—–w- c:\program files\Hitman Pro 3.5 2010-10-15 18:13 . 2010-10-17 21:40 ——– d—–w- c:\documents and settings\All Users\Application Data\Hitman Pro 2010-10-14 20:42 . 2010-10-14 20:42 ——– d—–w- c:\documents and settings\Siobhan\Application Data\Malwarebytes 2010-10-14 20:42 . 2010-04-29 14:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-10-14 20:42 . 2010-10-15 22:21 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-10-14 20:42 . 2010-10-14 20:42 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-10-14 20:42 . 2010-04-29 14:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-10-14 19:50 . 2010-10-14 19:50 ——– d-sh–w- c:\documents and settings\LocalService\PrivacIE 2010-10-14 19:49 . 2010-10-14 19:49 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache 2010-10-14 09:19 . 2010-10-14 09:19 110080 —-a-r- c:\documents and settings\Siobhan\Application Data\Microsoft\Installer\{9EFA7323-47A0-48E2-8F77-35DB5EED500A}\IconF7A21AF7.exe 2010-10-14 09:19 . 2010-10-14 09:19 110080 —-a-r- c:\documents and settings\Siobhan\Application Data\Microsoft\Installer\{9EFA7323-47A0-48E2-8F77-35DB5EED500A}\IconD7F16134.exe 2010-10-14 09:19 . 2010-10-14 09:19 ——– d—–w- C:\sh4ldr 2010-10-14 09:19 . 2010-10-14 09:19 ——– d—–w- c:\program files\Enigma Software Group 2010-10-14 09:19 . 2010-10-14 09:19 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard 2010-10-14 09:00 . 2010-10-14 09:00 ——– d—–w- c:\documents and settings\Siobhan\Local Settings\Application Data\Threat Expert 2010-10-14 08:42 . 2010-10-14 08:42 ——– d—–w- c:\documents and settings\Siobhan\Application Data\KidZui 2010-10-14 08:34 . 2010-10-17 01:32 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP 2010-10-14 03:11 . 2010-10-14 09:37 ——– d—–w- c:\documents and settings\Siobhan\Local Settings\Application Data\NPE 2010-10-13 22:00 . 2010-10-18 18:39 0 —-a-w- c:\windows\Dgatisadoq.bin 2010-10-13 21:59 . 2010-10-13 21:59 74240 –sha-r- c:\windows\system32\ir41_qcxt.dll 2010-10-13 21:58 . 2010-10-13 21:58 195 —-a-w- c:\documents and settings\Dave\Application Data\jsfhjjsd.bat 2010-10-13 06:54 . 2010-09-18 06:53 974848 -c—-w- c:\windows\system32\dllcache\mfc42.dll 2010-10-13 06:54 . 2010-09-18 06:53 953856 -c—-w- c:\windows\system32\dllcache\mfc40u.dll 2010-10-13 06:54 . 2010-08-23 16:12 617472 -c—-w- c:\windows\system32\dllcache\comctl32.dll 2010-10-10 19:20 . 2010-10-10 19:20 ——– d—–w- c:\documents and settings\Dave\Application Data\KidZui 2010-10-10 18:45 . 2010-10-10 18:45 ——– d—–w- c:\documents and settings\Katie\Application Data\KidZui 2010-10-10 18:45 . 2010-10-10 18:45 ——– d—–w- c:\program files\Kidzui 2010-10-10 16:14 . 2010-10-10 16:14 ——– d—–w- c:\program files\MSECache 2010-09-26 07:14 . 2010-09-26 07:14 ——– d—–w- c:\documents and settings\Siobhan\Local Settings\Application Data\Temp . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . . ——- Sigcheck ——- [-] 2010-10-15 . 3FC15946D03850C2BCE7FFBA7C86C2C6 . 507904 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\winlogon.exe [-] 2010-10-15 . 3FC15946D03850C2BCE7FFBA7C86C2C6 . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe [7] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\winlogon.exe [-] 2004-08-10 . 01C3346C241652F43AED8E2149881BFE . 502272 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\winlogon.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2009-01-08 98304] "msnmsgr"="c:\progra~1\MSNMES~1\msnmsgr.exe" [2005-09-19 7083056] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "Shockwave Updater"="c:\windows\system32\Adobe\Shockwave 11\SwHelper_1150595.exe" [2009-03-19 460216] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-09-16 149280] "Ptipbmf"="ptipbmf.dll" [2003-06-20 118784] "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 61952] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-11 7630848] "nwiz"="nwiz.exe" [2006-08-11 1519616] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-11 86016] "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472] "PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-29 30248] "IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-29 46632] "PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-02-15 141608] "HitmanPro35"="c:\program files\Hitman Pro 3.5\HitmanPro35.exe" [2010-10-15 6238016] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2008-04-14 53760] c:\documents and settings\Dave\Start Menu\Programs\Startup\ PMB Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2009-8-23 333088] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2005-9-19 581693] DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2006-9-28 962663] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk backup=c:\windows\pss\Bluetooth.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd] 2007-03-12 14:51 663552 ——w- c:\program files\Brother\Brmfcmon\BrMfcWnd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3] 2007-01-26 15:58 65536 ——w- c:\program files\Brother\ControlCenter3\BrCtrCen.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] 2008-04-14 00:12 15360 —-a-w- c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core] 2008-07-21 13:07 2752512 —-a-w- c:\program files\Electronic Arts\EADM\Core.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] 2008-04-14 00:12 1695232 –sh–w- c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] 2005-09-19 00:02 7083056 —-a-w- c:\program files\MSN Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService] 2005-01-14 18:21 110744 —-a-w- c:\program files\CyberLink\PowerCinema\PCMService.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Power2GoExpress] 2005-09-19 00:02 7083056 —-a-w- c:\program files\MSN Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2009-11-10 23:08 417792 —-a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] 2004-11-02 20:24 32768 —-a-w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{1290A33C-85F5-4164-A1BE-7DD299D4986A}] 2004-06-08 18:33 69721 —-a-w- c:\program files\CyberLink\PowerBackup\PBKScheduler.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\CyberLink\\PowerCinema\\PowerCinema.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Samsung\\Samsung New PC Studio\\npsasvr.exe"= "c:\\Program Files\\Samsung\\Samsung New PC Studio\\npsvsvr.exe"= "c:\\Program Files\\Kalypso\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1201000.025\SymDS.sys [08/09/2010 22:26 339504] R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1201000.025\SymEFA.sys [08/09/2010 22:26 666672] R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20101001.001\BHDrvx86.sys [06/10/2010 07:55 692272] R1 HCW88AUD;Hauppauge WinTV 88x Audio Capture;c:\windows\system32\drivers\hcw88aud.sys [21/09/2006 09:11 11970] R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1201000.025\Ironx86.sys [08/09/2010 22:26 134704] R2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [05/04/2009 17:04 233472] R2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe [08/09/2010 22:26 126904] R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;c:\windows\system32\drivers\atl01_xp.sys [13/09/2006 23:57 34944] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [10/09/2010 20:19 102448] R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [05/04/2009 17:04 36608] R3 HCW88BDA;Hauppauge WinTV 88x DVB Tuner/Demod;c:\windows\system32\drivers\hcw88bda.sys [21/09/2006 09:11 138304] R3 HCW88TSE;Hauppauge WinTV 88x MPEG/TS Capture;c:\windows\system32\drivers\hcw88tse.sys [21/09/2006 09:11 298307] R3 HCW88TUNE;Hauppauge WinTV 88x Tuner;c:\windows\system32\drivers\hcw88tun.sys [21/09/2006 09:11 141889] R3 hcw88vid;Hauppauge WinTV 88x Video;c:\windows\system32\drivers\hcw88vid.sys [21/09/2006 09:11 493632] R3 HCW88XBAR;Hauppauge WinTV 88x Crossbar;c:\windows\system32\drivers\hcw88bar.sys [21/09/2006 09:11 23104] R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20101015.005\IDSXpx86.sys [13/10/2010 20:59 341880] S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [01/06/2010 19:04 136176] S3 bfastfao;bfastfao;\??\c:\docume~1\Dave\LOCALS~1\Temp\bfastfao.sys –> c:\docume~1\Dave\LOCALS~1\Temp\bfastfao.sys [?] S3 U2KG54L;BUFFALO WLI-U2-KG54L Wireless LAN Driver;c:\windows\system32\drivers\U2KG54L.SYS [24/08/2006 05:44 477696] S4 m5287;m5287;c:\windows\system32\drivers\m5287.sys [02/12/2005 18:08 85888] S4 m5289;m5289;c:\windows\system32\drivers\m5289.sys [02/12/2005 18:08 51840] — Other Services/Drivers In Memory — *NewlyCreated* - FSUSBEXDISK . Contents of the 'Scheduled Tasks' folder 2010-06-07 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] 2010-10-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-01 18:04] 2010-10-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-01 18:04] . . ——- Supplementary Scan ——- . uStart Page = hxxp://uk.yahoo.com/?p=us mWindow Title = Tiscali Internet Access uInternet Connection Wizard,ShellNext = iexplore IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm . - - - - ORPHANS REMOVED - - - - HKCU-Run-PowerBar - (no file) HKCU-Run-RegistryBooster - c:\program files\Uniblue\RegistryBooster\launcher.exe HKCU-Run-Rpodabexobed - c:\windows\exvpsvev.dll HKLM-Run-adiras - adiras.exe HKLM-Run-NPSStartup - (no file) [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIS] "ImagePath"="\"c:\program files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\18.1.0.37\diMaster.dll\" /prefetch:1" . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_USERS\S-1-5-21-226113513-3097384743-832189314-1007\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:17,eb,4c,47,3f,de,ac,19,ff,03,de,c2,ae,f1,28,18,d0,9e,f7,4a,70,c5,01, 9e,a8,2e,dd,e6,90,26,77,04,9d,ae,7f,78,ce,ee,2e,e3,56,38,6b,e9,6d,ba,4e,a9,\ "??"=hex:d9,eb,e8,87,54,a1,8d,80,f0,7a,3a,0f,c2,c7,4d,2a [HKEY_USERS\S-1-5-21-226113513-3097384743-832189314-1007\Software\SecuROM\License information*] "datasecu"=hex:71,b0,38,3a,9e,38,28,54,14,3d,84,3a,cf,cb,63,d7,39,05,39,e0,ef, 7c,2e,40,58,fa,c1,56,50,6a,2c,31,99,b5,61,bb,6d,9e,f3,6c,c6,96,6d,be,aa,cc,\ "rkeysecu"=hex:e2,26,6d,94,9c,ba,ad,1d,64,79,70,1b,d8,19,de,23 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . ——————— DLLs Loaded Under Running Processes ——————— - - - - - - - > 'explorer.exe'(2092) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\btncopy.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ———————— Other Running Processes ———————— . c:\windows\system32\rundll32.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe c:\program files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe c:\program files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe c:\program files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe c:\windows\eHome\ehRecvr.exe c:\windows\eHome\ehSched.exe c:\program files\Common Files\EPSON\EBAPI\SAgent2.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\windows\system32\nvsvc32.exe c:\windows\ehome\mcrdsvc.exe c:\windows\system32\dllhost.exe c:\windows\system32\wscntfy.exe c:\windows\eHome\ehmsas.exe c:\program files\Windows Media Player\WMPNetwk.exe c:\program files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2010-10-19 16:14:27 - machine was rebooted ComboFix-quarantined-files.txt 2010-10-19 15:14 Pre-Run: 167,720,910,848 bytes free Post-Run: 167,579,754,496 bytes free - - End Of File - - 12FCBB2DC1907C4A330C14EAC8AB499E

oldman960

Post #23October 19, 2010, 6:55 PM UTC

Hi say-no-2-trojans,

Good job.

More files to scan.

We need some file informantion

Make sure to use Internet Explorer for this
Please go to VirSCAN.org FREE on-line scan service
Make sure Show Hidden files are enabled.
Please submit the following files, one at a time if more than file is listed, into the "Suspicious files to scan" box on the top of the page:

C:\WINDOWS\System32\ir41_qcxt.dll
c:\program files\Microsoft Games\Impossible Creatures\InsectMod.dll
c:\program files\Microsoft Games\Impossible Creatures\Filesystem.dll
Click on the Upload button
Please ensure the scan is complete and the results saved before submitting the next.
If a pop-up appears saying the file has been scanned already, please select the ReScan button.
Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
Paste the contents of the Clipboard in your next reply.

We will be using Combofix again but will run it differently.

Please follow all previous instructions regarding security programs.

Open a new Notepad session

Click the Start button, click run
in the run box type notepad
click ok
In the notepad, Click "Format" and be certain that Word Wrap is not checked.
Copy and paste all the all of the text in the code box below into the Notepad, (including the URL). Do Not copy the word CODE

http://forums.whatthetech.com/index.php?showtopic=115103&st=15

Collect::
C:\WINDOWS\System32\ir41_qcxt.dll

File::
C:\WINDOWS\tasks\LMOMNCB.job
C:\WINDOWS\Ezajeruxilexex.dat
C:\WINDOWS\Dgatisadoq.bin
C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
C:\Documents and Settings\Dave\Application Data\jsfhjjsd.bat

Fcopy::
c:\windows\ServicePackFiles\i386\winlogon.exe | c:\windows\system32\winlogon.exe
c:\windows\ServicePackFiles\i386\winlogon.exe | c:\windows\system32\dllcache\winlogon.exe

Dirlook::
C:\cmpnents
c:\documents and settings\Dave\Application Data\Tific

In the notepad

Click File, Save as…, and set the Save in to your Desktop
In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
Click save

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

**Note**

When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.

Please post back with

VirScan results
combofix log

How's the computer?

Thanks

say-no-2-trojans

Post #24October 19, 2010, 8:10 PM UTC

Even showing all hidden Files the following file can't be found

C:\WINDOWS\System32\ir41_qcxt.dll

Here are the other 2 reports:

VirSCAN.org Scanned Report :
Scanned time : 2010/10/19 20:42:36 (BST)
Scanner results: Scanners did not find malware!
File Name : InsectMod.dll
File Size : 1249280 byte
File Type : PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bi
MD5 : 0cae0264c650610cea2de7a87f7fc750
SHA1 : a86af5e6f3a29d7a9986d968e51d2e152acf8b54
Online report : http://virscan.org/report/34ce5ce0ceb50a31…db6ad0283f.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 5.0.0.20 20101019050622 2010-10-19 40.09 -
AhnLab V3 2010.10.19.02 2010.10.19 2010-10-19 40.09 -
AntiVir 8.2.4.82 7.10.12.252 2010-10-19 0.28 -
Antiy 2.0.18 20101019.5466701 2010-10-19 0.02 -
Arcavir 2010 201010200054 2010-10-20 0.12 -
Authentium 5.1.1 201010191003 2010-10-19 2.51 -
AVAST! 4.7.4 101019-1 2010-10-19 0.09 -
AVG 8.5.850 271.1.1/3206 2010-10-19 0.28 -
BitDefender 7.90123.6355926 7.34337 2010-10-20 4.90 -
ClamAV 0.96.3 12154 2010-10-19 0.21 -
Comodo 4.0 6443 2010-10-19 40.09 -
CP Secure 1.3.0.5 2010.10.20 2010-10-20 0.43 -
Dr.Web 5.0.2.3300 2010.10.20 2010-10-20 9.94 -
F-Prot 4.4.4.56 20101019 2010-10-19 2.53 -
F-Secure 7.02.73807 2010.10.19.05 2010-10-19 9.03 -
Fortinet 4.2.249 12.470 2010-10-18 40.09 -
GData 21.991/21.417 20101019 2010-10-19 40.09 -
ViRobot 20101019 2010.10.19 2010-10-19 40.09 -
Ikarus T3.1.32.15.0 2010.10.19.76973 2010-10-19 5.11 -
JiangMin 13.0.900 2010.10.19 2010-10-19 40.09 -
Kaspersky 5.5.10 2010.10.19 2010-10-19 0.14 -
KingSoft 2009.2.5.15 2010.10.19.18 2010-10-19 40.09 -
McAfee 5400.1158 6141 2010-10-19 19.41 -
Microsoft 1.6301 2010.10.19 2010-10-19 40.09 -
Norman 6.06.07 6.06.00 2010-10-19 8.02 -
Panda 9.05.01 2010.10.17 2010-10-17 15.64 -
Trend Micro 9.120-1004 7.552.12 2010-10-19 0.04 -
Quick Heal 11.00 2010.10.19 2010-10-19 40.09 -
Rising 20.0 22.70.01.04 2010-10-19 40.09 -
Sophos 3.12.1 4.58 2010-10-20 4.14 -
Sunbelt 3.9.2455.2 7094 2010-10-19 40.09 -
Symantec 1.3.0.24 20101019.004 2010-10-19 0.06 -
nProtect 20101019.01 9167579 2010-10-19 40.09 -
The Hacker 6.7.0.1 v00060 2010-10-19 40.09 -
VBA32 3.12.14.1 20101019.0912 2010-10-19 3.97 -
VirusBuster 4.5.11.10 10.129.18/1998491 2010-10-19 3.21 -

VirSCAN.org Scanned Report :
Scanned time : 2010/10/19 21:03:34 (BST)
Scanner results: Scanners did not find malware!
File Name : Filesystem.dll
File Size : 106496 byte
File Type : PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bi
MD5 : cf9e0c256a8375344f25ba56a196f7d3
SHA1 : 85a0bcf8dce0e6416ca9804890c46f0eb8b21d0d
Online report : http://virscan.org/report/73bf0d80bd70058a…ae08e55f52.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 5.0.0.20 20101019050622 2010-10-19 11.82 -
AhnLab V3 2010.10.19.02 2010.10.19 2010-10-19 40.09 -
AntiVir 8.2.4.82 7.10.12.252 2010-10-19 2.43 -
Antiy 2.0.18 20101019.5466701 2010-10-19 0.02 -
Arcavir 2010 201010200054 2010-10-20 0.12 -
Authentium 5.1.1 201010191003 2010-10-19 1.44 -
AVAST! 4.7.4 101019-1 2010-10-19 0.01 -
AVG 8.5.850 271.1.1/3206 2010-10-19 1.25 -
BitDefender 7.90123.6355926 7.34337 2010-10-20 4.73 -
ClamAV 0.96.3 12154 2010-10-19 0.04 -
Comodo 4.0 6443 2010-10-19 6.55 -
CP Secure 1.3.0.5 2010.10.20 2010-10-20 0.07 -
Dr.Web 5.0.2.3300 2010.10.20 2010-10-20 9.68 -
F-Prot 4.4.4.56 20101019 2010-10-19 1.43 -
F-Secure 7.02.73807 2010.10.19.05 2010-10-19 0.20 -
Fortinet 4.2.249 12.470 2010-10-18 0.93 -
GData 21.991/21.417 20101019 2010-10-19 40.09 -
ViRobot 20101019 2010.10.19 2010-10-19 5.81 -
Ikarus T3.1.32.15.0 2010.10.19.76973 2010-10-19 5.05 -
JiangMin 13.0.900 2010.10.19 2010-10-19 2.95 -
Kaspersky 5.5.10 2010.10.19 2010-10-19 0.14 -
KingSoft 2009.2.5.15 2010.10.19.18 2010-10-19 4.81 -
McAfee 5400.1158 6141 2010-10-19 19.16 -
Microsoft 1.6301 2010.10.19 2010-10-19 29.16 -
Norman 6.06.07 6.06.00 2010-10-19 8.01 -
Panda 9.05.01 2010.10.17 2010-10-17 27.12 -
Trend Micro 9.120-1004 7.552.12 2010-10-19 0.04 -
Quick Heal 11.00 2010.10.19 2010-10-19 40.09 -
Rising 20.0 22.70.01.04 2010-10-19 1.73 -
Sophos 3.12.1 4.58 2010-10-20 4.12 -
Sunbelt 3.9.2455.2 7094 2010-10-19 27.00 -
Symantec 1.3.0.24 20101019.004 2010-10-19 0.29 -
nProtect 20101019.01 9167579 2010-10-19 10.15 -
The Hacker 6.7.0.1 v00060 2010-10-19 0.49 -
VBA32 3.12.14.1 20101019.0912 2010-10-19 3.73 -
VirusBuster 4.5.11.10 10.129.18/1998491 2010-10-19 2.45 -

Combofix log to follow

say-no-2-trojans

Post #25October 19, 2010, 8:35 PM UTC

There's no Combofix log again - shall I run in Safe Mode?

oldman960

Post #26October 20, 2010, 8:13 AM UTC

Hi say-no-2-trojans, Something is interfering with combofix. Did you have Norton disabled? Did combofix even start to scan your computer? Please describe what you saw on your screen and the events when you ran combofix. Yes run combofix in safe mode with the last set of instructions. Be sure to boot back to safe mode is a reboot is required. Thanks

say-no-2-trojans

Post #27October 20, 2010, 10:11 PM UTC

Yes Norton was disabled Combofix did start the scan and got all the way to stage 50, but it did not get to the 'creating log' stage. Just ran in Safe Mode and log is included below. Whilst running a window popped up stating: 'The instruction at "0x0050005c" referenced memory at "0x0050005c". The memory could not be read. Options were to terminate program or debug - I clicked terminate, though nothing else happened at Combofix continued scanning. Once the logs had been created another window popped up saying that further files needed to be scanned for malware and to make sure that the computer was connected to the internet. Don't think it can in Safe Mode, so couldn't continue to scan these files so detailed where to find the file path of them. Just been there and the file listed is: C:\Qoobox\Quarantine\[4]-Submit_2010-10-20_22.32.01.zip This html page says to submit the file for scanning - I haven't done it Incidently, to answer your earlier question the computer is running much better than before thanks, though a little slow to start. Problems experiencing: - On start up only (not on restart) after first black screen the following message is displayed Windows could not start because the following file is missing or corrupt: \System32\hal.dll Please reinstall a copy of the above file - Norton detected 7 tracking cookies yesterday though nothing so far today (first time since these problems arose) Nothing else untoward has reared it's ugly head for a while! Combofix log: ComboFix 10-10-19.04 - Dave 20/10/2010 22:32:06.5.2 - x86 MINIMAL Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.1023.804 [GMT 1:00] Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Dave\Desktop\CFScript.txt AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8} FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220} FILE :: "c:\documents and settings\Dave\Application Data\jsfhjjsd.bat" "c:\windows\Dgatisadoq.bin" "c:\windows\Ezajeruxilexex.dat" "c:\windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job" "c:\windows\tasks\LMOMNCB.job" file zipped: c:\windows\System32\ir41_qcxt.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Dave\Application Data\jsfhjjsd.bat c:\windows\Dgatisadoq.bin c:\windows\Ezajeruxilexex.dat c:\windows\System32\ir41_qcxt.dll . ————— FCopy ————— c:\windows\ServicePackFiles\i386\winlogon.exe –> c:\windows\system32\winlogon.exe c:\windows\ServicePackFiles\i386\winlogon.exe –> c:\windows\system32\dllcache\winlogon.exe . ((((((((((((((((((((((((( Files Created from 2010-09-20 to 2010-10-20 ))))))))))))))))))))))))))))))) . 2067-05-27 14:16 . 2007-02-27 20:49 1249280 —-a-w- c:\program files\Microsoft Games\Impossible Creatures\InsectMod.dll 2067-05-21 21:35 . 2003-06-05 16:40 106496 —-a-w- c:\program files\Microsoft Games\Impossible Creatures\Filesystem.dll 2019-03-07 17:56 . 2010-09-10 05:58 916480 —-a-w- c:\windows\system32\wininet.dll 2019-03-07 17:53 . 2019-03-07 17:53 ——– d—–w- C:\cmpnents 2010-10-20 19:14 . 2010-10-20 19:15 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp 2010-10-19 14:37 . 2010-10-19 14:37 ——– d—–w- c:\documents and settings\Dave\Application Data\Tific 2010-10-18 23:07 . 2010-10-18 23:07 ——– d—–w- C:\_OTL 2010-10-17 09:55 . 2010-10-17 09:55 ——– d—–w- c:\windows\system32\Registry Patrol 2010-10-17 09:55 . 2010-10-17 18:03 ——– d—–w- c:\program files\Registry Patrol 2010-10-16 22:59 . 2010-10-16 22:59 ——– d—–w- c:\documents and settings\Dave\Application Data\Malwarebytes 2010-10-16 22:55 . 2008-04-14 00:12 1033728 -c–a-w- c:\windows\system32\dllcache\explorer.exe 2010-10-16 22:55 . 2008-04-14 00:12 1033728 —-a-w- c:\windows\explorer.exe 2010-10-16 22:29 . 2010-10-16 22:29 ——– d—–w- c:\documents and settings\Dave\Application Data\Uniblue 2010-10-16 22:29 . 2010-10-16 22:29 ——– d—–w- c:\program files\Uniblue 2010-10-15 18:14 . 2010-10-20 19:15 16968 —-a-w- c:\windows\system32\drivers\hitmanpro35.sys 2010-10-15 18:14 . 2010-10-15 18:14 ——– d—–w- c:\program files\Hitman Pro 3.5 2010-10-15 18:13 . 2010-10-17 21:40 ——– d—–w- c:\documents and settings\All Users\Application Data\Hitman Pro 2010-10-14 20:42 . 2010-10-14 20:42 ——– d—–w- c:\documents and settings\Siobhan\Application Data\Malwarebytes 2010-10-14 20:42 . 2010-04-29 14:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-10-14 20:42 . 2010-10-15 22:21 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-10-14 20:42 . 2010-10-14 20:42 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-10-14 20:42 . 2010-04-29 14:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-10-14 19:50 . 2010-10-14 19:50 ——– d-sh–w- c:\documents and settings\LocalService\PrivacIE 2010-10-14 19:49 . 2010-10-14 19:49 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache 2010-10-14 09:19 . 2010-10-14 09:19 110080 —-a-r- c:\documents and settings\Siobhan\Application Data\Microsoft\Installer\{9EFA7323-47A0-48E2-8F77-35DB5EED500A}\IconF7A21AF7.exe 2010-10-14 09:19 . 2010-10-14 09:19 110080 —-a-r- c:\documents and settings\Siobhan\Application Data\Microsoft\Installer\{9EFA7323-47A0-48E2-8F77-35DB5EED500A}\IconD7F16134.exe 2010-10-14 09:19 . 2010-10-14 09:19 ——– d—–w- C:\sh4ldr 2010-10-14 09:19 . 2010-10-14 09:19 ——– d—–w- c:\program files\Enigma Software Group 2010-10-14 09:19 . 2010-10-14 09:19 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard 2010-10-14 09:00 . 2010-10-14 09:00 ——– d—–w- c:\documents and settings\Siobhan\Local Settings\Application Data\Threat Expert 2010-10-14 08:42 . 2010-10-14 08:42 ——– d—–w- c:\documents and settings\Siobhan\Application Data\KidZui 2010-10-14 08:34 . 2010-10-17 01:32 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP 2010-10-14 03:11 . 2010-10-14 09:37 ——– d—–w- c:\documents and settings\Siobhan\Local Settings\Application Data\NPE 2010-10-13 06:54 . 2010-09-18 06:53 974848 -c—-w- c:\windows\system32\dllcache\mfc42.dll 2010-10-13 06:54 . 2010-09-18 06:53 953856 -c—-w- c:\windows\system32\dllcache\mfc40u.dll 2010-10-13 06:54 . 2010-08-23 16:12 617472 -c—-w- c:\windows\system32\dllcache\comctl32.dll 2010-10-10 19:20 . 2010-10-10 19:20 ——– d—–w- c:\documents and settings\Dave\Application Data\KidZui 2010-10-10 18:45 . 2010-10-10 18:45 ——– d—–w- c:\documents and settings\Katie\Application Data\KidZui 2010-10-10 18:45 . 2010-10-10 18:45 ——– d—–w- c:\program files\Kidzui 2010-10-10 16:14 . 2010-10-10 16:14 ——– d—–w- c:\program files\MSECache 2010-09-26 07:14 . 2010-09-26 07:14 ——– d—–w- c:\documents and settings\Siobhan\Local Settings\Application Data\Temp . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . —- Directory of C:\cmpnents —- 2019-03-07 17:54 . 2004-08-10 19:00 2779 ——w- c:\cmpnents\tabletpc\i386\zh-chtkb.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 2721 ——w- c:\cmpnents\tabletpc\i386\zh-chskb.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 673 ——w- c:\cmpnents\tabletpc\i386\webpad.in_ 2019-03-07 17:54 . 2004-08-10 19:00 75806 ——w- c:\cmpnents\tabletpc\i386\wisptis.ex_ 2019-03-07 17:54 . 2004-08-10 19:00 1101 ——w- c:\cmpnents\tabletpc\i386\viewer.ht_ 2019-03-07 17:54 . 2004-08-10 19:00 443 ——w- c:\cmpnents\tabletpc\i386\viewer.xm_ 2019-03-07 17:54 . 2004-08-10 19:00 2830 ——w- c:\cmpnents\tabletpc\i386\trkbc.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 2563 ——w- c:\cmpnents\tabletpc\i386\tutaicod.gi_ 2019-03-07 17:54 . 2004-08-10 19:00 2845 ——w- c:\cmpnents\tabletpc\i386\tutaicol.gi_ 2019-03-07 17:54 . 2004-08-10 19:00 5815 ——w- c:\cmpnents\tabletpc\i386\tpc_oobe.xm_ 2019-03-07 17:54 . 2004-08-10 19:00 14191 ——w- c:\cmpnents\tabletpc\i386\tpgwlnot.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 810 ——w- c:\cmpnents\tabletpc\i386\tiptute.ht_ 2019-03-07 17:54 . 2004-08-10 19:00 2415617 ——w- c:\cmpnents\tabletpc\i386\tpc_oobe.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 101399 ——w- c:\cmpnents\tabletpc\i386\tiptsf.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 215323 ——w- c:\cmpnents\tabletpc\i386\tipskins.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 33945 ——w- c:\cmpnents\tabletpc\i386\tipres.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 16849 ——w- c:\cmpnents\tabletpc\i386\tipcmpps.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 18619 ——w- c:\cmpnents\tabletpc\i386\tipincol.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 17163 ——w- c:\cmpnents\tabletpc\i386\tiplib.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 9106 ——w- c:\cmpnents\tabletpc\i386\tipband.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 528990 ——w- c:\cmpnents\tabletpc\i386\tip.ch_ 2019-03-07 17:54 . 2004-08-10 19:00 313 ——w- c:\cmpnents\tabletpc\i386\tcserver.cf_ 2019-03-07 17:54 . 2004-08-10 19:00 16755 ——w- c:\cmpnents\tabletpc\i386\tcserver.ex_ 2019-03-07 17:54 . 2004-08-10 19:00 17425 ——w- c:\cmpnents\tabletpc\i386\tabtipps.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 394403 ——w- c:\cmpnents\tabletpc\i386\tab_hb.ch_ 2019-03-07 17:54 . 2004-08-10 19:00 116835 ——w- c:\cmpnents\tabletpc\i386\tabtip.ex_ 2019-03-07 17:54 . 2004-08-10 19:00 616441 ——w- c:\cmpnents\tabletpc\i386\tabsys.ca_ 2019-03-07 17:54 . 2004-08-10 19:00 14131 ——w- c:\cmpnents\tabletpc\i386\tabsrv.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 941 ——w- c:\cmpnents\tabletpc\i386\sympad.in_ 2019-03-07 17:54 . 2004-08-10 19:00 213 ——w- c:\cmpnents\tabletpc\i386\tabc2g.cf_ 2019-03-07 17:54 . 2004-08-10 19:00 74945302 ——w- c:\cmpnents\tabletpc\i386\tabletpc.cab 2019-03-07 17:54 . 2004-08-10 19:00 65511 ——w- c:\cmpnents\tabletpc\i386\stikynot.ex_ 2019-03-07 17:54 . 2004-08-10 19:00 2842 ——w- c:\cmpnents\tabletpc\i386\svkbc.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 9217 ——w- c:\cmpnents\tabletpc\i386\splshwrp.ex_ 2019-03-07 17:54 . 2004-08-10 19:00 809 ——w- c:\cmpnents\tabletpc\i386\sptute.ht_ 2019-03-07 17:54 . 2004-08-10 19:00 67959 ——w- c:\cmpnents\tabletpc\i386\spdesk.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 38858 ——w- c:\cmpnents\tabletpc\i386\sklib.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 2748 ——w- c:\cmpnents\tabletpc\i386\softkbd.ex_ 2019-03-07 17:54 . 2004-08-10 19:00 3112 ——w- c:\cmpnents\tabletpc\i386\rukbc.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 5931 ——w- c:\cmpnents\tabletpc\i386\sftkbd.in_ 2019-03-07 17:54 . 2004-08-10 19:00 5657 ——w- c:\cmpnents\tabletpc\i386\sftkbdlc.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 2915 ——w- c:\cmpnents\tabletpc\i386\pt-brkbc.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 2939 ——w- c:\cmpnents\tabletpc\i386\pt-ptkbc.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 793 ——w- c:\cmpnents\tabletpc\i386\pipres.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 3022 ——w- c:\cmpnents\tabletpc\i386\plkbc.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 33874 ——w- c:\cmpnents\tabletpc\i386\pipanel.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 8262 ——w- c:\cmpnents\tabletpc\i386\pipanel.ex_ 2019-03-07 17:54 . 2004-08-10 19:00 621 ——w- c:\cmpnents\tabletpc\i386\numpad.in_ 2019-03-07 17:54 . 2004-08-10 19:00 15617 ——w- c:\cmpnents\tabletpc\i386\oobewrap.ex_ 2019-03-07 17:54 . 2004-08-10 19:00 811 ——w- c:\cmpnents\tabletpc\i386\overtute.ht_ 2019-03-07 17:54 . 2004-08-10 19:00 2908 ——w- c:\cmpnents\tabletpc\i386\nlkbc.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 2870 ——w- c:\cmpnents\tabletpc\i386\nokbc.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 809 ——w- c:\cmpnents\tabletpc\i386\nbtute.ht_ 2019-03-07 17:54 . 2004-08-10 19:00 463054 ——w- c:\cmpnents\tabletpc\i386\nbdoc.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 157267 ——w- c:\cmpnents\tabletpc\i386\mspvwctl.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 6077 ——w- c:\cmpnents\tabletpc\i386\msinkres.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 130132 ——w- c:\cmpnents\tabletpc\i386\msink.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 3043180 ——w- c:\cmpnents\tabletpc\i386\mshwusa.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 2773891 ——w- c:\cmpnents\tabletpc\i386\mshwuk.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 841 ——w- c:\cmpnents\tabletpc\i386\keypad.in_ 2019-03-07 17:54 . 2004-08-10 19:00 2622 ——w- c:\cmpnents\tabletpc\i386\kokbc.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 24531 ——w- c:\cmpnents\tabletpc\i386\loginkey.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 5145 ——w- c:\cmpnents\tabletpc\i386\kbcres.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 14587 ——w- c:\cmpnents\tabletpc\i386\kbdsur.ex_ 2019-03-07 17:54 . 2004-08-10 19:00 5284 ——w- c:\cmpnents\tabletpc\i386\kbchook.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 9177 ——w- c:\cmpnents\tabletpc\i386\jnwmon.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 274466 ——w- c:\cmpnents\tabletpc\i386\journal.ex_ 2019-03-07 17:54 . 2004-08-10 19:00 36367 ——w- c:\cmpnents\tabletpc\i386\jnwdui.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 354931 ——w- c:\cmpnents\tabletpc\i386\jnwdrv.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 359379 ——w- c:\cmpnents\tabletpc\i386\jntfiltr.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 13008 ——w- c:\cmpnents\tabletpc\i386\itipcmp.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 2864 ——w- c:\cmpnents\tabletpc\i386\itkbc.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 2766 ——w- c:\cmpnents\tabletpc\i386\jakbc.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 3956 ——w- c:\cmpnents\tabletpc\i386\isftkbd.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 226807 ——w- c:\cmpnents\tabletpc\i386\inkseg.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 470093 ——w- c:\cmpnents\tabletpc\i386\inkobj.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 80596 ——w- c:\cmpnents\tabletpc\i386\inked.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 111427 ——w- c:\cmpnents\tabletpc\i386\inkdiv.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 2820 ——w- c:\cmpnents\tabletpc\i386\hukbc.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 228924 ——w- c:\cmpnents\tabletpc\i386\inkball.ex_ 2019-03-07 17:54 . 2004-08-10 19:00 2818 ——w- c:\cmpnents\tabletpc\i386\fikbc.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 2932 ——w- c:\cmpnents\tabletpc\i386\frkbc.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 3712 ——w- c:\cmpnents\tabletpc\i386\deskres.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 637 ——w- c:\cmpnents\tabletpc\i386\epad.in_ 2019-03-07 17:54 . 2004-08-10 19:00 2934 ——w- c:\cmpnents\tabletpc\i386\eskbc.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 21053 ——w- c:\cmpnents\tabletpc\i386\ctxtgr.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 2804 ——w- c:\cmpnents\tabletpc\i386\dakbc.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 2810 ——w- c:\cmpnents\tabletpc\i386\dekbc.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 2846 ——w- c:\cmpnents\tabletpc\i386\cskbc.dl_ 2019-03-07 17:54 . 2004-08-10 19:00 12719471 ——w- c:\cmpnents\netfx\i386\netfx.cab 2019-03-07 17:54 . 2004-08-10 19:00 5950823 ——w- c:\cmpnents\mediactr\i386\sonic.cab 2019-03-07 17:54 . 2004-08-10 19:00 46911402 ——w- c:\cmpnents\mediactr\i386\plus.cab 2019-03-07 17:53 . 2004-08-10 19:00 116378551 ——w- c:\cmpnents\mediactr\i386\mediactr.cab —- Directory of c:\documents and settings\Dave\Application Data\Tific —- 2010-10-19 14:37 . 2010-10-19 14:38 11055 —-a-w- c:\documents and settings\Dave\Application Data\Tific\Environment.tfc 2010-10-19 14:37 . 2010-10-19 14:38 11055 —-a-w- c:\documents and settings\Dave\Application Data\Tific\tificocs.symantec.com.tfc ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2009-01-08 98304] "msnmsgr"="c:\progra~1\MSNMES~1\msnmsgr.exe" [2005-09-19 7083056] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "Shockwave Updater"="c:\windows\system32\Adobe\Shockwave 11\SwHelper_1150595.exe" [2009-03-19 460216] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-09-16 149280] "Ptipbmf"="ptipbmf.dll" [2003-06-20 118784] "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 61952] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-11 7630848] "nwiz"="nwiz.exe" [2006-08-11 1519616] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-11 86016] "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472] "PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-29 30248] "IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-29 46632] "PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-02-15 141608] "HitmanPro35"="c:\program files\Hitman Pro 3.5\HitmanPro35.exe" [2010-10-15 6238016] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2008-04-14 53760] c:\documents and settings\Dave\Start Menu\Programs\Startup\ PMB Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2009-8-23 333088] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2005-9-19 581693] DSLMON.lnk - c:\program files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2006-9-28 962663] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk backup=c:\windows\pss\Bluetooth.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd] 2007-03-12 14:51 663552 ——w- c:\program files\Brother\Brmfcmon\BrMfcWnd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3] 2007-01-26 15:58 65536 ——w- c:\program files\Brother\ControlCenter3\BrCtrCen.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] 2008-04-14 00:12 15360 —-a-w- c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core] 2008-07-21 13:07 2752512 —-a-w- c:\program files\Electronic Arts\EADM\Core.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] 2008-04-14 00:12 1695232 –sh–w- c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] 2005-09-19 00:02 7083056 —-a-w- c:\program files\MSN Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService] 2005-01-14 18:21 110744 —-a-w- c:\program files\CyberLink\PowerCinema\PCMService.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Power2GoExpress] 2005-09-19 00:02 7083056 —-a-w- c:\program files\MSN Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2009-11-10 23:08 417792 —-a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] 2004-11-02 20:24 32768 —-a-w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{1290A33C-85F5-4164-A1BE-7DD299D4986A}] 2004-06-08 18:33 69721 —-a-w- c:\program files\CyberLink\PowerBackup\PBKScheduler.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\CyberLink\\PowerCinema\\PowerCinema.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Samsung\\Samsung New PC Studio\\npsasvr.exe"= "c:\\Program Files\\Samsung\\Samsung New PC Studio\\npsvsvr.exe"= "c:\\Program Files\\Kalypso\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1201000.025\SymDS.sys [08/09/2010 22:26 339504] R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1201000.025\SymEFA.sys [08/09/2010 22:26 666672] S1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20101001.001\BHDrvx86.sys [06/10/2010 07:55 692272] S1 HCW88AUD;Hauppauge WinTV 88x Audio Capture;c:\windows\system32\drivers\hcw88aud.sys [21/09/2006 09:11 11970] S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1201000.025\Ironx86.sys [08/09/2010 22:26 134704] S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [05/04/2009 17:04 233472] S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [01/06/2010 19:04 136176] S2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe [08/09/2010 22:26 126904] S3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;c:\windows\system32\drivers\atl01_xp.sys [13/09/2006 23:57 34944] S3 bfastfao;bfastfao;\??\c:\docume~1\Dave\LOCALS~1\Temp\bfastfao.sys –> c:\docume~1\Dave\LOCALS~1\Temp\bfastfao.sys [?] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [10/09/2010 20:19 102448] S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [05/04/2009 17:04 36608] S3 HCW88BDA;Hauppauge WinTV 88x DVB Tuner/Demod;c:\windows\system32\drivers\hcw88bda.sys [21/09/2006 09:11 138304] S3 HCW88TSE;Hauppauge WinTV 88x MPEG/TS Capture;c:\windows\system32\drivers\hcw88tse.sys [21/09/2006 09:11 298307] S3 HCW88TUNE;Hauppauge WinTV 88x Tuner;c:\windows\system32\drivers\hcw88tun.sys [21/09/2006 09:11 141889] S3 hcw88vid;Hauppauge WinTV 88x Video;c:\windows\system32\drivers\hcw88vid.sys [21/09/2006 09:11 493632] S3 HCW88XBAR;Hauppauge WinTV 88x Crossbar;c:\windows\system32\drivers\hcw88bar.sys [21/09/2006 09:11 23104] S3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20101019.001\IDSXpx86.sys [19/10/2010 21:36 341880] S3 U2KG54L;BUFFALO WLI-U2-KG54L Wireless LAN Driver;c:\windows\system32\drivers\U2KG54L.SYS [24/08/2006 05:44 477696] S4 m5287;m5287;c:\windows\system32\drivers\m5287.sys [02/12/2005 18:08 85888] S4 m5289;m5289;c:\windows\system32\drivers\m5289.sys [02/12/2005 18:08 51840] . Contents of the 'Scheduled Tasks' folder 2010-06-07 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] 2010-10-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-01 18:04] 2010-10-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-06-01 18:04] . . ——- Supplementary Scan ——- . uStart Page = hxxp://uk.yahoo.com/?p=us mWindow Title = Tiscali Internet Access uInternet Connection Wizard,ShellNext = iexplore IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm . [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIS] "ImagePath"="\"c:\program files\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\18.1.0.37\diMaster.dll\" /prefetch:1" . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_USERS\S-1-5-21-226113513-3097384743-832189314-1007\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:17,eb,4c,47,3f,de,ac,19,ff,03,de,c2,ae,f1,28,18,d0,9e,f7,4a,70,c5,01, 9e,a8,2e,dd,e6,90,26,77,04,9d,ae,7f,78,ce,ee,2e,e3,56,38,6b,e9,6d,ba,4e,a9,\ "??"=hex:d9,eb,e8,87,54,a1,8d,80,f0,7a,3a,0f,c2,c7,4d,2a [HKEY_USERS\S-1-5-21-226113513-3097384743-832189314-1007\Software\SecuROM\License information*] "datasecu"=hex:71,b0,38,3a,9e,38,28,54,14,3d,84,3a,cf,cb,63,d7,39,05,39,e0,ef, 7c,2e,40,58,fa,c1,56,50,6a,2c,31,99,b5,61,bb,6d,9e,f3,6c,c6,96,6d,be,aa,cc,\ "rkeysecu"=hex:e2,26,6d,94,9c,ba,ad,1d,64,79,70,1b,d8,19,de,23 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . Completion time: 2010-10-20 22:42:46 ComboFix-quarantined-files.txt 2010-10-20 21:42 ComboFix2.txt 2010-10-19 15:14 Pre-Run: 167,428,452,352 bytes free Post-Run: 167,416,639,488 bytes free - - End Of File - - 7128FBFE85378663BE5F04D171EB2135

oldman960

Post #28October 21, 2010, 9:32 AM UTC last edited October 21, 2010, 9:43 AM UTC

Hi say-no-2-trojans,

Thanks for the details. I meant to give you the heads up on the file submittal. We will submit that file now.

Please visit this site and follow the instructions for uploading the file.

In the top box please copy and paste the following bold text

http://forums.whatthetech.com/index.php?showtopic=115103&pid=689780&st=15&#entry689780

Use the browse button to navigate to the following file

C:\Qoobox\Quarantine\[4]-Submit_2010-10-20_22.32.01.zip

Leave the bottom box blank. Click send file.

Don't worry about the tracking cookies, they are harmless.

'The instruction at "0x0050005c" referenced memory at "0x0050005c". The memory could not be read.

Options were to terminate program or debug - I clicked terminate, though nothing else happened at Combofix continued scanning.

Was an application or program named when you recieved the error?

Do you have your XP CD just in case we can't find a good copy of a file on your computer?

Next, Double click on OTL.exe

Click the None button near the top (it may appear to be greyed out)
Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE

md5start
hal.*
md5stop

Then click the Run Scan button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

It will be a fairly short log this time.

Next,

Click your start button, click run
Copy and paste the following bold text into the run box and click ok

dcomcnfg

The Component Services Console should open

Click the + sign beside Component Services
Click the + sign beside Computers
Right Click My Computer and select Properties
Click the COM Security tab.
Under Launch and Activation Permissions, clicked Edit Default

Please tell us what is listed there as users and groups and what the permissions are for each. Click cancel on each page to exit.

Please post back with

OTL log
user's permissions

Thanks

say-no-2-trojans

Post #29October 21, 2010, 6:54 PM UTC

File Sent

Sorry, forgot to include the whole of the error message - PEV.exe - Application Error

OTL Log:

OTL logfile created on: 21/10/2010 19:49:12 - Run 4
OTL by OldTimer - Version 3.2.15.2 Folder = C:\Documents and Settings\Dave\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,023.00 Mb Total Physical Memory | 415.00 Mb Available Physical Memory | 41.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 81.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 228.49 Gb Total Space | 156.05 Gb Free Space | 68.30% Space Free | Partition Type: NTFS
Drive D: | 451.83 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: DAVEMOSS | User Name: Dave | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

========== Custom Scans ==========

< md5start >

< hal.* >

< md5stop >

< >

< End of report >

Just done the last part for Permissions, but when I click on the + next to Component Services it disappears but no menu expands

Thanks

oldman960

Post #30October 22, 2010, 8:07 AM UTC

Hi say-no-2-trojans,

The same thing happened to me but I thought it was just this old clunker that I'm using. Try this. Click the + sign the click on Component Services . It should then expand. At least it did for me.

I made a mistake in the OTL script. Please rerun it with the previous settings but with this pasted into the window under Custom scans/fixes.

/md5start
hal.*
/md5stop

Sorry about that.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Trojan/malware infection - now have .dll files missing

✨ Ask AI

Ask AI