searchqu.com/406 [Solved]

Hello, I have downloaded iLivid - Free download manager and since then mu browser was hijack. I tried loads of tricks by advice from the web but no luck. I then found this forum and ran the following program tools as instructed: DDS, HijackThis, OTL. Following below are the results. Can somebody help me please?
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.7601.17514
Run by [removed] at 18:24:21 on 2011-12-30
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.2039.1252 [GMT -8:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Windows\System32\CTHELPER.EXE
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\sppsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
BHO: IDM integration (IDMIEHlprObj Class): {0055c089-8582-441b-a0bf-17b458c2a3a8} - c:\program files\internet download manager\IDMIECC.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
uRun: [SetDefaultMIDI] MIDIDef.exe
uRun: [IDMan] c:\program files\internet download manager\IDMan.exe /onboot
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [WINDVDPatch] CTHELPER.EXE
mRun: [UpdReg] c:\windows\UpdReg.EXE
mRun: [Jet Detection] "c:\program files\creative\sblive\program\ADGJDet.exe"
mRun: [DevconDefaultDB] c:\windows\READREG /PSCONV={NO} /NO_DEFPS
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: Download all links with IDM - c:\program files\internet download manager\IEGetAll.htm
IE: Download with IDM - c:\program files\internet download manager\IEExt.htm
IE: E&xport; to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{7A9B25F2-A275-4B3C-AA61-848A4D4F30C1} : DhcpNameServer = 192.168.2.1
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Notify: igfxcui - igfxdev.dll
AppInit_DLLs:
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\edward\appdata\roaming\mozilla\firefox\profiles\dzql6jye.default\
FF - prefs.js: browser.search.selectedEngine - Search Results
FF - prefs.js: browser.startup.homepage - hxxp://www.searchqu.com/406
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?q=
.
—- FIREFOX POLICIES —-
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
============= SERVICES / DRIVERS ===============
.
R0 oodrvled;oodrvled;c:\windows\system32\drivers\OODrvled.sys [2011-3-2 25680]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165648]
R1 MpKsl0e38bf82;MpKsl0e38bf82;c:\programdata\microsoft\microsoft antimalware\definition updates\{ca0e5e01-e090-45ab-86e6-47a7ffed7ded}\MpKsl0e38bf82.sys [2011-12-30 29904]
R2 IDMWFP;IDMWFP;c:\windows\system32\drivers\idmwfp.sys [2011-11-14 89376]
R3 Atc002;NDIS Miniport Driver for Atheros L2 Fast Ethernet Controller;c:\windows\system32\drivers\l260x86.sys [2009-6-10 29184]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-10-24 43392]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 65024]
R3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2011-4-27 208944]
S1 MpKslba7c8f73;MpKslba7c8f73;c:\programdata\microsoft\microsoft antimalware\definition updates\{ca0e5e01-e090-45ab-86e6-47a7ffed7ded}\MpKslba7c8f73.sys [2011-12-30 29904]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2011-12-24 15872]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-12-24 52224]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-12-23 1343400]
.
=============== Created Last 30 ================
.
2011-12-30 22:22:50 29904 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{ca0e5e01-e090-45ab-86e6-47a7ffed7ded}\MpKsl0e38bf82.sys
2011-12-30 16:23:00 56200 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{ca0e5e01-e090-45ab-86e6-47a7ffed7ded}\offreg.dll
2011-12-30 16:22:56 6823496 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{ca0e5e01-e090-45ab-86e6-47a7ffed7ded}\mpengine.dll
2011-12-30 02:12:25 ——– d—–w- c:\users\edward\appdata\local\Adobe
2011-12-29 17:28:53 ——– d—–w- c:\program files\Yahoo!
2011-12-29 14:50:00 ——– d—–w- c:\programdata\PC Tools
2011-12-29 08:24:02 ——– d—–w- c:\users\edward\appdata\roaming\GetRightToGo
2011-12-28 05:07:28 ——– d—–w- c:\users\edward\appdata\roaming\IDM
2011-12-28 05:07:28 ——– d—–w- c:\users\edward\appdata\roaming\DMCache
2011-12-28 05:07:06 ——– d—–w- c:\program files\Internet Download Manager
2011-12-28 02:02:00 ——– d—–w- c:\users\edward\appdata\roaming\DonationCoder
2011-12-28 02:01:38 ——– d—–w- c:\program files\WinPcap
2011-12-28 01:58:42 ——– d—–w- c:\program files\URLSnooper2
2011-12-26 16:46:41 ——– d—–w- c:\programdata\boost_interprocess
2011-12-26 03:46:51 ——– d—–w- c:\users\edward\appdata\local\Ilivid Player
2011-12-26 03:40:47 ——– d—–w- c:\program files\iLivid
2011-12-26 03:30:35 ——– d—–w- c:\users\edward\appdata\local\PackageAware
2011-12-26 00:34:07 ——– d—–w- c:\windows\system32\SPReview
2011-12-26 00:32:19 ——– d—–w- c:\windows\system32\EventProviders
2011-12-26 00:08:34 12288 —-a-w- c:\windows\system32\AHQCpURes.dll
2011-12-26 00:08:25 32768 —-a-w- c:\windows\system32\AudioHQU.cpl
2011-12-25 07:06:38 6823496 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2011-12-25 06:55:40 ——– d—–w- c:\programdata\OO Software
2011-12-25 05:19:32 ——– d—–w- c:\program files\OO Software
2011-12-24 19:58:59 520064 —-a-w- c:\windows\system32\mcupdate_GenuineIntel.dll
2011-12-24 19:57:59 988160 —-a-w- c:\windows\system32\propsys.dll
2011-12-24 19:56:59 933376 —-a-w- c:\windows\system32\Vault.dll
2011-12-24 19:55:59 293888 —-a-w- c:\windows\system32\ssText3d.scr
2011-12-24 19:54:59 9728 —-a-w- c:\windows\system32\sscore.dll
2011-12-24 19:53:41 606208 —-a-w- c:\windows\system32\wbem\fastprox.dll
2011-12-24 19:53:41 363008 —-a-w- c:\windows\system32\wbemcomn.dll
2011-12-24 19:53:41 189952 —-a-w- c:\program files\windows portable devices\sqmapi.dll
2011-12-24 19:53:13 189952 —-a-w- c:\windows\system32\sqmapi.dll
2011-12-24 01:11:11 ——– d—–w- c:\windows\system32\Wat
2011-12-23 22:45:31 6823496 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\updates\mpengine.dll
2011-12-23 22:35:36 ——– d—–w- c:\program files\Microsoft CAPICOM 2.1.0.2
2011-12-23 18:14:14 33104 —-a-w- c:\windows\system32\spool\prtprocs\w32x86\msonpppr.dll
2011-12-23 18:14:14 32656 —-a-w- c:\windows\system32\msonpmon.dll
2011-12-23 17:58:26 ——– d—–w- c:\windows\PCHEALTH
2011-12-23 17:51:33 ——– d—–w- c:\program files\Microsoft Visual Studio 8
2011-12-23 17:46:26 ——– d—–w- c:\users\edward\appdata\local\Microsoft Help
2011-12-23 17:25:49 311808 —-a-w- c:\windows\system32\drivers\srv.sys
2011-12-23 17:25:49 310272 —-a-w- c:\windows\system32\drivers\srv2.sys
2011-12-23 17:25:48 114688 —-a-w- c:\windows\system32\drivers\srvnet.sys
2011-12-23 17:25:45 338944 —-a-w- c:\windows\system32\drivers\afd.sys
2011-12-23 17:25:43 1290608 —-a-w- c:\windows\system32\drivers\tcpip.sys
2011-12-23 17:25:42 187776 —-a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2011-12-23 17:25:11 31232 —-a-w- c:\windows\system32\prevhost.exe
2011-12-23 17:25:08 428032 —-a-w- c:\windows\system32\vbscript.dll
2011-12-23 17:20:44 542208 —-a-w- c:\windows\system32\kerberos.dll
2011-12-23 17:18:39 759296 —-a-w- c:\program files\common files\microsoft shared\vgx\VGX.dll
2011-12-23 17:18:36 1137664 —-a-w- c:\windows\system32\mfc42.dll
2011-12-23 17:18:35 1164288 —-a-w- c:\windows\system32\mfc42u.dll
2011-12-23 17:18:18 69632 —-a-w- c:\windows\system32\drivers\bowser.sys
2011-12-23 17:18:12 123904 —-a-w- c:\windows\system32\poqexec.exe
2011-12-23 17:18:10 27008 —-a-w- c:\windows\system32\drivers\Diskdump.sys
2011-12-23 16:59:07 728448 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys
2011-12-23 16:59:07 219008 —-a-w- c:\windows\system32\drivers\dxgmms1.sys
2011-12-23 16:59:07 107520 —-a-w- c:\windows\system32\cdd.dll
2011-12-23 05:26:34 ——– d—–w- c:\program files\GRETECH
2011-12-23 04:59:04 ——– d—–r- c:\program files\Skype
2011-12-23 04:57:13 ——– d—–w- c:\program files\SpeedFan
2011-12-23 04:26:16 90112 ——w- c:\windows\Updreg.EXE
2011-12-23 04:26:14 84992 ——w- c:\windows\system32\SFCVRT32.DLL
2011-12-23 04:26:14 53552 ——w- c:\windows\CTCCW.DLL
2011-12-23 04:26:14 24976 ——w- c:\windows\CTRES.DLL
2011-12-23 04:26:14 149504 ——w- c:\windows\system32\MFCANS32.DLL
2011-12-23 04:26:14 108032 ——w- c:\windows\system32\MFCUIA32.DLL
2011-12-23 04:26:13 82432 ——w- c:\windows\system32\CTWFLT32.DLL
2011-12-23 04:26:13 54784 ——w- c:\windows\system32\INETWH32.DLL
2011-12-23 04:26:13 26768 ——w- c:\windows\system32\CTL3D.DLL
2011-12-23 04:26:10 ——– d—–w- c:\windows\system32\Defaults
2011-12-23 04:20:12 6752 ——w- c:\windows\system32\PFMODNT.SYS
2011-12-23 04:20:08 225280 —-a-w- c:\program files\common files\installshield\iscript\iscript.dll
2011-12-23 04:20:07 77824 —-a-w- c:\program files\common files\installshield\engine\6\intel 32\ctor.dll
2011-12-23 04:20:07 32768 —-a-w- c:\program files\common files\installshield\engine\6\intel 32\objectps.dll
2011-12-23 04:20:07 176128 —-a-w- c:\program files\common files\installshield\engine\6\intel 32\iuser.dll
2011-12-23 04:20:04 610436 —-a-w- c:\program files\common files\installshield\engine\6\intel 32\IKernel.exe
2011-12-23 04:18:34 ——– d—–w- c:\program files\Creative
2011-12-23 03:47:50 ——– d—–w- c:\windows\pss
2011-12-23 03:47:11 ——– d—–w- c:\program files\CCleaner
2011-12-23 03:26:43 703824 ——w- c:\programdata\microsoft\microsoft antimalware\definition updates\{e94aa5d5-bcd5-4596-8153-292f5745a866}\gapaengine.dll
2011-12-23 03:22:21 ——– d—–w- c:\program files\Microsoft Security Client
2011-12-23 03:19:02 ——– d—–w- c:\users\edward\appdata\local\LogiShrd
2011-12-23 03:16:48 ——– d-sh–w- c:\windows\Installer
2011-12-23 03:10:53 6823496 —-a-w- c:\programdata\microsoft\windows defender\definition updates\{df3566e4-bfd0-4203-a8c4-f99e34b30d67}\mpengine.dll
2011-12-23 03:10:52 222080 ——w- c:\windows\system32\MpSigStub.exe
2011-12-23 03:06:17 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-12-23 03:04:06 ——– d—–w- c:\windows\system32\wbem\Performance
2011-12-23 03:04:01 ——– d—–w- c:\users\edward\appdata\local\Mozilla
2011-12-23 03:00:20 1002008 —-a-w- c:\windows\system32\igxpun.exe
2011-12-23 03:00:20 ——– d—–w- c:\windows\system32\x64
2011-12-23 02:01:45 ——– d—–w- c:\windows\Panther
2011-12-23 02:01:28 ——– d-sh–w- C:\Boot
2011-12-23 01:45:36 ——– d—–w- C:\Windows.old.000
2011-12-22 10:08:30 ——– d—–w- C:\NVIDIA
2011-12-22 05:15:04 ——– d—–w- C:\Programs to run
2011-12-22 01:09:09 ——– d-sh–w- C:\Recovery
.
==================== Find3M ====================
.
2011-12-26 00:57:45 152576 —-a-w- c:\windows\system32\msclmd.dll
2011-11-24 04:25:27 2342912 —-a-w- c:\windows\system32\win32k.sys
2011-11-05 04:35:00 981504 —-a-w- c:\windows\system32\wininet.dll
2011-11-05 04:26:03 2048 —-a-w- c:\windows\system32\tzres.dll
2011-11-05 02:48:51 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2011-10-26 04:47:40 3967856 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-26 04:47:40 3912560 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-10-26 04:28:12 38912 —-a-w- c:\windows\system32\csrsrv.dll
2011-10-15 05:38:59 534528 —-a-w- c:\windows\system32\EncDec.dll
.
============= FINISH: 18:27:03.24 ===============

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:19:00 PM, on 12/30/2011
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Windows\System32\CTHELPER.EXE
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Edward\Downloads\Programs\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\Windows\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [DevconDefaultDB] C:\Windows\READREG /PSCONV={NO} /NO_DEFPS
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs:
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe

–
End of file - 4839 bytes

OTL logfile created on: 12/30/2011 7:22:25 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Edward\Downloads\Programs
Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.19 Gb Available Physical Memory | 59.86% Memory free
3.98 Gb Paging File | 3.09 Gb Available in Paging File | 77.55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 41.44 Gb Free Space | 55.61% Space Free | Partition Type: NTFS
Drive F: | 931.51 Gb Total Space | 879.17 Gb Free Space | 94.38% Space Free | Partition Type: NTFS

Computer Name: EDWARD-PC | User Name: Edward | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Edward\Downloads\Programs\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Internet Download Manager\IDMan.exe (Tonec Inc.)
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Internet Download Manager\IEMonitor.exe (Tonec Inc.)
PRC - C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
PRC - C:\Windows\System32\CTHELPER.EXE (Creative Technology Ltd)


========== Modules (No Company Name) ==========

MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()


========== Win32 Services (SafeList) ==========

SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (NisSrv) – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (LVPrcSrv) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) – C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (MpKsl0e38bf82) – c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{CA0E5E01-E090-45AB-86E6-47A7FFED7DED}\MpKsl0e38bf82.sys (Microsoft Corporation)
DRV - (MpKslba7c8f73) – c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{CA0E5E01-E090-45AB-86E6-47A7FFED7DED}\MpKslba7c8f73.sys ()
DRV - (IDMWFP) – C:\Windows\System32\drivers\idmwfp.sys (Tonec Inc.)
DRV - (NisDrv) – C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV - (MpNWMon) – C:\Windows\System32\drivers\MpNWMon.sys (Microsoft Corporation)
DRV - (speedfan) – C:\Windows\system32\speedfan.sys (Almico Software)
DRV - (oodrvled) – C:\Windows\system32\DRIVERS\oodrvled.sys (O&O; Software GmbH)
DRV - (vmbus) – C:\Windows\system32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (storflt) – C:\Windows\system32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) – C:\Windows\system32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (TsUsbFlt) – C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (RdpVideoMiniport) – C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (VMBusHID) – C:\Windows\system32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) – C:\Windows\system32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (NPF) – C:\Windows\System32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (LVPr2Mon) – C:\Windows\System32\drivers\LVPr2Mon.sys ()
DRV - (Serial) – C:\Windows\System32\drivers\serial.sys (Brother Industries Ltd.)
DRV - (Atc002) – C:\Windows\System32\drivers\l260x86.sys (Atheros Communications, Inc.)
DRV - (LVUSBSta) – C:\Windows\System32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) – C:\Windows\System32\drivers\LV302V32.SYS (Logitech Inc.)
DRV - (MTsensor) – C:\Windows\System32\drivers\ASACPI.sys ()
DRV - (ha10kx2k) – C:\Windows\System32\drivers\HA10KX2K.SYS (Creative Technology Ltd)
DRV - (emupia) – C:\Windows\System32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k) – C:\Windows\System32\drivers\CTSFM2K.SYS (Creative Technology Ltd)
DRV - (ctprxy2k) – C:\Windows\System32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\Windows\System32\drivers\CTOSS2K.SYS (Creative Technology Ltd.)
DRV - (ctaud2k) Creative Audio Driver (WDM) – C:\Windows\System32\drivers\CTAUD2K.SYS (Creative Technology Ltd)
DRV - (ctac32k) – C:\Windows\System32\drivers\CTAC32K.SYS (Creative Technology Ltd)
DRV - (PfModNT) – C:\Windows\System32\PFMODNT.SYS (Creative Technology Ltd.)
DRV - (giveio) – C:\Windows\system32\giveio.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://iat.msn.co.nz/tickler/default.aspx
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 77 57 96 62 1E C1 CC 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.selectedEngine: "Search Results"
FF - prefs.js..browser.startup.homepage: "http://www.searchqu.com/406"
FF - prefs.js..keyword.URL: "http://www.google.com/search?q="


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/12/22 19:03:46 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Users\Edward\AppData\Roaming\IDM\idmmzcc5 [2011/12/27 21:09:28 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\SeaMonkey\Extensions\\[removed]: C:\Users\Edward\AppData\Roaming\IDM\idmmzcc5 [2011/12/27 21:09:28 | 000,000,000 | —D | M]

[2011/12/26 21:14:30 | 000,000,000 | —D | M] (No name found) – C:\Users\Edward\AppData\Roaming\Mozilla\Extensions
[2011/12/26 19:05:00 | 000,000,000 | —D | M] (No name found) – C:\Users\Edward\AppData\Roaming\Mozilla\Firefox\Profiles\dzql6jye.default\extensions
[2011/12/25 19:39:45 | 000,002,519 | —- | M] () – C:\Users\Edward\AppData\Roaming\Mozilla\Firefox\Profiles\dzql6jye.default\searchplugins\Search_Results.xml
[2011/12/26 21:14:30 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/12/20 23:24:52 | 000,121,816 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/12/20 20:30:41 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/12/25 19:39:45 | 000,002,519 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
[2011/12/20 20:30:41 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2009/06/10 13:39:37 | 000,000,824 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (IDM integration (IDMIEHlprObj Class)) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll (Internet Download Manager, Tonec Inc.)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKLM..\Run: [DevconDefaultDB] C:\Windows\READREG.exe (Creative Technology Limited)
O4 - HKLM..\Run: [Jet Detection] C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe ()
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [WINDVDPatch] C:\Windows\System32\CTHELPER.EXE (Creative Technology Ltd)
O4 - HKCU..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe (Tonec Inc.)
O4 - HKCU..\Run: [SetDefaultMIDI] C:\Windows\MIDIDEF.EXE (Creative Technology Ltd)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm ()
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm ()
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7A9B25F2-A275-4B3C-AA61-848A4D4F30C1}: DhcpNameServer = 192.168.2.1
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 13:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.divxa32 - C:\Windows\System32\msaud32_divx.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/12/29 18:17:23 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe AIR
[2011/12/29 18:16:08 | 000,000,000 | —D | C] – C:\ProgramData\Adobe
[2011/12/29 18:15:31 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe
[2011/12/29 18:15:31 | 000,000,000 | —D | C] – C:\Program Files\Adobe
[2011/12/29 18:12:25 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Local\Adobe
[2011/12/29 09:34:35 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yahoo! Messenger
[2011/12/29 09:34:15 | 000,000,000 | —D | C] – C:\ProgramData\Yahoo!
[2011/12/29 09:28:53 | 000,000,000 | —D | C] – C:\Program Files\Yahoo!
[2011/12/29 06:50:00 | 000,000,000 | —D | C] – C:\ProgramData\PC Tools
[2011/12/29 00:28:15 | 000,000,000 | —D | C] – C:\ProgramData\TEMP
[2011/12/29 00:24:02 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\GetRightToGo
[2011/12/27 21:07:28 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\IDM
[2011/12/27 21:07:28 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\DMCache
[2011/12/27 21:07:20 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Download Manager
[2011/12/27 21:07:20 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Download Manager
[2011/12/27 21:07:06 | 000,000,000 | —D | C] – C:\Program Files\Internet Download Manager
[2011/12/27 18:02:00 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\DonationCoder
[2011/12/27 18:01:59 | 000,000,000 | —D | C] – C:\Users\Edward\Documents\DonationCoder
[2011/12/27 18:01:42 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPcap
[2011/12/27 18:01:38 | 000,000,000 | —D | C] – C:\Program Files\WinPcap
[2011/12/27 17:58:42 | 000,000,000 | —D | C] – C:\Program Files\URLSnooper2
[2011/12/26 08:46:41 | 000,000,000 | —D | C] – C:\ProgramData\boost_interprocess
[2011/12/25 19:46:51 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Local\Ilivid Player
[2011/12/25 19:40:47 | 000,000,000 | —D | C] – C:\Program Files\iLivid
[2011/12/25 19:34:43 | 000,000,000 | —D | C] – C:\Users\Edward\Documents\My Received Files
[2011/12/25 19:30:35 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Local\PackageAware
[2011/12/25 16:34:07 | 000,000,000 | —D | C] – C:\Windows\System32\SPReview
[2011/12/25 16:32:19 | 000,000,000 | —D | C] – C:\Windows\System32\EventProviders
[2011/12/25 16:08:34 | 000,012,288 | —- | C] (Creative Technology Ltd.) – C:\Windows\System32\AHQCpURes.dll
[2011/12/25 16:08:25 | 000,032,768 | —- | C] (Creative Technology Ltd.) – C:\Windows\System32\AudioHQU.cpl
[2011/12/24 22:55:40 | 000,000,000 | —D | C] – C:\ProgramData\OO Software
[2011/12/24 21:19:36 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\O&O; Software
[2011/12/24 21:19:32 | 000,000,000 | —D | C] – C:\Program Files\OO Software
[2011/12/24 11:59:34 | 000,053,760 | —- | C] (Microsoft Corporation) – C:\Windows\System32\LSCSHostPolicy.dll
[2011/12/24 11:59:34 | 000,052,224 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\TsUsbFlt.sys
[2011/12/24 11:59:34 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll
[2011/12/24 11:59:25 | 001,171,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10warp.dll
[2011/12/24 11:59:23 | 000,954,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc40.dll
[2011/12/24 11:59:23 | 000,954,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc40u.dll
[2011/12/24 11:59:22 | 000,915,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpcorets.dll
[2011/12/24 11:59:22 | 000,120,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tssrvlic.dll
[2011/12/24 11:59:18 | 000,739,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d2d1.dll
[2011/12/24 11:59:18 | 000,423,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc_isv.dll
[2011/12/24 11:59:15 | 000,327,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate_isv.exe
[2011/12/24 11:59:14 | 000,428,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc.dll
[2011/12/24 11:59:11 | 000,322,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate.exe
[2011/12/24 11:59:08 | 000,253,952 | —- | C] (Microsoft Corporation) – C:\Windows\System32\spwizui.dll
[2011/12/24 11:59:00 | 003,207,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mf.dll
[2011/12/24 11:58:59 | 000,520,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mcupdate_GenuineIntel.dll
[2011/12/24 11:58:58 | 001,334,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\CertEnroll.dll
[2011/12/24 11:58:54 | 000,295,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHost.exe
[2011/12/24 11:58:54 | 000,099,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHostProxy.dll
[2011/12/24 11:58:49 | 001,115,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RacEngn.dll
[2011/12/24 11:58:47 | 005,066,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\AuthFWSnapin.dll
[2011/12/24 11:58:45 | 000,134,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpudd.dll
[2011/12/24 11:58:42 | 001,493,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ExplorerFrame.dll
[2011/12/24 11:58:38 | 001,828,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d9.dll
[2011/12/24 11:58:38 | 001,076,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DWrite.dll
[2011/12/24 11:58:36 | 000,505,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\taskschd.dll
[2011/12/24 11:58:34 | 000,051,200 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PushPrinterConnections.exe
[2011/12/24 11:58:33 | 000,280,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\spreview.exe
[2011/12/24 11:58:32 | 000,456,192 | —- | C] (Microsoft Corporation) – C:\Windows\System32\spinstall.exe
[2011/12/24 11:58:31 | 000,381,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wer.dll
[2011/12/24 11:58:28 | 001,371,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dwmcore.dll
[2011/12/24 11:58:26 | 000,863,744 | —- | C] (Microsoft Corporation) – C:\Windows\System32\diagperf.dll
[2011/12/24 11:58:25 | 000,606,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/12/24 11:58:25 | 000,136,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\scavengeui.dll
[2011/12/24 11:58:24 | 003,367,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WinSAT.exe
[2011/12/24 11:58:23 | 001,328,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\quartz.dll
[2011/12/24 11:58:23 | 000,597,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\TSWorkspace.dll
[2011/12/24 11:58:22 | 000,270,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tsmf.dll
[2011/12/24 11:58:21 | 000,389,120 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/12/24 11:58:18 | 002,522,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dbgeng.dll
[2011/12/24 11:58:17 | 000,522,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d11.dll
[2011/12/24 11:58:16 | 000,260,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpshell.exe
[2011/12/24 11:58:15 | 001,619,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMVDECOD.DLL
[2011/12/24 11:58:14 | 000,584,192 | —- | C] (Microsoft Corporation) – C:\Windows\System32\gpprefcl.dll
[2011/12/24 11:58:14 | 000,314,880 | —- | C] (Microsoft Corporation) – C:\Windows\System32\webio.dll
[2011/12/24 11:58:12 | 000,252,928 | —- | C] (Microsoft) – C:\Windows\System32\DShowRdpFilter.dll
[2011/12/24 11:58:11 | 002,151,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mmcndmgr.dll
[2011/12/24 11:58:11 | 000,049,488 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netfxperf.dll
[2011/12/24 11:58:09 | 001,792,000 | —- | C] (Microsoft Corporation) – C:\Windows\System32\authui.dll
[2011/12/24 11:58:09 | 000,974,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sppobjs.dll
[2011/12/24 11:58:09 | 000,732,160 | —- | C] (Microsoft Corporation) – C:\Windows\System32\imapi2fs.dll
[2011/12/24 11:58:09 | 000,341,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdrm.dll
[2011/12/24 11:58:08 | 000,547,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PortableDeviceApi.dll
[2011/12/24 11:58:07 | 000,220,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mcbuilder.exe
[2011/12/24 11:58:05 | 001,555,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\certmgr.dll
[2011/12/24 11:58:04 | 000,508,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winload.exe
[2011/12/24 11:58:04 | 000,323,072 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drvstore.dll
[2011/12/24 11:58:03 | 001,712,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xpsservices.dll
[2011/12/24 11:58:02 | 000,412,160 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sppwinob.dll
[2011/12/24 11:58:01 | 000,302,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\cmd.exe
[2011/12/24 11:57:59 | 000,206,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\framedynos.dll
[2011/12/24 11:57:58 | 000,296,448 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfds.dll
[2011/12/24 11:57:58 | 000,140,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpendp.dll
[2011/12/24 11:57:57 | 000,240,000 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\netio.sys
[2011/12/24 11:57:56 | 002,414,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wucltux.dll
[2011/12/24 11:57:56 | 000,442,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winresume.exe
[2011/12/24 11:57:56 | 000,351,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmicmiplugin.dll
[2011/12/24 11:57:55 | 001,063,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\werconcpl.dll
[2011/12/24 11:57:55 | 000,762,880 | —- | C] (Microsoft Corporation) – C:\Windows\System32\azroles.dll
[2011/12/24 11:57:55 | 000,173,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpclip.exe
[2011/12/24 11:57:55 | 000,152,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ncsi.dll
[2011/12/24 11:57:54 | 000,339,968 | —- | C] (Microsoft Corporation) – C:\Windows\System32\appmgr.dll
[2011/12/24 11:57:50 | 000,508,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxgi.dll
[2011/12/24 11:57:50 | 000,196,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfreadwrite.dll
[2011/12/24 11:57:50 | 000,144,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\basecsp.dll
[2011/12/24 11:57:49 | 000,801,280 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NaturalLanguage6.dll
[2011/12/24 11:57:49 | 000,488,448 | —- | C] (Microsoft Corporation) – C:\Windows\System32\evr.dll
[2011/12/24 11:57:49 | 000,305,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\taskcomp.dll
[2011/12/24 11:57:49 | 000,161,280 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpinit.exe
[2011/12/24 11:57:47 | 000,776,192 | —- | C] (Microsoft Corporation) – C:\Windows\System32\calc.exe
[2011/12/24 11:57:47 | 000,335,872 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WinSATAPI.dll
[2011/12/24 11:57:46 | 000,778,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sqlsrv32.dll
[2011/12/24 11:57:45 | 000,242,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vpnike.dll
[2011/12/24 11:57:44 | 002,983,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\UIRibbon.dll
[2011/12/24 11:57:43 | 000,477,696 | —- | C] (Microsoft Corporation) – C:\Windows\System32\lpksetup.exe
[2011/12/24 11:57:43 | 000,271,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\fveapi.dll
[2011/12/24 11:57:42 | 000,176,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2011/12/24 11:57:42 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tspubwmi.dll
[2011/12/24 11:57:40 | 000,155,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\hgprint.dll
[2011/12/24 11:57:38 | 000,116,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\prncache.dll
[2011/12/24 11:57:35 | 000,352,256 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmpeffects.dll
[2011/12/24 11:57:34 | 000,690,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ci.dll
[2011/12/24 11:57:34 | 000,458,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WSDApi.dll
[2011/12/24 11:57:34 | 000,142,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\net1.exe
[2011/12/24 11:57:34 | 000,139,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rpchttp.dll
[2011/12/24 11:57:33 | 000,321,536 | —- | C] (Microsoft Corporation) – C:\Windows\System32\aepdu.dll
[2011/12/24 11:57:33 | 000,175,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\vmbus.sys
[2011/12/24 11:57:33 | 000,119,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\aitagent.exe
[2011/12/24 11:57:31 | 000,246,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\scansetting.dll
[2011/12/24 11:57:30 | 000,213,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MMDevAPI.dll
[2011/12/24 11:57:29 | 002,504,192 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMVCORE.DLL
[2011/12/24 11:57:29 | 000,411,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wlangpui.dll
[2011/12/24 11:57:29 | 000,131,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\aaclient.dll
[2011/12/24 11:57:28 | 000,167,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\QSHVHOST.DLL
[2011/12/24 11:57:28 | 000,101,760 | —- | C] (Microsoft Corporation) – C:\Windows\System32\consent.exe
[2011/12/24 11:57:27 | 001,750,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\pnidui.dll
[2011/12/24 11:57:27 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\t2embed.dll
[2011/12/24 11:57:26 | 000,782,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\webservices.dll
[2011/12/24 11:57:26 | 000,464,896 | —- | C] (Microsoft Corporation) – C:\Windows\System32\scrptadm.dll
[2011/12/24 11:57:25 | 000,154,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tscfgwmi.dll
[2011/12/24 11:57:25 | 000,124,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\fde.dll
[2011/12/24 11:57:24 | 002,146,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\SyncCenter.dll
[2011/12/24 11:57:24 | 000,225,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netdiagfx.dll
[2011/12/24 11:57:24 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\Windows\System32\TsUsbGDCoInstaller.dll
[2011/12/24 11:57:23 | 000,907,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sdengin2.dll
[2011/12/24 11:57:23 | 000,560,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wuapi.dll
[2011/12/24 11:57:23 | 000,215,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vmicsvc.exe
[2011/12/24 11:57:23 | 000,051,712 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wscapi.dll
[2011/12/24 11:57:21 | 000,139,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\cscobj.dll
[2011/12/24 11:57:20 | 000,727,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mcmde.dll
[2011/12/24 11:57:19 | 000,830,464 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MSMPEG2ENC.DLL
[2011/12/24 11:57:19 | 000,826,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpcore.dll
[2011/12/24 11:57:19 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\rdpvideominiport.sys
[2011/12/24 11:57:18 | 000,186,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/12/24 11:57:17 | 000,392,192 | —- | C] (Microsoft Corporation) – C:\Windows\System32\imapi2.dll
[2011/12/24 11:57:17 | 000,103,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\setupcl.exe
[2011/12/24 11:57:16 | 002,576,384 | —- | C] (Microsoft Corporation) – C:\Windows\System32\gameux.dll
[2011/12/24 11:57:16 | 000,630,784 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DXPTaskRingtone.dll
[2011/12/24 11:57:16 | 000,302,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\aeinv.dll
[2011/12/24 11:57:14 | 000,097,280 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dwmredir.dll
[2011/12/24 11:57:13 | 001,624,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMPEncEn.dll
[2011/12/24 11:57:12 | 000,196,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vaultsvc.dll
[2011/12/24 11:57:12 | 000,066,560 | —- | C] (Microsoft Corporation) – C:\Windows\System32\hbaapi.dll
[2011/12/24 11:57:11 | 001,077,248 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Narrator.exe
[2011/12/24 11:57:11 | 000,658,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\autofmt.exe
[2011/12/24 11:57:10 | 002,217,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\bootres.dll
[2011/12/24 11:57:10 | 000,166,400 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netiohlp.dll
[2011/12/24 11:57:10 | 000,100,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\audiodg.exe
[2011/12/24 11:57:09 | 000,195,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\AudioSes.dll
[2011/12/24 11:57:09 | 000,194,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\halmacpi.dll
[2011/12/24 11:57:09 | 000,194,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\hal.dll
[2011/12/24 11:57:09 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\proquota.exe
[2011/12/24 11:57:08 | 000,679,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\autoconv.exe
[2011/12/24 11:57:08 | 000,303,104 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msinfo32.exe
[2011/12/24 11:57:08 | 000,042,496 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mimefilt.dll
[2011/12/24 11:57:07 | 000,400,896 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ipsmsnap.dll
[2011/12/24 11:57:06 | 000,441,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\powercpl.dll
[2011/12/24 11:57:06 | 000,301,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\srchadmin.dll
[2011/12/24 11:57:06 | 000,222,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\eapphost.dll
[2011/12/24 11:57:06 | 000,181,760 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tcpipcfg.dll
[2011/12/24 11:57:06 | 000,179,712 | —- | C] (Microsoft Corporation) – C:\Windows\System32\schtasks.exe
[2011/12/24 11:57:05 | 000,337,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msihnd.dll
[2011/12/24 11:57:05 | 000,202,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\framedyn.dll
[2011/12/24 11:57:04 | 001,466,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2011/12/24 11:57:04 | 000,155,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mscorier.dll
[2011/12/24 11:57:03 | 000,665,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\AuxiliaryDisplayCpl.dll
[2011/12/24 11:57:02 | 000,478,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\timedate.cpl
[2011/12/24 11:57:02 | 000,399,872 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DXP.dll
[2011/12/24 11:57:02 | 000,171,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\QAGENT.DLL
[2011/12/24 11:57:02 | 000,117,248 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netid.dll
[2011/12/24 11:57:00 | 001,227,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wdc.dll
[2011/12/24 11:56:59 | 000,933,376 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Vault.dll
[2011/12/24 11:56:59 | 000,346,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\untfs.dll
[2011/12/24 11:56:59 | 000,132,992 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\ataport.sys
[2011/12/24 11:56:59 | 000,078,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\nci.dll
[2011/12/24 11:56:58 | 001,131,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sdclt.exe
[2011/12/24 11:56:57 | 001,326,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wlanpref.dll
[2011/12/24 11:56:57 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/12/24 11:56:56 | 001,003,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMNetMgr.dll
[2011/12/24 11:56:55 | 000,098,816 | —- | C] (Microsoft) – C:\Windows\System32\Robocopy.exe
[2011/12/24 11:56:54 | 001,400,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DxpTaskSync.dll
[2011/12/24 11:56:53 | 001,040,384 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Display.dll
[2011/12/24 11:56:53 | 000,417,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdri.dll
[2011/12/24 11:56:52 | 000,316,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sharemediacpl.dll
[2011/12/24 11:56:52 | 000,135,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsRasterService.dll
[2011/12/24 11:56:52 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\userinit.exe
[2011/12/24 11:56:51 | 000,352,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\termmgr.dll
[2011/12/24 11:56:51 | 000,324,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\puiobj.dll
[2011/12/24 11:56:50 | 001,188,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DiagCpl.dll
[2011/12/24 11:56:50 | 000,140,160 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\scsiport.sys
[2011/12/24 11:56:49 | 000,288,256 | —- | C] (Microsoft Corporation) – C:\Windows\System32\eudcedit.exe
[2011/12/24 11:56:49 | 000,043,392 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\winhv.sys
[2011/12/24 11:56:48 | 000,040,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\vmstorfl.sys
[2011/12/24 11:56:47 | 001,066,496 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdtctm.dll
[2011/12/24 11:56:47 | 000,428,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\biocpl.dll
[2011/12/24 11:56:47 | 000,127,488 | —- | C] (Microsoft Corporation) – C:\Windows\System32\logoncli.dll
[2011/12/24 11:56:47 | 000,111,104 | —- | C] (Microsoft Corporation) – C:\Windows\System32\shsetup.dll
[2011/12/24 11:56:46 | 000,856,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\FirewallControlPanel.dll
[2011/12/24 11:56:46 | 000,416,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wiadefui.dll
[2011/12/24 11:56:46 | 000,233,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msconfig.exe
[2011/12/24 11:56:46 | 000,193,536 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sppcomapi.dll
[2011/12/24 11:56:45 | 000,028,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\storvsc.sys
[2011/12/24 11:56:44 | 002,202,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\SensorsCpl.dll
[2011/12/24 11:56:44 | 002,157,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\themecpl.dll
[2011/12/24 11:56:43 | 000,766,464 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wpccpl.dll
[2011/12/24 11:56:43 | 000,216,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\FWPUCLNT.DLL
[2011/12/24 11:56:43 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dnscmmc.dll
[2011/12/24 11:56:41 | 000,413,696 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PhotoScreensaver.scr
[2011/12/24 11:56:41 | 000,312,832 | —- | C] (Microsoft Corporation) – C:\Windows\System32\hgcpl.dll
[2011/12/24 11:56:39 | 000,481,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mscms.dll
[2011/12/24 11:56:39 | 000,429,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\localsec.dll
[2011/12/24 11:56:39 | 000,080,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mscories.dll
[2011/12/24 11:56:38 | 000,400,896 | —- | C] (Microsoft Corporation) – C:\Windows\System32\srcore.dll
[2011/12/24 11:56:38 | 000,268,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mprddm.dll
[2011/12/24 11:56:38 | 000,220,160 | —- | C] (Microsoft Corporation) – C:\Windows\System32\SndVolSSO.dll
[2011/12/24 11:56:38 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\bcdsrv.dll
[2011/12/24 11:56:38 | 000,078,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iasacct.dll
[2011/12/24 11:56:37 | 000,600,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PerfCenterCPL.dll
[2011/12/24 11:56:37 | 000,600,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\usercpl.dll
[2011/12/24 11:56:37 | 000,410,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wlanui.dll
[2011/12/24 11:56:36 | 001,644,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netcenter.dll
[2011/12/24 11:56:36 | 000,941,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mblctr.exe
[2011/12/24 11:56:36 | 000,638,976 | —- | C] (Microsoft Corporation) – C:\Windows\System32\VAN.dll
[2011/12/24 11:56:36 | 000,509,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qedit.dll
[2011/12/24 11:56:36 | 000,120,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\prntvpt.dll
[2011/12/24 11:56:35 | 000,514,560 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qdvd.dll
[2011/12/24 11:56:35 | 000,314,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\SndVol.exe
[2011/12/24 11:56:35 | 000,066,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\w32tm.exe
[2011/12/24 11:56:34 | 000,352,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\spwizeng.dll
[2011/12/24 11:56:34 | 000,314,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\azroleui.dll
[2011/12/24 11:56:34 | 000,223,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wksprt.exe
[2011/12/24 11:56:33 | 003,727,872 | —- | C] (Microsoft Corporation) – C:\Windows\System32\accessibilitycpl.dll
[2011/12/24 11:56:32 | 000,190,976 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\ks.sys
[2011/12/24 11:56:32 | 000,059,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\fdeploy.dll
[2011/12/24 11:56:31 | 000,516,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\main.cpl
[2011/12/24 11:56:31 | 000,226,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MSAC3ENC.DLL
[2011/12/24 11:56:31 | 000,161,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netjoin.dll
[2011/12/24 11:56:30 | 002,130,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\networkmap.dll
[2011/12/24 11:56:30 | 000,186,880 | —- | C] (Microsoft Corporation) – C:\Windows\System32\adsldp.dll
[2011/12/24 11:56:29 | 000,414,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mspbda.dll
[2011/12/24 11:56:29 | 000,320,512 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Faultrep.dll
[2011/12/24 11:56:29 | 000,314,880 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wusa.exe
[2011/12/24 11:56:29 | 000,312,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MCEWMDRMNDBootstrap.dll
[2011/12/24 11:56:28 | 000,395,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\prnfldr.dll
[2011/12/24 11:56:28 | 000,218,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\OnLineIDCpl.dll
[2011/12/24 11:56:27 | 000,755,200 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sud.dll
[2011/12/24 11:56:27 | 000,744,448 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ActionCenter.dll
[2011/12/24 11:56:27 | 000,266,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MediaMetadataHandler.dll
[2011/12/24 11:56:26 | 000,389,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sysmon.ocx
[2011/12/24 11:56:26 | 000,325,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\slui.exe
[2011/12/24 11:56:26 | 000,233,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\taskbarcpl.dll
[2011/12/24 11:56:26 | 000,172,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iasrad.dll
[2011/12/24 11:56:26 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\taskhost.exe
[2011/12/24 11:56:25 | 000,271,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iprtrmgr.dll
[2011/12/24 11:56:25 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\hidclass.sys
[2011/12/24 11:56:24 | 000,220,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\defaultlocationcpl.dll
[2011/12/24 11:56:24 | 000,137,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\halacpi.dll
[2011/12/24 11:56:24 | 000,129,536 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpcorekmts.dll
[2011/12/24 11:56:24 | 000,082,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dot3cfg.dll
[2011/12/24 11:56:23 | 000,692,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\bthprops.cpl
[2011/12/24 11:56:23 | 000,042,496 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ftp.exe
[2011/12/24 11:56:22 | 000,577,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wpd_ci.dll
[2011/12/24 11:56:22 | 000,428,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\shwebsvc.dll
[2011/12/24 11:56:22 | 000,345,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\intl.cpl
[2011/12/24 11:56:22 | 000,148,992 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ifsutil.dll
[2011/12/24 11:56:22 | 000,139,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2011/12/24 11:56:22 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sisbkup.dll
[2011/12/24 11:56:21 | 000,205,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\efscore.dll
[2011/12/24 11:56:21 | 000,114,688 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2011/12/24 11:56:20 | 000,750,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sdcpl.dll
[2011/12/24 11:56:20 | 000,600,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\TabletPC.cpl
[2011/12/24 11:56:20 | 000,537,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ActionCenterCPL.dll
[2011/12/24 11:56:20 | 000,135,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\recovery.dll
[2011/12/24 11:56:19 | 000,146,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\autoplay.dll
[2011/12/24 11:56:19 | 000,058,880 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpwsx.dll
[2011/12/24 11:56:18 | 000,484,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DeviceCenter.dll
[2011/12/24 11:56:18 | 000,295,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\bcdedit.exe
[2011/12/24 11:56:18 | 000,115,712 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sppnp.dll
[2011/12/24 11:56:17 | 000,738,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmpmde.dll
[2011/12/24 11:56:17 | 000,068,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WSTPager.ax
[2011/12/24 11:56:16 | 000,859,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\OobeFldr.dll
[2011/12/24 11:56:16 | 000,151,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vdsutil.dll
[2011/12/24 11:56:15 | 000,410,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\systemcpl.dll
[2011/12/24 11:56:15 | 000,297,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntprint.dll
[2011/12/24 11:56:15 | 000,210,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\recdisc.exe
[2011/12/24 11:56:15 | 000,152,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\SmartcardCredentialProvider.dll
[2011/12/24 11:56:15 | 000,057,344 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpsign.exe
[2011/12/24 11:56:14 | 000,656,384 | —- | C] (Microsoft Corporation) – C:\Windows\System32\nshwfp.dll
[2011/12/24 11:56:14 | 000,270,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sethc.exe
[2011/12/24 11:56:14 | 000,262,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rstrui.exe
[2011/12/24 11:56:14 | 000,175,104 | —- | C] (Microsoft Corporation) – C:\Windows\System32\fvecpl.dll
[2011/12/24 11:56:14 | 000,146,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\bcdboot.exe
[2011/12/24 11:56:13 | 000,743,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\blackbox.dll
[2011/12/24 11:56:12 | 000,193,536 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ksproxy.ax
[2011/12/24 11:56:12 | 000,107,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NAPHLPR.DLL
[2011/12/24 11:56:12 | 000,093,696 | —- | C] (Windows ® Codename Longhorn DDK provider) – C:\Windows\System32\fms.dll
[2011/12/24 11:56:11 | 000,257,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dpx.dll
[2011/12/24 11:56:11 | 000,182,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmpsrcwp.dll
[2011/12/24 11:56:11 | 000,112,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\AuxiliaryDisplayServices.dll
[2011/12/24 11:56:11 | 000,101,888 | —- | C] (Microsoft Corporation) – C:\Windows\System32\migisol.dll
[2011/12/24 11:56:10 | 000,805,376 | —- | C] (Microsoft Corporation) – C:\Windows\System32\cdosys.dll
[2011/12/24 11:56:09 | 000,346,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\nshipsec.dll
[2011/12/24 11:56:09 | 000,254,976 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wsqmcons.exe
[2011/12/24 11:56:09 | 000,067,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\asycfilt.dll
[2011/12/24 11:56:08 | 000,592,384 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msftedit.dll
[2011/12/24 11:56:08 | 000,086,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\isoburn.exe
[2011/12/24 11:56:07 | 000,428,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wlanmsm.dll
[2011/12/24 11:56:07 | 000,333,824 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dot3ui.dll
[2011/12/24 11:56:07 | 000,247,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ReAgent.dll
[2011/12/24 11:56:07 | 000,222,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wavemsp.dll
[2011/12/24 11:56:07 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wuwebv.dll
[2011/12/24 11:56:06 | 000,586,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dfrgui.exe
[2011/12/24 11:56:06 | 000,047,616 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzutil.exe
[2011/12/24 11:56:05 | 000,444,928 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wvc.dll
[2011/12/24 11:56:05 | 000,406,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wimgapi.dll
[2011/12/24 11:56:05 | 000,198,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sysclass.dll
[2011/12/24 11:56:05 | 000,197,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ocsetup.exe
[2011/12/24 11:56:04 | 000,438,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\AdmTmpl.dll
[2011/12/24 11:56:03 | 000,209,920 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PkgMgr.exe
[2011/12/24 11:56:02 | 000,190,976 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qcap.dll
[2011/12/24 11:56:02 | 000,113,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\setupugc.exe
[2011/12/24 11:56:02 | 000,051,200 | —- | C] (Twain Working Group) – C:\Windows\twain_32.dll
[2011/12/24 11:56:01 | 000,206,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qasf.dll
[2011/12/24 11:56:01 | 000,064,512 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/12/24 11:56:00 | 000,697,344 | —- | C] (Microsoft Corporation) – C:\Windows\System32\SmiEngine.dll
[2011/12/24 11:56:00 | 000,195,072 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msrating.dll
[2011/12/24 11:56:00 | 000,170,496 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationSettings.exe
[2011/12/24 11:56:00 | 000,118,784 | —- | C] (Microsoft Corporation) – C:\Windows\System32\uxlib.dll
[2011/12/24 11:55:59 | 000,293,888 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ssText3d.scr
[2011/12/24 11:55:59 | 000,257,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\srrstr.dll
[2011/12/24 11:55:59 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\slwga.dll
[2011/12/24 11:55:58 | 000,196,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wwanconn.dll
[2011/12/24 11:55:57 | 000,616,960 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmdrmsdk.dll
[2011/12/24 11:55:57 | 000,098,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\nslookup.exe
[2011/12/24 11:55:57 | 000,084,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mciavi32.dll
[2011/12/24 11:55:57 | 000,034,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\imgutil.dll
[2011/12/24 11:55:56 | 000,211,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DevicePairingFolder.dll
[2011/12/24 11:55:55 | 000,504,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msscp.dll
[2011/12/24 11:55:54 | 000,327,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wimserv.exe
[2011/12/24 11:55:54 | 000,276,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\diskraid.exe
[2011/12/24 11:55:54 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\acppage.dll
[2011/12/24 11:55:53 | 000,186,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpencom.dll
[2011/12/24 11:55:53 | 000,157,184 | —- | C] (Microsoft Corporation) – C:\Windows\System32\perfmon.exe
[2011/12/24 11:55:52 | 000,402,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drmmgrtn.dll
[2011/12/24 11:55:52 | 000,202,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\input.dll
[2011/12/24 11:55:51 | 000,292,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WindowsAnytimeUpgradeResults.exe
[2011/12/24 11:55:51 | 000,174,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ocsetapi.dll
[2011/12/24 11:55:51 | 000,046,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NAPCRYPT.DLL
[2011/12/24 11:55:50 | 000,327,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\nltest.exe
[2011/12/24 11:55:50 | 000,078,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\UserAccountControlSettings.dll
[2011/12/24 11:55:50 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vpnikeapi.dll
[2011/12/24 11:55:49 | 001,111,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\onexui.dll
[2011/12/24 11:55:49 | 000,219,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iTVData.dll
[2011/12/24 11:55:49 | 000,160,256 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vdsbas.dll
[2011/12/24 11:55:48 | 000,198,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wpdwcn.dll
[2011/12/24 11:55:48 | 000,096,256 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inseng.dll
[2011/12/24 11:55:48 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\bfsvc.exe
[2011/12/24 11:55:48 | 000,050,688 | —- | C] (Microsoft Corporation) – C:\Windows\System32\runonce.exe
[2011/12/24 11:55:47 | 000,210,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxdiagn.dll
[2011/12/24 11:55:47 | 000,095,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\logagent.exe
[2011/12/24 11:55:47 | 000,083,968 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RegisterIEPKEYs.exe
[2011/12/24 11:55:46 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sspisrv.dll
[2011/12/24 11:55:45 | 000,242,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\eapp3hst.dll
[2011/12/24 11:55:45 | 000,176,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MFPlay.dll
[2011/12/24 11:55:45 | 000,117,760 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\rmcast.sys
[2011/12/24 11:55:44 | 000,489,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10level9.dll
[2011/12/24 11:55:44 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PnPUnattend.exe
[2011/12/24 11:55:43 | 000,507,392 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmdrmdev.dll
[2011/12/24 11:55:43 | 000,108,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\shacct.dll
[2011/12/24 11:55:42 | 000,309,760 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sqlcese30.dll
[2011/12/24 11:55:42 | 000,186,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\bitsadmin.exe
[2011/12/24 11:55:42 | 000,087,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wudriver.dll
[2011/12/24 11:55:42 | 000,059,392 | —- | C] (Microsoft Corporation) – C:\Windows\System32\unimdmat.dll
[2011/12/24 11:55:42 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iscsium.dll
[2011/12/24 11:55:42 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\lsmproxy.dll
[2011/12/24 11:55:41 | 000,878,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Bubbles.scr
[2011/12/24 11:55:41 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tabcal.exe
[2011/12/24 11:55:41 | 000,052,224 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpd3d.dll
[2011/12/24 11:55:40 | 001,160,192 | —- | C] (Microsoft Corporation) – C:\Windows\System32\OpcServices.dll
[2011/12/24 11:55:40 | 000,183,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PortableDeviceSyncProvider.dll
[2011/12/24 11:55:40 | 000,084,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\kstvtune.ax
[2011/12/24 11:55:39 | 000,350,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WPDSp.dll
[2011/12/24 11:55:39 | 000,162,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WUDFPlatform.dll
[2011/12/24 11:55:39 | 000,082,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\logman.exe
[2011/12/24 11:55:39 | 000,077,824 | —- | C] (Microsoft Corporation) – C:\Windows\System32\olethk32.dll
[2011/12/24 11:55:39 | 000,060,928 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ncryptui.dll
[2011/12/24 11:55:39 | 000,059,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\djoin.exe
[2011/12/24 11:55:38 | 000,427,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PortableDeviceStatus.dll
[2011/12/24 11:55:38 | 000,220,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Ribbons.scr
[2011/12/24 11:55:38 | 000,132,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MdSched.exe
[2011/12/24 11:55:38 | 000,099,328 | —- | C] (Microsoft Corporation) – C:\Windows\System32\QSVRMGMT.DLL
[2011/12/24 11:55:38 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\Windows\System32\lpremove.exe
[2011/12/24 11:55:38 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wwanprotdim.dll
[2011/12/24 11:55:37 | 000,221,184 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Mystify.scr
[2011/12/24 11:55:37 | 000,179,200 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ActionQueue.dll
[2011/12/24 11:55:37 | 000,142,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\powercfg.cpl
[2011/12/24 11:55:37 | 000,109,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\CscMig.dll
[2011/12/24 11:55:37 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tsgqec.dll
[2011/12/24 11:55:36 | 000,902,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMADMOD.DLL
[2011/12/24 11:55:36 | 000,318,464 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMPhoto.dll
[2011/12/24 11:55:36 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mapistub.dll
[2011/12/24 11:55:36 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mapi32.dll
[2011/12/24 11:55:36 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\Windows\System32\utildll.dll
[2011/12/24 11:55:35 | 000,115,200 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dot3msm.dll
[2011/12/24 11:55:35 | 000,109,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wiavideo.dll
[2011/12/24 11:55:35 | 000,107,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Kswdmcap.ax
[2011/12/24 11:55:35 | 000,098,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\fphc.dll
[2011/12/24 11:55:34 | 000,541,184 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMVSDECD.DLL
[2011/12/24 11:55:34 | 000,153,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\VBICodec.ax
[2011/12/24 11:55:34 | 000,051,200 | —- | C] (Microsoft Corporation) – C:\Windows\System32\takeown.exe
[2011/12/24 11:55:34 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\TsUsbRedirectionGroupPolicyControl.exe
[2011/12/24 11:55:33 | 000,436,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmdrmnet.dll
[2011/12/24 11:55:33 | 000,283,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qdv.dll
[2011/12/24 11:55:32 | 000,265,216 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msnetobj.dll
[2011/12/24 11:55:32 | 000,128,512 | —- | C] (Microsoft Corporation) – C:\Windows\System32\EhStorAPI.dll
[2011/12/24 11:55:32 | 000,100,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sppinst.dll
[2011/12/24 11:55:31 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\QCLIPROV.DLL
[2011/12/24 11:55:31 | 000,066,560 | —- | C] (Microsoft Corporation) – C:\Windows\System32\cca.dll
[2011/12/24 11:55:30 | 000,567,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WUDFx.dll
[2011/12/24 11:55:30 | 000,202,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\unattend.dll
[2011/12/24 11:55:30 | 000,182,784 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RelPost.exe
[2011/12/24 11:55:30 | 000,084,992 | —- | C] (Microsoft Corporation) – C:\Windows\System32\cmstp.exe
[2011/12/24 11:55:30 | 000,025,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qprocess.exe
[2011/12/24 11:55:29 | 000,070,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MuiUnattend.exe
[2011/12/24 11:55:29 | 000,056,832 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vfwwdm32.dll
[2011/12/24 11:55:29 | 000,051,712 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wsnmp32.dll
[2011/12/24 11:55:29 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\pdhui.dll
[2011/12/24 11:55:28 | 000,739,328 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMSPDMOD.DLL
[2011/12/24 11:55:28 | 000,115,712 | —- | C] (Microsoft Corporation) – C:\Windows\System32\setupcln.dll
[2011/12/24 11:55:28 | 000,050,688 | —- | C] (Microsoft Corporation) – C:\Windows\System32\umb.dll
[2011/12/24 11:55:28 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\basesrv.dll
[2011/12/24 11:55:27 | 000,176,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msorcl32.dll
[2011/12/24 11:55:27 | 000,028,160 | —- | C] (Microsoft Corporation) – C:\Windows\System32\AzSqlExt.dll
[2011/12/24 11:55:27 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msg.exe
[2011/12/24 11:55:26 | 000,122,880 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iasrecst.dll
[2011/12/24 11:55:26 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qwinsta.exe
[2011/12/24 11:55:26 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\chglogon.exe
[2011/12/24 11:55:25 | 000,144,896 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iscsicli.exe
[2011/12/24 11:55:25 | 000,128,000 | —- | C] (Microsoft Corporation) – C:\Windows\System32\desk.cpl
[2011/12/24 11:55:25 | 000,126,464 | —- | C] (Microsoft Corporation) – C:\Windows\System32\BdeHdCfg.exe
[2011/12/24 11:55:25 | 000,037,888 | —- | C] (Microsoft Corporation) – C:\Windows\System32\relog.exe
[2011/12/24 11:55:25 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PrintIsolationProxy.dll
[2011/12/24 11:55:25 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netiougc.exe
[2011/12/24 11:55:24 | 000,070,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\amstream.dll
[2011/12/24 11:55:24 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\Windows\System32\spbcd.dll
[2011/12/24 11:55:24 | 000,047,104 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wkscli.dll
[2011/12/24 11:55:24 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WavDest.dll
[2011/12/24 11:55:23 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\diskpart.exe
[2011/12/24 11:55:23 | 000,024,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netbtugc.exe
[2011/12/24 11:55:23 | 000,023,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\quser.exe
[2011/12/24 11:55:22 | 000,158,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\itircl.dll
[2011/12/24 11:55:22 | 000,085,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc_ssp_isv.dll
[2011/12/24 11:55:22 | 000,085,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc_ssp.dll
[2011/12/24 11:55:22 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\CertPolEng.dll
[2011/12/24 11:55:22 | 000,053,248 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MultiDigiMon.exe
[2011/12/24 11:55:22 | 000,050,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\setbcdlocale.dll
[2011/12/24 11:55:22 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\syssetup.dll
[2011/12/24 11:55:22 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\nrpsrv.dll
[2011/12/24 11:55:21 | 001,027,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\IMJP10.IME
[2011/12/24 11:55:21 | 000,144,384 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmpps.dll
[2011/12/24 11:55:21 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ksxbar.ax
[2011/12/24 11:55:21 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qappsrv.exe
[2011/12/24 11:55:20 | 000,430,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\FXSTIFF.dll
[2011/12/24 11:55:20 | 000,022,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\chgport.exe
[2011/12/24 11:55:20 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tsdiscon.exe
[2011/12/24 11:55:20 | 000,020,992 | —- | C] (Microsoft Corporation) – C:\Windows\System32\chgusr.exe
[2011/12/24 11:55:19 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wuapp.exe
[2011/12/24 11:55:19 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tscon.exe
[2011/12/24 11:55:18 | 000,278,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate_ssp_isv.exe
[2011/12/24 11:55:18 | 000,094,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\eappgnui.dll
[2011/12/24 11:55:18 | 000,069,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tlscsp.dll
[2011/12/24 11:55:18 | 000,062,976 | —- | C] (Microsoft Corporation) – C:\Windows\System32\findstr.exe
[2011/12/24 11:55:18 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WerFaultSecure.exe
[2011/12/24 11:55:18 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ReAgentc.exe
[2011/12/24 11:55:17 | 000,022,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tskill.exe
[2011/12/24 11:55:17 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\logoff.exe
[2011/12/24 11:55:16 | 000,280,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate_ssp.exe
[2011/12/24 11:55:16 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wiarpc.dll
[2011/12/24 11:55:16 | 000,020,992 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rwinsta.exe
[2011/12/24 11:55:15 | 000,036,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mciqtz32.dll
[2011/12/24 11:55:15 | 000,020,992 | —- | C] (Microsoft Corporation) – C:\Windows\System32\shadow.exe
[2011/12/24 11:55:14 | 000,121,344 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sppc.dll
[2011/12/24 11:55:14 | 000,082,944 | —- | C] (Radius Inc.) – C:\Windows\System32\iccvid.dll
[2011/12/24 11:55:14 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\muifontsetup.dll
[2011/12/24 11:55:13 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\tdi.sys
[2011/12/24 11:55:13 | 000,019,968 | —- | C] (Microsoft Corporation) – C:\Windows\System32\spopk.dll
[2011/12/24 11:55:12 | 000,057,344 | —- | C] (Microsoft Corporation) – C:\Windows\System32\repair-bde.exe
[2011/12/24 11:55:12 | 000,041,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\luainstall.dll
[2011/12/24 11:55:12 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wdiasqmmodule.dll
[2011/12/24 11:55:12 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\usbrpm.sys
[2011/12/24 11:55:12 | 000,022,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\HotStartUserAgent.dll
[2011/12/24 11:55:11 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\Windows\System32\manage-bde.exe
[2011/12/24 11:55:11 | 000,034,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\unlodctr.exe
[2011/12/24 11:55:11 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vbisurf.ax
[2011/12/24 11:55:11 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdmo.dll
[2011/12/24 11:55:11 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netcfg.exe
[2011/12/24 11:55:10 | 000,053,760 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vmicres.dll
[2011/12/24 11:55:10 | 000,052,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetmib1.dll
[2011/12/24 11:55:10 | 000,038,400 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vmstorfltres.dll
[2011/12/24 11:55:10 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdprefdrvapi.dll
[2011/12/24 11:55:09 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\g711codc.ax
[2011/12/24 11:55:09 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\reset.exe
[2011/12/24 11:55:09 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\change.exe
[2011/12/24 11:55:09 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\query.exe
[2011/12/24 11:55:08 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WUDFCoinstaller.dll
[2011/12/24 11:55:07 | 001,164,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\UIRibbonRes.dll
[2011/12/24 11:55:07 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vmbusres.dll
[2011/12/24 11:55:07 | 000,041,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\browcli.dll
[2011/12/24 11:55:07 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\Windows\System32\odbcconf.dll
[2011/12/24 11:55:07 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\profprov.dll
[2011/12/24 11:55:07 | 000,027,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wups.dll
[2011/12/24 11:55:06 | 000,017,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\perfts.dll
[2011/12/24 11:55:04 | 000,039,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\FXSMON.dll
[2011/12/24 11:55:04 | 000,022,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\elsTrans.dll
[2011/12/24 11:55:04 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/12/24 11:55:03 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\TRAPI.dll
[2011/12/24 11:55:02 | 000,121,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RDPENCDD.dll
[2011/12/24 11:55:02 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\bitsperf.dll
[2011/12/24 11:55:02 | 000,017,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\schedcli.dll
[2011/12/24 11:55:01 | 000,068,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\napdsnap.dll
[2011/12/24 11:55:01 | 000,030,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dsauth.dll
[2011/12/24 11:54:59 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sscore.dll
[2011/12/24 11:54:58 | 000,430,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\imkr80.ime
[2011/12/24 11:54:58 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wsdchngr.dll
[2011/12/24 11:54:57 | 000,036,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wups2.dll
[2011/12/24 11:54:57 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\riched32.dll
[2011/12/24 11:54:55 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\VMBusHID.sys
[2011/12/24 11:54:55 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpcfgex.dll
[2011/12/24 11:54:54 | 000,386,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/12/24 11:54:52 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wshirda.dll
[2011/12/24 11:54:50 | 000,025,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\USBCAMD2.sys
[2011/12/24 11:54:50 | 000,025,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\USBCAMD.sys
[2011/12/24 11:54:49 | 000,116,224 | —- | C] (Microsoft Corporation) – C:\Windows\System32\VmbusCoinstaller.dll
[2011/12/24 11:54:49 | 000,113,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\VmdCoinstall.dll
[2011/12/24 11:54:49 | 000,113,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\IcCoinstall.dll
[2011/12/24 11:54:49 | 000,047,616 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vmictimeprovider.dll
[2011/12/24 11:54:49 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vmbuspipe.dll
[2011/12/24 11:54:49 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\Windows\System32\spwmp.dll
[2011/12/24 11:54:47 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RDPREFDD.dll
[2011/12/24 11:54:47 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\C_ISCII.DLL
[2011/12/24 11:54:47 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\shunimpl.dll
[2011/12/24 11:54:47 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdxm.ocx
[2011/12/24 11:54:47 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxmasf.dll
[2011/12/24 11:54:44 | 012,625,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmploc.DLL
[2011/12/24 11:54:43 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\kbdlk41a.dll
[2011/12/24 11:54:43 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDSF.DLL
[2011/12/24 11:54:43 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDNEPR.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDUS.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDUGHR1.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDTURME.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDTAJIK.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDMON.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDMAORI.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDLT1.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDINTEL.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDINORI.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDINKAN.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDBULG.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDBLR.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDBASH.DLL
[2011/12/24 11:54:43 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDGEO.DLL
[2011/12/24 11:54:42 | 000,069,120 | —- | C] (Microsoft Corporation) – C:\Windows\System32\nlsbres.dll
[2011/12/24 11:54:42 | 000,052,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\BlbEvents.dll
[2011/12/24 11:54:42 | 000,035,328 | —- | C] (Microsoft Corporation) – C:\Windows\System32\pifmgr.dll
[2011/12/24 11:54:42 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\spwizres.dll
[2011/12/24 11:54:42 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDSG.DLL
[2011/12/24 11:54:42 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDCZ1.DLL
[2011/12/24 11:54:42 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDTUQ.DLL
[2011/12/24 11:54:42 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDTUF.DLL
[2011/12/24 11:54:42 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDPO.DLL
[2011/12/24 11:54:42 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDINBEN.DLL
[2011/12/24 11:54:42 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDGR1.DLL
[2011/12/24 11:54:42 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDGKL.DLL
[2011/12/24 11:54:42 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDINTAM.DLL
[2011/12/24 11:54:42 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDINMAR.DLL
[2011/12/24 11:54:42 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDINHIN.DLL
[2011/12/24 11:54:42 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\vms3cap.sys
[2011/12/24 11:54:42 | 000,002,560 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dpnaddr.dll
[2011/12/24 11:54:27 | 000,189,952 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wdscore.dll
[2011/12/24 11:53:41 | 000,363,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wbemcomn.dll
[2011/12/24 11:53:13 | 000,189,952 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sqmapi.dll
[2011/12/24 10:42:40 | 000,284,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\usbport.sys
[2011/12/24 10:42:37 | 000,005,888 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\usbd.sys
[2011/12/24 10:42:23 | 000,148,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\storport.sys
[2011/12/24 10:42:21 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\fsutil.exe
[2011/12/23 17:11:11 | 000,000,000 | —D | C] – C:\Windows\System32\Wat
[2011/12/23 14:35:36 | 000,000,000 | —D | C] – C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2011/12/23 11:46:20 | 000,000,000 | —D | C] – C:\Users\Edward\Documents\GomPlayer
[2011/12/23 11:46:19 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\GRETECH
[2011/12/23 10:15:11 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2011/12/23 10:14:14 | 000,032,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msonpmon.dll
[2011/12/23 10:04:39 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Works
[2011/12/23 10:01:55 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Visual Studio
[2011/12/23 10:01:53 | 000,000,000 | —D | C] – C:\Program Files\Common Files\DESIGNER
[2011/12/23 09:58:26 | 000,000,000 | —D | C] – C:\Windows\PCHEALTH
[2011/12/23 09:58:25 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2011/12/23 09:52:10 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Visual Studio 2005
[2011/12/23 09:51:33 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Visual Studio 8
[2011/12/23 09:46:26 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Local\Microsoft Help
[2011/12/23 09:45:07 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Office
[2011/12/23 09:45:04 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft Help
[2011/12/23 09:41:55 | 000,000,000 | RH-D | C] – C:\MSOCache
[2011/12/23 09:25:42 | 000,187,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\FWPKCLNT.SYS
[2011/12/23 09:25:11 | 000,031,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\prevhost.exe
[2011/12/23 09:24:44 | 000,599,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/12/23 09:24:40 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/12/23 09:24:39 | 000,132,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2011/12/23 09:24:38 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/12/23 09:24:38 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/12/23 09:21:52 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dnscacheugc.exe
[2011/12/23 09:21:49 | 000,294,912 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\atmfd.dll
[2011/12/23 09:21:49 | 000,070,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\fontsub.dll
[2011/12/23 09:21:49 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\System32\atmlib.dll
[2011/12/23 09:21:34 | 002,342,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2011/12/23 09:21:31 | 000,075,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\psisrndr.ax
[2011/12/23 09:21:30 | 000,465,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\psisdecd.dll
[2011/12/23 09:21:29 | 000,204,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MSNP.ax
[2011/12/23 09:21:29 | 000,072,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Mpeg2Data.ax
[2011/12/23 09:21:28 | 000,059,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MSDvbNP.ax
[2011/12/23 09:21:14 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2011/12/23 09:20:26 | 001,549,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tquery.dll
[2011/12/23 09:20:25 | 001,401,344 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mssrch.dll
[2011/12/23 09:20:22 | 000,666,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mssvp.dll
[2011/12/23 09:20:22 | 000,337,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mssph.dll
[2011/12/23 09:20:22 | 000,197,120 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mssphtb.dll
[2011/12/23 09:20:19 | 000,059,392 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msscntrs.dll
[2011/12/23 09:20:16 | 000,191,488 | —- | C] (Microsoft Corporation) – C:\Windows\System32\FXSCOVER.exe
[2011/12/23 09:20:15 | 000,802,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WFS.exe
[2011/12/23 09:20:13 | 000,534,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\EncDec.dll
[2011/12/23 09:20:10 | 000,870,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsPrint.dll
[2011/12/23 09:20:08 | 000,288,256 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsGdiConverter.dll
[2011/12/23 09:20:06 | 000,038,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\csrsrv.dll
[2011/12/23 09:20:03 | 000,642,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\CPFilters.dll
[2011/12/23 09:20:01 | 000,850,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sbe.dll
[2011/12/23 09:20:01 | 000,199,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mpg2splt.ax
[2011/12/23 09:19:53 | 000,271,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\conhost.exe
[2011/12/23 09:19:53 | 000,169,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winsrv.dll
[2011/12/23 09:19:52 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2011/12/23 09:19:51 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
[2011/12/23 09:19:51 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2011/12/23 09:19:51 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2011/12/23 09:19:51 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2011/12/23 09:19:51 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2011/12/23 09:19:51 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2011/12/23 09:19:51 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
[2011/12/23 09:19:51 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2011/12/23 09:19:50 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
[2011/12/23 09:19:50 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2011/12/23 09:19:50 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2011/12/23 09:19:50 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2011/12/23 09:19:50 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2011/12/23 09:19:50 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2011/12/23 09:19:50 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2011/12/23 09:19:50 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2011/12/23 09:19:50 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2011/12/23 09:19:49 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2011/12/23 09:19:49 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2011/12/23 09:19:49 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2011/12/23 09:19:49 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2011/12/23 09:19:49 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2011/12/23 09:19:49 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
[2011/12/23 09:19:49 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2011/12/23 09:19:49 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
[2011/12/23 09:19:49 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2011/12/23 09:19:49 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
[2011/12/23 09:19:39 | 002,616,320 | —- | C] (Microsoft Corporation) – C:\Windows\explorer.exe
[2011/12/23 09:19:29 | 000,319,488 | —- | C] (Microsoft Corporation) – C:\Windows\System32\odbcjt32.dll
[2011/12/23 09:19:29 | 000,122,880 | —- | C] (Microsoft Corporation) – C:\Windows\System32\odbccp32.dll
[2011/12/23 09:19:28 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\Windows\System32\odbccr32.dll
[2011/12/23 09:19:27 | 000,086,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\odbccu32.dll
[2011/12/23 09:19:26 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\odbctrac.dll
[2011/12/23 09:19:23 | 000,219,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1core.dll
[2011/12/23 09:19:22 | 000,161,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1.dll
[2011/12/23 09:19:19 | 003,967,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2011/12/23 09:19:17 | 003,912,560 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2011/12/23 09:18:36 | 001,137,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc42.dll
[2011/12/23 09:18:35 | 001,164,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc42u.dll
[2011/12/23 09:18:12 | 000,123,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\poqexec.exe
[2011/12/23 09:18:10 | 000,027,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\Diskdump.sys
[2011/12/23 08:59:07 | 000,219,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\dxgmms1.sys
[2011/12/23 08:59:07 | 000,107,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\cdd.dll
[2011/12/22 21:26:55 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOM Player
[2011/12/22 21:26:34 | 000,000,000 | —D | C] – C:\Program Files\GRETECH
[2011/12/22 21:00:08 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\Skype
[2011/12/22 20:59:28 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011/12/22 20:59:04 | 000,000,000 | R–D | C] – C:\Program Files\Skype
[2011/12/22 20:58:52 | 000,000,000 | —D | C] – C:\ProgramData\Skype
[2011/12/22 20:57:53 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan
[2011/12/22 20:57:13 | 000,000,000 | —D | C] – C:\Program Files\SpeedFan
[2011/12/22 20:26:16 | 000,090,112 | —- | C] (Creative Technology Ltd.) – C:\Windows\Updreg.EXE
[2011/12/22 20:26:14 | 000,149,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MFCANS32.DLL
[2011/12/22 20:26:14 | 000,108,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MFCUIA32.DLL
[2011/12/22 20:26:14 | 000,084,992 | —- | C] (Creative Technology Ltd.) – C:\Windows\System32\SFCVRT32.DLL
[2011/12/22 20:26:14 | 000,053,552 | —- | C] (Creative® Technology Ltd.) – C:\Windows\CTCCW.DLL
[2011/12/22 20:26:14 | 000,024,976 | —- | C] (Creative Technology Ltd.) – C:\Windows\CTRES.DLL
[2011/12/22 20:26:13 | 000,082,432 | —- | C] (Creative Technology Ltd.) – C:\Windows\System32\CTWFLT32.DLL
[2011/12/22 20:26:13 | 000,054,784 | —- | C] (Blue Sky Software Corporation.) – C:\Windows\System32\INETWH32.DLL
[2011/12/22 20:26:13 | 000,026,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\CTL3D.DLL
[2011/12/22 20:26:10 | 000,000,000 | —D | C] – C:\Windows\System32\Defaults
[2011/12/22 20:25:17 | 000,020,480 | —- | C] (Creative Technology Limited) – C:\Windows\INRES.DLL
[2011/12/22 20:25:17 | 000,000,000 | —D | C] – C:\Windows\System32\Data
[2011/12/22 20:25:13 | 000,998,004 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\drivers\HA10KX2K.SYS
[2011/12/22 20:25:13 | 000,213,860 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\drivers\CTSFM2K.SYS
[2011/12/22 20:25:13 | 000,195,432 | —- | C] (Creative Technology Ltd.) – C:\Windows\System32\drivers\CTOSS2K.SYS
[2011/12/22 20:25:13 | 000,156,604 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\drivers\EMUPIA2K.SYS
[2011/12/22 20:25:13 | 000,011,068 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\drivers\CTPRXY2K.SYS
[2011/12/22 20:25:12 | 000,837,548 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\drivers\CTAUD2K.SYS
[2011/12/22 20:25:12 | 000,127,948 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\drivers\CTAC32K.SYS
[2011/12/22 20:25:11 | 000,049,152 | —- | C] (Creative Technology Ltd) – C:\Windows\CTDCRES.DLL
[2011/12/22 20:25:10 | 000,270,336 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\SFMS32.DLL
[2011/12/22 20:25:10 | 000,176,128 | —- | C] (Creative Technology Limited) – C:\Windows\READREG.EXE
[2011/12/22 20:25:10 | 000,036,864 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\SFMAN32.DLL
[2011/12/22 20:25:09 | 000,135,168 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\OPENAL32.DLL
[2011/12/22 20:25:09 | 000,110,592 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\PIAPROXY.DLL
[2011/12/22 20:25:09 | 000,077,824 | —- | C] (Creative Labs) – C:\Windows\System32\EAXAC3.DLL
[2011/12/22 20:25:09 | 000,061,440 | —- | C] (Creative Technology Ltd) – C:\Windows\MIDIDEF.EXE
[2011/12/22 20:25:08 | 000,643,072 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\CTSBLFX.DLL
[2011/12/22 20:25:08 | 000,094,208 | —- | C] (Creative Technology Ltd) – C:\Windows\DEVREG.DLL
[2011/12/22 20:25:08 | 000,028,672 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\CTSPKHLP.DLL
[2011/12/22 20:25:07 | 000,155,648 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\CTOSUSER.DLL
[2011/12/22 20:25:07 | 000,106,496 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\CTDPROXY.DLL
[2011/12/22 20:25:07 | 000,036,864 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\CTEMUPIA.DLL
[2011/12/22 20:25:07 | 000,024,576 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\CTHELPER.EXE
[2011/12/22 20:25:06 | 000,319,488 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\CTDEVCON.DLL
[2011/12/22 20:25:06 | 000,110,592 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\COMMONFX.DLL
[2011/12/22 20:25:06 | 000,106,496 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\CTASIO.DLL
[2011/12/22 20:25:06 | 000,061,440 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\CTAGENT.DLL
[2011/12/22 20:25:05 | 000,065,536 | —- | C] ( ) – C:\Windows\System32\A3D.DLL
[2011/12/22 20:25:05 | 000,053,248 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\AC3API.DLL
[2011/12/22 20:22:05 | 000,000,000 | -H-D | C] – C:\Program Files\InstallShield Installation Information
[2011/12/22 20:22:05 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Creative
[2011/12/22 20:20:12 | 000,006,752 | —- | C] (Creative Technology Ltd.) – C:\Windows\System32\PFMODNT.SYS
[2011/12/22 20:20:04 | 000,000,000 | —D | C] – C:\Program Files\Common Files\InstallShield
[2011/12/22 20:18:34 | 000,000,000 | —D | C] – C:\Program Files\Creative
[2011/12/22 19:49:20 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\Macromedia
[2011/12/22 19:49:20 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\Adobe
[2011/12/22 19:47:50 | 000,000,000 | —D | C] – C:\Windows\pss
[2011/12/22 19:47:11 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2011/12/22 19:43:36 | 000,000,000 | —D | C] – C:\Users\Edward\Desktop\Programs
[2011/12/22 19:22:21 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Security Client
[2011/12/22 19:19:02 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Local\LogiShrd
[2011/12/22 19:18:28 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\Leadertech
[2011/12/22 19:18:07 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
[2011/12/22 19:17:58 | 000,000,000 | —D | C] – C:\ProgramData\LogiShrd
[2011/12/22 19:17:56 | 000,000,000 | —D | C] – C:\Program Files\Logitech
[2011/12/22 19:16:48 | 000,000,000 | -HSD | C] – C:\Windows\Installer
[2011/12/22 19:10:52 | 000,222,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MpSigStub.exe
[2011/12/22 19:06:17 | 000,414,368 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/12/22 19:06:14 | 000,000,000 | —D | C] – C:\Windows\System32\Macromed
[2011/12/22 19:04:01 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\Mozilla
[2011/12/22 19:04:01 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Local\Mozilla
[2011/12/22 19:03:40 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2011/12/22 19:00:20 | 001,002,008 | —- | C] (Intel Corporation) – C:\Windows\System32\igxpun.exe
[2011/12/22 19:00:20 | 000,000,000 | —D | C] – C:\Windows\System32\x64
[2011/12/22 18:58:16 | 000,000,000 | —D | C] – C:\Program Files\Common Files\logishrd
[2011/12/22 18:54:48 | 000,000,000 | R–D | C] – C:\Users\Edward\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2011/12/22 18:54:48 | 000,000,000 | R–D | C] – C:\Users\Edward\Searches
[2011/12/22 18:54:48 | 000,000,000 | R–D | C] – C:\Users\Edward\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011/12/22 18:54:47 | 000,000,000 | —D | C] – C:\Users\Edward\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
[2011/12/22 18:54:26 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\Identities
[2011/12/22 18:54:18 | 000,000,000 | R–D | C] – C:\Users\Edward\Contacts
[2011/12/22 18:53:42 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Local\VirtualStore
[2011/12/22 18:53:33 | 000,000,000 | -HSD | C] – C:\Users\Edward\AppData\Local\Temporary Internet Files
[2011/12/22 18:53:33 | 000,000,000 | -HSD | C] – C:\Users\Edward\Templates
[2011/12/22 18:53:33 | 000,000,000 | -HSD | C] – C:\Users\Edward\Local Settings
[2011/12/22 18:53:33 | 000,000,000 | -HSD | C] – C:\Users\Edward\AppData\Local\History
[2011/12/22 18:53:33 | 000,000,000 | -HSD | C] – C:\Users\Edward\AppData\Local\Application Data
[2011/12/22 18:53:32 | 000,000,000 | -HSD | C] – C:\Users\Edward\Start Menu
[2011/12/22 18:53:32 | 000,000,000 | -HSD | C] – C:\Users\Edward\SendTo
[2011/12/22 18:53:32 | 000,000,000 | -HSD | C] – C:\Users\Edward\Recent
[2011/12/22 18:53:32 | 000,000,000 | -HSD | C] – C:\Users\Edward\PrintHood
[2011/12/22 18:53:32 | 000,000,000 | -HSD | C] – C:\Users\Edward\NetHood
[2011/12/22 18:53:32 | 000,000,000 | -HSD | C] – C:\Users\Edward\Documents\My Videos
[2011/12/22 18:53:32 | 000,000,000 | -HSD | C] – C:\Users\Edward\Documents\My Pictures
[2011/12/22 18:53:32 | 000,000,000 | -HSD | C] – C:\Users\Edward\Documents\My Music
[2011/12/22 18:53:32 | 000,000,000 | -HSD | C] – C:\Users\Edward\My Documents
[2011/12/22 18:53:32 | 000,000,000 | -HSD | C] – C:\Users\Edward\Cookies
[2011/12/22 18:53:32 | 000,000,000 | -HSD | C] – C:\Users\Edward\Application Data
[2011/12/22 18:53:30 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Local\Temp
[2011/12/22 18:53:30 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Local\Microsoft
[2011/12/22 18:53:30 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\Media Center Programs
[2011/12/22 18:53:29 | 000,000,000 | –SD | C] – C:\Users\Edward\AppData\Roaming\Microsoft
[2011/12/22 18:53:29 | 000,000,000 | R–D | C] – C:\Users\Edward\Videos
[2011/12/22 18:53:29 | 000,000,000 | R–D | C] – C:\Users\Edward\Saved Games
[2011/12/22 18:53:29 | 000,000,000 | R–D | C] – C:\Users\Edward\Pictures
[2011/12/22 18:53:29 | 000,000,000 | R–D | C] – C:\Users\Edward\Music
[2011/12/22 18:53:29 | 000,000,000 | R–D | C] – C:\Users\Edward\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011/12/22 18:53:29 | 000,000,000 | R–D | C] – C:\Users\Edward\Links
[2011/12/22 18:53:29 | 000,000,000 | R–D | C] – C:\Users\Edward\Favorites
[2011/12/22 18:53:29 | 000,000,000 | R–D | C] – C:\Users\Edward\Downloads
[2011/12/22 18:53:29 | 000,000,000 | R–D | C] – C:\Users\Edward\Documents
[2011/12/22 18:53:29 | 000,000,000 | R–D | C] – C:\Users\Edward\Desktop
[2011/12/22 18:53:29 | 000,000,000 | R–D | C] – C:\Users\Edward\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011/12/22 18:53:29 | 000,000,000 | -H-D | C] – C:\Users\Edward\AppData
[2011/12/22 18:31:54 | 000,000,000 | —D | C] – C:\Windows\SoftwareDistribution
[2011/12/22 18:28:53 | 000,000,000 | —D | C] – C:\Windows\Minidump
[2011/12/22 18:28:09 | 000,000,000 | —D | C] – C:\Windows\Prefetch
[2011/12/22 18:01:45 | 000,000,000 | —D | C] – C:\Windows\Panther
[2011/12/22 18:01:28 | 000,000,000 | -HSD | C] – C:\Boot
[2011/12/22 17:45:36 | 000,000,000 | —D | C] – C:\Windows.old.000
[2011/12/22 02:08:30 | 000,000,000 | —D | C] – C:\NVIDIA
[2011/12/21 21:15:04 | 000,000,000 | —D | C] – C:\Programs to run
[2011/12/21 17:09:09 | 000,000,000 | -HSD | C] – C:\Recovery

========== Files - Modified Within 30 Days ==========

[2011/12/30 19:25:11 | 000,010,128 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/12/30 19:25:11 | 000,010,128 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/12/30 16:40:50 | 000,626,040 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/12/30 16:40:50 | 000,107,316 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/12/30 14:22:20 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/12/30 14:22:15 | 1603,723,264 | -HS- | M] () – C:\hiberfil.sys
[2011/12/29 09:35:31 | 000,414,368 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/12/29 09:34:35 | 000,001,141 | —- | M] () – C:\Users\Edward\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2011/12/27 18:02:00 | 000,000,046 | —- | M] () – C:\Windows\System32\DonationCoder_urlsnooper_InstallInfo.dat
[2011/12/26 08:45:34 | 000,409,752 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2011/12/25 23:24:38 | 000,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2011/12/25 16:57:45 | 000,152,576 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msclmd.dll
[2011/12/23 21:19:17 | 000,015,744 | —- | M] () – C:\Windows\System32\BMXCtrlState-{00000001-00000000-00000001-00001102-00000002-80271102}.rfx
[2011/12/23 21:19:17 | 000,015,744 | —- | M] () – C:\Windows\System32\BMXBkpCtrlState-{00000001-00000000-00000001-00001102-00000002-80271102}.rfx
[2011/12/23 21:19:17 | 000,000,024 | —- | M] () – C:\Windows\System32\DVCStateBkp-{00000001-00000000-00000001-00001102-00000002-80271102}.dat
[2011/12/23 21:19:17 | 000,000,024 | —- | M] () – C:\Windows\System32\DVCState-{00000001-00000000-00000001-00001102-00000002-80271102}.dat
[2011/12/23 14:46:29 | 000,001,945 | —- | M] () – C:\Windows\epplauncher.mif
[2011/12/22 20:57:13 | 000,000,045 | —- | M] () – C:\Windows\System32\initdebug.nfo
[2011/12/22 20:26:18 | 000,000,128 | —- | M] () – C:\Windows\SBWIN.INI
[2011/12/22 19:47:15 | 000,000,975 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk
[2011/12/22 19:03:48 | 000,001,106 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/12/22 18:55:45 | 000,001,417 | —- | M] () – C:\Users\Edward\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/12/22 18:35:26 | 000,042,045 | —- | M] () – C:\Windows\System32\license.rtf
[2011/12/22 18:01:32 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2011/12/22 18:01:29 | 000,000,490 | RHS- | M] () – C:\Boot.ini.saved

========== Files Created - No Company Name ==========

[2011/12/29 18:16:22 | 000,002,441 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2011/12/29 09:34:35 | 000,001,141 | —- | C] () – C:\Users\Edward\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2011/12/27 18:02:00 | 000,000,046 | —- | C] () – C:\Windows\System32\DonationCoder_urlsnooper_InstallInfo.dat
[2011/12/25 23:24:38 | 000,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2011/12/24 11:59:22 | 000,080,896 | —- | C] () – C:\Windows\System32\RDVGHelper.exe
[2011/12/24 11:58:44 | 000,146,852 | —- | C] () – C:\Windows\System32\systemsf.ebd
[2011/12/24 11:55:18 | 000,066,048 | —- | C] () – C:\Windows\System32\PrintBrmUi.exe
[2011/12/24 11:55:05 | 000,010,429 | —- | C] () – C:\Windows\System32\ScavengeSpace.xml
[2011/12/24 11:54:40 | 000,105,559 | —- | C] () – C:\Windows\System32\RacRules.xml
[2011/12/23 00:37:21 | 000,000,024 | —- | C] () – C:\Windows\System32\DVCStateBkp-{00000001-00000000-00000001-00001102-00000002-80271102}.dat
[2011/12/23 00:37:21 | 000,000,024 | —- | C] () – C:\Windows\System32\DVCState-{00000001-00000000-00000001-00001102-00000002-80271102}.dat
[2011/12/22 20:57:10 | 000,000,045 | —- | C] () – C:\Windows\System32\initdebug.nfo
[2011/12/22 20:31:05 | 000,015,744 | —- | C] () – C:\Windows\System32\BMXCtrlState-{00000001-00000000-00000001-00001102-00000002-80271102}.rfx
[2011/12/22 20:31:05 | 000,015,744 | —- | C] () – C:\Windows\System32\BMXBkpCtrlState-{00000001-00000000-00000001-00001102-00000002-80271102}.rfx
[2011/12/22 20:26:18 | 000,000,128 | —- | C] () – C:\Windows\SBWIN.INI
[2011/12/22 20:26:14 | 000,000,231 | —- | C] () – C:\Windows\AC3API.INI
[2011/12/22 20:26:13 | 001,048,576 | —- | C] () – C:\Windows\System32\SFMAN.DAT
[2011/12/22 20:25:17 | 000,037,727 | —- | C] () – C:\Windows\System32\Emu10kx.ini
[2011/12/22 20:25:17 | 000,000,029 | —- | C] () – C:\Windows\System32\ctzapxx.ini
[2011/12/22 20:25:14 | 000,003,126 | —- | C] () – C:\Windows\System32\Live.bmp
[2011/12/22 20:25:13 | 002,259,067 | —- | C] () – C:\Windows\System32\DEFAULT.ECW
[2011/12/22 20:25:13 | 000,179,669 | —- | C] () – C:\Windows\System32\CTSTATIC.DAT
[2011/12/22 20:25:13 | 000,164,044 | —- | C] () – C:\Windows\System32\CTDLANG.DAT
[2011/12/22 20:25:13 | 000,113,373 | —- | C] () – C:\Windows\System32\CTBASICW.DAT
[2011/12/22 20:25:13 | 000,044,055 | —- | C] () – C:\Windows\System32\CTDAUGHT.DAT
[2011/12/22 20:25:12 | 000,113,273 | —- | C] () – C:\Windows\System32\CTBAS2W.DAT
[2011/12/22 20:25:10 | 000,184,320 | —- | C] () – C:\Windows\PSCONV.EXE
[2011/12/22 20:25:10 | 000,036,864 | —- | C] () – C:\Windows\System32\REGPLIB.EXE
[2011/12/22 20:25:09 | 000,049,152 | —- | C] () – C:\Windows\System32\KILLAPPS.EXE
[2011/12/22 20:25:09 | 000,000,180 | —- | C] () – C:\Windows\System32\KILL.INI
[2011/12/22 20:25:08 | 000,000,059 | —- | C] () – C:\Windows\System32\DEFAULT8.SFM
[2011/12/22 20:25:08 | 000,000,059 | —- | C] () – C:\Windows\System32\DEFAULT4.SFM
[2011/12/22 20:25:08 | 000,000,059 | —- | C] () – C:\Windows\System32\DEFAULT.SFM
[2011/12/22 20:25:07 | 003,373,917 | —- | C] () – C:\Windows\CTDV10K1.CDF
[2011/12/22 20:25:06 | 002,167,684 | —- | C] () – C:\Windows\System32\CT2MGM.SF2
[2011/12/22 20:25:06 | 001,048,576 | —- | C] () – C:\Windows\System32\CT1MGM.ROM
[2011/12/22 19:47:14 | 000,000,975 | —- | C] () – C:\Users\Public\Desktop\CCleaner.lnk
[2011/12/22 19:39:23 | 000,001,945 | —- | C] () – C:\Windows\epplauncher.mif
[2011/12/22 19:22:32 | 000,001,907 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2011/12/22 19:03:48 | 000,001,118 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011/12/22 19:03:48 | 000,001,106 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/12/22 18:55:45 | 000,001,417 | —- | C] () – C:\Users\Edward\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/12/22 18:54:54 | 000,001,423 | —- | C] () – C:\Users\Edward\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011/12/22 18:53:30 | 000,000,290 | —- | C] () – C:\Users\Edward\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2011/12/22 18:53:30 | 000,000,272 | —- | C] () – C:\Users\Edward\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2011/12/22 18:34:46 | 000,001,345 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2011/12/22 18:34:30 | 000,001,326 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2011/12/22 18:01:32 | 000,008,192 | RHS- | C] () – C:\BOOTSECT.BAK
[2011/12/22 18:01:29 | 000,383,786 | RHS- | C] () – C:\bootmgr
[2011/12/22 18:01:29 | 000,000,346 | -H– | C] () – C:\Boot.BAK
[2011/12/21 16:50:36 | 1603,723,264 | -HS- | C] () – C:\hiberfil.sys
[2010/11/11 06:51:29 | 000,000,805 | —- | C] () – C:\Windows\System32\RTSLCS.dll
[2010/06/25 09:03:12 | 000,053,299 | —- | C] () – C:\Windows\System32\pthreadVC.dll
[2009/10/07 01:46:36 | 000,025,752 | —- | C] () – C:\Windows\System32\drivers\LVPr2Mon.sys
[2009/10/07 01:23:08 | 000,013,584 | —- | C] () – C:\Windows\System32\drivers\iKeyLFT2.dll
[2009/07/13 20:57:37 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/13 20:33:53 | 000,409,752 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2009/07/13 18:05:48 | 000,626,040 | —- | C] () – C:\Windows\System32\perfh009.dat
[2009/07/13 18:05:48 | 000,291,294 | —- | C] () – C:\Windows\System32\perfi009.dat
[2009/07/13 18:05:48 | 000,107,316 | —- | C] () – C:\Windows\System32\perfc009.dat
[2009/07/13 18:05:48 | 000,031,548 | —- | C] () – C:\Windows\System32\perfd009.dat
[2009/07/13 18:05:05 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2009/07/13 18:04:11 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2009/07/13 15:55:01 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/13 15:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 15:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/06/10 13:26:10 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2008/07/26 14:42:52 | 000,066,482 | —- | C] () – C:\Windows\System32\lvcoinst.ini
[2004/08/13 09:56:20 | 000,005,810 | —- | C] () – C:\Windows\System32\drivers\ASACPI.sys
[1996/04/03 11:33:26 | 000,005,248 | —- | C] () – C:\Windows\System32\giveio.sys

========== LOP Check ==========

[2011/12/29 08:13:32 | 000,000,000 | —D | M] – C:\Users\Edward\AppData\Roaming\DMCache
[2011/12/27 18:02:00 | 000,000,000 | —D | M] – C:\Users\Edward\AppData\Roaming\DonationCoder
[2011/12/29 00:27:36 | 000,000,000 | —D | M] – C:\Users\Edward\AppData\Roaming\GetRightToGo
[2011/12/29 09:27:09 | 000,000,000 | —D | M] – C:\Users\Edward\AppData\Roaming\IDM
[2011/12/22 19:18:28 | 000,000,000 | —D | M] – C:\Users\Edward\AppData\Roaming\Leadertech
[2009/07/13 20:53:46 | 000,004,910 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/06/10 13:42:20 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2011/06/03 08:16:25 | 000,000,346 | -H– | M] () – C:\Boot.BAK
[2011/12/22 18:01:29 | 000,000,490 | RHS- | M] () – C:\Boot.ini.saved
[2010/11/20 04:40:07 | 000,383,786 | RHS- | M] () – C:\bootmgr
[2011/12/22 18:01:32 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2009/06/10 13:42:20 | 000,000,010 | —- | M] () – C:\config.sys
[2011/12/30 14:22:15 | 1603,723,264 | -HS- | M] () – C:\hiberfil.sys
[2011/06/02 01:53:29 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2011/06/02 01:53:29 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2008/04/14 04:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/04/14 04:00:00 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/12/30 14:22:14 | 2138,300,416 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2009/07/13 20:52:25 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/13 20:52:25 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/13 20:52:25 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/13 20:52:25 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 13:31:19 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/07/13 17:15:35 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 19:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\msonpppr.dll
[2010/11/20 04:21:36 | 000,030,208 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/13 20:41:57 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/12/22 18:55:45 | 000,000,221 | -HS- | M] () – C:\Users\Edward\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-12-30 11:01:32

========== Alternate Data Streams ==========

@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >

Hi Doos,



My name is NoodleTech. I would be glad to assist you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• Please be aware that removing malware is not without risk and while unrecoverable damage to systems is rare, it can happen and may require a re-format and re-install of your operating system. Because of this it is a good idea to back-up anything important saved on your computer.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Do not delete anything unless instructed to.
• DO NOT use tools such as ComboFix without supervision.
• Please continue to review my answers until I tell you your machine appears to be clean. Absence of symptoms does not mean that everything is clean.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.
• Failure to respond within 3 days will result in this topic being closed - If you need more time to complete the steps required, please let me know.

===================================================

Please download aswMBR.exe and save it to your desktop. 

Double click aswMBR.exe to start the tool. (Vista/Windows 7 users - right click to run as administrator)

Click Scan

• Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review.
• Note - do NOT attempt any Fix yet.
• You will also notice another file created on the desktop named MBR.dat.
• Right click that file and select Send To>Compressed (zipped) file.
• Attach that zipped file in your next reply as well.

===================================================

Please download TDSSKiller.zip

• Extract it to your desktop
• Double click TDSSKiller.exe
• Press Start Scan.
  
  • If Malicious objects are found, DO NOT cure them.
  • Choose Skip then click on Continue.
• Copy and paste the log in your next reply
  
  • A copy of the log will be saved automatically to the root of the drive (typically C:\)

ComboFix results: ComboFix 11-12-30.02 - Edward 12/31/2011 20:31:46.1.2 - x86 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.2039.1454 [GMT -8:00] Running from: c:\users\[removed]\Downloads\Programs\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2011-12-01 to 2012-01-01 ))))))))))))))))))))))))))))))) . . 2011-12-30 02:17 . 2011-12-30 02:17 ——– d—–w- c:\program files\Common Files\Adobe AIR 2011-12-30 02:15 . 2011-12-30 02:16 ——– d—–w- c:\program files\Common Files\Adobe 2011-12-29 17:28 . 2011-12-31 02:07 ——– d—–w- c:\program files\Yahoo! 2011-12-28 05:07 . 2011-12-28 05:07 ——– d—–w- c:\program files\Internet Download Manager 2011-12-28 02:01 . 2011-12-28 02:01 ——– d—–w- c:\program files\WinPcap 2011-12-28 01:58 . 2011-12-29 14:57 ——– d—–w- c:\program files\URLSnooper2 2011-12-26 03:40 . 2011-12-26 04:39 ——– d—–w- c:\program files\iLivid 2011-12-26 00:34 . 2011-12-26 00:34 ——– d—–w- c:\windows\system32\SPReview 2011-12-26 00:32 . 2011-12-26 00:32 ——– d—–w- c:\windows\system32\EventProviders 2011-12-26 00:08 . 2001-05-28 21:47 12288 —-a-w- c:\windows\system32\AHQCpURes.dll 2011-12-26 00:08 . 2001-05-28 21:47 32768 —-a-w- c:\windows\system32\AudioHQU.cpl 2011-12-25 05:19 . 2011-12-25 05:19 ——– d—–w- c:\program files\OO Software 2011-12-24 19:58 . 2010-11-20 12:29 520064 —-a-w- c:\windows\system32\mcupdate_GenuineIntel.dll 2011-12-24 19:57 . 2010-11-20 12:21 269824 —-a-w- c:\windows\system32\Wldap32.dll 2011-12-24 19:56 . 2010-11-20 12:29 132992 —-a-w- c:\windows\system32\drivers\ataport.sys 2011-12-24 19:55 . 2010-11-20 12:21 257024 —-a-w- c:\windows\system32\srrstr.dll 2011-12-24 19:54 . 2010-11-20 12:21 9728 —-a-w- c:\windows\system32\sscore.dll 2011-12-24 19:53 . 2010-11-20 12:21 363008 —-a-w- c:\windows\system32\wbemcomn.dll 2011-12-24 19:53 . 2010-11-20 12:21 189952 —-a-w- c:\program files\Windows Portable Devices\sqmapi.dll 2011-12-24 19:53 . 2010-11-20 12:19 606208 —-a-w- c:\windows\system32\wbem\fastprox.dll 2011-12-24 19:53 . 2010-11-20 12:21 189952 —-a-w- c:\windows\system32\sqmapi.dll 2011-12-24 01:11 . 2011-12-24 01:11 ——– d—–w- c:\windows\system32\Wat 2011-12-23 22:35 . 2011-12-23 22:35 ——– d—–w- c:\program files\Microsoft CAPICOM 2.1.0.2 2011-12-23 18:14 . 2008-11-10 19:41 32656 —-a-w- c:\windows\system32\msonpmon.dll 2011-12-23 18:14 . 2006-10-27 03:56 33104 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll 2011-12-23 18:04 . 2011-12-23 22:18 ——– d—–w- c:\program files\Microsoft Works 2011-12-23 17:58 . 2011-12-23 17:58 ——– d—–w- c:\windows\PCHEALTH 2011-12-23 17:58 . 2011-12-24 02:28 ——– d—–w- c:\program files\Microsoft.NET 2011-12-23 17:51 . 2011-12-23 17:51 ——– d—–w- c:\program files\Microsoft Visual Studio 8 2011-12-23 17:41 . 2011-12-23 17:41 ——– d—–r- C:\MSOCache 2011-12-23 17:25 . 2011-04-29 02:46 311808 —-a-w- c:\windows\system32\drivers\srv.sys 2011-12-23 17:25 . 2011-04-29 02:46 310272 —-a-w- c:\windows\system32\drivers\srv2.sys 2011-12-23 17:25 . 2011-04-29 02:46 114688 —-a-w- c:\windows\system32\drivers\srvnet.sys 2011-12-23 17:25 . 2011-04-25 02:18 338944 —-a-w- c:\windows\system32\drivers\afd.sys 2011-12-23 17:25 . 2011-09-29 16:03 1290608 —-a-w- c:\windows\system32\drivers\tcpip.sys 2011-12-23 17:25 . 2010-11-20 12:29 187776 —-a-w- c:\windows\system32\drivers\FWPKCLNT.SYS 2011-12-23 17:25 . 2011-02-18 05:39 31232 —-a-w- c:\windows\system32\prevhost.exe 2011-12-23 17:25 . 2011-02-18 05:43 428032 —-a-w- c:\windows\system32\vbscript.dll 2011-12-23 17:20 . 2010-12-17 07:07 542208 —-a-w- c:\windows\system32\kerberos.dll 2011-12-23 17:18 . 2011-04-29 04:57 759296 —-a-w- c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll 2011-12-23 17:18 . 2011-03-11 05:33 1137664 —-a-w- c:\windows\system32\mfc42.dll 2011-12-23 17:18 . 2011-03-11 05:33 1164288 —-a-w- c:\windows\system32\mfc42u.dll 2011-12-23 17:18 . 2011-02-23 04:47 69632 —-a-w- c:\windows\system32\drivers\bowser.sys 2011-12-23 17:18 . 2011-04-09 05:56 123904 —-a-w- c:\windows\system32\poqexec.exe 2011-12-23 17:18 . 2011-04-22 19:14 27008 —-a-w- c:\windows\system32\drivers\Diskdump.sys 2011-12-23 16:59 . 2011-02-03 05:54 219008 —-a-w- c:\windows\system32\drivers\dxgmms1.sys 2011-12-23 16:59 . 2010-11-20 12:29 728448 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys 2011-12-23 16:59 . 2010-11-20 11:56 107520 —-a-w- c:\windows\system32\cdd.dll 2011-12-23 05:26 . 2011-12-23 05:26 ——– d—–w- c:\program files\GRETECH 2011-12-23 04:59 . 2011-12-23 04:59 ——– d—–r- c:\program files\Skype 2011-12-23 04:57 . 2011-12-23 05:08 ——– d—–w- c:\program files\SpeedFan 2011-12-23 04:26 . 2000-05-11 09:00 90112 ——w- c:\windows\Updreg.EXE 2011-12-23 04:26 . 1998-06-05 10:00 84992 ——w- c:\windows\system32\SFCVRT32.DLL 2011-12-23 04:26 . 1996-05-23 10:24 24976 ——w- c:\windows\CTRES.DLL 2011-12-23 04:26 . 1995-01-13 22:10 149504 ——w- c:\windows\system32\MFCANS32.DLL 2011-12-23 04:26 . 1995-01-13 22:10 108032 ——w- c:\windows\system32\MFCUIA32.DLL 2011-12-23 04:26 . 1994-12-05 11:11 53552 ——w- c:\windows\CTCCW.DLL 2011-12-23 04:26 . 1998-10-21 00:05 54784 ——w- c:\windows\system32\INETWH32.DLL 2011-12-23 04:26 . 1995-08-30 10:02 82432 ——w- c:\windows\system32\CTWFLT32.DLL 2011-12-23 04:26 . 1995-07-13 10:01 26768 ——w- c:\windows\system32\CTL3D.DLL 2011-12-23 04:26 . 2011-12-26 00:16 ——– d—–w- c:\windows\system32\Defaults 2011-12-23 04:22 . 2011-12-26 00:15 ——– d–h–w- c:\program files\InstallShield Installation Information 2011-12-23 04:20 . 1999-12-17 09:00 6752 ——w- c:\windows\system32\PFMODNT.SYS 2011-12-23 04:20 . 2011-12-23 04:20 ——– d—–w- c:\program files\Common Files\InstallShield 2011-12-23 04:18 . 2011-12-23 04:22 ——– d—–w- c:\program files\Creative 2011-12-23 03:47 . 2011-12-23 03:47 ——– d—–w- c:\program files\CCleaner 2011-12-23 02:01 . 2011-12-23 02:53 ——– d—–w- c:\windows\Panther 2011-12-23 02:01 . 2011-12-26 02:14 ——– d—–w- C:\Boot 2011-12-23 01:45 . 2011-12-23 01:45 ——– d—–w- C:\Windows.old.000 2011-12-22 10:08 . 2011-12-22 10:08 ——– d—–w- C:\NVIDIA 2011-12-22 05:15 . 2011-12-22 05:15 ——– d—–w- C:\Programs to run 2011-12-22 01:09 . 2011-12-23 02:52 ——– d—–w- C:\Recovery . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-12-26 00:57 . 2009-07-14 02:05 152576 —-a-w- c:\windows\system32\msclmd.dll 2011-12-21 07:24 . 2011-12-23 03:03 121816 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IDM Shell Extension] @="{CDC95B92-E27C-4745-A8C5-64A52A78855D}" [HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}] 2011-05-30 14:50 21864 —-a-w- c:\program files\Internet Download Manager\IDMShellExt.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SetDefaultMIDI"="MIDIDef.exe" [2002-01-14 61440] "IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2011-11-14 3437976] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DevconDefaultDB"="c:\windows\READREG" [X] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-24 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-24 173592] "Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-24 150552] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920] "WINDVDPatch"="CTHELPER.EXE" [2002-07-03 24576] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112] "Jet Detection"="c:\program files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 28672] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "mixer2"=wdmaud.drv . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . [HKLM\~\startupfolder\C:^Users^Edward^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Logitech . Product Registration.lnk] path=c:\users\Edward\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Product Registration.lnk backup=c:\windows\pss\Logitech . Product Registration.lnk.Startup backupExtension=.Startup . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon] 2009-10-14 21:36 2793304 —-a-w- c:\program files\Logitech\Logitech WebCam Software\LWS.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)] 2011-11-24 07:05 6497592 —-a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] S3 Atc002;NDIS Miniport Driver for Atheros L2 Fast Ethernet Controller;c:\windows\system32\DRIVERS\l260x86.sys [2009-07-13 29184] . . . ——- Supplementary Scan ——- . uStart Page = hxxp://www.google.com/ IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.2.1 FF - ProfilePath - c:\users\Edward\AppData\Roaming\Mozilla\Firefox\Profiles\dzql6jye.default\ FF - prefs.js: browser.search.selectedEngine - Search Results FF - prefs.js: browser.startup.homepage - hxxp://www.searchqu.com/406 FF - prefs.js: keyword.URL - hxxp://www.google.com/search?q= FF - user.js: yahoo.ytff.general.dontshowhpoffer - true . - - - - ORPHANS REMOVED - - - - . Toolbar-10 - (no file) . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System*] "OODLED04.00.00.01PRO"="E325E2D8782DD53DF60D9CDDCD1A0793D8551CE7626D69349089E09BD8848B7E605593F1ECC 966E5CEE0F9E4E1D7F0B1873EAF2E4C2B8CBC055D3F97A3FEBC9E127BECC74CFEBC9E127BECC74CFE BC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98085D5 75E7D6A3B98088EDD5E5BE2F6E6675D575E7D6A3B9808F0945845430447842723F8742D4D73807167 A733500C771CE55C5794B2E71EAEEE012F96E96CDB20054858CD191897896BCC4D64F0BC909005DB4 4E356B0C822B6CD225485CE0572DBAA0625CBC6DAD442295C6BD93D4EDEC4F285F1133E0159E83D0D 8F03FB720E13B1EE5650DE4C53C729F1924AE7C07200B00894035FF8DE88E3CC4B78D718BAF89701B 4D2F941A633CBAD982A2A3D6C74F9BF16E377A86E7CAE44FE1DD92C70BCEA3102A345D0271BE4342E 8208DE2245881FB71AFDC7FA1158DC174C10295F731077FA3801D7E07F9C2FF98095011B77E821A92 B7DD5A974F47EF486984FE994BBCEC9298476923F6D4B96F77E4494F67BC41643951553BA6818EBEF A922A5FD79B511B337102F22A9B7915D018FFD91748A95B07A0C855C6D1DC25089E7DE6EA7B1E4389 7CC6050F22B6CCA6F8AFC785D76B8E5720403B211843713172C920B7A4ACE3D351A7E57C15C1D7E2F 24EA441315017B598A40FD36C7F7C740BDF4DCF7894C69B7A71DA862890F5ABA0BD16E4672662A1EF 266E291E5AAA30A3069CE7A014D0AD669FB99F3F21FE3A2367455FB2154D143D3D466ADE2647D8DDA 8DB1B0433812619615E3E95C2045055EC53B8BB5A97661859B7668C234D2F658AFBB1E68E314B62D9 2248C0ED64D9B81EF462349383C232800DFF2131AC006075004180C1F4ACBEB55DCF8D67F6B305E4D 81C3FBC871481C7C58D2E0080D0E0D2785CBCDAA90ACD66E729B0645B71FFC71DBC1ED150323093E7 6623EE62079CD1F2336513CE8F4B728AEBBEF4CEB5C241DA5C544CC039BD7A6B4D0431384C277D620 AA3D7B7855987D406F6EA9E4ED634C96CCA9132AAD37CBF31D0ADC6BFA779FA4CF3F8586934C9C362 2DD67A5ED09294A274B7ED2679A76F61EB007A6C50101BDA005EC818963E907949D05530BAB15BCF9 DA99FBEB3624E47E5BCAB0DC0CB55B6B43B47824B97C0DD91371B786262552BD8DE3C7740486493BA ED2240BD3AAD154315722E3E82104DA2796C13713A1CF409ED1FDC9C4041427D64140B05605D9CF0B C058DED1D40F52C64B828754066120494809CD773518E581A96A43D6980FAA115315BF98CEB24FE1D EAFF50F041355D1A3F771E4688D72E191A9CADEF1F20305E27A40A6F2D637ED932415ACFED9A57CB1 7DBC161D0E1B2FF72AE1364EE9CA30B9CDB426DECBC0629FDC895B910B2F12B770CAD78B9A0223CB3 B3BEEA03CCADC92770288E141F83D" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2011-12-31 20:57:47 ComboFix-quarantined-files.txt 2012-01-01 04:57 . Pre-Run: 44,217,151,488 bytes free Post-Run: 44,003,995,648 bytes free . - - End Of File - - 1E1EDD54C84797DDE3A80472C52FAED4

OTL log data:

OTL logfile created on: 1/1/2012 6:00:03 PM - Run 2
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Edward\Downloads\Programs
Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.21 Gb Available Physical Memory | 60.91% Memory free
3.98 Gb Paging File | 3.07 Gb Available in Paging File | 77.04% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 40.34 Gb Free Space | 54.13% Space Free | Partition Type: NTFS

Computer Name: EDWARD-PC | User Name: Edward | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Edward\Downloads\Programs\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Internet Download Manager\IDMan.exe (Tonec Inc.)
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Internet Download Manager\IEMonitor.exe (Tonec Inc.)
PRC - C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
PRC - C:\Windows\System32\CTHELPER.EXE (Creative Technology Ltd)


========== Modules (No Company Name) ==========

MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()


========== Win32 Services (SafeList) ==========

SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (NisSrv) – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (LVPrcSrv) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) – C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (MpKslbe943d0b) – c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{6971F22D-D6CC-4DA6-9101-A760158657E0}\MpKslbe943d0b.sys (Microsoft Corporation)
DRV - (IDMWFP) – C:\Windows\System32\drivers\idmwfp.sys (Tonec Inc.)
DRV - (NisDrv) – C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV - (MpNWMon) – C:\Windows\System32\drivers\MpNWMon.sys (Microsoft Corporation)
DRV - (speedfan) – C:\Windows\system32\speedfan.sys (Almico Software)
DRV - (oodrvled) – C:\Windows\system32\DRIVERS\oodrvled.sys (O&O; Software GmbH)
DRV - (vmbus) – C:\Windows\system32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (storflt) – C:\Windows\system32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) – C:\Windows\system32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (TsUsbFlt) – C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (RdpVideoMiniport) – C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (VMBusHID) – C:\Windows\system32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) – C:\Windows\system32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (NPF) – C:\Windows\System32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (LVPr2Mon) – C:\Windows\System32\drivers\LVPr2Mon.sys ()
DRV - (Serial) – C:\Windows\System32\drivers\serial.sys (Brother Industries Ltd.)
DRV - (Atc002) – C:\Windows\System32\drivers\l260x86.sys (Atheros Communications, Inc.)
DRV - (LVUSBSta) – C:\Windows\System32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) – C:\Windows\System32\drivers\LV302V32.SYS (Logitech Inc.)
DRV - (MTsensor) – C:\Windows\System32\drivers\ASACPI.sys ()
DRV - (ha10kx2k) – C:\Windows\System32\drivers\HA10KX2K.SYS (Creative Technology Ltd)
DRV - (emupia) – C:\Windows\System32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k) – C:\Windows\System32\drivers\CTSFM2K.SYS (Creative Technology Ltd)
DRV - (ctprxy2k) – C:\Windows\System32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\Windows\System32\drivers\CTOSS2K.SYS (Creative Technology Ltd.)
DRV - (ctaud2k) Creative Audio Driver (WDM) – C:\Windows\System32\drivers\CTAUD2K.SYS (Creative Technology Ltd)
DRV - (ctac32k) – C:\Windows\System32\drivers\CTAC32K.SYS (Creative Technology Ltd)
DRV - (giveio) – C:\Windows\system32\giveio.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 77 57 96 62 1E C1 CC 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.selectedEngine: "Search Results"
FF - prefs.js..browser.startup.homepage: "http://www.searchqu.com/406"
FF - prefs.js..keyword.URL: "http://www.google.com/search?q="


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/12/22 19:03:46 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Users\Edward\AppData\Roaming\IDM\idmmzcc5 [2011/12/27 21:09:28 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\SeaMonkey\Extensions\\[removed]: C:\Users\Edward\AppData\Roaming\IDM\idmmzcc5 [2011/12/27 21:09:28 | 000,000,000 | —D | M]

[2011/12/26 21:14:30 | 000,000,000 | —D | M] (No name found) – C:\Users\Edward\AppData\Roaming\Mozilla\Extensions
[2011/12/26 19:05:00 | 000,000,000 | —D | M] (No name found) – C:\Users\Edward\AppData\Roaming\Mozilla\Firefox\Profiles\dzql6jye.default\extensions
[2011/12/25 19:39:45 | 000,002,519 | —- | M] () – C:\Users\Edward\AppData\Roaming\Mozilla\Firefox\Profiles\dzql6jye.default\searchplugins\Search_Results.xml
[2011/12/26 21:14:30 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/12/20 23:24:52 | 000,121,816 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/12/20 20:30:41 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/12/25 19:39:45 | 000,002,519 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
[2011/12/20 20:30:41 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2009/06/10 13:39:37 | 000,000,824 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (IDM integration (IDMIEHlprObj Class)) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll (Internet Download Manager, Tonec Inc.)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O4 - HKLM..\Run: [DevconDefaultDB] C:\Windows\READREG.exe (Creative Technology Limited)
O4 - HKLM..\Run: [Jet Detection] C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe ()
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [WINDVDPatch] C:\Windows\System32\CTHELPER.EXE (Creative Technology Ltd)
O4 - HKCU..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe (Tonec Inc.)
O4 - HKCU..\Run: [SetDefaultMIDI] C:\Windows\MIDIDEF.EXE (Creative Technology Ltd)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm ()
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm ()
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7A9B25F2-A275-4B3C-AA61-848A4D4F30C1}: DhcpNameServer = 192.168.2.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 13:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/01/01 15:40:07 | 000,012,288 | —- | C] (Creative Technology Ltd.) – C:\Windows\System32\AHQCpURes.dll
[2012/01/01 15:40:02 | 000,032,768 | —- | C] (Creative Technology Ltd.) – C:\Windows\System32\AudioHQU.cpl
[2012/01/01 15:34:24 | 000,306,688 | —- | C] (InstallShield Software Corporation) – C:\Windows\IsUninst.exe
[2012/01/01 14:23:25 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\Malwarebytes
[2012/01/01 14:22:48 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/12/31 20:57:51 | 000,000,000 | —D | C] – C:\Windows\temp
[2011/12/31 20:52:56 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2011/12/31 15:14:32 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2011/12/31 15:14:32 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2011/12/31 15:14:32 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2011/12/31 15:14:16 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2011/12/31 15:11:37 | 000,000,000 | —D | C] – C:\Qoobox
[2011/12/29 18:17:23 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe AIR
[2011/12/29 18:16:08 | 000,000,000 | —D | C] – C:\ProgramData\Adobe
[2011/12/29 18:15:31 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe
[2011/12/29 18:15:31 | 000,000,000 | —D | C] – C:\Program Files\Adobe
[2011/12/29 18:12:25 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Local\Adobe
[2011/12/29 09:34:35 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yahoo! Messenger
[2011/12/29 09:34:15 | 000,000,000 | —D | C] – C:\ProgramData\Yahoo!
[2011/12/29 09:28:53 | 000,000,000 | —D | C] – C:\Program Files\Yahoo!
[2011/12/29 06:50:00 | 000,000,000 | —D | C] – C:\ProgramData\PC Tools
[2011/12/29 00:28:15 | 000,000,000 | —D | C] – C:\ProgramData\TEMP
[2011/12/29 00:24:02 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\GetRightToGo
[2011/12/27 21:07:28 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\IDM
[2011/12/27 21:07:28 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\DMCache
[2011/12/27 21:07:20 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Download Manager
[2011/12/27 21:07:20 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Download Manager
[2011/12/27 21:07:06 | 000,000,000 | —D | C] – C:\Program Files\Internet Download Manager
[2011/12/27 18:02:00 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\DonationCoder
[2011/12/27 18:01:59 | 000,000,000 | —D | C] – C:\Users\Edward\Documents\DonationCoder
[2011/12/27 18:01:42 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPcap
[2011/12/27 18:01:38 | 000,000,000 | —D | C] – C:\Program Files\WinPcap
[2011/12/27 17:58:42 | 000,000,000 | —D | C] – C:\Program Files\URLSnooper2
[2011/12/26 08:46:41 | 000,000,000 | —D | C] – C:\ProgramData\boost_interprocess
[2011/12/25 19:46:51 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Local\Ilivid Player
[2011/12/25 19:40:47 | 000,000,000 | —D | C] – C:\Program Files\iLivid
[2011/12/25 19:34:43 | 000,000,000 | —D | C] – C:\Users\Edward\Documents\My Received Files
[2011/12/25 19:30:35 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Local\PackageAware
[2011/12/25 16:34:07 | 000,000,000 | —D | C] – C:\Windows\System32\SPReview
[2011/12/25 16:32:19 | 000,000,000 | —D | C] – C:\Windows\System32\EventProviders
[2011/12/24 22:55:40 | 000,000,000 | —D | C] – C:\ProgramData\OO Software
[2011/12/24 21:19:36 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\O&O; Software
[2011/12/24 21:19:32 | 000,000,000 | —D | C] – C:\Program Files\OO Software
[2011/12/24 11:59:34 | 000,053,760 | —- | C] (Microsoft Corporation) – C:\Windows\System32\LSCSHostPolicy.dll
[2011/12/24 11:59:34 | 000,052,224 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\TsUsbFlt.sys
[2011/12/24 11:59:34 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll
[2011/12/24 11:59:25 | 001,171,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10warp.dll
[2011/12/24 11:59:23 | 000,954,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc40.dll
[2011/12/24 11:59:23 | 000,954,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc40u.dll
[2011/12/24 11:59:22 | 000,915,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpcorets.dll
[2011/12/24 11:59:22 | 000,120,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tssrvlic.dll
[2011/12/24 11:59:18 | 000,739,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d2d1.dll
[2011/12/24 11:59:18 | 000,423,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc_isv.dll
[2011/12/24 11:59:15 | 000,327,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate_isv.exe
[2011/12/24 11:59:14 | 000,428,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc.dll
[2011/12/24 11:59:11 | 000,322,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate.exe
[2011/12/24 11:59:08 | 000,253,952 | —- | C] (Microsoft Corporation) – C:\Windows\System32\spwizui.dll
[2011/12/24 11:59:00 | 003,207,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mf.dll
[2011/12/24 11:58:59 | 000,520,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mcupdate_GenuineIntel.dll
[2011/12/24 11:58:58 | 001,334,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\CertEnroll.dll
[2011/12/24 11:58:54 | 000,295,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHost.exe
[2011/12/24 11:58:54 | 000,099,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHostProxy.dll
[2011/12/24 11:58:49 | 001,115,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RacEngn.dll
[2011/12/24 11:58:47 | 005,066,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\AuthFWSnapin.dll
[2011/12/24 11:58:45 | 000,134,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpudd.dll
[2011/12/24 11:58:42 | 001,493,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ExplorerFrame.dll
[2011/12/24 11:58:38 | 001,828,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d9.dll
[2011/12/24 11:58:38 | 001,076,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DWrite.dll
[2011/12/24 11:58:36 | 000,505,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\taskschd.dll
[2011/12/24 11:58:34 | 000,051,200 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PushPrinterConnections.exe
[2011/12/24 11:58:33 | 000,280,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\spreview.exe
[2011/12/24 11:58:32 | 000,456,192 | —- | C] (Microsoft Corporation) – C:\Windows\System32\spinstall.exe
[2011/12/24 11:58:31 | 000,381,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wer.dll
[2011/12/24 11:58:28 | 001,371,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dwmcore.dll
[2011/12/24 11:58:26 | 000,863,744 | —- | C] (Microsoft Corporation) – C:\Windows\System32\diagperf.dll
[2011/12/24 11:58:25 | 000,606,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/12/24 11:58:25 | 000,136,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\scavengeui.dll
[2011/12/24 11:58:24 | 003,367,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WinSAT.exe
[2011/12/24 11:58:23 | 001,328,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\quartz.dll
[2011/12/24 11:58:23 | 000,597,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\TSWorkspace.dll
[2011/12/24 11:58:22 | 000,270,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tsmf.dll
[2011/12/24 11:58:21 | 000,389,120 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/12/24 11:58:18 | 002,522,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dbgeng.dll
[2011/12/24 11:58:17 | 000,522,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d11.dll
[2011/12/24 11:58:16 | 000,260,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpshell.exe
[2011/12/24 11:58:15 | 001,619,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMVDECOD.DLL
[2011/12/24 11:58:14 | 000,584,192 | —- | C] (Microsoft Corporation) – C:\Windows\System32\gpprefcl.dll
[2011/12/24 11:58:14 | 000,314,880 | —- | C] (Microsoft Corporation) – C:\Windows\System32\webio.dll
[2011/12/24 11:58:12 | 000,252,928 | —- | C] (Microsoft) – C:\Windows\System32\DShowRdpFilter.dll
[2011/12/24 11:58:11 | 002,151,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mmcndmgr.dll
[2011/12/24 11:58:11 | 000,049,488 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netfxperf.dll
[2011/12/24 11:58:09 | 001,792,000 | —- | C] (Microsoft Corporation) – C:\Windows\System32\authui.dll
[2011/12/24 11:58:09 | 000,974,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sppobjs.dll
[2011/12/24 11:58:09 | 000,732,160 | —- | C] (Microsoft Corporation) – C:\Windows\System32\imapi2fs.dll
[2011/12/24 11:58:09 | 000,341,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdrm.dll
[2011/12/24 11:58:08 | 000,547,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PortableDeviceApi.dll
[2011/12/24 11:58:07 | 000,220,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mcbuilder.exe
[2011/12/24 11:58:05 | 001,555,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\certmgr.dll
[2011/12/24 11:58:04 | 000,508,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winload.exe
[2011/12/24 11:58:04 | 000,323,072 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drvstore.dll
[2011/12/24 11:58:03 | 001,712,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xpsservices.dll
[2011/12/24 11:58:02 | 000,412,160 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sppwinob.dll
[2011/12/24 11:58:01 | 000,302,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\cmd.exe
[2011/12/24 11:57:59 | 000,206,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\framedynos.dll
[2011/12/24 11:57:58 | 000,296,448 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfds.dll
[2011/12/24 11:57:58 | 000,140,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpendp.dll
[2011/12/24 11:57:57 | 000,240,000 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\netio.sys
[2011/12/24 11:57:56 | 002,414,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wucltux.dll
[2011/12/24 11:57:56 | 000,442,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winresume.exe
[2011/12/24 11:57:56 | 000,351,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmicmiplugin.dll
[2011/12/24 11:57:55 | 001,063,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\werconcpl.dll
[2011/12/24 11:57:55 | 000,762,880 | —- | C] (Microsoft Corporation) – C:\Windows\System32\azroles.dll
[2011/12/24 11:57:55 | 000,173,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpclip.exe
[2011/12/24 11:57:55 | 000,152,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ncsi.dll
[2011/12/24 11:57:54 | 000,339,968 | —- | C] (Microsoft Corporation) – C:\Windows\System32\appmgr.dll
[2011/12/24 11:57:50 | 000,508,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxgi.dll
[2011/12/24 11:57:50 | 000,196,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfreadwrite.dll
[2011/12/24 11:57:50 | 000,144,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\basecsp.dll
[2011/12/24 11:57:49 | 000,801,280 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NaturalLanguage6.dll
[2011/12/24 11:57:49 | 000,488,448 | —- | C] (Microsoft Corporation) – C:\Windows\System32\evr.dll
[2011/12/24 11:57:49 | 000,305,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\taskcomp.dll
[2011/12/24 11:57:49 | 000,161,280 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpinit.exe
[2011/12/24 11:57:47 | 000,776,192 | —- | C] (Microsoft Corporation) – C:\Windows\System32\calc.exe
[2011/12/24 11:57:47 | 000,335,872 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WinSATAPI.dll
[2011/12/24 11:57:46 | 000,778,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sqlsrv32.dll
[2011/12/24 11:57:45 | 000,242,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vpnike.dll
[2011/12/24 11:57:44 | 002,983,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\UIRibbon.dll
[2011/12/24 11:57:43 | 000,477,696 | —- | C] (Microsoft Corporation) – C:\Windows\System32\lpksetup.exe
[2011/12/24 11:57:43 | 000,271,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\fveapi.dll
[2011/12/24 11:57:42 | 000,176,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2011/12/24 11:57:42 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tspubwmi.dll
[2011/12/24 11:57:40 | 000,155,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\hgprint.dll
[2011/12/24 11:57:38 | 000,116,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\prncache.dll
[2011/12/24 11:57:35 | 000,352,256 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmpeffects.dll
[2011/12/24 11:57:34 | 000,690,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ci.dll
[2011/12/24 11:57:34 | 000,458,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WSDApi.dll
[2011/12/24 11:57:34 | 000,142,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\net1.exe
[2011/12/24 11:57:34 | 000,139,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rpchttp.dll
[2011/12/24 11:57:33 | 000,321,536 | —- | C] (Microsoft Corporation) – C:\Windows\System32\aepdu.dll
[2011/12/24 11:57:33 | 000,175,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\vmbus.sys
[2011/12/24 11:57:33 | 000,119,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\aitagent.exe
[2011/12/24 11:57:31 | 000,246,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\scansetting.dll
[2011/12/24 11:57:30 | 000,213,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MMDevAPI.dll
[2011/12/24 11:57:29 | 002,504,192 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMVCORE.DLL
[2011/12/24 11:57:29 | 000,411,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wlangpui.dll
[2011/12/24 11:57:29 | 000,131,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\aaclient.dll
[2011/12/24 11:57:28 | 000,167,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\QSHVHOST.DLL
[2011/12/24 11:57:28 | 000,101,760 | —- | C] (Microsoft Corporation) – C:\Windows\System32\consent.exe
[2011/12/24 11:57:27 | 001,750,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\pnidui.dll
[2011/12/24 11:57:27 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\t2embed.dll
[2011/12/24 11:57:26 | 000,782,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\webservices.dll
[2011/12/24 11:57:26 | 000,464,896 | —- | C] (Microsoft Corporation) – C:\Windows\System32\scrptadm.dll
[2011/12/24 11:57:25 | 000,154,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tscfgwmi.dll
[2011/12/24 11:57:25 | 000,124,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\fde.dll
[2011/12/24 11:57:24 | 002,146,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\SyncCenter.dll
[2011/12/24 11:57:24 | 000,225,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netdiagfx.dll
[2011/12/24 11:57:24 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\Windows\System32\TsUsbGDCoInstaller.dll
[2011/12/24 11:57:23 | 000,907,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sdengin2.dll
[2011/12/24 11:57:23 | 000,560,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wuapi.dll
[2011/12/24 11:57:23 | 000,215,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vmicsvc.exe
[2011/12/24 11:57:23 | 000,051,712 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wscapi.dll
[2011/12/24 11:57:21 | 000,139,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\cscobj.dll
[2011/12/24 11:57:20 | 000,727,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mcmde.dll
[2011/12/24 11:57:19 | 000,830,464 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MSMPEG2ENC.DLL
[2011/12/24 11:57:19 | 000,826,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpcore.dll
[2011/12/24 11:57:19 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\rdpvideominiport.sys
[2011/12/24 11:57:18 | 000,186,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/12/24 11:57:17 | 000,392,192 | —- | C] (Microsoft Corporation) – C:\Windows\System32\imapi2.dll
[2011/12/24 11:57:17 | 000,103,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\setupcl.exe
[2011/12/24 11:57:16 | 002,576,384 | —- | C] (Microsoft Corporation) – C:\Windows\System32\gameux.dll
[2011/12/24 11:57:16 | 000,630,784 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DXPTaskRingtone.dll
[2011/12/24 11:57:16 | 000,302,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\aeinv.dll
[2011/12/24 11:57:14 | 000,097,280 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dwmredir.dll
[2011/12/24 11:57:13 | 001,624,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMPEncEn.dll
[2011/12/24 11:57:12 | 000,196,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vaultsvc.dll
[2011/12/24 11:57:12 | 000,066,560 | —- | C] (Microsoft Corporation) – C:\Windows\System32\hbaapi.dll
[2011/12/24 11:57:11 | 001,077,248 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Narrator.exe
[2011/12/24 11:57:11 | 000,658,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\autofmt.exe
[2011/12/24 11:57:10 | 002,217,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\bootres.dll
[2011/12/24 11:57:10 | 000,166,400 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netiohlp.dll
[2011/12/24 11:57:10 | 000,100,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\audiodg.exe
[2011/12/24 11:57:09 | 000,195,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\AudioSes.dll
[2011/12/24 11:57:09 | 000,194,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\halmacpi.dll
[2011/12/24 11:57:09 | 000,194,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\hal.dll
[2011/12/24 11:57:09 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\proquota.exe
[2011/12/24 11:57:08 | 000,679,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\autoconv.exe
[2011/12/24 11:57:08 | 000,303,104 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msinfo32.exe
[2011/12/24 11:57:08 | 000,042,496 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mimefilt.dll
[2011/12/24 11:57:07 | 000,400,896 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ipsmsnap.dll
[2011/12/24 11:57:06 | 000,441,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\powercpl.dll
[2011/12/24 11:57:06 | 000,301,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\srchadmin.dll
[2011/12/24 11:57:06 | 000,222,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\eapphost.dll
[2011/12/24 11:57:06 | 000,181,760 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tcpipcfg.dll
[2011/12/24 11:57:06 | 000,179,712 | —- | C] (Microsoft Corporation) – C:\Windows\System32\schtasks.exe
[2011/12/24 11:57:05 | 000,337,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msihnd.dll
[2011/12/24 11:57:05 | 000,202,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\framedyn.dll
[2011/12/24 11:57:04 | 001,466,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2011/12/24 11:57:04 | 000,155,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mscorier.dll
[2011/12/24 11:57:03 | 000,665,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\AuxiliaryDisplayCpl.dll
[2011/12/24 11:57:02 | 000,478,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\timedate.cpl
[2011/12/24 11:57:02 | 000,399,872 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DXP.dll
[2011/12/24 11:57:02 | 000,171,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\QAGENT.DLL
[2011/12/24 11:57:02 | 000,117,248 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netid.dll
[2011/12/24 11:57:00 | 001,227,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wdc.dll
[2011/12/24 11:56:59 | 000,933,376 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Vault.dll
[2011/12/24 11:56:59 | 000,346,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\untfs.dll
[2011/12/24 11:56:59 | 000,132,992 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\ataport.sys
[2011/12/24 11:56:59 | 000,078,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\nci.dll
[2011/12/24 11:56:58 | 001,131,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sdclt.exe
[2011/12/24 11:56:57 | 001,326,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wlanpref.dll
[2011/12/24 11:56:57 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/12/24 11:56:56 | 001,003,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMNetMgr.dll
[2011/12/24 11:56:55 | 000,098,816 | —- | C] (Microsoft) – C:\Windows\System32\Robocopy.exe
[2011/12/24 11:56:54 | 001,400,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DxpTaskSync.dll
[2011/12/24 11:56:53 | 001,040,384 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Display.dll
[2011/12/24 11:56:53 | 000,417,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdri.dll
[2011/12/24 11:56:52 | 000,316,416 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sharemediacpl.dll
[2011/12/24 11:56:52 | 000,135,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsRasterService.dll
[2011/12/24 11:56:52 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\userinit.exe
[2011/12/24 11:56:51 | 000,352,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\termmgr.dll
[2011/12/24 11:56:51 | 000,324,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\puiobj.dll
[2011/12/24 11:56:50 | 001,188,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DiagCpl.dll
[2011/12/24 11:56:50 | 000,140,160 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\scsiport.sys
[2011/12/24 11:56:49 | 000,288,256 | —- | C] (Microsoft Corporation) – C:\Windows\System32\eudcedit.exe
[2011/12/24 11:56:49 | 000,043,392 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\winhv.sys
[2011/12/24 11:56:48 | 000,040,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\vmstorfl.sys
[2011/12/24 11:56:47 | 001,066,496 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdtctm.dll
[2011/12/24 11:56:47 | 000,428,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\biocpl.dll
[2011/12/24 11:56:47 | 000,127,488 | —- | C] (Microsoft Corporation) – C:\Windows\System32\logoncli.dll
[2011/12/24 11:56:47 | 000,111,104 | —- | C] (Microsoft Corporation) – C:\Windows\System32\shsetup.dll
[2011/12/24 11:56:46 | 000,856,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\FirewallControlPanel.dll
[2011/12/24 11:56:46 | 000,416,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wiadefui.dll
[2011/12/24 11:56:46 | 000,233,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msconfig.exe
[2011/12/24 11:56:46 | 000,193,536 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sppcomapi.dll
[2011/12/24 11:56:45 | 000,028,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\storvsc.sys
[2011/12/24 11:56:44 | 002,202,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\SensorsCpl.dll
[2011/12/24 11:56:44 | 002,157,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\themecpl.dll
[2011/12/24 11:56:43 | 000,766,464 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wpccpl.dll
[2011/12/24 11:56:43 | 000,216,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\FWPUCLNT.DLL
[2011/12/24 11:56:43 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dnscmmc.dll
[2011/12/24 11:56:41 | 000,413,696 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PhotoScreensaver.scr
[2011/12/24 11:56:41 | 000,312,832 | —- | C] (Microsoft Corporation) – C:\Windows\System32\hgcpl.dll
[2011/12/24 11:56:39 | 000,481,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mscms.dll
[2011/12/24 11:56:39 | 000,429,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\localsec.dll
[2011/12/24 11:56:39 | 000,080,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mscories.dll
[2011/12/24 11:56:38 | 000,400,896 | —- | C] (Microsoft Corporation) – C:\Windows\System32\srcore.dll
[2011/12/24 11:56:38 | 000,268,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mprddm.dll
[2011/12/24 11:56:38 | 000,220,160 | —- | C] (Microsoft Corporation) – C:\Windows\System32\SndVolSSO.dll
[2011/12/24 11:56:38 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\bcdsrv.dll
[2011/12/24 11:56:38 | 000,078,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iasacct.dll
[2011/12/24 11:56:37 | 000,600,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PerfCenterCPL.dll
[2011/12/24 11:56:37 | 000,600,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\usercpl.dll
[2011/12/24 11:56:37 | 000,410,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wlanui.dll
[2011/12/24 11:56:36 | 001,644,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netcenter.dll
[2011/12/24 11:56:36 | 000,941,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mblctr.exe
[2011/12/24 11:56:36 | 000,638,976 | —- | C] (Microsoft Corporation) – C:\Windows\System32\VAN.dll
[2011/12/24 11:56:36 | 000,509,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qedit.dll
[2011/12/24 11:56:36 | 000,120,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\prntvpt.dll
[2011/12/24 11:56:35 | 000,514,560 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qdvd.dll
[2011/12/24 11:56:35 | 000,314,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\SndVol.exe
[2011/12/24 11:56:35 | 000,066,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\w32tm.exe
[2011/12/24 11:56:34 | 000,352,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\spwizeng.dll
[2011/12/24 11:56:34 | 000,314,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\azroleui.dll
[2011/12/24 11:56:34 | 000,223,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wksprt.exe
[2011/12/24 11:56:33 | 003,727,872 | —- | C] (Microsoft Corporation) – C:\Windows\System32\accessibilitycpl.dll
[2011/12/24 11:56:32 | 000,190,976 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\ks.sys
[2011/12/24 11:56:32 | 000,059,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\fdeploy.dll
[2011/12/24 11:56:31 | 000,516,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\main.cpl
[2011/12/24 11:56:31 | 000,226,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MSAC3ENC.DLL
[2011/12/24 11:56:31 | 000,161,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netjoin.dll
[2011/12/24 11:56:30 | 002,130,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\networkmap.dll
[2011/12/24 11:56:30 | 000,186,880 | —- | C] (Microsoft Corporation) – C:\Windows\System32\adsldp.dll
[2011/12/24 11:56:29 | 000,414,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mspbda.dll
[2011/12/24 11:56:29 | 000,320,512 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Faultrep.dll
[2011/12/24 11:56:29 | 000,314,880 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wusa.exe
[2011/12/24 11:56:29 | 000,312,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MCEWMDRMNDBootstrap.dll
[2011/12/24 11:56:28 | 000,395,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\prnfldr.dll
[2011/12/24 11:56:28 | 000,218,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\OnLineIDCpl.dll
[2011/12/24 11:56:27 | 000,755,200 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sud.dll
[2011/12/24 11:56:27 | 000,744,448 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ActionCenter.dll
[2011/12/24 11:56:27 | 000,266,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MediaMetadataHandler.dll
[2011/12/24 11:56:26 | 000,389,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sysmon.ocx
[2011/12/24 11:56:26 | 000,325,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\slui.exe
[2011/12/24 11:56:26 | 000,233,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\taskbarcpl.dll
[2011/12/24 11:56:26 | 000,172,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iasrad.dll
[2011/12/24 11:56:26 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\taskhost.exe
[2011/12/24 11:56:25 | 000,271,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iprtrmgr.dll
[2011/12/24 11:56:25 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\hidclass.sys
[2011/12/24 11:56:24 | 000,220,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\defaultlocationcpl.dll
[2011/12/24 11:56:24 | 000,137,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\halacpi.dll
[2011/12/24 11:56:24 | 000,129,536 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpcorekmts.dll
[2011/12/24 11:56:24 | 000,082,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dot3cfg.dll
[2011/12/24 11:56:23 | 000,692,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\bthprops.cpl
[2011/12/24 11:56:23 | 000,042,496 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ftp.exe
[2011/12/24 11:56:22 | 000,577,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wpd_ci.dll
[2011/12/24 11:56:22 | 000,428,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\shwebsvc.dll
[2011/12/24 11:56:22 | 000,345,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\intl.cpl
[2011/12/24 11:56:22 | 000,148,992 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ifsutil.dll
[2011/12/24 11:56:22 | 000,139,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2011/12/24 11:56:22 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sisbkup.dll
[2011/12/24 11:56:21 | 000,205,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\efscore.dll
[2011/12/24 11:56:21 | 000,114,688 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2011/12/24 11:56:20 | 000,750,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sdcpl.dll
[2011/12/24 11:56:20 | 000,600,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\TabletPC.cpl
[2011/12/24 11:56:20 | 000,537,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ActionCenterCPL.dll
[2011/12/24 11:56:20 | 000,135,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\recovery.dll
[2011/12/24 11:56:19 | 000,146,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\autoplay.dll
[2011/12/24 11:56:19 | 000,058,880 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpwsx.dll
[2011/12/24 11:56:18 | 000,484,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DeviceCenter.dll
[2011/12/24 11:56:18 | 000,295,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\bcdedit.exe
[2011/12/24 11:56:18 | 000,115,712 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sppnp.dll
[2011/12/24 11:56:17 | 000,738,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmpmde.dll
[2011/12/24 11:56:17 | 000,068,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WSTPager.ax
[2011/12/24 11:56:16 | 000,859,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\OobeFldr.dll
[2011/12/24 11:56:16 | 000,151,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vdsutil.dll
[2011/12/24 11:56:15 | 000,410,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\systemcpl.dll
[2011/12/24 11:56:15 | 000,297,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntprint.dll
[2011/12/24 11:56:15 | 000,210,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\recdisc.exe
[2011/12/24 11:56:15 | 000,152,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\SmartcardCredentialProvider.dll
[2011/12/24 11:56:15 | 000,057,344 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpsign.exe
[2011/12/24 11:56:14 | 000,656,384 | —- | C] (Microsoft Corporation) – C:\Windows\System32\nshwfp.dll
[2011/12/24 11:56:14 | 000,270,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sethc.exe
[2011/12/24 11:56:14 | 000,262,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rstrui.exe
[2011/12/24 11:56:14 | 000,175,104 | —- | C] (Microsoft Corporation) – C:\Windows\System32\fvecpl.dll
[2011/12/24 11:56:14 | 000,146,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\bcdboot.exe
[2011/12/24 11:56:13 | 000,743,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\blackbox.dll
[2011/12/24 11:56:12 | 000,193,536 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ksproxy.ax
[2011/12/24 11:56:12 | 000,107,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NAPHLPR.DLL
[2011/12/24 11:56:12 | 000,093,696 | —- | C] (Windows ® Codename Longhorn DDK provider) – C:\Windows\System32\fms.dll
[2011/12/24 11:56:11 | 000,257,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dpx.dll
[2011/12/24 11:56:11 | 000,182,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmpsrcwp.dll
[2011/12/24 11:56:11 | 000,112,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\AuxiliaryDisplayServices.dll
[2011/12/24 11:56:11 | 000,101,888 | —- | C] (Microsoft Corporation) – C:\Windows\System32\migisol.dll
[2011/12/24 11:56:10 | 000,805,376 | —- | C] (Microsoft Corporation) – C:\Windows\System32\cdosys.dll
[2011/12/24 11:56:09 | 000,346,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\nshipsec.dll
[2011/12/24 11:56:09 | 000,254,976 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wsqmcons.exe
[2011/12/24 11:56:09 | 000,067,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\asycfilt.dll
[2011/12/24 11:56:08 | 000,592,384 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msftedit.dll
[2011/12/24 11:56:08 | 000,086,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\isoburn.exe
[2011/12/24 11:56:07 | 000,428,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wlanmsm.dll
[2011/12/24 11:56:07 | 000,333,824 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dot3ui.dll
[2011/12/24 11:56:07 | 000,247,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ReAgent.dll
[2011/12/24 11:56:07 | 000,222,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wavemsp.dll
[2011/12/24 11:56:07 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wuwebv.dll
[2011/12/24 11:56:06 | 000,586,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dfrgui.exe
[2011/12/24 11:56:06 | 000,047,616 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzutil.exe
[2011/12/24 11:56:05 | 000,444,928 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wvc.dll
[2011/12/24 11:56:05 | 000,406,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wimgapi.dll
[2011/12/24 11:56:05 | 000,198,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sysclass.dll
[2011/12/24 11:56:05 | 000,197,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ocsetup.exe
[2011/12/24 11:56:04 | 000,438,272 | —- | C] (Microsoft Corporation) – C:\Windows\System32\AdmTmpl.dll
[2011/12/24 11:56:03 | 000,209,920 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PkgMgr.exe
[2011/12/24 11:56:02 | 000,190,976 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qcap.dll
[2011/12/24 11:56:02 | 000,113,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\setupugc.exe
[2011/12/24 11:56:02 | 000,051,200 | —- | C] (Twain Working Group) – C:\Windows\twain_32.dll
[2011/12/24 11:56:01 | 000,206,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qasf.dll
[2011/12/24 11:56:01 | 000,064,512 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/12/24 11:56:00 | 000,697,344 | —- | C] (Microsoft Corporation) – C:\Windows\System32\SmiEngine.dll
[2011/12/24 11:56:00 | 000,195,072 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msrating.dll
[2011/12/24 11:56:00 | 000,170,496 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationSettings.exe
[2011/12/24 11:56:00 | 000,118,784 | —- | C] (Microsoft Corporation) – C:\Windows\System32\uxlib.dll
[2011/12/24 11:55:59 | 000,293,888 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ssText3d.scr
[2011/12/24 11:55:59 | 000,257,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\srrstr.dll
[2011/12/24 11:55:59 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\slwga.dll
[2011/12/24 11:55:58 | 000,196,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wwanconn.dll
[2011/12/24 11:55:57 | 000,616,960 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmdrmsdk.dll
[2011/12/24 11:55:57 | 000,098,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\nslookup.exe
[2011/12/24 11:55:57 | 000,084,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mciavi32.dll
[2011/12/24 11:55:57 | 000,034,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\imgutil.dll
[2011/12/24 11:55:56 | 000,211,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\DevicePairingFolder.dll
[2011/12/24 11:55:55 | 000,504,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msscp.dll
[2011/12/24 11:55:54 | 000,327,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wimserv.exe
[2011/12/24 11:55:54 | 000,276,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\diskraid.exe
[2011/12/24 11:55:54 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\acppage.dll
[2011/12/24 11:55:53 | 000,186,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpencom.dll
[2011/12/24 11:55:53 | 000,157,184 | —- | C] (Microsoft Corporation) – C:\Windows\System32\perfmon.exe
[2011/12/24 11:55:52 | 000,402,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drmmgrtn.dll
[2011/12/24 11:55:52 | 000,202,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\input.dll
[2011/12/24 11:55:51 | 000,292,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WindowsAnytimeUpgradeResults.exe
[2011/12/24 11:55:51 | 000,174,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ocsetapi.dll
[2011/12/24 11:55:51 | 000,046,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NAPCRYPT.DLL
[2011/12/24 11:55:50 | 000,327,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\nltest.exe
[2011/12/24 11:55:50 | 000,078,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\UserAccountControlSettings.dll
[2011/12/24 11:55:50 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vpnikeapi.dll
[2011/12/24 11:55:49 | 001,111,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\onexui.dll
[2011/12/24 11:55:49 | 000,219,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iTVData.dll
[2011/12/24 11:55:49 | 000,160,256 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vdsbas.dll
[2011/12/24 11:55:48 | 000,198,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wpdwcn.dll
[2011/12/24 11:55:48 | 000,096,256 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inseng.dll
[2011/12/24 11:55:48 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\bfsvc.exe
[2011/12/24 11:55:48 | 000,050,688 | —- | C] (Microsoft Corporation) – C:\Windows\System32\runonce.exe
[2011/12/24 11:55:47 | 000,210,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxdiagn.dll
[2011/12/24 11:55:47 | 000,095,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\logagent.exe
[2011/12/24 11:55:47 | 000,083,968 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RegisterIEPKEYs.exe
[2011/12/24 11:55:46 | 000,015,872 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sspisrv.dll
[2011/12/24 11:55:45 | 000,242,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\eapp3hst.dll
[2011/12/24 11:55:45 | 000,176,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MFPlay.dll
[2011/12/24 11:55:45 | 000,117,760 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\rmcast.sys
[2011/12/24 11:55:44 | 000,489,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10level9.dll
[2011/12/24 11:55:44 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PnPUnattend.exe
[2011/12/24 11:55:43 | 000,507,392 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmdrmdev.dll
[2011/12/24 11:55:43 | 000,108,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\shacct.dll
[2011/12/24 11:55:42 | 000,309,760 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sqlcese30.dll
[2011/12/24 11:55:42 | 000,186,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\bitsadmin.exe
[2011/12/24 11:55:42 | 000,087,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wudriver.dll
[2011/12/24 11:55:42 | 000,059,392 | —- | C] (Microsoft Corporation) – C:\Windows\System32\unimdmat.dll
[2011/12/24 11:55:42 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iscsium.dll
[2011/12/24 11:55:42 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\lsmproxy.dll
[2011/12/24 11:55:41 | 000,878,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Bubbles.scr
[2011/12/24 11:55:41 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tabcal.exe
[2011/12/24 11:55:41 | 000,052,224 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpd3d.dll
[2011/12/24 11:55:40 | 001,160,192 | —- | C] (Microsoft Corporation) – C:\Windows\System32\OpcServices.dll
[2011/12/24 11:55:40 | 000,183,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PortableDeviceSyncProvider.dll
[2011/12/24 11:55:40 | 000,084,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\kstvtune.ax
[2011/12/24 11:55:39 | 000,350,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WPDSp.dll
[2011/12/24 11:55:39 | 000,162,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WUDFPlatform.dll
[2011/12/24 11:55:39 | 000,082,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\logman.exe
[2011/12/24 11:55:39 | 000,077,824 | —- | C] (Microsoft Corporation) – C:\Windows\System32\olethk32.dll
[2011/12/24 11:55:39 | 000,060,928 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ncryptui.dll
[2011/12/24 11:55:39 | 000,059,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\djoin.exe
[2011/12/24 11:55:38 | 000,427,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PortableDeviceStatus.dll
[2011/12/24 11:55:38 | 000,220,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Ribbons.scr
[2011/12/24 11:55:38 | 000,132,608 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MdSched.exe
[2011/12/24 11:55:38 | 000,099,328 | —- | C] (Microsoft Corporation) – C:\Windows\System32\QSVRMGMT.DLL
[2011/12/24 11:55:38 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\Windows\System32\lpremove.exe
[2011/12/24 11:55:38 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wwanprotdim.dll
[2011/12/24 11:55:37 | 000,221,184 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Mystify.scr
[2011/12/24 11:55:37 | 000,179,200 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ActionQueue.dll
[2011/12/24 11:55:37 | 000,142,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\powercfg.cpl
[2011/12/24 11:55:37 | 000,109,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\CscMig.dll
[2011/12/24 11:55:37 | 000,036,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tsgqec.dll
[2011/12/24 11:55:36 | 000,902,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMADMOD.DLL
[2011/12/24 11:55:36 | 000,318,464 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMPhoto.dll
[2011/12/24 11:55:36 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mapistub.dll
[2011/12/24 11:55:36 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mapi32.dll
[2011/12/24 11:55:36 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\Windows\System32\utildll.dll
[2011/12/24 11:55:35 | 000,115,200 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dot3msm.dll
[2011/12/24 11:55:35 | 000,109,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wiavideo.dll
[2011/12/24 11:55:35 | 000,107,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Kswdmcap.ax
[2011/12/24 11:55:35 | 000,098,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\fphc.dll
[2011/12/24 11:55:34 | 000,541,184 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMVSDECD.DLL
[2011/12/24 11:55:34 | 000,153,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\VBICodec.ax
[2011/12/24 11:55:34 | 000,051,200 | —- | C] (Microsoft Corporation) – C:\Windows\System32\takeown.exe
[2011/12/24 11:55:34 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\TsUsbRedirectionGroupPolicyControl.exe
[2011/12/24 11:55:33 | 000,436,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmdrmnet.dll
[2011/12/24 11:55:33 | 000,283,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qdv.dll
[2011/12/24 11:55:32 | 000,265,216 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msnetobj.dll
[2011/12/24 11:55:32 | 000,128,512 | —- | C] (Microsoft Corporation) – C:\Windows\System32\EhStorAPI.dll
[2011/12/24 11:55:32 | 000,100,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sppinst.dll
[2011/12/24 11:55:31 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\QCLIPROV.DLL
[2011/12/24 11:55:31 | 000,066,560 | —- | C] (Microsoft Corporation) – C:\Windows\System32\cca.dll
[2011/12/24 11:55:30 | 000,567,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WUDFx.dll
[2011/12/24 11:55:30 | 000,202,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\unattend.dll
[2011/12/24 11:55:30 | 000,182,784 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RelPost.exe
[2011/12/24 11:55:30 | 000,084,992 | —- | C] (Microsoft Corporation) – C:\Windows\System32\cmstp.exe
[2011/12/24 11:55:30 | 000,025,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qprocess.exe
[2011/12/24 11:55:29 | 000,070,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MuiUnattend.exe
[2011/12/24 11:55:29 | 000,056,832 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vfwwdm32.dll
[2011/12/24 11:55:29 | 000,051,712 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wsnmp32.dll
[2011/12/24 11:55:29 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\pdhui.dll
[2011/12/24 11:55:28 | 000,739,328 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMSPDMOD.DLL
[2011/12/24 11:55:28 | 000,115,712 | —- | C] (Microsoft Corporation) – C:\Windows\System32\setupcln.dll
[2011/12/24 11:55:28 | 000,050,688 | —- | C] (Microsoft Corporation) – C:\Windows\System32\umb.dll
[2011/12/24 11:55:28 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\basesrv.dll
[2011/12/24 11:55:27 | 000,176,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msorcl32.dll
[2011/12/24 11:55:27 | 000,028,160 | —- | C] (Microsoft Corporation) – C:\Windows\System32\AzSqlExt.dll
[2011/12/24 11:55:27 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msg.exe
[2011/12/24 11:55:26 | 000,122,880 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iasrecst.dll
[2011/12/24 11:55:26 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qwinsta.exe
[2011/12/24 11:55:26 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\chglogon.exe
[2011/12/24 11:55:25 | 000,144,896 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iscsicli.exe
[2011/12/24 11:55:25 | 000,128,000 | —- | C] (Microsoft Corporation) – C:\Windows\System32\desk.cpl
[2011/12/24 11:55:25 | 000,126,464 | —- | C] (Microsoft Corporation) – C:\Windows\System32\BdeHdCfg.exe
[2011/12/24 11:55:25 | 000,037,888 | —- | C] (Microsoft Corporation) – C:\Windows\System32\relog.exe
[2011/12/24 11:55:25 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PrintIsolationProxy.dll
[2011/12/24 11:55:25 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netiougc.exe
[2011/12/24 11:55:24 | 000,070,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\amstream.dll
[2011/12/24 11:55:24 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\Windows\System32\spbcd.dll
[2011/12/24 11:55:24 | 000,047,104 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wkscli.dll
[2011/12/24 11:55:24 | 000,046,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WavDest.dll
[2011/12/24 11:55:23 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\diskpart.exe
[2011/12/24 11:55:23 | 000,024,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netbtugc.exe
[2011/12/24 11:55:23 | 000,023,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\quser.exe
[2011/12/24 11:55:22 | 000,158,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\itircl.dll
[2011/12/24 11:55:22 | 000,085,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc_ssp_isv.dll
[2011/12/24 11:55:22 | 000,085,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc_ssp.dll
[2011/12/24 11:55:22 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\CertPolEng.dll
[2011/12/24 11:55:22 | 000,053,248 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MultiDigiMon.exe
[2011/12/24 11:55:22 | 000,050,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\setbcdlocale.dll
[2011/12/24 11:55:22 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\syssetup.dll
[2011/12/24 11:55:22 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\nrpsrv.dll
[2011/12/24 11:55:21 | 001,027,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\IMJP10.IME
[2011/12/24 11:55:21 | 000,144,384 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmpps.dll
[2011/12/24 11:55:21 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ksxbar.ax
[2011/12/24 11:55:21 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qappsrv.exe
[2011/12/24 11:55:20 | 000,430,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\FXSTIFF.dll
[2011/12/24 11:55:20 | 000,022,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\chgport.exe
[2011/12/24 11:55:20 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tsdiscon.exe
[2011/12/24 11:55:20 | 000,020,992 | —- | C] (Microsoft Corporation) – C:\Windows\System32\chgusr.exe
[2011/12/24 11:55:19 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wuapp.exe
[2011/12/24 11:55:19 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tscon.exe
[2011/12/24 11:55:18 | 000,278,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate_ssp_isv.exe
[2011/12/24 11:55:18 | 000,094,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\eappgnui.dll
[2011/12/24 11:55:18 | 000,069,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tlscsp.dll
[2011/12/24 11:55:18 | 000,062,976 | —- | C] (Microsoft Corporation) – C:\Windows\System32\findstr.exe
[2011/12/24 11:55:18 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WerFaultSecure.exe
[2011/12/24 11:55:18 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ReAgentc.exe
[2011/12/24 11:55:17 | 000,022,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tskill.exe
[2011/12/24 11:55:17 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\logoff.exe
[2011/12/24 11:55:16 | 000,280,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate_ssp.exe
[2011/12/24 11:55:16 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wiarpc.dll
[2011/12/24 11:55:16 | 000,020,992 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rwinsta.exe
[2011/12/24 11:55:15 | 000,036,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mciqtz32.dll
[2011/12/24 11:55:15 | 000,020,992 | —- | C] (Microsoft Corporation) – C:\Windows\System32\shadow.exe
[2011/12/24 11:55:14 | 000,121,344 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sppc.dll
[2011/12/24 11:55:14 | 000,082,944 | —- | C] (Radius Inc.) – C:\Windows\System32\iccvid.dll
[2011/12/24 11:55:14 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\muifontsetup.dll
[2011/12/24 11:55:13 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\tdi.sys
[2011/12/24 11:55:13 | 000,019,968 | —- | C] (Microsoft Corporation) – C:\Windows\System32\spopk.dll
[2011/12/24 11:55:12 | 000,057,344 | —- | C] (Microsoft Corporation) – C:\Windows\System32\repair-bde.exe
[2011/12/24 11:55:12 | 000,041,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\luainstall.dll
[2011/12/24 11:55:12 | 000,031,744 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wdiasqmmodule.dll
[2011/12/24 11:55:12 | 000,026,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\usbrpm.sys
[2011/12/24 11:55:12 | 000,022,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\HotStartUserAgent.dll
[2011/12/24 11:55:11 | 000,061,952 | —- | C] (Microsoft Corporation) – C:\Windows\System32\manage-bde.exe
[2011/12/24 11:55:11 | 000,034,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\unlodctr.exe
[2011/12/24 11:55:11 | 000,033,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vbisurf.ax
[2011/12/24 11:55:11 | 000,030,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdmo.dll
[2011/12/24 11:55:11 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netcfg.exe
[2011/12/24 11:55:10 | 000,053,760 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vmicres.dll
[2011/12/24 11:55:10 | 000,052,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetmib1.dll
[2011/12/24 11:55:10 | 000,038,400 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vmstorfltres.dll
[2011/12/24 11:55:10 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdprefdrvapi.dll
[2011/12/24 11:55:09 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\g711codc.ax
[2011/12/24 11:55:09 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\reset.exe
[2011/12/24 11:55:09 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\change.exe
[2011/12/24 11:55:09 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\query.exe
[2011/12/24 11:55:08 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WUDFCoinstaller.dll
[2011/12/24 11:55:07 | 001,164,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\UIRibbonRes.dll
[2011/12/24 11:55:07 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vmbusres.dll
[2011/12/24 11:55:07 | 000,041,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\browcli.dll
[2011/12/24 11:55:07 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\Windows\System32\odbcconf.dll
[2011/12/24 11:55:07 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\profprov.dll
[2011/12/24 11:55:07 | 000,027,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wups.dll
[2011/12/24 11:55:06 | 000,017,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\perfts.dll
[2011/12/24 11:55:04 | 000,039,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\FXSMON.dll
[2011/12/24 11:55:04 | 000,022,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\elsTrans.dll
[2011/12/24 11:55:04 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/12/24 11:55:03 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\TRAPI.dll
[2011/12/24 11:55:02 | 000,121,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RDPENCDD.dll
[2011/12/24 11:55:02 | 000,019,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\bitsperf.dll
[2011/12/24 11:55:02 | 000,017,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\schedcli.dll
[2011/12/24 11:55:01 | 000,068,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\napdsnap.dll
[2011/12/24 11:55:01 | 000,030,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dsauth.dll
[2011/12/24 11:54:59 | 000,009,728 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sscore.dll
[2011/12/24 11:54:58 | 000,430,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\imkr80.ime
[2011/12/24 11:54:58 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wsdchngr.dll
[2011/12/24 11:54:57 | 000,036,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wups2.dll
[2011/12/24 11:54:57 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\riched32.dll
[2011/12/24 11:54:55 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\VMBusHID.sys
[2011/12/24 11:54:55 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rdpcfgex.dll
[2011/12/24 11:54:54 | 000,386,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/12/24 11:54:52 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wshirda.dll
[2011/12/24 11:54:50 | 000,025,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\USBCAMD2.sys
[2011/12/24 11:54:50 | 000,025,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\USBCAMD.sys
[2011/12/24 11:54:49 | 000,116,224 | —- | C] (Microsoft Corporation) – C:\Windows\System32\VmbusCoinstaller.dll
[2011/12/24 11:54:49 | 000,113,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\VmdCoinstall.dll
[2011/12/24 11:54:49 | 000,113,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\IcCoinstall.dll
[2011/12/24 11:54:49 | 000,047,616 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vmictimeprovider.dll
[2011/12/24 11:54:49 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vmbuspipe.dll
[2011/12/24 11:54:49 | 000,008,192 | —- | C] (Microsoft Corporation) – C:\Windows\System32\spwmp.dll
[2011/12/24 11:54:47 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RDPREFDD.dll
[2011/12/24 11:54:47 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\C_ISCII.DLL
[2011/12/24 11:54:47 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\Windows\System32\shunimpl.dll
[2011/12/24 11:54:47 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdxm.ocx
[2011/12/24 11:54:47 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxmasf.dll
[2011/12/24 11:54:44 | 012,625,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmploc.DLL
[2011/12/24 11:54:43 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\kbdlk41a.dll
[2011/12/24 11:54:43 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDSF.DLL
[2011/12/24 11:54:43 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDNEPR.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDUS.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDUGHR1.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDTURME.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDTAJIK.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDMON.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDMAORI.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDLT1.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDINTEL.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDINORI.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDINKAN.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDBULG.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDBLR.DLL
[2011/12/24 11:54:43 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDBASH.DLL
[2011/12/24 11:54:43 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDGEO.DLL
[2011/12/24 11:54:42 | 000,069,120 | —- | C] (Microsoft Corporation) – C:\Windows\System32\nlsbres.dll
[2011/12/24 11:54:42 | 000,052,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\BlbEvents.dll
[2011/12/24 11:54:42 | 000,035,328 | —- | C] (Microsoft Corporation) – C:\Windows\System32\pifmgr.dll
[2011/12/24 11:54:42 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\spwizres.dll
[2011/12/24 11:54:42 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDSG.DLL
[2011/12/24 11:54:42 | 000,007,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDCZ1.DLL
[2011/12/24 11:54:42 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDTUQ.DLL
[2011/12/24 11:54:42 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDTUF.DLL
[2011/12/24 11:54:42 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDPO.DLL
[2011/12/24 11:54:42 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDINBEN.DLL
[2011/12/24 11:54:42 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDGR1.DLL
[2011/12/24 11:54:42 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDGKL.DLL
[2011/12/24 11:54:42 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDINTAM.DLL
[2011/12/24 11:54:42 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDINMAR.DLL
[2011/12/24 11:54:42 | 000,006,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\KBDINHIN.DLL
[2011/12/24 11:54:42 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\vms3cap.sys
[2011/12/24 11:54:42 | 000,002,560 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dpnaddr.dll
[2011/12/24 11:54:27 | 000,189,952 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wdscore.dll
[2011/12/24 11:53:41 | 000,363,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wbemcomn.dll
[2011/12/24 11:53:13 | 000,189,952 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sqmapi.dll
[2011/12/24 10:42:40 | 000,284,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\usbport.sys
[2011/12/24 10:42:37 | 000,005,888 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\usbd.sys
[2011/12/24 10:42:23 | 000,148,864 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\storport.sys
[2011/12/24 10:42:21 | 000,074,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\fsutil.exe
[2011/12/23 17:11:11 | 000,000,000 | —D | C] – C:\Windows\System32\Wat
[2011/12/23 14:35:36 | 000,000,000 | —D | C] – C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2011/12/23 11:46:20 | 000,000,000 | —D | C] – C:\Users\Edward\Documents\GomPlayer
[2011/12/23 11:46:19 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\GRETECH
[2011/12/23 10:15:11 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2011/12/23 10:14:14 | 000,032,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msonpmon.dll
[2011/12/23 10:04:39 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Works
[2011/12/23 10:01:55 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Visual Studio
[2011/12/23 10:01:53 | 000,000,000 | —D | C] – C:\Program Files\Common Files\DESIGNER
[2011/12/23 09:58:26 | 000,000,000 | —D | C] – C:\Windows\PCHEALTH
[2011/12/23 09:58:25 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2011/12/23 09:52:10 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Visual Studio 2005
[2011/12/23 09:51:33 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Visual Studio 8
[2011/12/23 09:46:26 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Local\Microsoft Help
[2011/12/23 09:45:07 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Office
[2011/12/23 09:45:04 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft Help
[2011/12/23 09:41:55 | 000,000,000 | R–D | C] – C:\MSOCache
[2011/12/23 09:25:42 | 000,187,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\FWPKCLNT.SYS
[2011/12/23 09:25:11 | 000,031,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\prevhost.exe
[2011/12/23 09:24:44 | 000,599,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/12/23 09:24:40 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/12/23 09:24:39 | 000,132,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2011/12/23 09:24:38 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/12/23 09:24:38 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/12/23 09:21:52 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dnscacheugc.exe
[2011/12/23 09:21:49 | 000,294,912 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\atmfd.dll
[2011/12/23 09:21:49 | 000,070,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\fontsub.dll
[2011/12/23 09:21:49 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\System32\atmlib.dll
[2011/12/23 09:21:34 | 002,342,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2011/12/23 09:21:31 | 000,075,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\psisrndr.ax
[2011/12/23 09:21:30 | 000,465,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\psisdecd.dll
[2011/12/23 09:21:29 | 000,204,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MSNP.ax
[2011/12/23 09:21:29 | 000,072,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Mpeg2Data.ax
[2011/12/23 09:21:28 | 000,059,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MSDvbNP.ax
[2011/12/23 09:21:14 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2011/12/23 09:20:26 | 001,549,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tquery.dll
[2011/12/23 09:20:25 | 001,401,344 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mssrch.dll
[2011/12/23 09:20:22 | 000,666,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mssvp.dll
[2011/12/23 09:20:22 | 000,337,408 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mssph.dll
[2011/12/23 09:20:22 | 000,197,120 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mssphtb.dll
[2011/12/23 09:20:19 | 000,059,392 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msscntrs.dll
[2011/12/23 09:20:16 | 000,191,488 | —- | C] (Microsoft Corporation) – C:\Windows\System32\FXSCOVER.exe
[2011/12/23 09:20:15 | 000,802,304 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WFS.exe
[2011/12/23 09:20:13 | 000,534,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\EncDec.dll
[2011/12/23 09:20:10 | 000,870,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsPrint.dll
[2011/12/23 09:20:08 | 000,288,256 | —- | C] (Microsoft Corporation) – C:\Windows\System32\XpsGdiConverter.dll
[2011/12/23 09:20:06 | 000,038,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\csrsrv.dll
[2011/12/23 09:20:03 | 000,642,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\CPFilters.dll
[2011/12/23 09:20:01 | 000,850,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sbe.dll
[2011/12/23 09:20:01 | 000,199,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mpg2splt.ax
[2011/12/23 09:19:53 | 000,271,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\conhost.exe
[2011/12/23 09:19:53 | 000,169,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winsrv.dll
[2011/12/23 09:19:52 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2011/12/23 09:19:51 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
[2011/12/23 09:19:51 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2011/12/23 09:19:51 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2011/12/23 09:19:51 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2011/12/23 09:19:51 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2011/12/23 09:19:51 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2011/12/23 09:19:51 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
[2011/12/23 09:19:51 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2011/12/23 09:19:50 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
[2011/12/23 09:19:50 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2011/12/23 09:19:50 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2011/12/23 09:19:50 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2011/12/23 09:19:50 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2011/12/23 09:19:50 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2011/12/23 09:19:50 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2011/12/23 09:19:50 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2011/12/23 09:19:50 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2011/12/23 09:19:49 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2011/12/23 09:19:49 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2011/12/23 09:19:49 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2011/12/23 09:19:49 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2011/12/23 09:19:49 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2011/12/23 09:19:49 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
[2011/12/23 09:19:49 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2011/12/23 09:19:49 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
[2011/12/23 09:19:49 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2011/12/23 09:19:49 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
[2011/12/23 09:19:39 | 002,616,320 | —- | C] (Microsoft Corporation) – C:\Windows\explorer.exe
[2011/12/23 09:19:29 | 000,319,488 | —- | C] (Microsoft Corporation) – C:\Windows\System32\odbcjt32.dll
[2011/12/23 09:19:29 | 000,122,880 | —- | C] (Microsoft Corporation) – C:\Windows\System32\odbccp32.dll
[2011/12/23 09:19:28 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\Windows\System32\odbccr32.dll
[2011/12/23 09:19:27 | 000,086,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\odbccu32.dll
[2011/12/23 09:19:26 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\odbctrac.dll
[2011/12/23 09:19:23 | 000,219,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1core.dll
[2011/12/23 09:19:22 | 000,161,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\d3d10_1.dll
[2011/12/23 09:19:19 | 003,967,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2011/12/23 09:19:17 | 003,912,560 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2011/12/23 09:18:36 | 001,137,664 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc42.dll
[2011/12/23 09:18:35 | 001,164,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfc42u.dll
[2011/12/23 09:18:12 | 000,123,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\poqexec.exe
[2011/12/23 09:18:10 | 000,027,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\Diskdump.sys
[2011/12/23 08:59:07 | 000,219,008 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\dxgmms1.sys
[2011/12/23 08:59:07 | 000,107,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\cdd.dll
[2011/12/22 21:26:55 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOM Player
[2011/12/22 21:26:34 | 000,000,000 | —D | C] – C:\Program Files\GRETECH
[2011/12/22 21:00:08 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\Skype
[2011/12/22 20:59:28 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011/12/22 20:59:04 | 000,000,000 | R–D | C] – C:\Program Files\Skype
[2011/12/22 20:58:52 | 000,000,000 | —D | C] – C:\ProgramData\Skype
[2011/12/22 20:57:53 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan
[2011/12/22 20:57:13 | 000,000,000 | —D | C] – C:\Program Files\SpeedFan
[2011/12/22 20:26:16 | 000,090,112 | —- | C] (Creative Technology Ltd.) – C:\Windows\Updreg.EXE
[2011/12/22 20:26:14 | 000,149,504 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MFCANS32.DLL
[2011/12/22 20:26:14 | 000,108,032 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MFCUIA32.DLL
[2011/12/22 20:26:14 | 000,084,992 | —- | C] (Creative Technology Ltd.) – C:\Windows\System32\SFCVRT32.DLL
[2011/12/22 20:26:14 | 000,053,552 | —- | C] (Creative® Technology Ltd.) – C:\Windows\CTCCW.DLL
[2011/12/22 20:26:14 | 000,024,976 | —- | C] (Creative Technology Ltd.) – C:\Windows\CTRES.DLL
[2011/12/22 20:26:13 | 000,082,432 | —- | C] (Creative Technology Ltd.) – C:\Windows\System32\CTWFLT32.DLL
[2011/12/22 20:26:13 | 000,054,784 | —- | C] (Blue Sky Software Corporation.) – C:\Windows\System32\INETWH32.DLL
[2011/12/22 20:26:13 | 000,026,768 | —- | C] (Microsoft Corporation) – C:\Windows\System32\CTL3D.DLL
[2011/12/22 20:26:10 | 000,000,000 | —D | C] – C:\Windows\System32\Defaults
[2011/12/22 20:25:17 | 000,020,480 | —- | C] (Creative Technology Limited) – C:\Windows\INRES.DLL
[2011/12/22 20:25:17 | 000,000,000 | —D | C] – C:\Windows\System32\Data
[2011/12/22 20:25:13 | 000,998,004 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\drivers\HA10KX2K.SYS
[2011/12/22 20:25:13 | 000,213,860 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\drivers\CTSFM2K.SYS
[2011/12/22 20:25:13 | 000,195,432 | —- | C] (Creative Technology Ltd.) – C:\Windows\System32\drivers\CTOSS2K.SYS
[2011/12/22 20:25:13 | 000,156,604 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\drivers\EMUPIA2K.SYS
[2011/12/22 20:25:13 | 000,011,068 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\drivers\CTPRXY2K.SYS
[2011/12/22 20:25:12 | 000,837,548 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\drivers\CTAUD2K.SYS
[2011/12/22 20:25:12 | 000,127,948 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\drivers\CTAC32K.SYS
[2011/12/22 20:25:11 | 000,049,152 | —- | C] (Creative Technology Ltd) – C:\Windows\CTDCRES.DLL
[2011/12/22 20:25:10 | 000,270,336 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\SFMS32.DLL
[2011/12/22 20:25:10 | 000,176,128 | —- | C] (Creative Technology Limited) – C:\Windows\READREG.EXE
[2011/12/22 20:25:10 | 000,036,864 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\SFMAN32.DLL
[2011/12/22 20:25:09 | 000,135,168 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\OPENAL32.DLL
[2011/12/22 20:25:09 | 000,110,592 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\PIAPROXY.DLL
[2011/12/22 20:25:09 | 000,077,824 | —- | C] (Creative Labs) – C:\Windows\System32\EAXAC3.DLL
[2011/12/22 20:25:09 | 000,061,440 | —- | C] (Creative Technology Ltd) – C:\Windows\MIDIDEF.EXE
[2011/12/22 20:25:08 | 000,643,072 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\CTSBLFX.DLL
[2011/12/22 20:25:08 | 000,094,208 | —- | C] (Creative Technology Ltd) – C:\Windows\DEVREG.DLL
[2011/12/22 20:25:08 | 000,028,672 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\CTSPKHLP.DLL
[2011/12/22 20:25:07 | 000,155,648 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\CTOSUSER.DLL
[2011/12/22 20:25:07 | 000,106,496 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\CTDPROXY.DLL
[2011/12/22 20:25:07 | 000,036,864 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\CTEMUPIA.DLL
[2011/12/22 20:25:07 | 000,024,576 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\CTHELPER.EXE
[2011/12/22 20:25:06 | 000,319,488 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\CTDEVCON.DLL
[2011/12/22 20:25:06 | 000,110,592 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\COMMONFX.DLL
[2011/12/22 20:25:06 | 000,106,496 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\CTASIO.DLL
[2011/12/22 20:25:06 | 000,061,440 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\CTAGENT.DLL
[2011/12/22 20:25:05 | 000,065,536 | —- | C] ( ) – C:\Windows\System32\A3D.DLL
[2011/12/22 20:25:05 | 000,053,248 | —- | C] (Creative Technology Ltd) – C:\Windows\System32\AC3API.DLL
[2011/12/22 20:22:05 | 000,000,000 | -H-D | C] – C:\Program Files\InstallShield Installation Information
[2011/12/22 20:22:05 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Creative
[2011/12/22 20:20:04 | 000,000,000 | —D | C] – C:\Program Files\Common Files\InstallShield
[2011/12/22 20:18:34 | 000,000,000 | —D | C] – C:\Program Files\Creative
[2011/12/22 19:49:20 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\Macromedia
[2011/12/22 19:49:20 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\Adobe
[2011/12/22 19:47:50 | 000,000,000 | —D | C] – C:\Windows\pss
[2011/12/22 19:47:11 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2011/12/22 19:43:36 | 000,000,000 | —D | C] – C:\Users\Edward\Desktop\Programs
[2011/12/22 19:22:21 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Security Client
[2011/12/22 19:19:02 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Local\LogiShrd
[2011/12/22 19:18:28 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\Leadertech
[2011/12/22 19:18:07 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
[2011/12/22 19:17:58 | 000,000,000 | —D | C] – C:\ProgramData\LogiShrd
[2011/12/22 19:17:56 | 000,000,000 | —D | C] – C:\Program Files\Logitech
[2011/12/22 19:16:48 | 000,000,000 | -HSD | C] – C:\Windows\Installer
[2011/12/22 19:10:52 | 000,222,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MpSigStub.exe
[2011/12/22 19:06:17 | 000,414,368 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/12/22 19:06:14 | 000,000,000 | —D | C] – C:\Windows\System32\Macromed
[2011/12/22 19:04:01 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\Mozilla
[2011/12/22 19:04:01 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Local\Mozilla
[2011/12/22 19:03:40 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2011/12/22 19:00:20 | 001,002,008 | —- | C] (Intel Corporation) – C:\Windows\System32\igxpun.exe
[2011/12/22 19:00:20 | 000,000,000 | —D | C] – C:\Windows\System32\x64
[2011/12/22 18:58:16 | 000,000,000 | —D | C] – C:\Program Files\Common Files\logishrd
[2011/12/22 18:54:48 | 000,000,000 | R–D | C] – C:\Users\Edward\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2011/12/22 18:54:48 | 000,000,000 | R–D | C] – C:\Users\Edward\Searches
[2011/12/22 18:54:48 | 000,000,000 | R–D | C] – C:\Users\Edward\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011/12/22 18:54:47 | 000,000,000 | —D | C] – C:\Users\Edward\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
[2011/12/22 18:54:26 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\Identities
[2011/12/22 18:54:18 | 000,000,000 | R–D | C] – C:\Users\Edward\Contacts
[2011/12/22 18:53:42 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Local\VirtualStore
[2011/12/22 18:53:33 | 000,000,000 | -HSD | C] – C:\Users\Edward\AppData\Local\Temporary Internet Files
[2011/12/22 18:53:33 | 000,000,000 | -HSD | C] – C:\Users\Edward\Templates
[2011/12/22 18:53:33 | 000,000,000 | -HSD | C] – C:\Users\Edward\Local Settings
[2011/12/22 18:53:33 | 000,000,000 | -HSD | C] – C:\Users\Edward\AppData\Local\History
[2011/12/22 18:53:33 | 000,000,000 | -HSD | C] – C:\Users\Edward\AppData\Local\Application Data
[2011/12/22 18:53:32 | 000,000,000 | -HSD | C] – C:\Users\Edward\Start Menu
[2011/12/22 18:53:32 | 000,000,000 | -HSD | C] – C:\Users\Edward\SendTo
[2011/12/22 18:53:32 | 000,000,000 | -HSD | C] – C:\Users\Edward\Recent
[2011/12/22 18:53:32 | 000,000,000 | -HSD | C] – C:\Users\Edward\PrintHood
[2011/12/22 18:53:32 | 000,000,000 | -HSD | C] – C:\Users\Edward\NetHood
[2011/12/22 18:53:32 | 000,000,000 | -HSD | C] – C:\Users\Edward\Documents\My Videos
[2011/12/22 18:53:32 | 000,000,000 | -HSD | C] – C:\Users\Edward\Documents\My Pictures
[2011/12/22 18:53:32 | 000,000,000 | -HSD | C] – C:\Users\Edward\Documents\My Music
[2011/12/22 18:53:32 | 000,000,000 | -HSD | C] – C:\Users\Edward\My Documents
[2011/12/22 18:53:32 | 000,000,000 | -HSD | C] – C:\Users\Edward\Cookies
[2011/12/22 18:53:32 | 000,000,000 | -HSD | C] – C:\Users\Edward\Application Data
[2011/12/22 18:53:30 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Local\Temp
[2011/12/22 18:53:30 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Local\Microsoft
[2011/12/22 18:53:30 | 000,000,000 | —D | C] – C:\Users\Edward\AppData\Roaming\Media Center Programs
[2011/12/22 18:53:29 | 000,000,000 | –SD | C] – C:\Users\Edward\AppData\Roaming\Microsoft
[2011/12/22 18:53:29 | 000,000,000 | R–D | C] – C:\Users\Edward\Videos
[2011/12/22 18:53:29 | 000,000,000 | R–D | C] – C:\Users\Edward\Saved Games
[2011/12/22 18:53:29 | 000,000,000 | R–D | C] – C:\Users\Edward\Pictures
[2011/12/22 18:53:29 | 000,000,000 | R–D | C] – C:\Users\Edward\Music
[2011/12/22 18:53:29 | 000,000,000 | R–D | C] – C:\Users\Edward\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011/12/22 18:53:29 | 000,000,000 | R–D | C] – C:\Users\Edward\Links
[2011/12/22 18:53:29 | 000,000,000 | R–D | C] – C:\Users\Edward\Favorites
[2011/12/22 18:53:29 | 000,000,000 | R–D | C] – C:\Users\Edward\Downloads
[2011/12/22 18:53:29 | 000,000,000 | R–D | C] – C:\Users\Edward\Documents
[2011/12/22 18:53:29 | 000,000,000 | R–D | C] – C:\Users\Edward\Desktop
[2011/12/22 18:53:29 | 000,000,000 | R–D | C] – C:\Users\Edward\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011/12/22 18:53:29 | 000,000,000 | -H-D | C] – C:\Users\Edward\AppData
[2011/12/22 18:31:54 | 000,000,000 | —D | C] – C:\Windows\SoftwareDistribution
[2011/12/22 18:28:53 | 000,000,000 | —D | C] – C:\Windows\Minidump
[2011/12/22 18:28:09 | 000,000,000 | —D | C] – C:\Windows\Prefetch
[2011/12/22 18:01:45 | 000,000,000 | —D | C] – C:\Windows\Panther
[2011/12/22 18:01:28 | 000,000,000 | —D | C] – C:\Boot
[2011/12/22 17:45:36 | 000,000,000 | —D | C] – C:\Windows.old.000
[2011/12/22 02:08:30 | 000,000,000 | —D | C] – C:\NVIDIA
[2011/12/21 21:15:04 | 000,000,000 | —D | C] – C:\Programs to run
[2011/12/21 17:09:09 | 000,000,000 | —D | C] – C:\Recovery

========== Files - Modified Within 30 Days ==========

[2012/01/01 17:50:35 | 000,010,128 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/01/01 17:50:35 | 000,010,128 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/01/01 15:53:33 | 000,626,040 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/01/01 15:53:33 | 000,107,316 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/01/01 15:48:09 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/01/01 15:48:04 | 1603,723,264 | -HS- | M] () – C:\hiberfil.sys
[2011/12/29 09:35:31 | 000,414,368 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/12/29 09:34:35 | 000,001,141 | —- | M] () – C:\Users\Edward\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2011/12/27 18:02:00 | 000,000,046 | —- | M] () – C:\Windows\System32\DonationCoder_urlsnooper_InstallInfo.dat
[2011/12/26 08:45:34 | 000,409,752 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2011/12/25 23:24:38 | 000,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2011/12/25 16:57:45 | 000,152,576 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msclmd.dll
[2011/12/23 21:19:17 | 000,015,744 | —- | M] () – C:\Windows\System32\BMXCtrlState-{00000001-00000000-00000001-00001102-00000002-80271102}.rfx
[2011/12/23 21:19:17 | 000,015,744 | —- | M] () – C:\Windows\System32\BMXBkpCtrlState-{00000001-00000000-00000001-00001102-00000002-80271102}.rfx
[2011/12/23 21:19:17 | 000,000,024 | —- | M] () – C:\Windows\System32\DVCStateBkp-{00000001-00000000-00000001-00001102-00000002-80271102}.dat
[2011/12/23 21:19:17 | 000,000,024 | —- | M] () – C:\Windows\System32\DVCState-{00000001-00000000-00000001-00001102-00000002-80271102}.dat
[2011/12/23 14:46:29 | 000,001,945 | —- | M] () – C:\Windows\epplauncher.mif
[2011/12/22 20:57:13 | 000,000,045 | —- | M] () – C:\Windows\System32\initdebug.nfo
[2011/12/22 20:26:18 | 000,000,128 | —- | M] () – C:\Windows\SBWIN.INI
[2011/12/22 19:47:15 | 000,000,975 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk
[2011/12/22 19:03:48 | 000,001,106 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/12/22 18:55:45 | 000,001,417 | —- | M] () – C:\Users\Edward\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/12/22 18:35:26 | 000,042,045 | —- | M] () – C:\Windows\System32\license.rtf
[2011/12/22 18:01:32 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2011/12/22 18:01:29 | 000,000,490 | RHS- | M] () – C:\Boot.ini.saved

========== Files Created - No Company Name ==========

[2011/12/31 15:14:32 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2011/12/31 15:14:32 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2011/12/31 15:14:32 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2011/12/31 15:14:32 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2011/12/31 15:14:32 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2011/12/29 18:16:22 | 000,002,441 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2011/12/29 09:34:35 | 000,001,141 | —- | C] () – C:\Users\Edward\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2011/12/27 18:02:00 | 000,000,046 | —- | C] () – C:\Windows\System32\DonationCoder_urlsnooper_InstallInfo.dat
[2011/12/25 23:24:38 | 000,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2011/12/24 11:59:22 | 000,080,896 | —- | C] () – C:\Windows\System32\RDVGHelper.exe
[2011/12/24 11:58:44 | 000,146,852 | —- | C] () – C:\Windows\System32\systemsf.ebd
[2011/12/24 11:55:18 | 000,066,048 | —- | C] () – C:\Windows\System32\PrintBrmUi.exe
[2011/12/24 11:55:05 | 000,010,429 | —- | C] () – C:\Windows\System32\ScavengeSpace.xml
[2011/12/24 11:54:40 | 000,105,559 | —- | C] () – C:\Windows\System32\RacRules.xml
[2011/12/23 00:37:21 | 000,000,024 | —- | C] () – C:\Windows\System32\DVCStateBkp-{00000001-00000000-00000001-00001102-00000002-80271102}.dat
[2011/12/23 00:37:21 | 000,000,024 | —- | C] () – C:\Windows\System32\DVCState-{00000001-00000000-00000001-00001102-00000002-80271102}.dat
[2011/12/22 20:57:10 | 000,000,045 | —- | C] () – C:\Windows\System32\initdebug.nfo
[2011/12/22 20:31:05 | 000,015,744 | —- | C] () – C:\Windows\System32\BMXCtrlState-{00000001-00000000-00000001-00001102-00000002-80271102}.rfx
[2011/12/22 20:31:05 | 000,015,744 | —- | C] () – C:\Windows\System32\BMXBkpCtrlState-{00000001-00000000-00000001-00001102-00000002-80271102}.rfx
[2011/12/22 20:26:18 | 000,000,128 | —- | C] () – C:\Windows\SBWIN.INI
[2011/12/22 20:26:14 | 000,000,231 | —- | C] () – C:\Windows\AC3API.INI
[2011/12/22 20:26:13 | 001,048,576 | —- | C] () – C:\Windows\System32\SFMAN.DAT
[2011/12/22 20:25:17 | 000,037,727 | —- | C] () – C:\Windows\System32\Emu10kx.ini
[2011/12/22 20:25:17 | 000,000,029 | —- | C] () – C:\Windows\System32\ctzapxx.ini
[2011/12/22 20:25:14 | 000,003,126 | —- | C] () – C:\Windows\System32\Live.bmp
[2011/12/22 20:25:13 | 002,259,067 | —- | C] () – C:\Windows\System32\DEFAULT.ECW
[2011/12/22 20:25:13 | 000,179,669 | —- | C] () – C:\Windows\System32\CTSTATIC.DAT
[2011/12/22 20:25:13 | 000,164,044 | —- | C] () – C:\Windows\System32\CTDLANG.DAT
[2011/12/22 20:25:13 | 000,113,373 | —- | C] () – C:\Windows\System32\CTBASICW.DAT
[2011/12/22 20:25:13 | 000,044,055 | —- | C] () – C:\Windows\System32\CTDAUGHT.DAT
[2011/12/22 20:25:12 | 000,113,273 | —- | C] () – C:\Windows\System32\CTBAS2W.DAT
[2011/12/22 20:25:10 | 000,184,320 | —- | C] () – C:\Windows\PSCONV.EXE
[2011/12/22 20:25:10 | 000,036,864 | —- | C] () – C:\Windows\System32\REGPLIB.EXE
[2011/12/22 20:25:09 | 000,049,152 | —- | C] () – C:\Windows\System32\KILLAPPS.EXE
[2011/12/22 20:25:09 | 000,000,180 | —- | C] () – C:\Windows\System32\KILL.INI
[2011/12/22 20:25:08 | 000,000,059 | —- | C] () – C:\Windows\System32\DEFAULT8.SFM
[2011/12/22 20:25:08 | 000,000,059 | —- | C] () – C:\Windows\System32\DEFAULT4.SFM
[2011/12/22 20:25:08 | 000,000,059 | —- | C] () – C:\Windows\System32\DEFAULT.SFM
[2011/12/22 20:25:07 | 003,373,917 | —- | C] () – C:\Windows\CTDV10K1.CDF
[2011/12/22 20:25:06 | 002,167,684 | —- | C] () – C:\Windows\System32\CT2MGM.SF2
[2011/12/22 20:25:06 | 001,048,576 | —- | C] () – C:\Windows\System32\CT1MGM.ROM
[2011/12/22 19:47:14 | 000,000,975 | —- | C] () – C:\Users\Public\Desktop\CCleaner.lnk
[2011/12/22 19:39:23 | 000,001,945 | —- | C] () – C:\Windows\epplauncher.mif
[2011/12/22 19:22:32 | 000,001,907 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2011/12/22 19:03:48 | 000,001,118 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011/12/22 19:03:48 | 000,001,106 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/12/22 18:55:45 | 000,001,417 | —- | C] () – C:\Users\Edward\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/12/22 18:54:54 | 000,001,423 | —- | C] () – C:\Users\Edward\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011/12/22 18:53:30 | 000,000,290 | —- | C] () – C:\Users\Edward\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2011/12/22 18:53:30 | 000,000,272 | —- | C] () – C:\Users\Edward\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2011/12/22 18:34:46 | 000,001,345 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2011/12/22 18:34:30 | 000,001,326 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2011/12/22 18:01:32 | 000,008,192 | RHS- | C] () – C:\BOOTSECT.BAK
[2011/12/22 18:01:29 | 000,383,786 | RHS- | C] () – C:\bootmgr
[2011/12/22 18:01:29 | 000,000,346 | -H– | C] () – C:\Boot.BAK
[2011/12/21 16:50:36 | 1603,723,264 | -HS- | C] () – C:\hiberfil.sys
[2010/11/11 06:51:29 | 000,000,805 | —- | C] () – C:\Windows\System32\RTSLCS.dll
[2010/06/25 09:03:12 | 000,053,299 | —- | C] () – C:\Windows\System32\pthreadVC.dll
[2009/10/07 01:46:36 | 000,025,752 | —- | C] () – C:\Windows\System32\drivers\LVPr2Mon.sys
[2009/10/07 01:23:08 | 000,013,584 | —- | C] () – C:\Windows\System32\drivers\iKeyLFT2.dll
[2009/07/13 20:57:37 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/13 20:33:53 | 000,409,752 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2009/07/13 18:05:48 | 000,626,040 | —- | C] () – C:\Windows\System32\perfh009.dat
[2009/07/13 18:05:48 | 000,291,294 | —- | C] () – C:\Windows\System32\perfi009.dat
[2009/07/13 18:05:48 | 000,107,316 | —- | C] () – C:\Windows\System32\perfc009.dat
[2009/07/13 18:05:48 | 000,031,548 | —- | C] () – C:\Windows\System32\perfd009.dat
[2009/07/13 18:05:05 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2009/07/13 18:04:11 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2009/07/13 15:55:01 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/13 15:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 15:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/06/10 13:26:10 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2008/07/26 14:42:52 | 000,066,482 | —- | C] () – C:\Windows\System32\lvcoinst.ini
[2004/08/13 09:56:20 | 000,005,810 | —- | C] () – C:\Windows\System32\drivers\ASACPI.sys
[1996/04/03 11:33:26 | 000,005,248 | —- | C] () – C:\Windows\System32\giveio.sys

========== LOP Check ==========

[2012/01/01 15:46:42 | 000,000,000 | —D | M] – C:\Users\Edward\AppData\Roaming\DMCache
[2011/12/27 18:02:00 | 000,000,000 | —D | M] – C:\Users\Edward\AppData\Roaming\DonationCoder
[2011/12/29 00:27:36 | 000,000,000 | —D | M] – C:\Users\Edward\AppData\Roaming\GetRightToGo
[2011/12/29 09:27:09 | 000,000,000 | —D | M] – C:\Users\Edward\AppData\Roaming\IDM
[2011/12/22 19:18:28 | 000,000,000 | —D | M] – C:\Users\Edward\AppData\Roaming\Leadertech
[2009/07/13 20:53:46 | 000,005,658 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >

Happy new year to you too mate! . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 8.0.7601.17514 Run by [removed] at 23:53:49 on 2012-01-01 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.2039.1110 [GMT -8:00] . AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Windows\System32\CTHELPER.EXE C:\Windows\system32\igfxsrvc.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe C:\Program Files\Internet Download Manager\IDMan.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\Internet Download Manager\IEMonitor.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\sppsvc.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\conhost.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com/ BHO: IDM integration (IDMIEHlprObj Class): {0055c089-8582-441b-a0bf-17b458c2a3a8} - c:\program files\internet download manager\IDMIECC.dll BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll uRun: [SetDefaultMIDI] MIDIDef.exe uRun: [IDMan] c:\program files\internet download manager\IDMan.exe /onboot mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey mRun: [WINDVDPatch] CTHELPER.EXE mRun: [UpdReg] c:\windows\UpdReg.EXE mRun: [Jet Detection] "c:\program files\creative\sblive\program\ADGJDet.exe" mRun: [DevconDefaultDB] c:\windows\READREG /PSCONV={NO} /NO_DEFPS mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) mPolicies-system: PromptOnSecureDesktop = 0 (0x0) IE: Download all links with IDM - c:\program files\internet download manager\IEGetAll.htm IE: Download with IDM - c:\program files\internet download manager\IEExt.htm IE: E&xport; to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL TCP: DhcpNameServer = 192.168.2.1 TCP: Interfaces\{7A9B25F2-A275-4B3C-AA61-848A4D4F30C1} : DhcpNameServer = 192.168.2.1 Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll Notify: igfxcui - igfxdev.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\users\edward\appdata\roaming\mozilla\firefox\profiles\dzql6jye.default\ FF - prefs.js: browser.search.selectedEngine - Search Results FF - prefs.js: browser.startup.homepage - hxxp://www.searchqu.com/406 FF - prefs.js: keyword.URL - hxxp://www.google.com/search?q= . —- FIREFOX POLICIES —- FF - user.js: yahoo.ytff.general.dontshowhpoffer - true . ============= SERVICES / DRIVERS =============== . R0 oodrvled;oodrvled;c:\windows\system32\drivers\OODrvled.sys [2011-3-2 25680] R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165648] R1 MpKslbe943d0b;MpKslbe943d0b;c:\programdata\microsoft\microsoft antimalware\definition updates\{6971f22d-d6cc-4da6-9101-a760158657e0}\MpKslbe943d0b.sys [2012-1-1 29904] R2 IDMWFP;IDMWFP;c:\windows\system32\drivers\idmwfp.sys [2011-11-14 89376] R3 Atc002;NDIS Miniport Driver for Atheros L2 Fast Ethernet Controller;c:\windows\system32\drivers\l260x86.sys [2009-6-10 29184] R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-10-24 43392] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 65024] R3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2011-4-27 208944] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888] S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2011-12-24 15872] S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-12-24 52224] S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-12-23 1343400] . =============== Created Last 30 ================ . 2012-01-01 23:48:37 29904 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{6971f22d-d6cc-4da6-9101-a760158657e0}\MpKslbe943d0b.sys 2012-01-01 23:48:28 56200 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{6971f22d-d6cc-4da6-9101-a760158657e0}\offreg.dll 2012-01-01 23:40:07 12288 —-a-w- c:\windows\system32\AHQCpURes.dll 2012-01-01 23:40:02 32768 —-a-w- c:\windows\system32\AudioHQU.cpl 2012-01-01 23:34:24 306688 —-a-w- c:\windows\IsUninst.exe 2012-01-01 22:23:25 ——– d—–w- c:\users\edward\appdata\roaming\Malwarebytes 2012-01-01 22:22:48 ——– d—–w- c:\programdata\Malwarebytes 2012-01-01 09:46:35 6823496 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{6971f22d-d6cc-4da6-9101-a760158657e0}\mpengine.dll 2012-01-01 04:52:56 ——– d-sh–w- C:\$RECYCLE.BIN 2011-12-31 23:14:32 98816 —-a-w- c:\windows\sed.exe 2011-12-31 23:14:32 518144 —-a-w- c:\windows\SWREG.exe 2011-12-31 23:14:32 256000 —-a-w- c:\windows\PEV.exe 2011-12-31 23:14:32 208896 —-a-w- c:\windows\MBR.exe 2011-12-30 02:12:25 ——– d—–w- c:\users\edward\appdata\local\Adobe 2011-12-29 17:28:53 ——– d—–w- c:\program files\Yahoo! 2011-12-29 14:50:00 ——– d—–w- c:\programdata\PC Tools 2011-12-29 08:24:02 ——– d—–w- c:\users\edward\appdata\roaming\GetRightToGo 2011-12-28 05:07:28 ——– d—–w- c:\users\edward\appdata\roaming\IDM 2011-12-28 05:07:28 ——– d—–w- c:\users\edward\appdata\roaming\DMCache 2011-12-28 05:07:06 ——– d—–w- c:\program files\Internet Download Manager 2011-12-28 02:02:00 ——– d—–w- c:\users\edward\appdata\roaming\DonationCoder 2011-12-28 02:01:38 ——– d—–w- c:\program files\WinPcap 2011-12-28 01:58:42 ——– d—–w- c:\program files\URLSnooper2 2011-12-26 16:46:41 ——– d—–w- c:\programdata\boost_interprocess 2011-12-26 03:46:51 ——– d—–w- c:\users\edward\appdata\local\Ilivid Player 2011-12-26 03:40:47 ——– d—–w- c:\program files\iLivid 2011-12-26 03:30:35 ——– d—–w- c:\users\edward\appdata\local\PackageAware 2011-12-26 00:34:07 ——– d—–w- c:\windows\system32\SPReview 2011-12-26 00:32:19 ——– d—–w- c:\windows\system32\EventProviders 2011-12-25 07:06:38 6823496 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll 2011-12-25 06:55:40 ——– d—–w- c:\programdata\OO Software 2011-12-25 05:19:32 ——– d—–w- c:\program files\OO Software 2011-12-24 19:58:59 520064 —-a-w- c:\windows\system32\mcupdate_GenuineIntel.dll 2011-12-24 19:57:59 988160 —-a-w- c:\windows\system32\propsys.dll 2011-12-24 19:56:59 933376 —-a-w- c:\windows\system32\Vault.dll 2011-12-24 19:55:59 293888 —-a-w- c:\windows\system32\ssText3d.scr 2011-12-24 19:54:59 9728 —-a-w- c:\windows\system32\sscore.dll 2011-12-24 19:53:41 606208 —-a-w- c:\windows\system32\wbem\fastprox.dll 2011-12-24 19:53:41 363008 —-a-w- c:\windows\system32\wbemcomn.dll 2011-12-24 19:53:41 189952 —-a-w- c:\program files\windows portable devices\sqmapi.dll 2011-12-24 19:53:13 189952 —-a-w- c:\windows\system32\sqmapi.dll 2011-12-24 01:11:11 ——– d—–w- c:\windows\system32\Wat 2011-12-23 22:45:31 6823496 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\updates\mpengine.dll 2011-12-23 22:35:36 ——– d—–w- c:\program files\Microsoft CAPICOM 2.1.0.2 2011-12-23 18:14:14 33104 —-a-w- c:\windows\system32\spool\prtprocs\w32x86\msonpppr.dll 2011-12-23 18:14:14 32656 —-a-w- c:\windows\system32\msonpmon.dll 2011-12-23 17:58:26 ——– d—–w- c:\windows\PCHEALTH 2011-12-23 17:51:33 ——– d—–w- c:\program files\Microsoft Visual Studio 8 2011-12-23 17:46:26 ——– d—–w- c:\users\edward\appdata\local\Microsoft Help 2011-12-23 17:25:49 311808 —-a-w- c:\windows\system32\drivers\srv.sys 2011-12-23 17:25:49 310272 —-a-w- c:\windows\system32\drivers\srv2.sys 2011-12-23 17:25:48 114688 —-a-w- c:\windows\system32\drivers\srvnet.sys 2011-12-23 17:25:45 338944 —-a-w- c:\windows\system32\drivers\afd.sys 2011-12-23 17:25:43 1290608 —-a-w- c:\windows\system32\drivers\tcpip.sys 2011-12-23 17:25:42 187776 —-a-w- c:\windows\system32\drivers\FWPKCLNT.SYS 2011-12-23 17:25:11 31232 —-a-w- c:\windows\system32\prevhost.exe 2011-12-23 17:25:08 428032 —-a-w- c:\windows\system32\vbscript.dll 2011-12-23 17:20:44 542208 —-a-w- c:\windows\system32\kerberos.dll 2011-12-23 17:18:39 759296 —-a-w- c:\program files\common files\microsoft shared\vgx\VGX.dll 2011-12-23 17:18:36 1137664 —-a-w- c:\windows\system32\mfc42.dll 2011-12-23 17:18:35 1164288 —-a-w- c:\windows\system32\mfc42u.dll 2011-12-23 17:18:18 69632 —-a-w- c:\windows\system32\drivers\bowser.sys 2011-12-23 17:18:12 123904 —-a-w- c:\windows\system32\poqexec.exe 2011-12-23 17:18:10 27008 —-a-w- c:\windows\system32\drivers\Diskdump.sys 2011-12-23 16:59:07 728448 —-a-w- c:\windows\system32\drivers\dxgkrnl.sys 2011-12-23 16:59:07 219008 —-a-w- c:\windows\system32\drivers\dxgmms1.sys 2011-12-23 16:59:07 107520 —-a-w- c:\windows\system32\cdd.dll 2011-12-23 05:26:34 ——– d—–w- c:\program files\GRETECH 2011-12-23 04:59:04 ——– d—–r- c:\program files\Skype 2011-12-23 04:57:13 ——– d—–w- c:\program files\SpeedFan 2011-12-23 04:26:16 90112 ——w- c:\windows\Updreg.EXE 2011-12-23 04:26:14 84992 ——w- c:\windows\system32\SFCVRT32.DLL 2011-12-23 04:26:14 53552 ——w- c:\windows\CTCCW.DLL 2011-12-23 04:26:14 24976 ——w- c:\windows\CTRES.DLL 2011-12-23 04:26:14 149504 ——w- c:\windows\system32\MFCANS32.DLL 2011-12-23 04:26:14 108032 ——w- c:\windows\system32\MFCUIA32.DLL 2011-12-23 04:26:13 82432 ——w- c:\windows\system32\CTWFLT32.DLL 2011-12-23 04:26:13 54784 ——w- c:\windows\system32\INETWH32.DLL 2011-12-23 04:26:13 26768 ——w- c:\windows\system32\CTL3D.DLL 2011-12-23 04:26:10 ——– d—–w- c:\windows\system32\Defaults 2011-12-23 04:20:08 225280 —-a-w- c:\program files\common files\installshield\iscript\iscript.dll 2011-12-23 04:20:07 77824 —-a-w- c:\program files\common files\installshield\engine\6\intel 32\ctor.dll 2011-12-23 04:20:07 32768 —-a-w- c:\program files\common files\installshield\engine\6\intel 32\objectps.dll 2011-12-23 04:20:07 176128 —-a-w- c:\program files\common files\installshield\engine\6\intel 32\iuser.dll 2011-12-23 04:20:04 614532 —-a-w- c:\program files\common files\installshield\engine\6\intel 32\IKernel.exe 2011-12-23 04:18:34 ——– d—–w- c:\program files\Creative 2011-12-23 03:47:50 ——– d—–w- c:\windows\pss 2011-12-23 03:47:11 ——– d—–w- c:\program files\CCleaner 2011-12-23 03:26:43 703824 ——w- c:\programdata\microsoft\microsoft antimalware\definition updates\{e94aa5d5-bcd5-4596-8153-292f5745a866}\gapaengine.dll 2011-12-23 03:22:21 ——– d—–w- c:\program files\Microsoft Security Client 2011-12-23 03:19:02 ——– d—–w- c:\users\edward\appdata\local\LogiShrd 2011-12-23 03:16:48 ——– d-sh–w- c:\windows\Installer 2011-12-23 03:10:53 6823496 —-a-w- c:\programdata\microsoft\windows defender\definition updates\{df3566e4-bfd0-4203-a8c4-f99e34b30d67}\mpengine.dll 2011-12-23 03:10:52 222080 ——w- c:\windows\system32\MpSigStub.exe 2011-12-23 03:06:17 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-12-23 03:04:06 ——– d—–w- c:\windows\system32\wbem\Performance 2011-12-23 03:04:01 ——– d—–w- c:\users\edward\appdata\local\Mozilla 2011-12-23 03:00:20 1002008 —-a-w- c:\windows\system32\igxpun.exe 2011-12-23 03:00:20 ——– d—–w- c:\windows\system32\x64 2011-12-23 02:01:45 ——– d—–w- c:\windows\Panther 2011-12-23 02:01:28 ——– d—–w- C:\Boot 2011-12-23 01:45:36 ——– d—–w- C:\Windows.old.000 2011-12-22 10:08:30 ——– d—–w- C:\NVIDIA 2011-12-22 05:15:04 ——– d—–w- C:\Programs to run 2011-12-22 01:09:09 ——– d—–w- C:\Recovery . ==================== Find3M ==================== . 2011-12-26 00:57:45 152576 —-a-w- c:\windows\system32\msclmd.dll 2011-11-24 04:25:27 2342912 —-a-w- c:\windows\system32\win32k.sys 2011-11-05 04:35:00 981504 —-a-w- c:\windows\system32\wininet.dll 2011-11-05 04:26:03 2048 —-a-w- c:\windows\system32\tzres.dll 2011-11-05 02:48:51 1638912 —-a-w- c:\windows\system32\mshtml.tlb 2011-10-26 04:47:40 3967856 —-a-w- c:\windows\system32\ntkrnlpa.exe 2011-10-26 04:47:40 3912560 —-a-w- c:\windows\system32\ntoskrnl.exe 2011-10-26 04:28:12 38912 —-a-w- c:\windows\system32\csrsrv.dll 2011-10-15 05:38:59 534528 —-a-w- c:\windows\system32\EncDec.dll . ============= FINISH: 23:56:44.84 ===============

I do not see any file created called Extras.txt, but did a search and found this one only. Hope it help.

OTL Extras logfile created on: 12/30/2011 7:22:25 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Edward\Downloads\Programs
Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.19 Gb Available Physical Memory | 59.86% Memory free
3.98 Gb Paging File | 3.09 Gb Available in Paging File | 77.55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 41.44 Gb Free Space | 55.61% Space Free | Partition Type: NTFS
Drive F: | 931.51 Gb Total Space | 879.17 Gb Free Space | 94.38% Space Free | Partition Type: NTFS

Computer Name: EDWARD-PC | User Name: Edward | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FCAADB8-EB1B-11D6-AB2D-0090271A23A2}" = Sound Blaster Live!
"{54B6DC7D-8C5B-4DFB-BC15-C010A3326B2B}" = Microsoft Security Client
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{986DC057-D360-492C-8F31-DBD0E5096B65}" = O&O DriveLED Professional
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.0
"{C27BC2A2-30DD-4014-B22E-63EB0DB572F9}" = Logitech Webcam Software
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"CCleaner" = CCleaner
"ENTERPRISE" = Microsoft Office Enterprise 2007
"GOM Player" = GOM Player
"HDMI" = Intel® Graphics Media Accelerator Driver
"Internet Download Manager" = Internet Download Manager
"Logitech Vid" = Logitech Vid HD
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox 9.0.1 (x86 en-US)" = Mozilla Firefox 9.0.1 (x86 en-US)
"SpeedFan" = SpeedFan (remove only)
"WinPcapInst" = WinPcap 4.1.2
"Yahoo! Messenger" = Yahoo! Messenger

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/25/2011 4:32:26 AM | Computer Name = Edward-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 12/25/2011 10:15:30 PM | Computer Name = Edward-PC | Source = ESENT | ID = 215
Description = WinMail (3864) WindowsMail0: The backup has been stopped because it
was halted by the client or the connection with the client failed.

Error - 12/26/2011 4:31:14 AM | Computer Name = Edward-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 12/26/2011 11:02:25 PM | Computer Name = Edward-PC | Source = Application Hang | ID = 1002
Description = The program firefox.exe version 9.0.1.4371 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: dfc Start
Time: 01ccc443147a4e5c Termination Time: 150 Application Path: C:\Program Files\Mozilla
Firefox\firefox.exe Report Id: 2ab89dee-3037-11e1-a55e-001fc6eb3160

Error - 12/27/2011 5:09:41 AM | Computer Name = Edward-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 12/28/2011 1:09:41 AM | Computer Name = Edward-PC | Source = Application Error | ID = 1000
Description = Faulting application name: Explorer.EXE, version: 6.1.7601.17567,
time stamp: 0x4d6727a7 Faulting module name: unknown, version: 0.0.0.0, time stamp:
0x00000000 Exception code: 0xc0000005 Fault offset: 0x00000000 Faulting process id:
0x8d4 Faulting application start time: 0x01ccc3eddd006550 Faulting application path:
C:\Windows\Explorer.EXE Faulting module path: unknown Report Id: 25a8d6b7-3112-11e1-a55e-001fc6eb3160

Error - 12/28/2011 4:31:28 AM | Computer Name = Edward-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 12/29/2011 4:46:51 AM | Computer Name = Edward-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

Error - 12/29/2011 12:13:01 PM | Computer Name = Edward-PC | Source = pctsSvc.exe | ID = 0
Description =

Error - 12/30/2011 4:31:16 AM | Computer Name = Edward-PC | Source = SideBySide | ID = 16842824
Description = Activation context generation failed for "c:\program files\microsoft
security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft
security client\MSESysprep.dll" on line 10. The element imaging appears as a child
of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by
this version of Windows.

[ System Events ]
Error - 12/23/2011 9:16:18 PM | Computer Name = Edward-PC | Source = Service Control Manager | ID = 7023
Description = The Windows Modules Installer service terminated with the following
error: %%16405

Error - 12/23/2011 10:50:01 PM | Computer Name = Edward-PC | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
cdrom

Error - 12/25/2011 5:00:18 AM | Computer Name = Edward-PC | Source = Microsoft-Windows-Time-Service | ID = 34
Description = The time service has detected that the system time needs to be changed
by -75645 seconds. The time service will not change the system time by more than
54000 seconds. Verify that your time and time zone are correct, and that the time
source time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->64.4.11.169:123) is working
properly.

Error - 12/25/2011 9:23:17 PM | Computer Name = Edward-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Windows Internet Explorer 9 for Windows 7.

Error - 12/25/2011 10:14:16 PM | Computer Name = Edward-PC | Source = DCOM | ID = 10010
Description =

Error - 12/29/2011 10:55:40 AM | Computer Name = Edward-PC | Source = Service Control Manager | ID = 7030
Description = The ThreatFire service is marked as an interactive service. However,
the system is configured to not allow interactive services. This service may not
function properly.

Error - 12/29/2011 12:17:26 PM | Computer Name = Edward-PC | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
TfFsMon TfSysMon

Error - 12/29/2011 12:18:06 PM | Computer Name = Edward-PC | Source = WMPNetworkSvc | ID = 866300
Description = Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder)
encountered error '0x80004005'. Verify that the UPnPHost service is running and
that the UPnPHost component of Windows is installed properly.

Error - 12/30/2011 6:22:27 PM | Computer Name = Edward-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 1:42:24 PM on ?12/?30/?2011 was unexpected.

Error - 12/30/2011 6:22:49 PM | Computer Name = Edward-PC | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
TfFsMon TfSysMon


< End of report >